versionary 1.5.0 → 1.6.0

package/dist/git/redact.d.ts

@@ -0,0 +1 @@
+export declare function redactCredentials(message: string): string;

package/dist/git/redact.js

@@ -0,0 +1,14 @@
+export function redactCredentials(message) {
+    let redacted = message.replace(/([a-z][a-z\d+.-]*:\/\/)[^\s/]*@/giu, "$1[REDACTED]@");
+    const tokens = [
+        process.env.VERSIONARY_PR_TOKEN,
+        process.env.GH_TOKEN,
+        process.env.GITHUB_TOKEN,
+    ].filter((token) => Boolean(token));
+    const secrets = new Set(tokens.flatMap((token) => [token, encodeURIComponent(token)]));
+    // Replace longer secrets first so an overlapping token cannot leave a suffix.
+    for (const secret of [...secrets].sort((a, b) => b.length - a.length)) {
+        redacted = redacted.replaceAll(secret, "[REDACTED]");
+    }
+    return redacted;
+}

package/dist/release/changelog.js

@@ -162,25 +162,25 @@ export function renderReleaseNotesSection(input, options = {}) {
         sections.push(trimmedHighlights, "");
     }
     if (grouped.breaking.length > 0) {
-        sections.push("### Breaking changes", ...grouped.breaking, "");
+        sections.push("### Breaking changes", "", ...grouped.breaking, "");
     }
     if (grouped.features.length > 0) {
-        sections.push("### Features", ...grouped.features, "");
+        sections.push("### Features", "", ...grouped.features, "");
     }
     if (grouped.fixes.length > 0) {
-        sections.push("### Bug Fixes", ...grouped.fixes, "");
+        sections.push("### Bug Fixes", "", ...grouped.fixes, "");
     }
     if (grouped.performance.length > 0) {
-        sections.push("### Performance Improvements", ...grouped.performance, "");
+        sections.push("### Performance Improvements", "", ...grouped.performance, "");
     }
     if (grouped.reverts.length > 0) {
-        sections.push("### Reverts", ...grouped.reverts, "");
+        sections.push("### Reverts", "", ...grouped.reverts, "");
     }
     if (input.dependencies && input.dependencies.length > 0) {
-        sections.push("### Dependencies", ...input.dependencies.map((dependency) => `- updated ${dependency.name} to v${dependency.version}`), "");
+        sections.push("### Dependencies", "", ...input.dependencies.map((dependency) => `- updated ${dependency.name} to v${dependency.version}`), "");
     }
     if (needsOtherChangesFallback(grouped, trimmedHighlights.length > 0, input.dependencies?.length ?? 0)) {
-        sections.push("### Other changes", ...grouped.other, "");
+        sections.push("### Other changes", "", ...grouped.other, "");
     }
     const body = [header, "", ...sections].join("\n").trimEnd();
     if (options.includeFooter) {

package/dist/release/pr.js

@@ -4,6 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { loadConfig } from "../config/load-config.js";
 import { ensureGitIdentity } from "../git/identity.js";
+import { redactCredentials } from "../git/redact.js";
 import { getScmClient } from "../scm/client.js";
 import { resolvePackageStrategyContext, resolveReleaseName, } from "../strategy/package-context.js";
 import { applyConfiguredArtifactRules } from "./artifact-rules.js";
@@ -985,10 +986,18 @@ export async function closeStaleReviewRequestIfExists(cwd = process.cwd(), optio
     return result;
 }
 export function pushReleaseBranch(cwd, branch) {
-    execFileSync("git", ["push", "--force-with-lease", "origin", branch], {
-        cwd,
-        stdio: ["ignore", "pipe", "ignore"],
-    });
+    try {
+        execFileSync("git", ["push", "--force-with-lease", "origin", branch], {
+            cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        // Captured stderr is included in the message. Do not retain the original
+        // error as a cause: its output buffers may contain credentials.
+        throw new Error(redactCredentials(message));
+    }
 }
 export function isReleaseCommitMessage(commitMessage) {
     if (/^Versionary-Release:\s*true$/imu.test(commitMessage)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "versionary",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Automatic release framework based on conventional commits and semantic versioning",
   "keywords": [
     "releasing",