Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@rimac-technology/semantic-release-monorepo
Advanced tools
Enhanced semantic-release by enabling simplified and automatic package publishing in multi-package repositories
This project is a TypeScript-enhanced version of the original semantic-release-monorepo. It leverages TypeScript for improved type safety and includes updates to dependencies, codebase simplification, and support for ECMAScript Modules (ESM).
Ensure both semantic-release
and semantic-release-monorepo
are accessible in each package of your monorepo.
Install the package as a development dependency using yarn:
yarn add --dev @rimac-technology/semantic-release-monorepo
or npm:
npm install --dev @rimac-technology/semantic-release-monorepo
It is designed to integrate seamlessly with your current semantic-release workflow. Simply replace instances where you call the semantic-release CLI command with semantic-release-monorepo. For example, in your package.json's release script:
{
"scripts": {
"release": "semantic-release-monorepo"
}
}
Or, when using it in the CLI:
semantic-release-monorepo --extends @semantic-release/gitlab-config --dry-run
ℹ️ As the allowUnknownFlags is enabled, all flags will be passed to
internal semantic-release
call as options
argument.
This library modifies the context
object passed to semantic-release
plugins in the following way to make them compatible with
a monorepo.
Step | Description |
---|---|
analyzeCommits | Filters context.commits to only include the given monorepo package's commits. Additionally, it checks whether any workspace that has been modified in the commits is listed as a dependency, devDependency, or peerDependency of the current workspace, and includes those commits as well. |
generateNotes |
|
In more detail, this library runs the npm query .workspaces command to retrieve a list of all package.json
files across the workspaces in the monorepo.
It then checks if any commits from the last release have modified any workspace listed as a dependency, devDependency, or peerDependency for the current workspace.
If such modifications are found, those commits are included in the list of commits for the dependent workspace, even if the workspace itself was not directly changed.
To prevent version conflicts, git tags are created with a namespace that incorporates the name of the package, such as
my-package-name@1.0.1
. To change this default setting, specify a
tagFormat key in the .releaserc
.
⚠️ Remember, it's essential to choose a format that ensures each workspace/release is unique.
The .releaserc
configuration allows an optional processCommits
function, enabling you to define custom logic to include additional commits based on specific requirements.
This function provides flexibility for more advanced use cases where the default commit filtering behavior doesn't cover your needs.
The processCommits
function receives an array of CommitWithFilePaths
objects.
Each object contains the usual commit data, plus a filePaths
array listing all the file paths changed in the commit.
You can use this information to add custom conditions for determining whether certain commits should trigger a release.
For example, you may want to include specific commits based on custom file path patterns, metadata in commit messages, or some external conditions.
Imagine you have a monorepo and want to trigger a release not only when relevant files are changed but also based on specific commit messages or tags that are used for triggering feature-specific releases.
In the following example, the processCommits
function will include additional commits if they contain a specific tag in the commit message, such as [release:docs]
, to force a release for documentation updates:
export default {
branches: ['main'],
plugins: [
'@semantic-release/commit-analyzer',
'@semantic-release/release-notes-generator'
],
processCommits(commitsWithFilePaths) {
const customTriggerCommits = commitsWithFilePaths.filter((commit) => {
// Include commits with a specific tag in the message for custom releases
return commit.message.includes('[release:docs]') ||
commit.message.includes('[release:hotfix]');
});
// You can also perform additional checks based on file paths or other conditions
const filePathFilteredCommits = commitsWithFilePaths.filter((commitWithFilePath) => {
return commitWithFilePath.filePaths.some((filePath) =>
filePath.startsWith('docs/') || filePath.startsWith('hotfix/')
);
});
// Combine custom-triggered commits with those affected by file paths
return [...customTriggerCommits, ...filePathFilteredCommits];
},
}
FAQs
Enhanced semantic-release by enabling simplified and automatic package publishing in multi-package repositories
The npm package @rimac-technology/semantic-release-monorepo receives a total of 183 weekly downloads. As such, @rimac-technology/semantic-release-monorepo popularity was classified as not popular.
We found that @rimac-technology/semantic-release-monorepo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.