inline-sql-toolkit 0.4.9 → 0.4.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +21 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,26 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.4.10 - 2026-09-19
|
|
4
|
+
|
|
5
|
+
- CI: the npm publish job is now OIDC-only. The dormant `NPM_TOKEN` path that was
|
|
6
|
+
kept for the one-time 0.4.7 bootstrap is gone, so a stray token secret can no
|
|
7
|
+
longer silently take precedence over trusted publishing — one did, and it would
|
|
8
|
+
have expired a week later. npm exchanges the GitHub OIDC token for a
|
|
9
|
+
short-lived publish credential and attaches provenance attestations, matching
|
|
10
|
+
the setup already used by `sql-template-formatter`.
|
|
11
|
+
- Documentation: `docs/releasing.md` now records the bootstrap as a one-time
|
|
12
|
+
local publish that is needed only for a brand-new package name: install with
|
|
13
|
+
`bun install --frozen-lockfile --ignore-scripts`, build with `bun run build`,
|
|
14
|
+
then `npm publish`. It also states that dispatching the workflow can no longer
|
|
15
|
+
verify OIDC, because the publish is skipped when the version is already on npm:
|
|
16
|
+
the next release is the first real test of the credential exchange.
|
|
17
|
+
- Documentation: the tarball check now requires `dist/cli.js` and
|
|
18
|
+
`dist/package.json` together: the latter marks `dist/` as CommonJS, and 0.4.7
|
|
19
|
+
shipped without it, so the published CLI died with the error
|
|
20
|
+
`module is not defined in ES module scope`.
|
|
21
|
+
- No formatting behavior changes and no code changes: this release is publish
|
|
22
|
+
workflow and release-documentation only.
|
|
23
|
+
|
|
3
24
|
## 0.4.9 - 2026-09-18
|
|
4
25
|
|
|
5
26
|
- CI: the Open VSX publish step now retries up to four times with a 30-second
|