
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Automate semantic releases based on conventional commits. Similar to semantic-release but much simpler.
Autorel is a fast, simple, and reliable tool for automating releases based on commit messages. Similar to semantic-release or release-please, but faster, more reliable, and easier to use. Use autorel to save time, prevent broken releases, and ship with confidence.
npx autorel@^2 --pre-release alpha --publish --run 'echo "Next version is ${NEXT_VERSION}"'
It follows Conventional Commits and Semantic Versioning to automatically:
Designed for GitHub Actions and npm, but you can use custom commands for other platforms (or contribute built-in support).
✅ Conventional Commit & SemVer Compliant
🔒 Safe & Reliable
🚀 Fast & Lightweight
The simplest way to get started is using npx (no installation required):
First, test what would happen:
npx autorel@^2 --dry-run --verbose
This shows you what version would be released and what changes would be made, without actually doing anything.
When ready, run for real:
npx autorel@^2 --publish
This will automatically:
--publish is set)Note: When using
npx, append the version number (e.g.,@^2) to prevent breaking changes in future versions.
⚠️ Before publishing: Make sure you're authenticated with npm (see Authentication & Permissions). If no commits require a release, autorel will exit successfully without making any changes.
When autorel runs, it follows this sequence:
preRun scripts (tests, builds, etc.) if configured--skip-release)--publish is setrun scripts with NEXT_VERSION and NEXT_TAG environment variablesIf your commits don't include any that trigger a release (e.g., only docs: or style: commits), autorel will:
This is expected behavior and not an error.
If this is your first release (no previous tags exist), autorel will:
0.0.0 as the base versionfix: → 0.0.1 (patch)feat: → 0.1.0 (minor)feat!: or breaking change → 1.0.0 (major)Note: The version in your package.json is not used for version calculation—only git tags are considered.
If any step fails, autorel will:
Use --dry-run to test before running for real.
autorel --publish --run 'aws s3 sync dist/ s3://my-bucket/${NEXT_VERSION}/'
This will:
You can configure autorel in two ways, and you can use both together:
1. CLI Arguments - Pass options directly via command-line flags
2. YAML Configuration File - Create a .autorel.yaml file in your project root
Priority: CLI arguments override YAML settings. You can set defaults in .autorel.yaml and override them with CLI flags when needed.
Create a .autorel.yaml file in your project root:
# Define the branches and their respective channels
branches:
- {name: 'main'}
- {name: 'next', preRelease: 'next'}
# Enable publishing to npm
publish: true
# Run custom script after publish
run: |
echo "$(date +"%Y-%m-%d") ${NEXT_VERSION}" >> versions.txt
aws s3 sync dist/ s3://my-bucket/${NEXT_VERSION}/
Note: The YAML file must be named
.autorel.yamland placed in the root of your project. CLI arguments override YAML settings. See Configuration Options for all available settings.
Release a specific version regardless of commit messages:
autorel --use-version 2.0.0 --publish
Run tests and build before releasing, then deploy to S3 after:
autorel --pre-run 'npm test && npm run build' --publish --run 'aws s3 sync dist/ s3://my-bucket/${NEXT_VERSION}/'
Skip GitHub release but publish to npm and build Docker image:
autorel --publish --skip-release --run 'docker build -t myapp:${NEXT_VERSION} .'
Enable verbose logging to debug release issues:
autorel --verbose --publish --run 'echo "Published ${NEXT_VERSION}"'
Autorel works seamlessly with GitHub Actions. Here's a complete workflow example:
name: Release
on:
push:
branches: [main, alpha, beta]
jobs:
release:
name: Release
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
fetch-tags: true
- uses: actions/setup-node@v4
with:
node-version: latest
registry-url: "https://registry.npmjs.org"
cache: 'npm'
- run: npx autorel@^2
env:
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
❗️ Required: You must set
fetch-depth: 0andfetch-tags: trueinactions/checkout@v4(or later) or autorel will not work correctly. This ensures autorel can analyze the full git history.
❗️ For npm publishing: You must be authenticated with npm. See the npm authentication guide for setup instructions.
--run with the version in GitHub ActionsWhen passing $NEXT_VERSION or $NEXT_TAG in your --run command, wrap the --run argument in single quotes so the shell doesn't expand the variable before autorel has a chance to set it:
- run: npx autorel@^2 --publish --run 'deploy-service $NEXT_VERSION'
With single quotes, $NEXT_VERSION is passed as a literal string to autorel. Autorel sets the environment variable and then executes your command in a sub-shell where it resolves correctly.
⚠️ Do not use double quotes around the
--runargument — the shell would expand$NEXT_VERSIONto an empty string before autorel runs.
You can also use .autorel.yaml or a wrapper script (e.g. --run "./deploy.sh"); they run in a shell where the version is already set, so $NEXT_VERSION / $NEXT_TAG work as usual.
To create releases on GitHub, autorel needs a GitHub token:
GITHUB_TOKEN is automatically provided (no setup needed)GITHUB_TOKEN environment variable or use --github-token flagrepo (to create releases)To publish packages to npm, you need authentication:
npm loginNODE_AUTH_TOKEN environment variable to your npm tokenpublish (at minimum)When using npm publishing, autorel:
package.json version in memorypackage.json to the original version (even if publish fails)--run)Important: Package.json is restored before post-release scripts run. If your post-release script needs the new version in package.json (e.g., for Docker builds), you have two options:
Option 1: Use environment variables (recommended)
autorel --publish --run 'docker build -t myapp:${NEXT_VERSION} .'
