discord-ops 0.23.0 → 0.23.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +36 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,41 @@
|
|
|
1
1
|
# discord-ops
|
|
2
2
|
|
|
3
|
+
## 0.23.3
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 4faf83d: fix(release): pin npm to 11.5.1 for OIDC trusted-publishing auth
|
|
8
|
+
|
|
9
|
+
The previous corepack-based install activated npm 10.9.7 (corepack's
|
|
10
|
+
`npm@latest` alias is stale), which supports `--provenance` for sigstore
|
|
11
|
+
attestation but lacks native trusted-publishing OIDC auth. The publish
|
|
12
|
+
PUT to the registry therefore went out unauthenticated and was rejected
|
|
13
|
+
with a misleading E404. Pinning to npm 11.5.1 ensures both provenance
|
|
14
|
+
signing and TP auth function correctly.
|
|
15
|
+
|
|
16
|
+
## 0.23.2
|
|
17
|
+
|
|
18
|
+
### Patch Changes
|
|
19
|
+
|
|
20
|
+
- d227788: chore(deps): resolve npm audit findings via audit fix
|
|
21
|
+
|
|
22
|
+
Updates lockfile to clear 1 high-severity (fast-uri path traversal,
|
|
23
|
+
CVSS 7.5) and 7 moderate-severity transitive vulnerabilities in hono,
|
|
24
|
+
ip-address, postcss, and ws. No direct dependency changes; no behavioral
|
|
25
|
+
impact. Unblocks `prepublishOnly` audit gate for release pipeline.
|
|
26
|
+
|
|
27
|
+
## 0.23.1
|
|
28
|
+
|
|
29
|
+
### Patch Changes
|
|
30
|
+
|
|
31
|
+
- 2f303d6: chore: migrate npm publishing to Trusted Publishing (OIDC)
|
|
32
|
+
|
|
33
|
+
Removes long-lived `NPM_TOKEN` dependency from CI publish workflow.
|
|
34
|
+
Authentication now happens via GitHub Actions OIDC token federation,
|
|
35
|
+
in response to the npm Mini Shai-Hulud token rotation event. No
|
|
36
|
+
behavioral changes for package consumers — sigstore provenance
|
|
37
|
+
attestation is preserved.
|
|
38
|
+
|
|
3
39
|
## 0.23.0
|
|
4
40
|
|
|
5
41
|
### Minor Changes
|