
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@metamask/create-release-branch
Advanced tools
An interactive command-line tool to prepare a release branch by automatically bumping versions and updating changelogs for desired packages. Works for both polyrepos and monorepos.
This is an interactive command-line tool that automates steps involved in preparing a new release of a project. These steps include updating versions of one or more desired packages, adding a new section to the packages' changelogs to include changes since the previous release, and then creating a new branch from which a pull request can be submitted for review before the release goes live.
Note At the moment, this tool only supports monorepos that use an independent versioning strategy. Support for other types of projects is planned in a future release.
Add this tool as a development dependency to your project:
yarn add --dev @metamask/create-release-branch
or:
npm install --save-dev @metamask/create-release-branch
For more on how to use this tool, please see the docs.
nvm use will automatically choose the right node version for you..nvmrc) is intentionally higher than version used for consumption (as engines in package.json), as we have not fully phased out legacy versions of Node from our products yet.yarn install to install dependencies and run any required post-install scriptsRun yarn test to run the tests once. To run tests on file changes, run yarn test:watch.
Run yarn lint to run the linter, or run yarn lint:fix to run the linter and fix any automatically fixable issues.
The project follows the same release process as the other libraries in the MetaMask organization. The GitHub Actions action-create-release-pr and action-publish-release are used to automate the release process; see those repositories for more information about how they work.
Choose a release version.
If this release is backporting changes onto a previous release, then ensure there is a major version branch for that version (e.g. 1.x for a v1 backport release).
v1.0.2 release, you'd want to ensure there was a 1.x branch that was set to the v1.0.1 tag.Trigger the workflow_dispatch event manually for the Create Release Pull Request action to create the release PR.
action-create-release-pr workflow to create the release PR.Update the changelog to move each change entry into the appropriate change category (See here for the full list of change categories, and the correct ordering), and edit them to be more easily understood by users of the package.
yarn auto-changelog validate --rc --prettier to check that the changelog is correctly formatted.Review and QA the release.
Squash & Merge the release.
action-publish-release workflow to tag the final release commit and publish the release on GitHub.Publish the release on npm.
publish-release GitHub Action workflow to finish. This should trigger a second job (publish-npm), which will wait for a run approval by the npm publishers team.publish-npm job (or ask somebody on the npm publishers team to approve it for you).publish-npm job has finished, check npm to verify that it has been published.If you are working on a pull request and want to test changes in another project before you publish them, you can create a preview build and then configure your project to use it.
@metamaskbot publish-preview. This starts the publish-preview GitHub action, which will create a preview build and publish it to NPM.@metamask-previews instead of @metamask.1.2.3-preview-e2df9b4 instead of 1.2.3.To use a preview build within a project, you need to override the resolution logic for your package manager so that the "production" version of that package is replaced with the preview version. Here's how you do that:
package.json in the project and locate the entry for this package in dependencies.resolutions; if you're using NPM or any other package manager, this is overrides.resolutions:
"@metamask/create-release-branch@^1.2.3": "npm:@metamask-previews/create-release-branch@1.2.3-preview-abcdefg"
resolutions:
"@metamask/create-release-branch": "npm:@metamask-previews/create-release-branch@1.2.3-preview-abcdefg"
overrides:
"@metamask/create-release-branch": "npm:@metamask-previews/create-release-branch@1.2.3-preview-abcdefg"
yarn install.If you make more changes to your pull request and want to create a new preview build:
@metamaskbot comment on the pull request and wait for the response.package.json. Make sure to re-run yarn install!FAQs
An interactive command-line tool to prepare a release branch by automatically bumping versions and updating changelogs for desired packages. Works for both polyrepos and monorepos.
The npm package @metamask/create-release-branch receives a total of 1,931 weekly downloads. As such, @metamask/create-release-branch popularity was classified as popular.
We found that @metamask/create-release-branch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.