
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Generate Beautiful Changelogs using Conventional Commits
Generate a changelog in Markdown format and display in the console:
npx changegear@latest
Generate a changelog, bump the version in package.json and update CHANGELOG.md (without commit):
npx changegear@latest --bump
Bump the version, update CHANGELOG.md and make a git commit and tag:
npx changegear@latest --release
npx changegear@latest [...args] [--dir <dir>]
Arguments:
--from: Start commit reference. When not provided, latest git tag will be used as default.--to: End commit reference. When not provided, latest commit in HEAD will be used as default.--dir: Path to git repository. When not provided, current working directory will be used as as default.--clean: Determine if the working directory is clean and if it is not clean, exit.--output: Changelog file name to create or update. Defaults to CHANGELOG.md and resolved relative to dir. Use --no-output to write to console only.--bump: Determine semver change and update version in package.json.--release. Bumps version in package.json and creates commit and git tags using local git. You can disable commit using --no-commit and tag using --no-tag. You can enable the automatic push of the new tag and release commit to your git repository by adding --push.--publish. Publishes package as a new version on npm. You will need to set authorisation tokens separately via .npmrc or environment variables.--publishTag Use custom npm tag for publishing (Default is latest)--nameSuffix: Adds suffix to package name (Example: --nameSuffix canary renames foo to foo-canary)--versionSuffix: Adds suffix to package version. When set without value or to true, uses date + commit hash as commit--canary. Shortcut to --bump --versionSuffix (--nameSuffix will be also added if arg has a string value).-r: Release as specific version.--major: Bump as a semver-major version--minor: Bump as a semver-minor version--patch: Bump as a semver-patch version--premajor: Bump as a semver-premajor version, can set id with string.--preminor: Bump as a semver-preminor version, can set id with string.--prepatch: Bump as a semver-prepatch version, can set id with string.--prerelease: Bump as a semver-prerelease version, can set id with string.changegear gh releaseChangelogen has built-in functionality to sync with with Github releases.
In order to manually sync a release, you can use changegear gh release. It will parse current CHANGELOG.md from current repository (local, then remote) and create or update releases.
Usage:
npx changegear@latest gh release [all|versions...] [--dir] [--token]
To enable this integration, make sure there is a valid repository field in package.json or repo is set in .changelogenrc.
By default in unauthenticated mode, changegear will open a browser link to make manual release. By providing github token, it can be automated.
.env, use CHANGELOGEN_TOKENS_GITHUB or GITHUB_TOKEN or GH_TOKEN--token <token>tokens.github=<token> inside ~/.changlogenrcgh auth loginConfiguration is loaded by unjs/c12 from cwd. You can use either changelog.config.json, changelog.config.{ts,js,mjs,cjs}, .changelogrc or use the changelog field in package.json.
See ./src/config.ts for available options and defaults.
corepack enable (use npm i -g corepack for Node.js < 16.10)pnpm installpnpm devMade with 💛
Published under MIT License.
FAQs
Generate Beautiful Changelogs using Conventional Commits
The npm package changegear receives a total of 0 weekly downloads. As such, changegear popularity was classified as not popular.
We found that changegear demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.