generator-easy-ui5 3.9.1 → 3.10.0

package/README.md

@@ -6,6 +6,18 @@
 [![License Status][license-image]][license-url]
 [![REUSE status][reuse-image]][reuse-url]
 
+<!-- prettier-ignore -->
+```text
+
+  ███████╗ █████╗ ███████╗██╗   ██╗   ██╗   ██╗██╗███████╗     ▄▄ ▄▄
+  ██╔════╝██╔══██╗██╔════╝╚██╗ ██╔╝   ██║   ██║██║██╔════╝     █████
+  █████╗  ███████║███████╗ ╚████╔╝    ██║   ██║██║███████╗      ███
+  ██╔══╝  ██╔══██║╚════██║  ╚██╔╝     ██║   ██║██║╚════██║       █
+  ███████╗██║  ██║███████║   ██║      ╚██████╔╝██║███████║
+  ╚══════╝╚═╝  ╚═╝╚══════╝   ╚═╝       ╚═════╝ ╚═╝╚══════╝   v3.10.0
+
+```
+
 ## Description
 
 Easy UI5 (`easy-ui5`) 💙 is a [Yeoman](http://yeoman.io/) generator which enables you to create simple [SAPUI5](https://ui5.sap.com)/[OpenUI5](https://sdk.openui5.org)-based web-apps and other UI5-related projects within seconds.
@@ -20,7 +32,7 @@ The purpose of the (preinstalled) `project generator` is to guide you on your fi
 
 ## Requirements
 
-- Get [Node.js](https://nodejs.org/en/download/) (:warning: **version 20 or higher**).
+- Get [Node.js](https://nodejs.org/en/download/) (:warning: **version 20.19 or higher**).
 
 ## Download and Installation
 
@@ -105,6 +117,57 @@ Once you decided on the generator, run:
 yo easy-ui5 [project|ts-app|...]
 ```
 
+## Configuration
+
+easy-ui5 reads its configuration from `~/.easyui5rc.json` (recommended) or
+`~/.easyui5rc` (INI). Both files are optional and use bare option names — no
+prefix needed.
+
+`~/.easyui5rc.json`:
+
+```json
+{
+  "ghAuthToken": "github_pat_...",
+  "ghBaseUrl": "https://github.tools.sap/api/v3",
+  "pluginsHome": "/Users/me/.npm/_generator-easy-ui5/plugin-generators",
+  "addGhBaseUrl": "https://github.tools.sap/api/v3",
+  "addGhOrg": "my-org",
+  "addSubGeneratorPrefix": "generator-"
+}
+```
+
+`~/.easyui5rc` (INI alternative):
+
+```text
+ghAuthToken=github_pat_...
+ghBaseUrl=https://github.tools.sap/api/v3
+```
+
+### Cascade & per-project overrides
+
+Resolution walks from the current working directory up to your home directory
+(ESLint-style). At each level, `.easyui5rc.json` wins over `.easyui5rc`; closer
+files win over farther ones. Add `"root": true` to a file to stop the cascade
+at that level.
+
+### Environment variables
+
+Every option also accepts a `EASY_UI5_<SCREAMING_SNAKE>` environment variable
+which takes precedence over every config file — ideal for CI:
+
+```sh
+EASY_UI5_GH_AUTH_TOKEN=ghp_...
+EASY_UI5_GH_BASE_URL=https://github.tools.sap/api/v3
+EASY_UI5_PLUGINS_HOME=/var/cache/easy-ui5
+```
+
+### Legacy `~/.npmrc` keys (deprecated)
+
+Earlier versions read `easy-ui5_*` keys directly from `~/.npmrc`. These are
+still resolved for one release, but npm 11+ warns and npm 12 will reject
+unknown user config — please move them to `~/.easyui5rc.json`. The generator
+prints a one-time migration notice when it detects legacy keys.
+
 ## Proxy settings
 
 If you are running easy-ui5 behind a coporate proxy, just use the default proxy environment variables for Node.js to configure your corporate proxy:
@@ -135,6 +198,17 @@ Proxies can be passed as env variables or as npm config options. The highest pre
 
 Please use the GitHub bug tracking system to post questions, bug reports or to create pull requests.
 
+## Releases
+
+Releases are automated via [Changesets](https://github.com/changesets/changesets) and the
+[`Release` workflow](.github/workflows/release.yml). Contributors record the intended semver
+bump and summary in a `.changeset/*.md` file as part of their PR (`npm run changeset`); when
+that PR merges to `main`, a "Version Packages" PR is opened or updated. Merging that PR cuts
+the actual release: version bump, `CHANGELOG.md` update, npm publish via OIDC Trusted
+Publishing, git tag, GitHub Release.
+
+See [CONTRIBUTING.md](CONTRIBUTING.md#release-life-cycle) for the contributor-facing details.
+
 ## Contributing
 
 We welcome any type of contribution (code contributions, pull requests, issues) to this project equally.

package/generators/app/banner.js

@@ -0,0 +1,92 @@
+// Renders the easy-ui5 welcome banner.
+//
+// A box-drawing wordmark in the ANSI-Shadow style spelling out
+// `EASY UI5`, rendered in a six-row rainbow when a chalk-style colorizer
+// is supplied. A small heart in the same block style sits on the top
+// right; an empty row separates the heart from the version which is
+// printed on the wordmark's last row. The banner is bracketed by blank
+// lines so it has visual breathing room when log output streams above
+// and below it.
+
+const WORDMARK = [
+	"███████╗ █████╗ ███████╗██╗   ██╗   ██╗   ██╗██╗███████╗",
+	"██╔════╝██╔══██╗██╔════╝╚██╗ ██╔╝   ██║   ██║██║██╔════╝",
+	"█████╗  ███████║███████╗ ╚████╔╝    ██║   ██║██║███████╗",
+	"██╔══╝  ██╔══██║╚════██║  ╚██╔╝     ██║   ██║██║╚════██║",
+	"███████╗██║  ██║███████║   ██║      ╚██████╔╝██║███████║",
+	"╚══════╝╚═╝  ╚═╝╚══════╝   ╚═╝       ╚═════╝ ╚═╝╚══════╝",
+];
+
+// One chalk colour per wordmark row — six rows, six rainbow tones.
