
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@bonvoy/plugin-conventional
Advanced tools
Conventional commits plugin for bonvoy
Analyzes conventional commit messages to automatically determine semantic version bumps for your packages.
conventional-commits-parserfeat!: syntax and BREAKING CHANGE: footernpm install @bonvoy/plugin-conventional
This plugin is included by default in bonvoy, so you typically don't need to install it separately.
The plugin works out of the box with the Angular preset:
// bonvoy.config.js
export default {
plugins: [
'@bonvoy/plugin-conventional', // Uses Angular preset by default
],
};
// bonvoy.config.js
export default {
plugins: [
['@bonvoy/plugin-conventional', {
preset: 'conventional', // 'angular' | 'conventional' | 'atom' | 'custom'
types: {
// Only used when preset: 'custom'
feat: 'minor',
fix: 'patch',
breaking: 'major',
perf: 'patch',
}
}]
],
};
| Type | Bump | Example |
|---|---|---|
feat | minor | feat: add new API endpoint |
fix | patch | fix: resolve memory leak |
perf | patch | perf: optimize database queries |
feat! | major | feat!: remove deprecated API |
BREAKING CHANGE | major | Any commit with BREAKING CHANGE: in body |
Breaking changes can be indicated in two ways:
feat!: remove old APIBREAKING CHANGE: in the bodyfeat: add new authentication system
BREAKING CHANGE: The old auth API has been removed.
Use the new `authenticate()` method instead.
git commit -m "feat: add user authentication" # → minor bump
git commit -m "fix: resolve login bug" # → patch bump
git commit -m "feat!: remove legacy API" # → major bump
git commit -m "perf: optimize queries" # → patch bump
git commit -m "docs: update README" # → no bump
git commit -m "chore: update dependencies" # → no bump
git commit -m "style: fix formatting" # → no bump
git commit -m "test: add unit tests" # → no bump
feat → minorfix → patchperf → patchfeat → minorfix → patchperf → patch:sparkles: → minor:bug: → patch:racehorse: → patchDefine your own commit types and their corresponding bumps.
The plugin automatically filters commits based on the files they modify, ensuring each package only gets bumped for relevant changes.
# This commit only affects @myorg/core
git commit -m "feat(core): add new feature" packages/core/src/feature.ts
# This commit affects both packages
git commit -m "feat: add shared utility" packages/core/src/util.ts packages/cli/src/util.ts
import ConventionalPlugin from '@bonvoy/plugin-conventional';
interface ConventionalConfig {
preset?: 'angular' | 'conventional' | 'atom' | 'custom';
types?: Record<string, SemverBump>;
}
const plugin = new ConventionalPlugin({
preset: 'angular',
types: {
feat: 'minor',
fix: 'patch',
}
});
MIT
FAQs
🚢 Conventional commits plugin for bonvoy
We found that @bonvoy/plugin-conventional demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.