release-it 19.0.3 → 19.0.5

package/README.md

@@ -146,26 +146,32 @@ remote.
 
 → See [Git][29] for more details.
 
+## npmjs.com Releases
+
+As of July 2025, GitHub and GitLab CI workflows can now use npm's [Trusted Publishing][30] OpenID Connect (OIDC)
+integration for secure, token-free publishing from CI/CD. This eliminates long-lived tokens and automatically generates
+provenance attestations. See [docs/npm.md][31] for details.
+
 ## GitHub Releases
 
 GitHub projects can have releases attached to Git tags, containing release notes and assets. There are two ways to add
-[GitHub releases][30] in your release-it flow:
+[GitHub releases][32] in your release-it flow:
 
 1. Automated (requires a `GITHUB_TOKEN`)
 2. Manual (using the GitHub web interface with pre-populated fields)
 
-→ See [GitHub Releases][31] for more details.
+→ See [GitHub Releases][33] for more details.
 
 ## GitLab Releases
 
 GitLab projects can have releases attached to Git tags, containing release notes and assets. To automate [GitLab
-releases][32]:
+releases][34]:
 
 - Configure `gitlab.release: true`
-- Obtain a [personal access token][33] (release-it needs the `api` and `self_rotate` scopes).
-- Make sure the token is [available as an environment variable][34].
+- Obtain a [personal access token][35] (release-it needs the `api` and `self_rotate` scopes).
+- Make sure the token is [available as an environment variable][36].
 
-→ See [GitLab Releases][35] for more details.
+→ See [GitLab Releases][37] for more details.
 
 ## Changelog
 
@@ -185,7 +191,7 @@ message conventions. Plugins are available for:
 
 To print the changelog without releasing anything, add the `--changelog` flag.
 
-→ See [Changelog][36] for more details.
+→ See [Changelog][38] for more details.
 
 ## Publish to npm
 
@@ -200,7 +206,7 @@ With release-it, it's easy to create pre-releases: a version of your software th
 it's not in the stable semver range yet. Often "alpha", "beta", and "rc" (release candidate) are used as identifiers for
 pre-releases. An example pre-release version is `2.0.0-beta.0`.
 
-→ See [Manage pre-releases][37] for more details.
+→ See [Manage pre-releases][39] for more details.
 
 ## Update or re-run existing releases
 
@@ -230,7 +236,7 @@ Use the optional `:plugin` part in the middle to hook into a life cycle method e
 The core plugins include `version`, `git`, `npm`, `github`, `gitlab`.
 
 Note that hooks like `after:git:release` will not run when either the `git push` failed, or when it is configured not to
-be executed (e.g. `git.push: false`). See [execution order][38] for more details on execution order of plugin lifecycle
+be executed (e.g. `git.push: false`). See [execution order][40] for more details on execution order of plugin lifecycle
 methods.
 
 All commands can use configuration variables (like template strings). An array of commands can also be provided, they
@@ -280,7 +286,7 @@ Using Inquirer.js inside custom hook scripts might cause issues (since release-i
 
 Use `--dry-run` to show the interactivity and the commands it _would_ execute.
 
-→ See [Dry Runs][39] for more details.
+→ See [Dry Runs][41] for more details.
 