+const RAINBOW = ["red", "yellow", "green", "cyan", "blue", "magenta"];
+
+// Small 4-row heart, anchored to the right of the wordmark's top half.
+// Aligned manually so it visually rests against the wordmark with a small
+// gap. Width includes leading spaces so each row has identical length.
+const HEART = ["   ▄▄ ▄▄ ", "   █████ ", "    ███  ", "     █   "];
+
+const WORDMARK_WIDTH = 56;
+const HEART_GAP = 2; // spaces between the wordmark and the heart
+const HEART_WIDTH = HEART[0].length;
+const BANNER_WIDTH = WORDMARK_WIDTH + HEART_GAP + HEART_WIDTH;
+const INDENT = "  ";
+// The version sits on the last wordmark row, leaving the row between the
+// heart and the version blank for a bit of breathing space.
+const VERSION_ROW_INDEX = WORDMARK.length - 1;
+
+/**
+ * @param {string} version The generator version to render under the heart.
+ * @param {Partial<Record<"red"|"yellow"|"green"|"cyan"|"blue"|"magenta", (s:string)=>string>>} [c]
+ *        Optional chalk-like colorizer. When omitted the banner renders
+ *        without ANSI escapes.
+ * @returns {string}
+ */
+export function renderBanner(version, c) {
+	const id = (s) => s;
+	const rainbow = RAINBOW.map((name) => c?.[name] ?? id);
+	const yellow = c?.yellow ?? id;
+	// The heart accent uses magenta as a pink fallback against any of the
+	// rainbow rows it overlaps. Fall back to red if the caller didn't
+	// supply magenta.
+	const pink = c?.magenta ?? c?.red ?? id;
+
+	const versionText = `v${version}`;
+	// Centre the version under the heart by padding it to the heart's width.
+	const versionRow = centerInWidth(versionText, HEART_WIDTH);
+
+	const lines = WORDMARK.map((line, i) => {
+		const colorize = rainbow[i] ?? id;
+		const heart = HEART[i];
+		const wordmark = `${INDENT}${colorize(line)}`;
+		if (heart) {
+			return `${wordmark}${" ".repeat(HEART_GAP)}${pink(heart)}`;
+		}
+		if (i === VERSION_ROW_INDEX) {
+			return `${wordmark}${" ".repeat(HEART_GAP)}${yellow(versionRow)}`;
+		}
+		return wordmark;
+	});
+
+	// Bracket the banner with blank lines so log output above and below has
+	// some breathing space.
+	return ["", ...lines, ""].join("\n");
+}
+
+function centerInWidth(text, width) {
+	if (text.length >= width) return text;
+	const pad = width - text.length;
+	const left = Math.floor(pad / 2);
+	const right = pad - left;
+	return `${" ".repeat(left)}${text}${" ".repeat(right)}`;
+}
+
+// Exported for tests that need the design constants without running render.
+export const _internals = {
+	WORDMARK_WIDTH,
+	WORDMARK_HEIGHT: WORDMARK.length,
+	HEART_WIDTH,
+	HEART_HEIGHT: HEART.length,
+	BANNER_WIDTH,
+	RAINBOW,
+	VERSION_ROW_INDEX,
+};

package/generators/app/getNPMConfig.js

@@ -1,12 +1,278 @@
-import libnpmconfig from "libnpmconfig";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
 
-// helper to retrieve config entries from npm
-//   --> npm config set easy-ui5_addGhOrg XYZ
+import { createLogger } from "./log.js";
+
+// Singleton cache of the merged config map.
 let npmConfig;
 
+// Internal: keys we accept from .npmrc. Application keys (easy-ui5_*) are
+// being phased out of .npmrc — npm 11+ warns and npm 12 will reject them.
+// Proxy keys remain legitimate npm config and continue to be read from .npmrc.
+const NPMRC_PROXY_KEYS = new Set(["http-proxy", "https-proxy", "proxy", "no-proxy"]);
+
+// Map an easy-ui5 option name (`ghAuthToken`) to its EASY_UI5_* env-var name
+// (`EASY_UI5_GH_AUTH_TOKEN`). Inserts an underscore before each upper-case run.
+function envVarNameFor(optionName) {
+	const snake = optionName.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2");
+	return `EASY_UI5_${snake.toUpperCase()}`;
+}
+
+// ---------- parsers ----------
+
+// Minimal INI parser for .easyui5rc / .npmrc. Handles blank lines, `;`/`#`
+// comments, and flat `key = value` pairs. No sections, no JSON coercion.
+function parseIni(raw) {
+	const out = {};
+	for (const rawLine of raw.split(/\r?\n/)) {
+		let line = rawLine.replace(/(^|\s)[;#].*$/, "$1").trim();
+		if (!line) continue;
+		const eq = line.indexOf("=");
+		if (eq < 0) continue;
+		const key = line.slice(0, eq).trim();
+		let value = line.slice(eq + 1).trim();
+		if (!key) continue;
+		if ((value.startsWith('"') && value.endsWith('"') && value.length >= 2) || (value.startsWith("'") && value.endsWith("'") && value.length >= 2)) {
+			value = value.slice(1, -1);
+		}
+		out[key] = value;
+	}
+	return out;
+}
+
+function parseJson(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+	} catch {
+		/* fall through */
+	}
+	return {};
+}
+
+function readFile(file) {
+	if (!file) return null;
+	try {
+		return readFileSync(file, "utf-8");
+	} catch {
+		return null;
+	}
+}
+
+// Read a .npmrc, returning {data, raw}. We need the raw object to detect
+// legacy easy-ui5_* keys for the deprecation warning even though we don't
+// expose them as resolved config (we strip them to proxy-keys only).
