
Security News
RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.
@dvashim/changesets-gitlab
Advanced tools
[](https://www.npmjs.com/package/@dvashim/changesets-gitlab) [. If not set, read from the GitLab API
GITLAB_CI_USER_EMAIL # optional, default `gitlab[bot]@users.noreply.gitlab.com`
GITLAB_COMMENT_TYPE # optional, type of the comment. Defaults to `discussion`. Set to `note` for a simple comment instead of a thread
GITLAB_COMMENT_DISCUSSION_AUTO_RESOLVE # optional, auto-resolve discussion when changeset is present. If you want to always resolve, use `GITLAB_COMMENT_TYPE=note` instead. Default `true`
GITLAB_COMMENT_CUSTOM_LINKS # optional, override the links in the bot comment. Use {{ addChangesetUrl }} placeholder for the dynamic URL to add a changeset
GITLAB_ADD_CHANGESET_MESSAGE # optional, default commit message for adding changesets on GitLab Web UI
DEBUG_GITLAB_CREDENTIAL # optional, whether to log the remote URL with the token visible
Create a file at .gitlab-ci.yml with the following content.
stages:
- comment
- release
comment:
image: node:lts-alpine
stage: comment
before_script: pnpm install --frozen-lockfile
rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
script: pnpm changesets-gitlab comment
release:
image: node:lts-alpine
stage: release
before_script: pnpm install --frozen-lockfile
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
script: pnpm changesets-gitlab
You'll need an npm token that can publish the packages in the repo and doesn't have 2FA on publish enabled (2FA on auth can be enabled). Add it as a CI/CD variable with the name NPM_TOKEN.
stages:
- comment
- release
comment:
image: node:lts-alpine
stage: comment
before_script: pnpm install --frozen-lockfile
rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
script: pnpm changesets-gitlab comment
release:
image: node:lts-alpine
stage: release
before_script: pnpm install --frozen-lockfile
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
script: pnpm changesets-gitlab
variables:
INPUT_PUBLISH: pnpm release
By default, the CLI creates a ~/.npmrc file with the NPM_TOKEN interpolated as the auth token for registry.npmjs.org. If a .npmrc file already exists, it will not be overwritten. This is useful if you need to configure .npmrc yourself:
script: |
cat << EOF > "$HOME/.npmrc"
email=my@email.com
//registry.npmjs.org/:_authToken=$NPM_TOKEN
EOF
If you need to add additional logic to the version command, you can use a version script.
When the version script is present, the CLI will run that script instead of changeset version, so make sure your script calls changeset version at some point. All changes made by the script will be included in the MR.
stages:
- comment
- release
comment:
image: node:lts-alpine
stage: comment
before_script: pnpm install --frozen-lockfile
rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
script: pnpm changesets-gitlab comment
release:
image: node:lts-alpine
stage: release
before_script: pnpm install --frozen-lockfile
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
script: pnpm changesets-gitlab
variables:
INPUT_VERSION: pnpm version-packages
Detailed changes for each release are documented in CHANGELOG.md.
Originally created by JounQin at un-ts/changesets-gitlab.
FAQs
GitLab CI CLI for changesets — automate versioning, changelogs, and publishing via merge requests
The npm package @dvashim/changesets-gitlab receives a total of 24 weekly downloads. As such, @dvashim/changesets-gitlab popularity was classified as not popular.
We found that @dvashim/changesets-gitlab demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.