@williamthorsen/release-kit 10.5.0 → 10.7.0

package/.readyup/kits/default.js

@@ -1,6 +1,6 @@
 /** @noformat -- @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.35.0";
+export const __readyupVersion = "0.36.0";
 
 
 // .readyup/kits/default.ts
@@ -50,9 +50,55 @@ function detectRepoType() {
   return "single-package";
 }
 
+// src/packsPath.ts
+function packsPath(filesField, path) {
+  if (!isStringArray(filesField)) return true;
+  const prefixes = listAncestorPrefixes(path);
+  return filesField.some((entry) => {
+    const pattern = compileEntry(entry);
+    return pattern !== void 0 && prefixes.some((prefix) => pattern.test(prefix));
+  });
+}
+var GLOB_TOKEN_PATTERN = /\*\*\/|\*\*|\*|\?|[^*?]+/g;
+function compileEntry(entry) {
+  if (entry.startsWith("!")) return void 0;
+  const normalized = entry.replace(/^\.?\//, "").replace(/\/+$/, "");
+  if (normalized === "") return void 0;
+  return new RegExp(`^${translateGlob(normalized)}$`);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function listAncestorPrefixes(path) {
+  const segments = path.split("/");
+  return segments.map((_segment, index) => segments.slice(0, index + 1).join("/"));
+}
+function translateGlob(pattern) {
+  let source = "";
+  for (const [token] of pattern.matchAll(GLOB_TOKEN_PATTERN)) {
+    switch (token) {
+      case "**/":
+        source += String.raw`(?:[^/]*\/)*`;
+        break;
+      case "**":
+        source += ".*";
+        break;
+      case "*":
+        source += "[^/]*";
+        break;
+      case "?":
+        source += "[^/]";
+        break;
+      default:
+        source += RegExp.escape(token);
+    }
+  }
+  return source;
+}
+
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "10.5.0" };
+  const picked = { "version": "10.7.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }
@@ -61,6 +107,7 @@ function getMinVersion() {
 function hasPublishablePackages() {
   return discoverWorkspaces({ filter: (w) => w.isPackage }).length > 0;
 }
+var DEFAULT_CHANGELOG_JSON_PATH = ".meta/changelog.json";
 var CONFIG_EXPORT_PATTERNS = [
   /export\s+default\b/,
   /export\s+(?:const|let|var)\s+config\b/,
@@ -74,6 +121,8 @@ var RELEASE_WORKFLOW_HASH_MONOREPO = "0a9724b7b3c5e24087fd3a8f36fed8e990d699267f
 var RELEASE_WORKFLOW_HASH_SINGLE = "a3d19bbc1ba8bb30622e53c590137b97e3179e80988c0967737b021cdaeab73f";
 var PUBLISH_WORKFLOW_HASH_MONOREPO = "0afa9ffe914f3dc8f043e68252ebc604c8cc1a953422fcea37a909a4def370ee";
 var PUBLISH_WORKFLOW_HASH_SINGLE = "6f31183e0a1e66be791a19266c3b028dadbd9fe010f7fc4452f3f8970c937b43";
+var CREATE_GITHUB_RELEASE_WORKFLOW_HASH_MONOREPO = "c455d88c93d855737c96079945ff729a9d094f846519c24afbefe83a425c1d7f";
+var CREATE_GITHUB_RELEASE_WORKFLOW_HASH_SINGLE = "f595831ff28f8b3a01d97e6cb0cfe100262f7a8821091c6c458b0c0224cebba8";
 var default_default = defineRdyKit({
   checklists: [
     {
@@ -148,6 +197,16 @@ var default_default = defineRdyKit({
             }
           ]
         },
+        {
+          name: "create-github-release.yaml matches template",
+          severity: "warn",
+          skip: () => !fileExists(".github/workflows/create-github-release.yaml") ? "no create-github-release workflow (GitHub Releases not adopted)" : false,
+          check: () => {
+            const hash = detectRepoType() === "monorepo" ? CREATE_GITHUB_RELEASE_WORKFLOW_HASH_MONOREPO : CREATE_GITHUB_RELEASE_WORKFLOW_HASH_SINGLE;
+            return fileMatchesHash(".github/workflows/create-github-release.yaml", hash);
+          },
+          fix: "Run `release-kit init --force` to regenerate create-github-release.yaml from the current template"
+        },
         {
           name: ".config/release-kit.config.ts exports a config",
           severity: "error",
@@ -204,12 +263,38 @@ var default_default = defineRdyKit({
             }
           ]
         },
+        // Deliberately outside the config gate above: that check skips where the config file is absent, and a repo
+        // with no config file still defaults `changelogJson.enabled` to true and still publishes tarballs.
+        {
+          name: "published packages ship CHANGELOG.md",
+          severity: "warn",
+          skip: () => !hasPublishablePackages() ? "no publishable packages" : false,
+          check: () => packagesShipChangelog(),