+function readNpmrc(file) {
+	const raw = readFile(file);
+	if (raw == null) return { all: {}, proxy: {} };
+	const all = parseIni(raw);
+	// also normalise `//easy-ui5_*` to the bare key, for legacy-detection only
+	for (const [k, v] of Object.entries(all)) {
+		if (k.startsWith("//easy-ui5_")) {
+			const stripped = k.slice(2);
+			if (!(stripped in all)) all[stripped] = v;
+		}
+	}
+	const proxy = {};
+	for (const key of NPMRC_PROXY_KEYS) {
+		if (key in all) proxy[key] = all[key];
+	}
+	return { all, proxy };
+}
+
+// Read an .easyui5rc[.json] file. JSON takes precedence over INI at the same
+// directory level. Returns { data, root } where `root` indicates the file
+// declared itself as the cascade root.
+function readEasyUi5Rc(dir) {
+	const jsonPath = path.join(dir, ".easyui5rc.json");
+	const iniPath = path.join(dir, ".easyui5rc");
+
+	let data = {};
+	const jsonRaw = readFile(jsonPath);
+	if (jsonRaw != null) data = parseJson(jsonRaw);
+	else {
+		const iniRaw = readFile(iniPath);
+		if (iniRaw != null) data = parseIni(iniRaw);
+	}
+
+	const root = data && (data.root === true || data.root === "true");
+	if (root) delete data.root;
+	return { data, root };
+}
+
+// ---------- value transforms ----------
+
+// npm-style ${ENV_VAR} interpolation in values, with a recursion guard.
+function expandEnv(value, depth = 0) {
+	if (typeof value !== "string" || depth > 10) return value;
+	let replaced = false;
+	const out = value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (m, name) => {
+		const v = process.env[name];
+		if (v === undefined) return m;
+		replaced = true;
+		return v;
+	});
+	return replaced ? expandEnv(out, depth + 1) : out;
+}
+
+// ---------- env sources ----------
+
+// Pull `npm_config_*` env vars; only proxy keys are honoured, because
+// `easy-ui5_*` is no longer an npm-namespace concern.
+function readEnvNpmConfig() {
+	const out = {};
+	for (const [k, v] of Object.entries(process.env)) {
+		if (!k.toLowerCase().startsWith("npm_config_")) continue;
+		const raw = k.slice("npm_config_".length);
+		const lower = raw.toLowerCase();
+		const dashed = lower.replace(/_/g, "-");
+		if (NPMRC_PROXY_KEYS.has(lower)) out[lower] = v;
+		if (NPMRC_PROXY_KEYS.has(dashed)) out[dashed] = v;
+	}
+	return out;
+}
+
+// Resolve `EASY_UI5_*` env vars to easy-ui5_<camelCase> keys. We only know
+// the canonical option names when getNPMConfig() is called, so we don't
+// pre-compute this map — instead `getNPMConfig` checks process.env directly
+// after the file cascade misses.
+//
+// This function is unused for file-cascade building; kept here as a stub
+// for symmetry / documentation. The real resolution happens in getNPMConfig.
+
+// ---------- the cascade ----------
+
+// Walk from `startDir` upward, collecting .easyui5rc[.json] at each level.
+// Stops at a directory whose file sets `root: true`, or at homedir, or at
+// filesystem root, whichever comes first. Always also reads ~/.easyui5rc at
+// the end (lowest precedence) so a per-user file always applies.
+//
+// Result is ordered low-precedence-first.
+function collectEasyUi5RcCascade(startDir) {
+	const home = homedir();
+	const visited = new Set();
+	const chain = []; // each entry: { dir, data }
+
+	let dir = path.resolve(startDir);
+	let stoppedAtRoot = false;
+	for (let i = 0; i < 64; i++) {
+		if (visited.has(dir)) break;
+		visited.add(dir);
+
+		const { data, root } = readEasyUi5Rc(dir);
+		if (Object.keys(data).length > 0 || root) {
+			chain.push({ dir, data });
+		}
+		if (root) {
+			stoppedAtRoot = true;
+			break;
+		}
+		if (dir === home) break;
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+
+	// Always include the home file (if not already visited and not stopped by `root:true`)
+	if (!stoppedAtRoot && !visited.has(home)) {
+		const { data } = readEasyUi5Rc(home);
+		if (Object.keys(data).length > 0) chain.push({ dir: home, data });
+	}
+
+	// chain is ordered cwd → root (high precedence → low precedence).
+	// Reverse so callers can spread left-to-right with the usual
+	// "later wins" semantics.
+	return chain.reverse();
+}
+
+// ---------- legacy ~/.npmrc deprecation warning ----------
+
+let legacyWarningEmitted = false;
+function maybeWarnLegacyNpmrcKeys(npmrcAll) {
+	if (legacyWarningEmitted) return;
+	const legacy = Object.keys(npmrcAll).filter((k) => k.startsWith("easy-ui5_"));
+	if (legacy.length === 0) return;
+	legacyWarningEmitted = true;
+	// One [WARN]-tagged line on stderr. We instantiate the logger without
+	// chalk here to keep this module renderable from tests/non-TTY callers
+	// — the tag still surfaces, colour just becomes a no-op.
+	const logger = createLogger();
+	logger.warn(`Found legacy easy-ui5_* keys in ~/.npmrc (${legacy.join(", ")}). These will be ignored in a future release. Move them to ~/.easyui5rc.json — see README.`);
+}
+
+// ---------- merge ----------
+
+function loadConfig() {
+	const userNpmrcPath = process.env.NPM_CONFIG_USERCONFIG || path.join(homedir(), ".npmrc");
+	const globalNpmrcPath = process.env.NPM_CONFIG_GLOBALCONFIG;
+	const projectNpmrcPath = path.join(process.cwd(), ".npmrc");
+
+	const globalNpmrc = readNpmrc(globalNpmrcPath);
+	const userNpmrc = readNpmrc(userNpmrcPath);
+	const projectNpmrc = readNpmrc(projectNpmrcPath);
+
+	// Warn once if legacy easy-ui5_* keys still live in ~/.npmrc.
