
Product
Introducing Socket Scanning for OpenVSX Extensions
Socket now scans OpenVSX extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.
@aurora-is-near/semantic-release-config
Advanced tools
A shareable Semantic Release configuration.
This repository enforces semantic commit messages. For more details and examples see the Conventional Commits Specification.
Install the package:
yarn add @aurora-is-near/semantic-release-config -D
As well as the peer dependencies:
yarn add semantic-release -D
Add the following to your semantic-release configuration file (e.g. .releaserc.json):
{
"extends": "@aurora-is-near/semantic-release-config"
}
By default this configuration uses the npm plugin to publish your code as a package.
If you do not want to release your code as a package add "private": true to
your package.json. This can be useful when we have a service (e.g. a website
or API) where we still want to take advantage of the tagging behaviour provided
by semantic release, just not deploy the code as an NPM or GitHub package.
This package is best used alongside commitlint and husky, in order to enforce the required commit message structure.
Install these packages with:
yarn add @commitlint/cli @commitlint/config-conventional husky -D
Create a file at commitlint.config.js with the following contents:
module.exports = {
extends: ['@commitlint/config-conventional'],
rules: { 'body-max-line-length': [0] },
};
And a file at .husky/commit-msg with the following contents:
npx --no -- commitlint --edit $1
And add a prepare script to your package.json:
npm pkg set scripts.prepare="husky"
The configuration sets previous-version and next-version
variables as
GitHub Actions outputs,
which can be useful for defining complex workflows.
FAQs
A shareable semantic release configuration
We found that @aurora-is-near/semantic-release-config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket now scans OpenVSX extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.

Product
Bringing supply chain security to the next generation of JavaScript package managers

Product
A safer, faster way to eliminate vulnerabilities without updating dependencies