
Security News
The Nightmare Before Deployment
Season’s greetings from Socket, and here’s to a calm end of year: clean dependencies, boring pipelines, no surprises.
@metamask/create-release-branch
Advanced tools
An interactive command-line tool to prepare a release branch by automatically bumping versions and updating changelogs for desired packages. Works for both polyrepos and monorepos.
This is an interactive command-line tool that automates steps involved in preparing a new release of a project. These steps include updating versions of one or more desired packages, adding a new section to the packages' changelogs to include changes since the previous release, and then creating a new branch from which a pull request can be submitted for review before the release goes live.
Note
At the moment, this tool only supports monorepos that use an independent versioning strategy. Support for other types of projects is planned in a future release.
Add this tool as a development dependency to your project:
yarn add --dev @metamask/create-release-branch
or:
npm install --save-dev @metamask/create-release-branch
For more on how to use this tool, please see the docs.
nvm use will automatically choose the right node version for you..nvmrc) is intentionally higher than version used for consumption (as engines in package.json), as we have not fully phased out legacy versions of Node from our products yet.yarn install to install dependencies and run any required post-install scriptsRun yarn test to run the tests once. To run tests on file changes, run yarn test:watch.
Run yarn lint to run the linter, or run yarn lint:fix to run the linter and fix any automatically fixable issues.
The project follows the same release process as the other libraries in the MetaMask organization. The GitHub Actions action-create-release-pr and action-publish-release are used to automate the release process; see those repositories for more information about how they work.
Choose a release version.
If this release is backporting changes onto a previous release, then ensure there is a major version branch for that version (e.g. 1.x for a v1 backport release).
v1.0.2 release, you'd want to ensure there was a 1.x branch that was set to the v1.0.1 tag.Trigger the workflow_dispatch event manually for the Create Release Pull Request action to create the release PR.
action-create-release-pr workflow to create the release PR.Update the changelog to move each change entry into the appropriate change category (See here for the full list of change categories, and the correct ordering), and edit them to be more easily understood by users of the package.
yarn auto-changelog validate --rc to check that the changelog is correctly formatted.Review and QA the release.
Squash & Merge the release.
action-publish-release workflow to tag the final release commit and publish the release on GitHub.Publish the release on npm.
publish-release GitHub Action workflow to finish. This should trigger a second job (publish-npm), which will wait for a run approval by the npm publishers team.publish-npm job (or ask somebody on the npm publishers team to approve it for you).publish-npm job has finished, check npm to verify that it has been published.FAQs
An interactive command-line tool to prepare a release branch by automatically bumping versions and updating changelogs for desired packages. Works for both polyrepos and monorepos.
The npm package @metamask/create-release-branch receives a total of 1,095 weekly downloads. As such, @metamask/create-release-branch popularity was classified as popular.
We found that @metamask/create-release-branch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Season’s greetings from Socket, and here’s to a calm end of year: clean dependencies, boring pipelines, no surprises.

Research
/Security News
Impostor NuGet package Tracer.Fody.NLog typosquats Tracer.Fody and its author, using homoglyph tricks, and exfiltrates Stratis wallet JSON/passwords to a Russian IP address.

Security News
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.