+	maybeWarnLegacyNpmrcKeys(userNpmrc.all);
+
+	// Build the easy-ui5_* layer with precedence (low -> high):
+	// 1. legacy npmrc easy-ui5_* (one-release grace period, deprecated)
+	// 2. easyui5rc cascade (canonical home)
+	// 3. EASY_UI5_* env vars (highest — handled in getNPMConfig)
+	const easyUi5Layer = {};
+	// 1. legacy: pull easy-ui5_* out of user/project .npmrc
+	for (const npmrcLayer of [userNpmrc.all, projectNpmrc.all]) {
+		for (const [k, v] of Object.entries(npmrcLayer)) {
+			if (k.startsWith("easy-ui5_")) easyUi5Layer[k] = v;
+		}
+	}
+	// 2. canonical: walk the .easyui5rc cascade (low -> high precedence)
+	const cascade = collectEasyUi5RcCascade(process.cwd());
+	for (const { data } of cascade) {
+		for (const [k, v] of Object.entries(data)) {
+			easyUi5Layer[`easy-ui5_${k}`] = v;
+		}
+	}
+
+	// Proxy layer from .npmrc (legitimate npm config) and npm_config_*
+	const proxyLayer = {
+		...globalNpmrc.proxy,
+		...userNpmrc.proxy,
+		...projectNpmrc.proxy,
+		...readEnvNpmConfig(),
+	};
+
+	const merged = { ...proxyLayer, ...easyUi5Layer };
+
+	// EASY_UI5_* env vars win over file values. We expand `getNPMConfig` to
+	// check these dynamically on each call so we don't need to enumerate
+	// every option here.
+
+	// ${ENV_VAR} interpolation on all string values
+	for (const k of Object.keys(merged)) {
+		merged[k] = expandEnv(merged[k]);
+	}
+	return merged;
+}
+
+// ---------- public API ----------
+
 export default function getNPMConfig(configName, prefix = "easy-ui5_") {
-	if (!npmConfig) {
-		npmConfig = libnpmconfig.read();
+	if (!npmConfig) npmConfig = loadConfig();
+
+	// EASY_UI5_* env vars always win for the easy-ui5_ prefix
+	if (prefix === "easy-ui5_") {
+		const envName = envVarNameFor(configName);
+		const fromEnv = process.env[envName];
+		if (fromEnv !== undefined && fromEnv !== "") return fromEnv;
 	}
-	return npmConfig && npmConfig[`${prefix}${configName}`];
+
+	return npmConfig[`${prefix}${configName}`];
+}
+
+// ---------- test hooks ----------
+
+export function _resetCacheForTests() {
+	npmConfig = undefined;
+	legacyWarningEmitted = false;
 }

package/generators/app/index.js

@@ -10,10 +10,12 @@ import url from "url";
 
 import { glob } from "glob";
 import chalk from "chalk";
-import yosay from "yosay";
 import nodeFetch from "node-fetch";
 import AdmZip from "adm-zip";
 
+import { renderBanner } from "./banner.js";
+import { createLogger } from "./log.js";
+
 import { request } from "@octokit/request";
 import { Octokit } from "@octokit/rest";
 import { throttling } from "@octokit/plugin-throttling";
@@ -31,6 +33,11 @@ export default class EasyUI5Generator extends Generator {
 
 		defineGeneratorArguments(this);
 		defineGeneratorOptions(this);
+
+		// Tagged logger: [INFO]/[WARN]/[ERROR]/[OK]/[DEBUG]. DEBUG is shown only
+		// when --verbose is set. WARN/ERROR are routed to stderr so they don't
+		// get swallowed when stdout is redirected.
+		this.logger = createLogger({ chalk, verbose: !!this.options.verbose });
 	}
 
 	_showBusy(statusText) {
@@ -57,7 +64,11 @@ export default class EasyUI5Generator extends Generator {
 
 	async _npmInstall(dir, withDevDeps) {
 		return new Promise((resolve, reject) => {
-			this.spawnCommand("npm", ["install", "--no-progress", "--ignore-engines", "--ignore-scripts"], {
+			// yeoman-generator v8+ split the spawn API: `spawnCommand` now takes
+			// `(command, execaOptions)` (no args array — it parses the shell
+			// string), whereas `spawn` takes `(command, args[], options)`. We
+			// pass argv as an array, so we want `spawn`.
