@oakoss/oakum 0.6.1 → 0.6.3

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 0.6.3 (2026-10-24)
+
+### Fixed
+
+When `version` fails creating a file and rolls back, a file it cannot check is named instead of being taken as never created. A stat that failed for any reason but the file being absent, before the create or after it, was read as nothing to clean up, so the failure report described a tree it had not checked. It now says it could not check whether the run created the file, and why, and to remove it only if the run did; the consume marker stays so the next `version` refuses rather than plan over it. A create refused because the file already exists names nothing, since it created nothing.
+
+A YAML catalog pin that shares an anchor with another entry moves alone. `version` rewrote the anchored value, so a pin written as `*caret` also moved every other entry using `&caret`, including another package's, and the next `pnpm install` failed. Now an alias pin is written out as a quoted literal range and the anchor keeps its value; a pin that carries an anchor is rewritten and its aliases are written out, quoted, with the old value. An entry that reaches the pin through an alias of a whole table still moves with it. A line on stderr names each case once the files are written.
+
+Recovery advice after a `version` that failed and rolled back is right in more cases. The consume marker is now marked as rolled back before the rollback's first step, so a run stopped partway through it is advised to keep none of its writes instead of being read as one whose writes landed. That advice points at `git status` and `git diff` rather than the failed run's own message, which may be gone, and says to keep edits made before the run. A marker that could not be marked says why, a marker overwritten in place keeps none of its old listing, and an empty marker beside a set-aside bump file is no longer read as a consume that landed, whose advice would remove bump files never applied. The advice for set-aside bump files of unknown state says to remove one the kept writes already applied.
+
+Files oakum rewrites keep their permissions. `version`, a rollback, `upgrade` and `migrate` replace a file by renaming a new copy over it, and that copy was created with default permissions, so an executable manifest came back `644` (a mode change in `git diff`). The new copy now takes the old file's permissions; on a filesystem that cannot keep them, the file is still written and a warning says so. A file's owner and inode still change.
+
+A file `version` rewrites through a symlink stays a symlink. `version` read a symlinked manifest through the link but replaced the link with a regular file, so the shared file it named kept the old version. Writes now follow the link: the file it names gets the new text, staged beside that file, and the link stays, and `check` looks for staging files beside a link's file too. A link oakum does not follow safely (one into a `.git`, one it cannot resolve, one whose file refuses the new text, or one whose file another write of the same run also names) is replaced by a regular file as before, and stderr names the file that did not get the new text.
+
+A git, `cargo metadata` or pnpm child, or a source tool `migrate` runs, that goes past `OAKUM_REMOTE_DEADLINE` is killed together with what it started and is still waiting on, such as a signing program, a credential helper or an ssh `ProxyCommand`. The message names those programs: on stderr, and in `migrate`'s report on stdout. Before, only the child was killed and the rest kept running. The tree is stopped before it is killed, so nothing it starts in the meantime escapes. A process whose parent had already exited is not reached. When oakum cannot vouch for the whole tree, the message says what the child started may still be running. That happens when oakum could not list the tree or kill a process in it, a process would not stop or exited before it could be stopped, the child kept starting processes faster than oakum could stop them, or a process could not be confirmed as still under the child and was let go rather than killed. A passphrase prompt that gpg's agent shows through pinentry belongs to the agent, not to git, so the agent decides when it closes.
+
+`version` and `ci version-pr` name the lockfile entries left for `pnpm install` once the files are written, so a run refused after planning no longer lists entries it never wrote. The version pull request also lists catalog entries that share a YAML anchor with a bumped pin.
+