+          fix: 'Add "CHANGELOG.md" to the files field of each affected package.json'
+        },
+        {
+          name: "changelog.json generation is enabled",
+          severity: "recommend",
+          skip: () => !hasPublishablePackages() ? "no publishable packages" : false,
+          check: () => changelogJsonIsEnabled(),
+          fix: "Remove changelogJson.enabled: false from .config/release-kit.config.ts so release-kit writes the machine-readable changelog that upgrade tooling reads before CHANGELOG.md",
+          checks: [
+            {
+              name: "published packages ship the changelog JSON",
+              severity: "warn",
+              check: () => packagesShipChangelogJson(),
+              get fix() {
+                return `Add "${resolveChangelogJsonOutputPath()}" to the files field of each affected package.json`;
+              }
+            }
+          ]
+        },
         {
           name: "config does not use removed releaseNotes.shouldCreateGithubRelease",
           severity: "error",
           quiet: true,
           check: () => fileDoesNotContain(".config/release-kit.config.ts", /shouldCreateGithubRelease/),
-          fix: "Remove 'shouldCreateGithubRelease' from .config/release-kit.config.ts. Adoption of GitHub Releases is now signaled by installing the create-github-release workflow (see release-kit README for setup)."
+          fix: "Remove 'shouldCreateGithubRelease' from .config/release-kit.config.ts. Adoption of GitHub Releases is now signaled by installing the create-github-release workflow, which `release-kit init` scaffolds."
         },
         {
           name: "git-cliff not in devDependencies",
@@ -264,6 +349,11 @@ var default_default = defineRdyKit({
     }
   ]
 });
+function changelogJsonIsEnabled() {
+  const content = readFile(".config/release-kit.config.ts");
+  if (content === void 0) return true;
+  return !/changelogJson\s*:\s*\{[^}]*enabled\s*:\s*false/.test(content);
+}
 function configFileExportsConfig() {
   const content = readFile(".config/release-kit.config.ts");
   if (content === void 0) return false;
@@ -276,6 +366,12 @@ function labelsHaveCurrentPresetHash(presetName, expectedHash) {
   const match = pattern.exec(content);
   return match !== null && match[1] === expectedHash;
 }
+function packagesShipChangelog() {
+  return reportWorkspacesOmitting("CHANGELOG.md");
+}
+function packagesShipChangelogJson() {
+  return reportWorkspacesOmitting(resolveChangelogJsonOutputPath());
+}
 function readmeHasReleaseNotesMarkers(content) {
   return content.includes("<!-- section:release-notes -->") && content.includes("<!-- /section:release-notes -->");
 }
@@ -308,16 +404,43 @@ function releaseNotesInjectsIntoReadme() {
   if (content === void 0) return false;
   return /shouldInjectIntoReadme\s*:\s*true/.test(content);
 }
+function reportWorkspacesOmitting(path) {
+  const failing = [];
+  const packageWorkspaces = discoverWorkspaces({ filter: (w) => w.isPackage });
+  for (const { dir, packageJson } of packageWorkspaces) {
+    if (!packsPath(packageJson["files"], path)) {
+      failing.push(dir === "." ? "package.json" : `${dir}/package.json`);
+    }
+  }
+  if (failing.length === 0) return true;
+  return {
+    ok: false,
+    detail: `files field omits ${path}: ${failing.join(", ")}`
+  };
+}
+function resolveChangelogJsonOutputPath() {
+  const content = readFile(".config/release-kit.config.ts");
+  if (content === void 0) return DEFAULT_CHANGELOG_JSON_PATH;
+  const match = /changelogJson\s*:\s*\{[^}]*outputPath\s*:\s*['"]([^'"]+)['"]/.exec(content);
+  return match?.[1] ?? DEFAULT_CHANGELOG_JSON_PATH;
+}
 export {
   CLIFF_TEMPLATE_HASH,
   COMMON_PRESET_HASH,
+  CREATE_GITHUB_RELEASE_WORKFLOW_HASH_MONOREPO,
+  CREATE_GITHUB_RELEASE_WORKFLOW_HASH_SINGLE,
+  DEFAULT_CHANGELOG_JSON_PATH,
   PUBLISH_WORKFLOW_HASH_MONOREPO,
   PUBLISH_WORKFLOW_HASH_SINGLE,
   RELEASE_WORKFLOW_HASH_MONOREPO,
   RELEASE_WORKFLOW_HASH_SINGLE,
   SYNC_LABELS_WORKFLOW_HASH,
+  changelogJsonIsEnabled,
   configFileExportsConfig,
   default_default as default,
+  packagesShipChangelog,
+  packagesShipChangelogJson,
   readmeHasReleaseNotesMarkers,
-  readmesHaveReleaseNotesMarkers
+  readmesHaveReleaseNotesMarkers,
+  resolveChangelogJsonOutputPath
 };