 ## Troubleshooting & debugging
 
@@ -298,51 +304,51 @@ Since v11, release-it can be extended in many, many ways. Here are some plugins:
 | ----------------------------------------- | ------------------------------------------------------------------------------------------- |
 | [@release-it/bumper][26]                  | Read & write the version from/to any file                                                   |
 | [@release-it/conventional-changelog][27]  | Provides recommended bump, conventional-changelog, and updates `CHANGELOG.md`               |
-| [@release-it/keep-a-changelog][40]        | Maintain CHANGELOG.md using the Keep a Changelog standards                                  |
-| [@release-it-plugins/lerna-changelog][41] | Integrates lerna-changelog into the release-it pipeline                                     |
-| [@jcamp-code/release-it-changelogen][42]  | Use [@unjs/changelogen][43] for versioning and changelog                                    |
-| [@release-it-plugins/workspaces][44]      | Releases each of your projects configured workspaces                                        |
+| [@release-it/keep-a-changelog][42]        | Maintain CHANGELOG.md using the Keep a Changelog standards                                  |
+| [@release-it-plugins/lerna-changelog][43] | Integrates lerna-changelog into the release-it pipeline                                     |
+| [@jcamp-code/release-it-changelogen][44]  | Use [@unjs/changelogen][45] for versioning and changelog                                    |
+| [@release-it-plugins/workspaces][46]      | Releases each of your projects configured workspaces                                        |
 | [release-it-calver-plugin][28]            | Enables Calendar Versioning (calver) with release-it                                        |
-| [@grupoboticario/news-fragments][45]      | An easy way to generate your changelog file                                                 |
-| [@j-ulrich/release-it-regex-bumper][46]   | Regular expression based version read/write plugin for release-it                           |
-| [@jcamp-code/release-it-dotnet][47]       | Use .csproj or .props file for versioning, automate NuGet publishing                        |
-| [release-it-pnpm][16]                     | Add basic support for pnpm workspaces, integrates with [bumpp][48] and [changelogithub][49] |
-| [changesets-release-it-plugin][50]        | Combine [Changesets][51] changelog management with release-it                               |
+| [@grupoboticario/news-fragments][47]      | An easy way to generate your changelog file                                                 |
+| [@j-ulrich/release-it-regex-bumper][48]   | Regular expression based version read/write plugin for release-it                           |
+| [@jcamp-code/release-it-dotnet][49]       | Use .csproj or .props file for versioning, automate NuGet publishing                        |
+| [release-it-pnpm][16]                     | Add basic support for pnpm workspaces, integrates with [bumpp][50] and [changelogithub][51] |
+| [changesets-release-it-plugin][52]        | Combine [Changesets][53] changelog management with release-it                               |
+| [release-it-gitea][54]                    | Gitea plugin to create Gitea releases and upload attachments                                |
 
 Internally, release-it uses its own plugin architecture (for Git, GitHub, GitLab, npm).
 
-→ See all [release-it plugins on npm][52].
+→ See all [release-it plugins on npm][55].
 
-→ See [plugins][53] for documentation to write plugins.
+→ See [plugins][56] for documentation to write plugins.
 
 ## Use release-it programmatically
 
 While mostly used as a CLI tool, release-it can be used as a dependency to integrate in your own scripts. See [use
-release-it programmatically][54] for example code.
+release-it programmatically][57] for example code.
 
 ## Projects using release-it
 
-- [AdonisJs][55]
-- [Axios][56]
-- [Cal.com][57]
-- [Ember CLI][58]
-- [Halo][59]
-- [hosts][60]
-- [js-cookie][61]
-- [jQuery][62]
-- [Madge][63]
-- [Metalsmith][64]
-- [Node-Redis][65]
-- [React Native Paper][66]
-- [Readability.js][67]
-- [Redux][68]
-- [Saleor][69]
-- [Semantic UI React][70]
-- [Shepherd][71]
-- [Tabler][72] + [tabler-icons][73]
-- Swagger ([swagger-ui][74] + [swagger-editor][75])
-- [Repositories that depend on release-it][76]
-- GitHub search for [path:\*\*/.release-it.json][77]
+- [AdonisJs][58]
+- [Axios][59]
+- [Chakra UI][60]
+- [Halo][61]
+- [hosts][62]
+- [js-cookie][63]
+- [jQuery][64]
+- [Madge][65]
+- [Metalsmith][66]
+- [n8n][67]
+- [Node-Redis][68]
+- [React Native Paper][69]
+- [Readability.js][70]
+- [Redux][71]
+- [Saleor][72]
+- [Semantic UI React][73]
+- [tabler-icons][74]
+- Swagger ([swagger-ui][75] + [swagger-editor][76])
+- [Repositories that depend on release-it][77]
+- GitHub search for [path:\*\*/.release-it.json][78]
 
 ## Node.js version support
 
@@ -356,17 +362,17 @@ The latest major version is v19, supporting Node.js 20 and up:
 |    v16     |   v16   |
 |    v15     |   v14   |
 
-Also see [CHANGELOG.md][78] for dates and details.
+Also see [CHANGELOG.md][79] for dates and details.
 
 ## Links
 
-- See [CHANGELOG.md][78] for major/breaking updates, and [releases][79] for a detailed version history.
-- To **contribute**, please read [CONTRIBUTING.md][80] first.
-- Please [open an issue][81] if anything is missing or unclear in this documentation.
+- See [CHANGELOG.md][79] for major/breaking updates, and [releases][80] for a detailed version history.
+- To **contribute**, please read [CONTRIBUTING.md][81] first.
+- Please [open an issue][82] if anything is missing or unclear in this documentation.
 
 ## License
 
-[MIT][82]
+[MIT][83]
 
 Are you using release-it at work? Please consider [sponsoring me][14]!
 
