
Security News
Security Community Slams MIT-linked Report Claiming AI Powers 80% of Ransomware
Experts push back on new claims about AI-driven ransomware, warning that hype and sponsored research are distorting how the threat is understood.
@squiz/dxp-ai-semantic-release-config
Advanced tools
Shared semantic-release configuration for DXP AI Tools
Shared semantic-release configuration for DXP AI Tools repository.
npm install --save-dev @squiz/dxp-ai-semantic-release-config
In your tool's package.json:
{
  "release": {
    "extends": "@squiz/dxp-ai-semantic-release-config"
  }
}
Or create a .releaserc.js:
module.exports = require('@squiz/dxp-ai-semantic-release-config');
RELEASE_STAGEControls which release stage to execute and determines git tag prefix:
feature: Creates alpha prerelease versions with feature-v tag prefixdevelopment: Creates dev prerelease versions with dev-v tag prefixstaging: Creates beta prerelease versions with stg-v tag prefixproduction (or unset): Creates stable versions with v tag prefixNPM_CONFIG_TAGControls the npm dist-tag for publishing:
alpha: Feature/alpha dist-tagdev: Development dist-tagstg: Staging dist-taglatest: Production dist-tag (default)| Environment | Branch | RELEASE_STAGE | NPM_CONFIG_TAG | Git Tag Format | Version Example | Use Case | 
|---|---|---|---|---|---|---|
| Feature | feature/* | feature | alpha | feature-v${version} | feature-v1.0.0-alpha.1 | Feature branch testing | 
| Development | develop | development | dev | dev-v${version} | dev-v1.0.0-dev.5 | Development environment | 
| Staging | main | staging | stg | stg-v${version} | stg-v1.0.0-beta.1 | Pre-production testing | 
| Production | main | production | latest | v${version} | v1.0.0 | Production releases | 
Different tag prefixes prevent conflicts between environments:
feature-v1.0.0-alpha.1dev-v1.0.0-dev.5stg-v1.0.0-beta.1v1.0.0This allows semantic-release to track releases independently across all environments.
staging:publish-tools:
  stage: staging-deploy
  variables:
    RELEASE_STAGE: staging
    NPM_CONFIG_TAG: stg
  script:
    - npm run publish-tools
production:publish-tools:
  stage: production-deploy
  variables:
    RELEASE_STAGE: production
    NPM_CONFIG_TAG: latest
  script:
    - npm run publish-tools
This config uses conventional commits for version bumping:
| Commit Type | Release Type | Example | 
|---|---|---|
| feat: | minor | feat: add new validation rule | 
| fix: | patch | fix: correct schema validation | 
| docs:(with README scope) | patch | docs(README): update examples | 
| refactor: | patch | refactor: simplify error handling | 
| style: | patch | style: format code | 
| test: | patch | test: add unit tests | 
| BREAKING CHANGE: | major | Any commit with BREAKING CHANGE:in body | 
Both staging and production can run on main branch without conflicts:
1. Push to main β Both pipelines trigger
2. Staging runs first:
   ββ RELEASE_STAGE=staging
   ββ Creates version: 1.0.0-beta.1
   ββ Creates tag: stg-v1.0.0-beta.1
   ββ Publishes: npm publish --tag stg
   ββ Success β
3. Production runs later:
   ββ RELEASE_STAGE=production
   ββ Ignores stg-v* tags
   ββ Creates version: 1.0.0
   ββ Creates tag: v1.0.0
   ββ Publishes: npm publish --tag latest
   ββ Success β
No conflict! Different tag prefixes keep them separate.
This config works with any npm-compatible registry. Registry configuration should be set in .npmrc:
# GitLab Package Registry
@squiz-ai-tool:registry=https://gitlab.squiz.net/api/v4/projects/17893/packages/npm/
//gitlab.squiz.net/api/v4/projects/17893/packages/npm/:_authToken=${CI_JOB_TOKEN}
ISC
FAQs
Shared semantic-release configuration for DXP AI Tools
The npm package @squiz/dxp-ai-semantic-release-config receives a total of 140 weekly downloads. As such, @squiz/dxp-ai-semantic-release-config popularity was classified as not popular.
We found that @squiz/dxp-ai-semantic-release-config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 74 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Experts push back on new claims about AI-driven ransomware, warning that hype and sponsored research are distorting how the threat is understood.

Security News
Ruby's creator Matz assumes control of RubyGems and Bundler repositories while former maintainers agree to step back and transfer all rights to end the dispute.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.