dsh-loci 2.0.0 → 2.0.2

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html) from 1.0.0.
 
+## [2.0.2] — 2026-11-14
+
+### Fixed
+
+- The manifest gate now checks the `bin` entry: bare relative path, target exists,
+  shebang present, covered by `files`. No user-visible behaviour changed — measured
+  on the published builds, `bin` was already correct in both 2.0.0 and 2.0.1
+  (`node_modules/.bin/dsh-loci` is created and `npx dsh-loci help` works).
+
+  The reason for the guard: npm rewrites a bin path that starts with `./` and prints
+  `script name … was invalid and removed`, which reads like the binary was dropped.
+  It was not. The value is now canonical so that warning cannot hide a real problem
+  next time.
+
+## [2.0.1] — 2026-11-14
+
+### Changed
+
+- **Publishing now uses Trusted Publishing (OIDC) only.** `setup-node` no longer
+  receives `registry-url` and the publish step no longer reads `NODE_AUTH_TOKEN`:
+  the collaboration center's npm runbook records both as `ENEEDAUTH` traps, and
+  with a Trusted Publisher bound, the OIDC identity token is the credential. The
+  repository therefore holds no npm secret.
+- `release.yml` gained an `npm >= 11.5` check, because npm 10 never performs the
+  OIDC exchange.
+
+### Note
+
+`2.0.0` was the bootstrap publish (npm does not allow a first publish over OIDC,
+[npm/cli#8544](https://github.com/npm/cli/issues/8544)), so it carries no
+attestation. **2.0.1 is the first version with a provenance attestation.**
+
 ## [2.0.0] — 2026-11-14
 
 ### Added