@@ -399,56 +405,57 @@ Are you using release-it at work? Please consider [sponsoring me][14]!
 [27]: https://github.com/release-it/conventional-changelog
 [28]: https://github.com/casmith/release-it-calver-plugin
 [29]: ./docs/git.md
-[30]: https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases
-[31]: ./docs/github-releases.md
-[32]: https://docs.gitlab.com/api/releases/
-[33]: https://gitlab.com/profile/personal_access_tokens
-[34]: ./docs/environment-variables.md
-[35]: ./docs/gitlab-releases.md
-[36]: ./docs/changelog.md
-[37]: ./docs/pre-releases.md
-[38]: ./docs/plugins.md#execution-order
-[39]: ./docs/dry-runs.md
-[40]: https://github.com/release-it/keep-a-changelog
-[41]: https://github.com/release-it-plugins/lerna-changelog
-[42]: https://github.com/jcamp-code/release-it-changelogen
-[43]: https://github.com/unjs/changelogen
-[44]: https://github.com/release-it-plugins/workspaces
-[45]: https://github.com/grupoboticario/news-fragments
-[46]: https://github.com/j-ulrich/release-it-regex-bumper
-[47]: https://github.com/jcamp-code/release-it-dotnet
-[48]: https://github.com/antfu/bumpp
-[49]: https://github.com/antfu/changelogithub
-[50]: https://www.npmjs.com/package/changesets-release-it-plugin
-[51]: https://github.com/changesets/changesets
-[52]: https://www.npmjs.com/search?q=keywords:release-it-plugin
-[53]: ./docs/plugins.md
-[54]: ./docs/recipes/programmatic.md
-[55]: https://github.com/adonisjs/core
-[56]: https://github.com/axios/axios
-[57]: https://github.com/calcom/cal.com
-[58]: https://github.com/ember-cli/ember-cli
-[59]: https://github.com/halo-dev/halo
-[60]: https://github.com/StevenBlack/hosts
-[61]: https://github.com/js-cookie/js-cookie
-[62]: https://github.com/jquery/jquery
-[63]: https://github.com/pahen/madge
-[64]: https://github.com/metalsmith/metalsmith
-[65]: https://github.com/redis/node-redis
-[66]: https://github.com/callstack/react-native-paper
-[67]: https://github.com/mozilla/readability
-[68]: https://github.com/reduxjs/redux
-[69]: https://github.com/saleor/saleor
-[70]: https://github.com/Semantic-Org/Semantic-UI-React
-[71]: https://github.com/shipshapecode/shepherd
-[72]: https://github.com/tabler/tabler
-[73]: https://github.com/tabler/tabler-icons
-[74]: https://github.com/swagger-api/swagger-ui
-[75]: https://github.com/swagger-api/swagger-editor
-[76]: https://github.com/release-it/release-it/network/dependents
-[77]: https://github.com/search?q=path%3A**%2F.release-it.json&type=code
-[78]: ./CHANGELOG.md
-[79]: https://github.com/release-it/release-it/releases
-[80]: ./.github/CONTRIBUTING.md
-[81]: https://github.com/release-it/release-it/issues/new
-[82]: ./LICENSE
+[30]: https://docs.npmjs.com/trusted-publishers
+[31]: ./docs/npm.md#trusted-publishing-oidc
+[32]: https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases
+[33]: ./docs/github-releases.md
+[34]: https://docs.gitlab.com/api/releases/
+[35]: https://gitlab.com/profile/personal_access_tokens
+[36]: ./docs/environment-variables.md
+[37]: ./docs/gitlab-releases.md
+[38]: ./docs/changelog.md
+[39]: ./docs/pre-releases.md
+[40]: ./docs/plugins.md#execution-order
+[41]: ./docs/dry-runs.md
+[42]: https://github.com/release-it/keep-a-changelog
+[43]: https://github.com/release-it-plugins/lerna-changelog
+[44]: https://github.com/jcamp-code/release-it-changelogen
+[45]: https://github.com/unjs/changelogen
+[46]: https://github.com/release-it-plugins/workspaces
+[47]: https://github.com/grupoboticario/news-fragments
+[48]: https://github.com/j-ulrich/release-it-regex-bumper
+[49]: https://github.com/jcamp-code/release-it-dotnet
+[50]: https://github.com/antfu/bumpp
+[51]: https://github.com/antfu/changelogithub
+[52]: https://www.npmjs.com/package/changesets-release-it-plugin
+[53]: https://github.com/changesets/changesets
+[54]: https://github.com/lib-pack/release-it-gitea
+[55]: https://www.npmjs.com/search?q=keywords:release-it-plugin
+[56]: ./docs/plugins.md
+[57]: ./docs/recipes/programmatic.md
+[58]: https://github.com/adonisjs/core
+[59]: https://github.com/axios/axios
+[60]: https://github.com/chakra-ui/chakra-ui
+[61]: https://github.com/halo-dev/halo
+[62]: https://github.com/StevenBlack/hosts
+[63]: https://github.com/js-cookie/js-cookie
+[64]: https://github.com/jquery/jquery
+[65]: https://github.com/pahen/madge
+[66]: https://github.com/metalsmith/metalsmith
+[67]: https://github.com/n8n-io/n8n
+[68]: https://github.com/redis/node-redis
+[69]: https://github.com/callstack/react-native-paper
+[70]: https://github.com/mozilla/readability
+[71]: https://github.com/reduxjs/redux
+[72]: https://github.com/saleor/saleor
+[73]: https://github.com/Semantic-Org/Semantic-UI-React
+[74]: https://github.com/tabler/tabler-icons
+[75]: https://github.com/swagger-api/swagger-ui
+[76]: https://github.com/swagger-api/swagger-editor
+[77]: https://github.com/release-it/release-it/network/dependents
+[78]: https://github.com/search?q=path%3A**%2F.release-it.json&type=code
+[79]: ./CHANGELOG.md
+[80]: https://github.com/release-it/release-it/releases
+[81]: ./.github/CONTRIBUTING.md
+[82]: https://github.com/release-it/release-it/issues/new
+[83]: ./LICENSE

