
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
@savvy-web/commitlint
Advanced tools
Dynamic, intelligent commitlint configuration with auto-detection of DCO, workspace scopes, and versioning strategies.
A commitlint config factory that reads your repo and builds the right rules — DCO requirements, workspace scopes, and versioning strategy included. No per-project configuration needed.
ai, release and tdd commit types beyond conventional commitssavvy-commitnpm install -D @savvy-web/commitlint @commitlint/cli @commitlint/config-conventional husky
// commitlint.config.ts
import { CommitlintConfig } from "@savvy-web/commitlint";
export default CommitlintConfig.silk();
Or use the static configuration without auto-detection:
// commitlint.config.ts
export { default } from "@savvy-web/commitlint/static";
Set up your project with the CLI:
npx savvy-commit init
This package ships a companion Claude Code plugin that keeps AI agents on the right side of your commit conventions:
# Add the Savvy Web plugin marketplace (one-time setup)
/plugin marketplace add savvy-web/systems
# Install the commitlint plugin for this project
/plugin install commitlint@savvy-web-systems --scope project
Once installed, the plugin:
gh.rm, curl, git push --force, package installers, gh repo delete, gh secret, etc.) are never auto-allowed.git commit and gh pr create|edit, denying messages that contain markdown headers or code fences, or that conflict with your signing config (--no-gpg-sign while commit.gpgsign=true).Closes/Fixes/Resolves trailers when the branch encodes a ticket id.--amend fix.For configuration options, API reference and usage details, see docs/.
FAQs
Dynamic, intelligent commitlint configuration with auto-detection of DCO, workspace scopes, and versioning strategies.
The npm package @savvy-web/commitlint receives a total of 757 weekly downloads. As such, @savvy-web/commitlint popularity was classified as not popular.
We found that @savvy-web/commitlint demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.