package/.readyup/kits/npm-auto-publish.js

@@ -1,6 +1,6 @@
 /** @noformat -- @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.35.0";
+export const __readyupVersion = "0.36.0";
 
 
 // .readyup/kits/npm-auto-publish.ts
@@ -18,6 +18,7 @@ import {
   readJsonFile
 } from "readyup/check-utils";
 var AUTH_ERROR_CODES = /* @__PURE__ */ new Set(["E401", "ENEEDAUTH"]);
+var OTP_ERROR_CODE = "EOTP";
 var PUBLISH_WORKFLOW_FILE = "publish.yaml";
 var UNREACHABLE_ERROR_CODES = /* @__PURE__ */ new Set([
   "EAI_AGAIN",
@@ -77,24 +78,19 @@ var packagesChecklist = defineRdyChecklist({
       fix: "Ensure pnpm-workspace.yaml lists package globs, or that a root package.json exists"
     }
   ],
-  checks: [
-    {
-      name: "npm session is usable",
-      skip: () => skipIfNothingPublishable(),
-      check: () => {
-        const auth = getCachedNpmAuthStatus();
-        return auth.status === "authenticated" ? { ok: true } : { ok: false, detail: auth.detail };
-      },
-      // readyup reads `fix` before it consults `skip`, and again when it validates the kit, so a getter here would
-      // reach the registry on every run regardless of the skip. Per-outcome wording goes in the check's detail.
-      fix: 'Restore a usable npm session: log in with "npm login", or restore access to the registry, which the trusted-publisher check queries directly',
-      get checks() {
-        return discoverWorkspaces({ filter: belongsInPackagesChecklist }).map(
-          (workspace) => buildWorkspaceCheck(workspace)
-        );
-      }
+  // The gate stands beside the workspace rows rather than above them, so a session that cannot answer trust queries
+  // suppresses the trusted-publisher rows alone and leaves the package.json checks reporting. The rows no longer
+  // hang beneath the gate's skip, so a repo that publishes nothing has to be held to its one line here.
+  get checks() {
+    const sessionCheck = buildSessionCheck();
+    if (skipIfNothingPublishable() !== false) {
+      return [sessionCheck];
     }
-  ]
+    return [
+      sessionCheck,
+      ...discoverWorkspaces({ filter: belongsInPackagesChecklist }).map((workspace) => buildWorkspaceCheck(workspace))
+    ];
+  }
 });
 var npm_auto_publish_default = defineRdyKit({
   fixLocation: "inline",
@@ -103,6 +99,19 @@ var npm_auto_publish_default = defineRdyKit({
 function belongsInPackagesChecklist(workspace) {
   return !workspace.isRoot || workspace.isPackage;
 }
+function buildSessionCheck() {
+  return {
+    name: "npm session can answer trust queries",
+    skip: () => skipIfNothingPublishable(),
+    check: () => {
+      const capability = getCachedTrustCapability();
+      return capability.ok ? { ok: true } : { ok: false, detail: capability.detail };
+    },
+    // A plain string rather than a getter, because readyup takes outcome-specific wording in `detail`, which the
+    // check above already carries.
+    fix: 'Restore a usable npm session: log in with "npm login", supplying the one-time password when prompted, or restore access to the registry, which the trusted-publisher check queries directly'
+  };
+}
 function buildWorkspaceCheck(workspace) {
   const displayName = workspace.name ?? "(unnamed)";
   const pkgJsonPath = path.join(workspace.dir, "package.json");
@@ -126,11 +135,22 @@ function buildWorkspaceCheck(workspace) {
   children.push(
     {
       name: "published to npm",
+      // `npm view` reads the registry without a session, so a missing login or a missing one-time password leaves
+      // this answerable. An unreachable registry does not: the lookup fails for every package, and reporting that
+      // as unpublished would advise publishing a package that is already there.
+      skip: () => {
+        const auth = getCachedNpmAuthStatus();
+        return auth.status === "unreachable" ? auth.detail : false;
+      },
       check: () => isPublishedToNpm(displayName),
       fix: `Run "npm publish --access public" from ${workspace.dir} to bootstrap the package on npm`,
       checks: [
         {
           name: "trusted publisher configured",
+          skip: () => {
+            const capability = getCachedTrustCapability();
+            return capability.ok ? false : capability.detail;
+          },
           check: () => checkTrustedPublisher(displayName),
           get fix() {
             return `Run: npm trust github ${displayName} --repo ${getCachedOwnerRepo()} --file ${PUBLISH_WORKFLOW_FILE}`;