+			this.spawn("npm", ["install", "--no-progress", "--ignore-engines", "--ignore-scripts", "--prefer-offline"], {
 				stdio: this.config.verbose ? "inherit" : "ignore",
 				cwd: dir,
 				env: {
@@ -118,9 +129,9 @@ export default class EasyUI5Generator extends Generator {
 				});
 				generator.branch = repoInfo.data.default_branch;
 			} catch (e) {
-				console.error(`Generator "${owner}/${repo}!${dir}${branch ? "#" + branch : ""}" not found! Run with --verbose for details!\n(Hint: ${e.message})`);
+				this.logger.error(`Generator "${owner}/${repo}!${dir}${branch ? "#" + branch : ""}" not found! Run with --verbose for details!\n(Hint: ${e.message})`);
 				if (this.options.verbose) {
-					console.error(e);
+					this.logger.debug(String(e?.stack ?? e));
 				}
 				return;
 			}
@@ -136,17 +147,17 @@ export default class EasyUI5Generator extends Generator {
 			});
 			commitSHA = reqBranch.data.commit.sha;
 		} catch (ex) {
-			console.error(
-				chalk.red(`Failed to retrieve the branch "${generator.branch}" for repository "${generator.name}" for "${generator.org}" organization! Run with --verbose for details!\n(Hint: ${ex.message})`),
+			this.logger.error(
+				`Failed to retrieve the branch "${generator.branch}" for repository "${generator.name}" for "${generator.org}" organization! Run with --verbose for details!\n(Hint: ${ex.message})`,
 			);
 			if (this.options.verbose) {
-				console.error(chalk.red(ex.message));
+				this.logger.debug(String(ex?.stack ?? ex.message));
 			}
 			return;
 		}
 
 		if (this.options.verbose) {
-			this.log(`Using commit ${commitSHA} from @${generator.org}/${generator.name}#${generator.branch}!`);
+			this.logger.debug(`Using commit ${commitSHA} from @${generator.org}/${generator.name}#${generator.branch}!`);
 		}
 		const shaMarker = path.join(generatorPath, `.${commitSHA}`);
 
@@ -154,7 +165,7 @@ export default class EasyUI5Generator extends Generator {
 			// check if the SHA marker exists to know whether the generator is up-to-date or not
 			if (this.options.forceUpdate || !fs.existsSync(shaMarker)) {
 				if (this.options.verbose) {
-					this.log(`Generator ${chalk.yellow(generator.name)} in "${generatorPath}" is outdated!`);
+					this.logger.debug(`Generator ${chalk.yellow(generator.name)} in "${generatorPath}" is outdated!`);
 				}
 				// remove if the SHA marker doesn't exist => outdated!
 				this._showBusy(`  Deleting subgenerator ${chalk.yellow(generator.name)}...`);
@@ -166,7 +177,7 @@ export default class EasyUI5Generator extends Generator {
 		if (!fs.existsSync(generatorPath)) {
 			// unzip the archive
 			if (this.options.verbose) {
-				this.log(`Extracting ZIP to "${generatorPath}"...`);
+				this.logger.debug(`Extracting ZIP to "${generatorPath}"...`);
 			}
 			this._showBusy(`  Downloading subgenerator ${chalk.yellow(generator.name)}...`);
 			const reqZIPArchive = await octokit.repos.downloadZipballArchive({
@@ -186,7 +197,7 @@ export default class EasyUI5Generator extends Generator {
 		// run npm install when not embedding the generator (always for self-healing!)
 		if (!this.options.embed) {
 			if (this.options.verbose) {
-				this.log("Installing the subgenerator dependencies...");
+				this.logger.debug("Installing the subgenerator dependencies...");
 			}
 			this._showBusy(`  Preparing ${chalk.yellow(generator.name)}...`);
 			await this._npmInstall(generatorPath, this.options.pluginsWithDevDeps);
@@ -199,26 +210,26 @@ export default class EasyUI5Generator extends Generator {
 		const home = path.join(__dirname, "..", "..");
 		const pkgJson = JSON.parse(fs.readFileSync(path.join(home, "package.json"), "utf8"));
 
-		// Have Yeoman greet the user.
+		// Have Yeoman greet the user — with our own easy-ui5 banner.
 		if (!this.options.embedded) {
-			this.log(yosay(`Welcome to the ${chalk.red("easy-ui5")} ${chalk.yellow(pkgJson.version)} generator!`));
+			this.log(renderBanner(pkgJson.version, chalk));
 		}
 
 		// by default we install the easy-ui5 plugin generators into the following folder:
 		// %user_dir%/.npm/_generator-easy-ui5/plugin-generators
 		let pluginsHome = this.options.pluginsHome;
 		if (this.options.verbose) {
-			console.info("  Context:");
-			console.info(`    - sourceRoot = ${chalk.green(this.sourceRoot())}`);
-			console.info(`    - destinationRoot = ${chalk.green(this.destinationRoot())}`);
-			console.info("  Options:");
+			this.logger.debug("Context:");
+			this.logger.debug(`  sourceRoot = ${chalk.green(this.sourceRoot())}`);
+			this.logger.debug(`  destinationRoot = ${chalk.green(this.destinationRoot())}`);
+			this.logger.debug("Options:");
 			Object.keys(generatorOptions).forEach((option) => {
-				console.info(`    - ${option} = ${chalk.green(this.options[option])}`);
+				this.logger.debug(`  ${option} = ${chalk.green(this.options[option])}`);
 			});
-			console.info("  Proxy:");
-			console.info(`    - HTTP_PROXY = ${chalk.green(HTTP_PROXY)}`);
-			console.info(`    - HTTPS_PROXY = ${chalk.green(HTTPS_PROXY)}`);
-			console.info(`    - NO_PROXY = ${chalk.green(NO_PROXY)}`);
+			this.logger.debug("Proxy:");
+			this.logger.debug(`  HTTP_PROXY = ${chalk.green(HTTP_PROXY)}`);
+			this.logger.debug(`  HTTPS_PROXY = ${chalk.green(HTTPS_PROXY)}`);
+			this.logger.debug(`  NO_PROXY = ${chalk.green(NO_PROXY)}`);
 		}
 		fs.mkdirSync(pluginsHome, { recursive: true });
 
@@ -244,7 +255,17 @@ export default class EasyUI5Generator extends Generator {
 			this.log(chalk.green("\nAvailable generators:"));
 			glob.sync(`${pluginsHome}/*/package.json`).forEach((plugin) => {
 				const name = plugin.match(/.*\/generator-(.+)\/package\.json/)[1];
-				const lib = require(plugin);
+				// Resolve and validate the path is within pluginsHome to satisfy eslint security rule.
+				const resolvedPlugin = path.resolve(plugin);
+				const resolvedPluginsHome = path.resolve(pluginsHome);
+				if (!resolvedPlugin.startsWith(resolvedPluginsHome + path.sep)) {
+					return; // skip paths outside pluginsHome
+				}
+				// plugin is a filesystem path under pluginsHome (Yeoman cache).
