inline-sql-toolkit 0.4.8 → 0.4.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +36 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,41 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.4.10 - 2026-09-19
|
|
4
|
+
|
|
5
|
+
- CI: the npm publish job is now OIDC-only. The dormant `NPM_TOKEN` path that was
|
|
6
|
+
kept for the one-time 0.4.7 bootstrap is gone, so a stray token secret can no
|
|
7
|
+
longer silently take precedence over trusted publishing — one did, and it would
|
|
8
|
+
have expired a week later. npm exchanges the GitHub OIDC token for a
|
|
9
|
+
short-lived publish credential and attaches provenance attestations, matching
|
|
10
|
+
the setup already used by `sql-template-formatter`.
|
|
11
|
+
- Documentation: `docs/releasing.md` now records the bootstrap as a one-time
|
|
12
|
+
local publish that is needed only for a brand-new package name: install with
|
|
13
|
+
`bun install --frozen-lockfile --ignore-scripts`, build with `bun run build`,
|
|
14
|
+
then `npm publish`. It also states that dispatching the workflow can no longer
|
|
15
|
+
verify OIDC, because the publish is skipped when the version is already on npm:
|
|
16
|
+
the next release is the first real test of the credential exchange.
|
|
17
|
+
- Documentation: the tarball check now requires `dist/cli.js` and
|
|
18
|
+
`dist/package.json` together: the latter marks `dist/` as CommonJS, and 0.4.7
|
|
19
|
+
shipped without it, so the published CLI died with the error
|
|
20
|
+
`module is not defined in ES module scope`.
|
|
21
|
+
- No formatting behavior changes and no code changes: this release is publish
|
|
22
|
+
workflow and release-documentation only.
|
|
23
|
+
|
|
24
|
+
## 0.4.9 - 2026-09-18
|
|
25
|
+
|
|
26
|
+
- CI: the Open VSX publish step now retries up to four times with a 30-second
|
|
27
|
+
pause between attempts instead of failing the release on the first response.
|
|
28
|
+
Open VSX answers 503 intermittently and can even fail the request after
|
|
29
|
+
accepting the upload; `--skip-duplicate` makes a retry harmless in that case,
|
|
30
|
+
because an already-published version reports success.
|
|
31
|
+
- CI: the npm publish job is now idempotent. Re-running the workflow to retry
|
|
32
|
+
the marketplaces (for example after an Open VSX 503) no longer turns the npm
|
|
33
|
+
job red: it asks the registry whether the version is already published and
|
|
34
|
+
skips both publish steps when it is, so the retry cannot fail with "cannot
|
|
35
|
+
publish over the previously published versions".
|
|
36
|
+
- No formatting behavior changes and no code changes: this release is publish
|
|
37
|
+
workflow robustness only.
|
|
38
|
+
|
|
3
39
|
## 0.4.8 - 2026-09-17
|
|
4
40
|
|
|
5
41
|
### Fixed
|