@@ -180,11 +200,7 @@ function checkProvenanceMatchesVisibility() {
   return { ok: true };
 }
 function checkTrustedPublisher(packageName) {
-  const result = classifyTrustQuery(
-    runNpmJson(`npm trust list ${packageName} --json`),
-    getCachedOwnerRepo(),
-    PUBLISH_WORKFLOW_FILE
-  );
+  const result = getTrustQueryResult(packageName);
   switch (result.status) {
     case "configured":
       return { ok: true };
@@ -210,6 +226,12 @@ function classifyNpmAuth(result) {
   }
   return { status: "unreachable", detail: `The npm registry query failed (${error.code}): ${error.summary}` };
 }
+function classifyTrustCapability(auth, probe) {
+  if (auth.status !== "authenticated") {
+    return { ok: false, detail: auth.detail };
+  }
+  return probe?.status === "unanswerable" ? { ok: false, detail: probe.detail } : { ok: true };
+}
 function classifyTrustQuery(result, expectedRepo, expectedFile) {
   if (!result.exitOk) {
     const error = readNpmError(result.stdout);
@@ -219,6 +241,15 @@ function classifyTrustQuery(result, expectedRepo, expectedFile) {
     if (error.code === "E404") {
       return { status: "not-configured" };
     }
+    if (AUTH_ERROR_CODES.has(error.code) || error.code === OTP_ERROR_CODE) {
+      return {
+        status: "unanswerable",
+        detail: `The npm session cannot answer trust queries (${error.code}): ${error.summary}`
+      };
+    }
+    if (UNREACHABLE_ERROR_CODES.has(error.code)) {
+      return { status: "unanswerable", detail: `Cannot reach the npm registry (${error.code})` };
+    }
     return { status: "error", detail: `The npm trust query failed (${error.code}): ${error.summary}` };
   }
   const relationships = readTrustRelationships(result.stdout);
@@ -252,6 +283,10 @@ var getCachedOwnerRepo = /* @__PURE__ */ (() => {
   let cached;
   return () => cached ??= getOwnerRepo();
 })();
+var getCachedTrustCapability = /* @__PURE__ */ (() => {
+  let cached;
+  return () => cached ??= resolveTrustCapability();
+})();
 function getOwnerRepo() {
   const url = execSync("git remote get-url origin", {
     encoding: "utf8"
@@ -266,6 +301,20 @@ function getOwnerRepo() {
   }
   throw new Error(`Cannot parse GitHub owner/repo from remote URL: ${url}`);
 }
+var trustQueryResults = /* @__PURE__ */ new Map();
+function getTrustQueryResult(packageName) {
+  const cached = trustQueryResults.get(packageName);
+  if (cached !== void 0) {
+    return cached;
+  }
+  const result = classifyTrustQuery(
+    runNpmJson(`npm trust list ${packageName} --json`),
+    getCachedOwnerRepo(),
+    PUBLISH_WORKFLOW_FILE
+  );
+  trustQueryResults.set(packageName, result);
+  return result;
+}
 function hasTokenReferences() {
   const workflowDir = path.resolve(process.cwd(), ".github/workflows");
   if (!existsSync(workflowDir)) {
@@ -301,6 +350,10 @@ function isRepoPrivate() {
 function parseProvenanceSetting(workflowContent) {
   return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
 }
+function probeTrustQuery() {
+  const probeName = selectProbeName();
+  return probeName === void 0 ? void 0 : getTrustQueryResult(probeName);
+}
 function readNpmError(stdout) {
   let parsed;
   try {
@@ -329,6 +382,10 @@ function readTrustRelationships(stdout) {
   }
   return "type" in parsed ? [parsed] : [];
 }
+function resolveTrustCapability() {
+  const auth = getCachedNpmAuthStatus();
+  return classifyTrustCapability(auth, auth.status === "authenticated" ? probeTrustQuery() : void 0);
+}
 function runNpmJson(command) {
   try {
     return { exitOk: true, stdout: execSync(command, { encoding: "utf8", stdio: "pipe" }) };
@@ -337,6 +394,11 @@ function runNpmJson(command) {
     return { exitOk: false, stdout };
   }
 }
+function selectProbeName() {
+  return discoverWorkspaces({ filter: (workspace) => workspace.isPackage }).find(
+    (workspace) => workspace.name !== void 0
+  )?.name;
+}
 function skipIfNothingPublishable() {
   const publishable = discoverWorkspaces({ filter: (workspace) => workspace.isPackage });
   return publishable.length > 0 ? false : "no publishable packages";
@@ -347,9 +409,11 @@ function skipIfNotPublishable(workspace) {
 export {
   buildWorkspaceCheck,
   classifyNpmAuth,
+  classifyTrustCapability,
   classifyTrustQuery,
   npm_auto_publish_default as default,
   packagesChecklist,
+  selectProbeName,
   skipIfNotPublishable,
   skipIfNothingPublishable
 };