+				// Read its package.json directly rather than require()-ing it,
+				// so we never execute arbitrary code from a cached plugin just
+				// to print its version.
+				const lib = JSON.parse(fs.readFileSync(resolvedPlugin, "utf8"));
 				this.log(`  - ${chalk.green(name)}: ${lib.version}`);
 			});
 
@@ -255,7 +276,7 @@ export default class EasyUI5Generator extends Generator {
 		// when not running in offline mode!
 		let octokit;
 		if (this.options.offline) {
-			this.log(`Running in ${chalk.yellow("offline")} mode!`);
+			this.logger.info(`Running in ${chalk.yellow("offline")} mode!`);
 		} else {
 			// define the options for the Octokit API
 			const octokitOptions = {
@@ -271,18 +292,18 @@ export default class EasyUI5Generator extends Generator {
 				baseUrl: this.options.ghBaseUrl,
 				throttle: {
 					onRateLimit: (retryAfter, options) => {
-						this.log(`${chalk.yellow("Hit the GitHub API limit!")} Request quota exhausted for this request.`);
+						this.logger.warn("Hit the GitHub API limit! Request quota exhausted for this request.");
 						if (options.request.retryCount === 0) {
 							// only retries once
-							this.log(
-								`Retrying after ${retryAfter} seconds. Alternatively, you can cancel this operation and supply an auth token with the \`--ghAuthToken\` option. For more details, run \`yo easy-ui5 --help\`. `,
+							this.logger.warn(
+								`Retrying after ${retryAfter} seconds. Alternatively, you can cancel this operation and supply an auth token with the \`--ghAuthToken\` option. For more details, run \`yo easy-ui5 --help\`.`,
 							);
 							return true;
 						}
 					},
 					onSecondaryRateLimit: () => {
-						// does not retry, only logs a warning
-						this.log(`${chalk.red("Hit the GitHub API limit again!")} Please supply an auth token with the \`--ghAuthToken\` option. For more details, run \`yo easy-ui5 --help\` `);
+						// does not retry, only logs an error
+						this.logger.error("Hit the GitHub API limit again! Please supply an auth token with the `--ghAuthToken` option. For more details, run `yo easy-ui5 --help`.");
 					},
 				},
 			};
@@ -353,7 +374,7 @@ export default class EasyUI5Generator extends Generator {
 			};
 			// log which generator is being used!
 			if (this.options.verbose) {
-				this.log(`Using generator ${chalk.green(`${owner}/${repo}!${dir}${branch ? "#" + branch : ""}`)}`);
+				this.logger.debug(`Using generator ${chalk.green(`${owner}/${repo}!${dir}${branch ? "#" + branch : ""}`)}`);
 			}
 		}
 
@@ -417,9 +438,9 @@ export default class EasyUI5Generator extends Generator {
 								};
 							});
 					} catch (e) {
-						console.error(`Failed to connect to bestofui5.org to retrieve all available generators! Run with --verbose for details!\n(Hint: ${e.message})`);
+						this.logger.error(`Failed to connect to bestofui5.org to retrieve all available generators! Run with --verbose for details!\n(Hint: ${e.message})`);
 						if (this.options.verbose) {
-							console.error(e);
+							this.logger.debug(String(e?.stack ?? e));
 						}
 						return;
 					}
@@ -428,9 +449,9 @@ export default class EasyUI5Generator extends Generator {
 					try {
 						availGenerators = await listGeneratorsForOrg(this.options.ghOrg, this.options.subGeneratorPrefix, this.options.ghThreshold);
 					} catch (e) {
-						console.error(`Failed to connect to GitHub to retrieve all available generators for "${this.options.ghOrg}" organization! Run with --verbose for details!\n(Hint: ${e.message})`);
+						this.logger.error(`Failed to connect to GitHub to retrieve all available generators for "${this.options.ghOrg}" organization! Run with --verbose for details!\n(Hint: ${e.message})`);
 						if (this.options.verbose) {
-							console.error(e);
+							this.logger.debug(String(e?.stack ?? e));
 						}
 						return;
 					}
@@ -442,14 +463,16 @@ export default class EasyUI5Generator extends Generator {
 						}
 					} catch (e) {
 						if (this.options.verbose) {
-							this.log(`Failed to connect to GitHub retrieve additional generators for "${this.options.addGhOrg}" organization! Try to retrieve for user...`);
+							this.logger.debug(`Failed to connect to GitHub retrieve additional generators for "${this.options.addGhOrg}" organization! Try to retrieve for user...`);
 						}
 						try {
 							availGenerators = availGenerators.concat(await listGeneratorsForUser(this.options.addGhOrg, this.options.addSubGeneratorPrefix, this.options.ghThreshold));
 						} catch (e1) {
-							console.error(`Failed to connect to GitHub to retrieve additional generators for organization or user "${this.options.addGhOrg}"! Run with --verbose for details!\n(Hint: ${e.message})`);
+							this.logger.error(
+								`Failed to connect to GitHub to retrieve additional generators for organization or user "${this.options.addGhOrg}"! Run with --verbose for details!\n(Hint: ${e.message})`,
+							);
 							if (this.options.verbose) {
-								console.error(e1);
+								this.logger.debug(String(e1?.stack ?? e1));
 							}
 							return;
 						}
@@ -465,7 +488,7 @@ export default class EasyUI5Generator extends Generator {
 
 			// if no generator is provided and doesn't exist, ask for generator name
 			if (this.options.generator && !generator) {
-				this.log(`The generator ${chalk.red(this.options.generator)} was not found. Please select an existing generator!`);