+`check` and `status` no longer count a version commit's own writes as an uncovered change. A range holding the commit that ran `version` reported its packages as changed with no covering intent, and the suggested fix would have bumped them a second time. A commit that deletes a bump file now has its manifest, changelog, lockfile and catalog edits left out of coverage in each package directory whose `CHANGELOG.md` it also wrote, whatever its subject says. Its other edits, a merge's, and a later commit's still count.
+
+## 0.6.2 (2026-10-23)
+
+### Fixed
+
+`version` finishes a pre-release instead of skipping past it. A patch bump on `2.0.0-rc.1` now gives `2.0.0` rather than `2.0.1`; a minor bump on `2.1.0-rc.1` gives `2.1.0`, and a major bump on `2.0.0-rc.1` gives `2.0.0`. A bump that leaves the line the pre-release was heading toward still moves past it: a minor bump on `2.1.3-rc.1` gives `2.2.0`. This matches node-semver's `inc`, which changesets uses. Under the default `versioning = "zero-major"`, a major below 1.0.0 is still read as a minor first, so a major bump on `0.3.0-rc.1` gives `0.3.0`; under `versioning = "semver"` it gives `1.0.0`.
+
+Discovery no longer writes `pnpm-lock.yaml` into a lock-free pnpm workspace that declares its package manager. pnpm 11 wrote one despite `--config.lockfile=false` under a `devEngines.packageManager` naming a version it accepted, and under a `packageManager` naming a newer pnpm; pnpm 12 did when a `devEngines.packageManager` switched it to an 11. Discovery now has the pnpm on `PATH` answer, so a declaration pnpm would refuse, such as a `devEngines.packageManager` array or `onFail: "error"` naming another pnpm, no longer stops discovery.
+
+The workflow `init` and `migrate` print now takes the pnpm version from a `devEngines.packageManager` array that names an exact one, since `pnpm/action-setup` reads only the object form, instead of asking pnpm. An array naming a pnpm other than the one on `PATH` gets that pnpm as the workflow's `version` input rather than exiting `unverified`. An array whose version is not an exact one, such as a range, still asks pnpm, which under pnpm 11 can write a lockfile when the version matches it.
+
+In a pnpm workspace, a dependency whose range the same-named member's current version does not satisfy, such as `"is-number": "7.0.0"` beside a workspace member `is-number` at `1.0.0`, is no longer read as depending on that member. pnpm installs it from the registry, yet `version` rewrote it to the member's new version on a release that left the range. This covers plain ranges, `npm:` aliases and `catalog:` entries; a `workspace:` dependency still always counts as depending on the member.
+
+`oakum ci pr-status --emit-comment <dir>` no longer writes the comment file when `pr-status = "summary"`. It wrote `oakum-pr-comment.md` anyway, so a trusted job that posts whatever it finds there posted a comment the config had turned off. It now writes the job summary as configured, removes a comment file left by an earlier run, says on stderr that `summary` turned the comment off, and exits 0.
+
+The `leftover tag ambiguity` refusal from `check`, `version` and `release` now says how to resolve it, on a line after the tags it names:
+
+- Two versions of one package tagged on one commit: keep the tag for the version that commit's manifest names and delete the other, on the remote too if it was pushed.
+- A bare `v<version>` tag with several packages tagged: use `<package>/v<version>`.
+- A version-like tag in a shape oakum does not read: rename it to one it does.
+- A tag naming a package the workspace no longer has, as after a rename: delete it, or tag the release with a current package's name.
+- A tag whose package name exists in two ecosystems: rename the package it did not release.
+
+The refusal and its exit code are unchanged, and so is the `summary` of its `check --json` refusal, which keeps the first line only.
+
 ## 0.6.1 (2026-10-23)
 
 ### Fixed
@@ -329,4 +373,4 @@ Release workflow checks out the homebrew tap in a subdirectory so the composite
 
 Self-host release CI uploads cargo-dist artifacts into the GitHub Release oakum already created, instead of calling create again.
 
-Generated by oakum 0.6.0.
+Generated by oakum 0.6.2.

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "MIT",
       "name": "@oakoss/oakum",
-      "version": "0.6.1"
+      "version": "0.6.3"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "0.6.1"
+  "version": "0.6.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/oakoss/oakum/releases/download/v0.6.1"
+    "https://github.com/oakoss/oakum/releases/download/v0.6.3"
   ],
   "author": "Jace Babin",
   "bin": {
@@ -105,7 +105,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.6.1",
+  "version": "0.6.3",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"