package/.readyup/manifest.json

@@ -8,12 +8,12 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "c948b179",
+          "hash": "55ff5731",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "221d9444",
+          "hash": "a373c49d",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -30,6 +30,11 @@
           "kind": "module",
           "path": "../src/init/parseJsonRecord.ts"
         },
+        {
+          "hash": "b798d024",
+          "kind": "module",
+          "path": "../src/packsPath.ts"
+        },
         {
           "hash": "646fe51b",
           "kind": "module",
@@ -38,10 +43,10 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.35.0",
+      "readyupVersion": "0.36.0",
       "source": "kits/default.ts",
-      "sourceHash": "c948b179",
-      "targetHash": "08e4eb5a"
+      "sourceHash": "55ff5731",
+      "targetHash": "68976fc8"
     },
     {
       "checklists": [
@@ -51,17 +56,17 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "15641d4a",
+          "hash": "2f1fb68c",
           "kind": "module",
           "path": "kits/npm-auto-publish.ts"
         }
       ],
       "name": "npm-auto-publish",
       "path": "kits/npm-auto-publish.js",
-      "readyupVersion": "0.35.0",
+      "readyupVersion": "0.36.0",
       "source": "kits/npm-auto-publish.ts",
-      "sourceHash": "15641d4a",
-      "targetHash": "721e337b"
+      "sourceHash": "2f1fb68c",
+      "targetHash": "cbabceb3"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,89 @@
 
 All notable changes to this project will be documented in this file.
 