+				this.logger.error(`The generator ${chalk.red(this.options.generator)} was not found. Please select an existing generator!`);
 			}
 
 			// still not found, select a generator
@@ -552,7 +575,7 @@ export default class EasyUI5Generator extends Generator {
 				if (selectedSubGenerator.length == 1) {
 					subGenerators = selectedSubGenerator;
 				} else {
-					this.log(`The generator ${chalk.red(this.options.generator)} has no subcommand ${chalk.red(this.options.subcommand)}. Please select an existing subcommand!`);
+					this.logger.error(`The generator ${chalk.red(this.options.generator)} has no subcommand ${chalk.red(this.options.subcommand)}. Please select an existing subcommand!`);
 				}
 			}
 
@@ -629,7 +652,7 @@ export default class EasyUI5Generator extends Generator {
 									subGensToRun.push(theNestedGen.namespace);
 									await resolveNestedGenerator(theNestedGen.namespace);
 								} else {
-									this.log(`The nested generator "${nestedGeneratorInfo.org}/${nestedGeneratorInfo.name}" has no subgenerator "${subcommand || "default"}"! Ignoring execution...`);
+									this.logger.warn(`The nested generator "${nestedGeneratorInfo.org}/${nestedGeneratorInfo.name}" has no subgenerator "${subcommand || "default"}"! Ignoring execution...`);
 								}
 							}
 						}) || [],
@@ -658,7 +681,7 @@ export default class EasyUI5Generator extends Generator {
 				};
 
 				if (this.options.verbose) {
-					this.log(`Running generators in "${generatorPath}"...`);
+					this.logger.debug(`Running generators in "${generatorPath}"...`);
 				}
 
 				// chain the execution of the generators
@@ -690,20 +713,20 @@ export default class EasyUI5Generator extends Generator {
 				});
 				*/
 			} else {
-				this.log(`The generator ${chalk.red(this.options.generator)} has no visible subgenerators!`);
+				this.logger.error(`The generator ${chalk.red(this.options.generator)} has no visible subgenerators!`);
 			}
 		} else {
 			// zip the content of the plugin generator or
 			// install the dependencies of the generator
 			if (this.options.verbose) {
-				this.log(`Embedding plugin generator ${chalk.yellow(generator.name)}...`);
+				this.logger.debug(`Embedding plugin generator ${chalk.yellow(generator.name)}...`);
 			}
 			const generatorZIP = new AdmZip();
 			const addLocalFile = (file) => {
 				const filePath = path.join(generator.name, path.relative(generatorPath, file));
 				generatorZIP.addLocalFile(file, path.dirname(filePath), path.basename(filePath));
 				if (this.options.verbose) {
-					this.log(`  + file: ${file}`);
+					this.logger.debug(`  + file: ${file}`);
 				}
 			};
 			glob.sync(`${generatorPath}/*`, { nodir: true, dot: true }).forEach(addLocalFile);
@@ -711,20 +734,22 @@ export default class EasyUI5Generator extends Generator {
 			const generatorZIPPath = path.join(__dirname, "../../plugins", `${generator.name}.zip`);
 			generatorZIP.writeZip(generatorZIPPath);
 			if (this.options.verbose) {
-				this.log(`Stored plugin generator ${chalk.yellow(generator.name)} zip to "${generatorZIPPath}"!`);
+				this.logger.ok(`Stored plugin generator ${chalk.yellow(generator.name)} zip to "${generatorZIPPath}"!`);
 			}
 		}
 	}
 
 	end() {
 		if (this.config.get("initrepo")) {
-			this.spawnCommandSync("git", ["init", "--quiet"], {
+			// yeoman-generator v8+: `spawnSync` is the arg-array variant;
+			// `spawnCommandSync` would parse a single shell string instead.
+			this.spawnSync("git", ["init", "--quiet"], {
 				cwd: this.destinationPath(),
 			});
-			this.spawnCommandSync("git", ["add", "."], {
+			this.spawnSync("git", ["add", "."], {
 				cwd: this.destinationPath(),
 			});
-			this.spawnCommandSync("git", ["commit", "--quiet", "--allow-empty", "-m", "Initial commit"], {
+			this.spawnSync("git", ["commit", "--quiet", "--allow-empty", "-m", "Initial commit"], {
 				cwd: this.destinationPath(),
 			});
 		}

package/generators/app/log.js

@@ -0,0 +1,90 @@
+// Tagged logger used across the easy-ui5 runtime.
+//
+// Each call is prefixed with a fixed-width category tag (`[INFO ]`, `[WARN ]`,
+// `[ERROR]`, `[OK   ]`, `[DEBUG]`) so messages line up in the user's terminal.
+// The tag is coloured by severity; the message body is passed through
+// untouched so existing call sites that already paint individual words with
+// chalk keep working.
+//
+// Routing follows POSIX conventions: `ERROR` and `WARN` go to stderr, everything
+// else to stdout. `DEBUG` is suppressed unless `verbose` is enabled.
+//
+// The logger takes its colorizer (chalk-like) and its sinks by injection so
+// tests can render deterministically and capture output without monkey-patching
+// globals.
+
+const TAG_WIDTH = 5; // longest tag name: "DEBUG" / "ERROR"
+
+const LEVELS = {
+	debug: { name: "DEBUG", colour: "gray", stream: "stdout" },
+	info: { name: "INFO", colour: "cyan", stream: "stdout" },
+	ok: { name: "OK", colour: "green", stream: "stdout" },
+	warn: { name: "WARN", colour: "yellow", stream: "stderr" },
+	error: { name: "ERROR", colour: "red", stream: "stderr" },
+};
+
+function pad(name) {
+	return name.padEnd(TAG_WIDTH, " ");
+}
+
+/**
+ * Build a tagged logger.
+ *
+ * @param {object} [opts]
+ * @param {object} [opts.chalk] chalk-like colorizer. When omitted the logger
+ *   renders without ANSI escapes — handy for tests / non-TTY pipes.
+ * @param {boolean} [opts.verbose] Include DEBUG messages when true. Off by default.
