Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
conventional-changelog-cli
Advanced tools
The conventional-changelog-cli package is a command-line tool that helps automate the process of generating changelogs based on conventional commit messages. It follows the Conventional Commits specification, which is a standardized way of writing commit messages that makes it easier to create automated tools for versioning and changelog generation.
Generate Changelog
This command generates a changelog based on the Angular preset and writes it to the CHANGELOG.md file. The '-s' flag ensures that the file is saved.
npx conventional-changelog -p angular -i CHANGELOG.md -s
Generate Changelog for a Specific Release
This command generates a changelog for the last two releases based on the Angular preset and writes it to the CHANGELOG.md file.
npx conventional-changelog -p angular -i CHANGELOG.md -s -r 2
Generate Changelog for a Specific Commit Range
This command generates a changelog for commits in a specific path or range and writes it to the CHANGELOG.md file.
npx conventional-changelog -p angular -i CHANGELOG.md -s --commit-path ./path/to/commits
standard-version is a tool for versioning and changelog generation based on conventional commit messages. It automates the process of version bumping, changelog generation, and Git tagging. Compared to conventional-changelog-cli, standard-version provides a more integrated approach to version management and release automation.
semantic-release automates the whole package release workflow including determining the next version number, generating the changelog, and publishing the package. It uses the commit messages to determine the type of changes in the codebase. Compared to conventional-changelog-cli, semantic-release offers a more comprehensive solution for continuous delivery and release management.
release-it is a versatile CLI tool for automating versioning and package publishing. It supports conventional changelog generation and can be extended with plugins for additional functionality. Compared to conventional-changelog-cli, release-it provides a more flexible and extensible approach to release automation.
Generate a changelog from git metadata
Note You don't have to use the angular commit convention. For the best result of the tool to tokenize your commit and produce flexible output, it's recommended to use a commit convention.
$ npm install -g conventional-changelog-cli
$ cd my-project
$ conventional-changelog -p angular -i CHANGELOG.md -s
This will not overwrite any previous changelogs. The above generates a changelog based on commits since the last semver tag that matches the pattern of "Feature", "Fix", "Performance Improvement" or "Breaking Changes".
If this is your first time using this tool and you want to generate all previous changelogs, you could do
$ conventional-changelog -p angular -i CHANGELOG.md -s -r 0
This will overwrite any previous changelogs if they exist.
All available command line parameters can be listed using CLI: conventional-changelog --help
.
Hint: You can alias your command or add it to your package.json. EG: "changelog": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0"
.
To fully customize the tool, please checkout conventional-changelog and conventional-changelog-core docs. You can find more details there. Note: config
here can work with preset
, which is different than options.config
in conventional-changelog.
package.json
conventionalChangelog
package.json
and CHANGELOG.md
filesThe reason why you should commit and tag after conventionalChangelog
is that the CHANGELOG should be included in the new release, hence gitRawCommitsOpts.from
defaults to the latest semver tag.
npm version
Using the npm scripts to our advantage with the following hooks:
{
"scripts": {
"version": "conventional-changelog -p angular -i CHANGELOG.md -s && git add CHANGELOG.md"
}
}
You could follow the following workflow
npm version [patch|minor|major]
commandYou could optionally add a preversion
script to package your project or running a full suit of test.
And a postversion
script to clean your system and push your release and tags.
By adding a .npmrc
you could also automate your commit message and set your tag prefix as such:
tag-version-prefix=""
message="chore(release): %s :tada:"
Please use conventional-changelog
MIT © Steve Mao
FAQs
Generate a changelog from git metadata.
We found that conventional-changelog-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.