+## 10.7.0 — 2026-09-15
+
+### 🎉 Features
+
+- Fix scaffold error handling and cover every scaffolded workflow (#806)
+
+  - Adds a `create-github-release.yaml matches template` check to release-kit's ReadyUp kit, which warns when `.github/workflows/create-github-release.yaml` differs from the template for the detected repo type and skips in a repo that has not installed that workflow.
+  - Stops `v11y init --force` from replacing an existing `.config/v11y-check.config.json` with the defaults, which discarded the repo's thresholds and the allowlist maintained by `v11y sync`.
+
+  Migration: To reset `.config/v11y-check.config.json` to its defaults, delete the file and run `v11y init`, because `v11y init --force` now overwrites only `.github/workflows/audit.yaml`.
+
+### 🐛 Bug fixes
+
+- Gate the trusted-publisher checks on trust-query capability (#786)
+
+  - Fixes the issue that the `npm-auto-publish` kit advised `npm trust github …` for every package when the npm session lacked the two-factor authentication that trust queries need.
+
+- Treat label names that differ only in case as one label (#808)
+
+  - Fixes the issue that `sync-labels generate` wrote a preset's `bug` and a local `Bug` to `.github/labels.yaml` as two labels, which made the first sync fail to create the second and every later sync rename the existing label back and forth.
+  - Lets a `labels` entry change a preset label's casing: `Bug` replaces a preset's `bug` and appears in the output as `Bug`, and `Bug: null` removes it.
+  - Makes `labels` keys that differ only in case a config error that names each group, such as `'bug' and 'Bug'`, since folding them would discard all but one without any sign in the output.
+
+  Migration: Keep one of any keys in the `labels` record that differ only in case, and delete the others.
+
+### ♻️ Refactoring
+
+- Remove the redundant, soft-failing version read from release prepare (#811)
+
+  - Deletes `readCurrentVersion` from `release-kit`, moving into `planVersionSet` the check that a `--set-version` target exceeds the current version and recording each workspace's version in the `DependencyGraph` passed to `propagateBumps`.
+  - Stops prepare from printing a warning before it fails on an unreadable `package.json`, and replaces `failed to read current version` for a missing `version` under `--set-version` with an error from `planVersionSet` that reports the missing `version` field.
+
+### ⚙️ Tooling
+
+- Upgrade eslint-config-typescript to v17 and adopt its ignore lists (#797)
+
+  - Declares `vitest` as `catalog:` in every workspace that imports it, with the pnpm catalog pinning 4.1.11, because v17 no longer exempts `vitest` from `n/no-extraneous-import`.
+  - Builds the global ignores in `eslint.config.ts` from the published `commonIgnores` and `toolIgnores`, which also exclude `pnpm-lock.yaml` and each `.readyup/manifest.json`, so the `eslint --fix` in `nmr lint` can no longer rewrite a kit manifest and make the next build's `rdy verify` fail.
+
+### 📚 Documentation
+
+- Trim the release-kit README and move reference detail into shipped docs (#802)
+
+  - Adds `docs` to the published `files` of `@williamthorsen/release-kit` and a `!docs/*.v*.md` exclusion to both it and `@williamthorsen/nmr`, because `pnpm pack` would otherwise include the release-notes previews that a local checkout holds.
+  - Adds `--version` to the options that `release-kit --help` lists, and points the hints for the removed `releaseNotes.shouldCreateGithubRelease` field at `release-kit init` instead of the README.
+
+## 10.6.0 — 2026-09-08
+
+### 🎉 Features
+
+- Report a package whose tarball would omit its changelog (#768)
+
+  Adds ReadyUp checks to verify that every published package bundles its changelog files: the human-readable `CHANGELOG.md` and the machine-readable `changelog.json`.
+
+- Add a migration field to changelog.json items (#770)
+
+  Adds an optional `migration` field to entries in the `.meta/changelog.json` that `release-kit` generates. If a commit body contains a labeled migration step, that content is copied to the `migration` field.
+
+### 🐛 Bug fixes
+
+- Pin git-cliff and remove the per-run npx cache refresh (#776)
+
+  Fixes an issue where git-cliff's version was unpinned, resulting in a per-run cache refresh. An exact version is now pinned.
+
+  Removes the per-run cache refresh, which re-ran `npx` without `--prefer-offline` once per prepare and forced a registry round trip. An exact version leaves npm nothing to revalidate, so a prepare run no longer waits on registry latency.
+
+  Also silences git-cliff's INFO output, in particular the crates.io update notice.
+
+### ♻️ Refactoring
+
+- Remove the unwired isChangelogItem type guard (#771)
+
+  Removes the unused `isChangelogItem` from `release-kit`'s `changelogJsonUtils.ts`, together with its tests.
+
+  Documentation is updated to record the boundary on `isChangelogEntry`: Entries parsed from `.meta/changelog.json` are shape-checked at the top level only, and strict validation applies only to the human-authored `.meta/changelog-overrides.json`.
+
+### 🧪 Tests
+
+- Read console spy output with listConsoleLines rather than by hand (#781)
+
+  - Replaces the hand-rolled reads of a console spy's `mock.calls` in the `nmr`, `release-kit`, and `v11y-check` test suites with `listConsoleLines` from `@williamthorsen/toolbelt.vitest/candidate`.
+  - Clears the `toolbelt.vitest/no-console-calls-read` recommendation that `rdy run --packages` reported.
+
 ## 10.5.0 — 2026-09-01
 
 ### 🎉 Features