+ * @param {(s:string)=>void} [opts.stdout] Stdout sink. Defaults to writing to `process.stdout` with a trailing newline.
+ * @param {(s:string)=>void} [opts.stderr] Stderr sink. Defaults to writing to `process.stderr` with a trailing newline.
+ */
+export function createLogger(opts = {}) {
+	const chalk = opts.chalk;
+	const verbose = !!opts.verbose;
+	const stdout = opts.stdout ?? ((line) => process.stdout.write(`${line}\n`));
+	const stderr = opts.stderr ?? ((line) => process.stderr.write(`${line}\n`));
+
+	function colour(name, text) {
+		const fn = chalk?.[name];
+		return typeof fn === "function" ? fn(text) : text;
+	}
+
+	function format(levelKey, message) {
+		const lvl = LEVELS[levelKey];
+		const tag = `[${pad(lvl.name)}]`;
+		const colouredTag = colour(lvl.colour, tag);
+		return `${colouredTag} ${message}`;
+	}
+
+	function emit(levelKey, message) {
+		if (levelKey === "debug" && !verbose) return;
+		const lvl = LEVELS[levelKey];
+		const sink = lvl.stream === "stderr" ? stderr : stdout;
+		sink(format(levelKey, message));
+	}
+
+	return {
+		debug(...args) {
+			emit("debug", args.join(" "));
+		},
+		info(...args) {
+			emit("info", args.join(" "));
+		},
+		ok(...args) {
+			emit("ok", args.join(" "));
+		},
+		warn(...args) {
+			emit("warn", args.join(" "));
+		},
+		error(...args) {
+			emit("error", args.join(" "));
+		},
+		/**
+		 * Print a line WITHOUT a category tag. Use for cosmetic output such as
+		 * the welcome banner, headers, and the "verbose context" dump where a
+		 * `[INFO]` prefix would just add noise.
+		 */
+		plain(...args) {
+			stdout(args.join(" "));
+		},
+	};
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "generator-easy-ui5",
-  "version": "3.9.1",
+  "version": "3.10.0",
   "description": "Generator for UI5-based project",
   "main": "generators/app/index.js",
   "type": "module",
@@ -9,18 +9,23 @@
     "plugins"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=20.19"
   },
   "scripts": {
-    "prepublishOnly": "npx yo@5.1.0 ./generators/app/index.js project --embed",
+    "embed": "npx yo@7.0.1 ./generators/app/index.js project --embed",
     "start": "yo easy-ui5 project",
     "test": "mocha",
     "test:subgen:list": "yo easy-ui5 project --list",
     "test:subgen:start": "yo easy-ui5 project app",
-    "release:changelog": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",
-    "postversion": "npm run release:changelog && git commit --all --amend --no-edit",
+    "changeset": "changeset",
+    "changeset:auto": "node ./scripts/auto-changeset.mjs",
+    "changeset:empty": "changeset --empty",
+    "changeset:status": "changeset status --since=origin/main",
+    "version-packages": "changeset version && npm install --package-lock-only --ignore-scripts",
+    "release-publish": "changeset publish",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
+    "lint:ci": "eslint . --max-warnings 0",
     "lint:staged": "lint-staged",
     "format": "prettier --write .",
     "format:staged": "pretty-quick --staged --verbose",
@@ -49,38 +54,42 @@
   "homepage": "https://github.com/ui5-community/generator-easy-ui5#readme",
   "dependencies": {
     "@octokit/plugin-throttling": "^11.0.3",
+    "@octokit/request": "^10.0.10",
     "@octokit/rest": "^22.0.1",
-    "adm-zip": "^0.5.16",
+    "adm-zip": "^0.5.17",
     "chalk": "^5.6.2",
-    "colors": "^1.4.0",
-    "glob": "^13.0.0",
-    "libnpmconfig": "^1.2.1",
+    "glob": "^13.0.6",
     "node-fetch": "^3.3.2",
-    "rimraf": "^6.1.2",
-    "yeoman-environment": "^5.1.2",
-    "yeoman-generator": "^7.5.1",
-    "yosay": "^3.0.0"
+    "rimraf": "^6.1.3",
+    "yeoman-environment": "^6.1.0",
+    "yeoman-generator": "^8.2.2"
   },
   "devDependencies": {
+    "@changesets/changelog-github": "^0.7.0",
+    "@changesets/cli": "^2.31.0",
     "@commitlint/cli": "^20.2.0",
     "@commitlint/config-conventional": "^20.2.0",
-    "conventional-changelog-cli": "^5.0.0",
-    "cz-conventional-changelog": "^3.3.0",
-    "eslint": "^9.39.2",
-    "fs-extra": "^11.3.3",
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.5.0",
+    "eslint-plugin-n": "^18.1.0",
+    "eslint-plugin-security": "^4.0.1",
+    "fs-extra": "^11.3.5",
+    "globals": "^17.6.0",
     "husky": "^9.1.7",
-    "lint-staged": "^16.2.7",
-    "mocha": "^11.7.5",
-    "npm-run-all": "^4.1.5",
-    "prettier": "^3.7.4",
+    "lint-staged": "^16.4.0",
+    "mocha": "^11.7.6",
+    "prettier": "^3.8.4",
     "pretty-quick": "^4.2.2",
     "yeoman-assert": "^3.1.1",
-    "yeoman-test": "^11.2.0"
+    "yeoman-test": "^11.6.0",
+    "yosay": "^3.0.0"
   },
-  "config": {
-    "commitizen": {
-      "path": "cz-conventional-changelog"
-    }
+  "overrides": {
+    "serialize-javascript": "^7.0.5",
+    "diff": "^8.0.3",
+    "conventional-commits-parser": "^6.4.0",
+    "js-yaml": "^4.2.0",
+    "tar": "^7.5.16"
   },
   "commitlint": {
     "extends": [