node-publisher 3.4.0 → 3.4.2

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+### v3.4.0 (2026-02-13)
+
+#### Pull requests
+
+- [#67](https://github.com/zendesk/node-publisher/pull/67) Fix missing method ([Sune Simonsen](mailto:sune@we-knowhow.dk))
+- [#66](https://github.com/zendesk/node-publisher/pull/66) Fix dependency security vulnerabilities ([Daria Radu](mailto:daria.radu@zendesk.com), [Sune Simonsen](mailto:sune@we-knowhow.dk))
+
+#### Commits to master
+
+- [v3.4.0](https://github.com/zendesk/node-publisher/commit/b8dd1babc44b361d1362ccfef4df1f67c8b21738) ([Sune Simonsen](mailto:sune@we-knowhow.dk))
+- [Small readme tweaks](https://github.com/zendesk/node-publisher/commit/76d1195a305dc59d5d69f0b5d2b68aa86fab1ca8) ([Sune Simonsen](mailto:sune@we-knowhow.dk))
+- [Add CODEOWNERS file with team @zendesk\/guide \(\#65\)](https://github.com/zendesk/node-publisher/commit/641ae99cec9acc2857984ea986b31975d6c43f29) ([zd-svc-gha-ci-platform](mailto:zd-svc-gha-ci-platform@zendesk.com))
+- [Update changelog](https://github.com/zendesk/node-publisher/commit/d293180673485aa8cb4e97cef18b1d78c9034841) ([Sune Simonsen](mailto:sune@we-knowhow.dk))
+
 ### v3.3.0 (2025-09-03)
 
 #### Pull requests

package/README.md

@@ -174,9 +174,21 @@ yarn
 
 ## Release a new version
 
-```sh
-yarn release <version>
-```
+`node-publisher` is published to npm from CI via the [`npm publish`](.github/workflows/npm-publish.yml) GitHub Actions workflow. Publishing is **tokenless** — it uses [npm trusted publishing](https://docs.npmjs.com/trusted-publishers) over GitHub OIDC, so no npm token or local npm login is required.
+
+1. **Bump the version in a PR.** Run `yarn version <patch|minor|major>` (this edits the `version` field in `package.json`; it does not create a commit or tag), or edit the field by hand. Commit, open a PR, and merge to `master`.
+2. **Publish.** Go to **Actions → npm publish → Run workflow** and run it against `master`. The workflow builds the package and runs `yarn npm publish` to the Zendesk npmjs org, authenticating via OIDC.
+
+> **Note:** publishing is restricted to the required reviewers configured on the `npm-publish` GitHub environment. Only those admins can approve and run a release.
+
+**Prerequisites:**
+
+- The `npm-publish` GitHub environment must exist on the repository (managed via #ask-packaging). The `NPM_TOKEN` and `NPM_TOTP_DEVICE` secrets are only needed for the one-time trusted-publisher setup below, not for regular publishes.
+- The `version` in `package.json` must be higher than the latest version already on [npmjs.com](https://www.npmjs.com/package/node-publisher) — npm rejects re-publishing an existing version.
+
+**First-time setup (once per package):**
+
+Before the first OIDC publish, the trusted publisher must be registered on npm. After the `npm-publish` environment and its `NPM_TOKEN`/`NPM_TOTP_DEVICE` secrets exist, run **Actions → npm trusted publishing → Run workflow** against `master` once. This registers this repository, the `npm-publish.yml` workflow, and the `npm-publish` environment with npm. After it succeeds, all releases publish tokenlessly via step 2 above.
 
 # Contributing
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-publisher",
-  "version": "3.4.0",
+  "version": "3.4.2",
   "description": "A configurable release automation tool inspired by create-react-app and Travis CI.",
   "author": "Attila Večerek <avecerek@zendesk.com>",
   "homepage": "https://github.com/zendesk/node-publisher#readme",
@@ -14,6 +14,7 @@
   "main": "src/index.js",
   "bin": "./bin/node-publisher",
   "scripts": {
+    "build": "echo 'no build step required'",
     "coverage": "jest --coverage",
     "lint": "eslint src/**/*.js bin/**",
     "lint-staged": "lint-staged",
@@ -22,14 +23,18 @@
     "travis": "yarn lint && yarn test"
   },
   "resolutions": {
-    "tmp": "^0.2.4",
-    "form-data": "^3.0.4"
+    "tmp": "^0.2.6",
+    "form-data": "^3.0.5",
+    "lodash": "^4.18.1",
+    "flatted": "^3.4.2",
+    "filelist/minimatch": "^5.1.9",
+    "brace-expansion": "^1.1.13"
   },
   "dependencies": {
     "check-node-version": "3.2.0",
     "commander": "2.15.1",
     "inquirer": "6.5.0",
-    "js-yaml": "4.1.1",
+    "js-yaml": "4.3.0",
     "offline-github-changelog": "4.0.0",
     "semver": "7.7.2"
   },
@@ -79,6 +84,6 @@
       "git add"
     ]
   },
-  "packageManager": "yarn@1.22.21",
+  "packageManager": "yarn@4.17.1",
   "pre-commit": "lint-staged"
-}
+}

package/.github/CODEOWNERS

@@ -1,4 +0,0 @@
-# CODEOWNERS file
-# This file defines who should review code changes in this repository.
-
-* @zendesk/guide

package/.github/workflows/actions.yml

@@ -1,19 +0,0 @@
-name: repo-checks
-on: [push]
-jobs:
-  main:
-    name: yarn-simple
-    runs-on: ubuntu-latest
-    steps:
-    - uses: zendesk/checkout@v2
-    - name: Read .nvmrc
-      run: echo "##[set-output name=NVMRC;]$(cat .nvmrc)"
-      id: node-read-nvmrc
-    - uses: zendesk/setup-node@v2.1.2
-      with:
-        node-version: "${{ steps.node-read-nvmrc.outputs.NVMRC }}"
-    - name: yarn test
-      run: |
-        yarn install
-        yarn travis
-