Option 2: Update package.json in your script
autorel --publish --run 'npm version ${NEXT_VERSION} --no-git-tag-version && docker build -t myapp:${NEXT_VERSION} .'
Why this approach?
package.json is only needed for npm publishingThe NEXT_VERSION and NEXT_TAG environment variables are always available in your --run scripts.
Autorel automatically determines version bumps and generates changelogs by parsing your commit messages. Your commits must follow the Conventional Commits specification.
Here are examples of commit messages and the resulting version bump (using default configuration):
fix: fix a bug → 0.0.1 (patch)feat: add new feature → 0.1.0 (minor)feat!: add breaking change → 1.0.0 (major)By default, the following commit types trigger releases:
feat: minor version bumpfix, perf, revert: patch version bump! after the type (e.g., feat!:) or BREAKING CHANGE:/BREAKING CHANGES: in the footer: major version bumpOther commit types (like docs, style, refactor, test, build, ci) don't trigger releases but are included in changelogs.
See the default configuration for the complete mapping, or customize it in your .autorel.yaml file. Learn more about Conventional Commits.
Autorel is designed to work with any CI/CD system, not just GitHub Actions. You can use it with GitLab, Bitbucket, Jenkins, or any other system that supports running shell commands and meets our system requirements.
Simply use the --skip-release flag (or skipRelease: true in YAML) to skip creating a release on GitHub. Then, use the --run flag (or run: string in YAML) to run any command or script after the version bump with the new version number available as an environment variable (NEXT_VERSION or NEXT_TAG).
Example:
autorel --skip-release --run 'echo "Version ${NEXT_VERSION} released"'
If you're interested in contributing built-in support for other systems, please open an issue or PR.
Autorel is designed to work with any language or platform. You can use it with Python, Ruby, Go, Java, or any other language.
Simply omit the --publish flag (or set publish: false in YAML, which is the default) to skip publishing to npm. Then, use the --run flag (or run: string in YAML) to run any command or script after the version bump.
Example:
# Docker build using the version from environment variable
autorel --run 'docker build -t myapp:${NEXT_VERSION} . && docker push myapp:${NEXT_VERSION}'
Note: If you're using --publish, package.json is restored to the original version before --run scripts execute. Use the NEXT_VERSION environment variable (as shown above) rather than reading from package.json.
If you're interested in contributing built-in support for other package managers, please open an issue or PR.
You can use autorel programmatically in your Node.js projects.
npm i autorel
import {autorel, defaultConfig} from 'autorel';
const autorelConfig = {
...defaultConfig,
publish: true,
};
autorel(autorelConfig).then((nextVersion) => {
console.log(`Next version is ${nextVersion}`); // e.g., "Next version is 1.0.1"
});
When used as a library, you pass the configuration directly to the autorel function. It will not automatically load any default configuration—you can use the defaultConfig object to get the default configuration:
import {autorel, defaultConfig} from 'autorel';
autorel(defaultConfig).then((nextVersion) => {
console.log(`Next version is ${nextVersion}`);
});
TypeScript types are available. You can find the type definitions at src/index.ts or import them directly:
import type {Config, CommitType} from 'autorel';
The NEXT_VERSION and NEXT_TAG environment variables are available in:
run scripts (after release is complete)preRun scripts (version not yet determined)Note: Package.json is restored to the original version before run scripts execute. If you need the new version in package.json for your script, use the environment variables or update package.json manually in your script.
Example:
# Using environment variable (package.json will have old version)
autorel --run 'echo "Published ${NEXT_VERSION}" && docker build -t myapp:${NEXT_VERSION} .'
# If you need package.json to have the new version:
autorel --run 'npm version ${NEXT_VERSION} --no-git-tag-version && docker build -t myapp:${NEXT_VERSION} .'
This means autorel analyzed your commits and determined none of them require a release. This is not an error—autorel exits successfully.
Common causes:
release: 'none' in your configurationSolution: Make commits that trigger releases (e.g., feat:, fix:, or commits with ! for breaking changes).
npm authentication:
# Test locally
npm whoami
# If not logged in:
npm login
# Or set token:
export NODE_AUTH_TOKEN=your_token_here
GitHub authentication:
# Test token
export GITHUB_TOKEN=your_token_here
# Verify it works
curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/user
GitHub Actions: Make sure GITHUB_TOKEN and NODE_AUTH_TOKEN are set in your workflow's env section.
If you see "tag already exists" error:
Solution:
git tag -d v1.0.0 && git push origin :refs/tags/v1.0.0autorel --use-version 1.0.1If the GitHub release was created but npm publish failed:
--use-version to avoid creating a new release)preRun scripts only run if:
If your preRun isn't running, check:
--dry-run? (preRun doesn't run in dry-run)--verboseIf autorel calculated the wrong version:
commitTypes configuration (if customized)--dry-run --verbose to see which commits were analyzedAlways test before running in CI:
# See what would happen
npx autorel@^2 --dry-run --verbose
# Test with a specific version
npx autorel@^2 --dry-run --use-version 1.0.0 --verbose
# Test authentication
npm whoami # for npm
export GITHUB_TOKEN=your_token && npx autorel@^2 --dry-run # for GitHub
main — all tests must pass.FAQs
Automate semantic releases based on conventional commits. Similar to semantic-release but much simpler.
The npm package autorel receives a total of 81 weekly downloads. As such, autorel popularity was classified as not popular.
We found that autorel demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.