package/lib/config.js

@@ -4,9 +4,8 @@ import { isCI } from 'ci-info';
 import defaultsDeep from '@nodeutils/defaults-deep';
 import { isObjectStrict } from '@phun-ky/typeof';
 import merge from 'lodash.merge';
-import get from 'lodash.get';
 import { loadConfig as loadC12 } from 'c12';
-import { getSystemInfo, readJSON } from './util.js';
+import { get, getSystemInfo, readJSON } from './util.js';
 
 const debug = util.debug('release-it:config');
 const defaultConfig = readJSON(new URL('../config/release-it.json', import.meta.url));

package/lib/plugin/Plugin.js

@@ -1,6 +1,6 @@
 import { debug } from 'node:util';
 import merge from 'lodash.merge';
-import get from 'lodash.get';
+import { get } from '../util.js';
 
 class Plugin {
   static isEnabled() {

package/lib/plugin/github/GitHub.js

@@ -178,7 +178,7 @@ class GitHub extends Release {
       baseUrl,
       auth: `token ${this.token}`,
       userAgent: `release-it/${pkg.version}`,
-      log: this.config.isDebug ? console : null,
+      log: this.config.isDebug ? console : {},
       request: {
         timeout
       }

package/lib/util.js

@@ -179,3 +179,28 @@ export const pick = (object, keys) => {
     return obj;
   }, {});
 };
+
+const parsePath = path => {
+  const result = [];
+  const regex = /[^.[\]]+|\[(?:(\d+)|["'](.+?)["'])\]/g;
+  let match;
+
+  while ((match = regex.exec(path)) !== null) {
+    result.push(match[1] ?? match[2] ?? match[0]);
+  }
+
+  return result;
+};
+
+export const get = (obj, path, defaultValue = undefined) => {
+  if (!path || typeof path !== 'string') {
+    return defaultValue;
+  }
+
+  try {
+    const keys = parsePath(path);
+    return keys.reduce((acc, key) => acc?.[key], obj) ?? defaultValue;
+  } catch {
+    return defaultValue;
+  }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-it",
-  "version": "19.0.3",
+  "version": "19.0.5",
   "description": "Generic CLI tool to automate versioning and package publishing-related tasks.",
   "keywords": [
     "build",
@@ -79,48 +79,47 @@
   "license": "MIT",
   "dependencies": {
     "@nodeutils/defaults-deep": "1.1.0",
-    "@octokit/rest": "21.1.1",
-    "@phun-ky/typeof": "1.2.8",
+    "@octokit/rest": "22.0.0",
+    "@phun-ky/typeof": "2.0.3",
     "async-retry": "1.3.3",
-    "c12": "3.0.4",
-    "ci-info": "^4.2.0",
-    "eta": "3.5.0",
+    "c12": "3.3.0",
+    "ci-info": "^4.3.0",
+    "eta": "4.0.1",
     "git-url-parse": "16.1.0",
-    "inquirer": "12.6.3",
+    "inquirer": "12.9.6",
     "issue-parser": "7.0.1",
-    "lodash.get": "4.4.2",
     "lodash.merge": "4.6.2",
     "mime-types": "3.0.1",
     "new-github-release-url": "2.0.0",
-    "open": "10.1.2",
-    "ora": "8.2.0",
+    "open": "10.2.0",
+    "ora": "9.0.0",
     "os-name": "6.1.0",
     "proxy-agent": "6.5.0",
     "semver": "7.7.2",
-    "tinyglobby": "0.2.14",
-    "undici": "6.21.2",
+    "tinyglobby": "0.2.15",
+    "undici": "6.21.3",
     "url-join": "5.0.0",
     "wildcard-match": "5.1.4",
     "yargs-parser": "21.1.1"
   },
   "devDependencies": {
-    "@eslint/compat": "1.2.9",
+    "@eslint/compat": "1.3.2",
     "@eslint/eslintrc": "3.3.1",
-    "@eslint/js": "9.27.0",
-    "@octokit/request-error": "6.1.8",
-    "@types/node": "20.17.32",
-    "eslint": "9.27.0",
-    "eslint-plugin-import-x": "4.13.3",
-    "globals": "16.2.0",
+    "@eslint/js": "9.35.0",
+    "@octokit/request-error": "7.0.0",
+    "@types/node": "24.5.2",
+    "eslint": "9.35.0",
+    "eslint-plugin-import-x": "4.16.1",
+    "globals": "16.4.0",
     "installed-check": "9.3.0",
-    "knip": "5.59.1",
+    "knip": "5.63.1",
     "mentoss": "0.11.0",
     "mock-stdio": "1.0.3",
-    "prettier": "3.5.3",
+    "prettier": "3.6.2",
     "remark-cli": "12.0.1",
     "remark-preset-webpro": "1.1.1",
     "tar": "7.4.3",
-    "typescript": "5.8.3"
+    "typescript": "5.9.2"
   },
   "overrides": {
     "pac-resolver": "7.0.1",

package/test/utils.js

@@ -3,7 +3,7 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import { stripVTControlCharacters } from 'node:util';
 import mockStdIo from 'mock-stdio';
-import { format, truncateLines, parseGitUrl, parseVersion } from '../lib/util.js';
+import { format, truncateLines, parseGitUrl, parseVersion, get } from '../lib/util.js';
 
 test('format', () => {
   assert.equal(format('release v${version}', { version: '1.0.0' }), 'release v1.0.0');
@@ -96,3 +96,50 @@ test('parseVersion', () => {
   assert.deepEqual(parseVersion('1.0.0-next.1'), { version: '1.0.0-next.1', isPreRelease: true, preReleaseId: 'next' });
   assert.deepEqual(parseVersion('21.04.1'), { version: '21.04.1', isPreRelease: false, preReleaseId: null });
 });
+
+const sample = {
+  root: {
+    level1: {
+      level2: {
+        value: 'nested'
+      },
+      array: [
+        { id: 1, data: 'first' },
+        { id: 2, data: 'second' }
+      ],
+      'key.with.dot': {
+        special: true
+      }
+    },
+    mixed: [{ deep: { value: 100 } }, { deep: { value: 200 } }]
+  }
+};
+
+test('get: accesses a simple nested property', () => {
+  assert.equal(get(sample, 'root.level1.level2.value'), 'nested');
+});
+
+test('get: accesses array elements by index', () => {
+  assert.equal(get(sample, 'root.level1.array[0].data'), 'first');
+  assert.equal(get(sample, 'root.level1.array[1].id'), 2);
+});
+
+test('get: accesses keys with dots using bracket notation', () => {
+  assert.equal(get(sample, 'root.level1["key.with.dot"].special'), true);
+});
+
+test('get: navigates mixed objects and arrays', () => {
+  assert.equal(get(sample, 'root.mixed[0].deep.value'), 100);
+  assert.equal(get(sample, 'root.mixed[1].deep.value'), 200);
+});
+
+test('get: returns default value for non-existent properties', () => {
+  assert.equal(get(sample, 'root.level1.unknown', 'default'), 'default');
+  assert.equal(get(sample, 'root.level1.array[10].id', null), null);
+});
+
+test('get: handles empty path and null/undefined objects', () => {
+  assert.equal(get(sample, '', 'default'), 'default');
+  assert.equal(get(null, 'any.path', 'default'), 'default');
+  assert.equal(get(undefined, 'any.path', 'default'), 'default');
+});