
Security News
/Research
npm Phishing Email Targets Developers with Typosquatted Domain
A phishing attack targeted developers using a typosquatted npm domain (npnjs.com) to steal credentials via fake login pages - watch out for similar scams.
eslint-release
Advanced tools
This release tool has been extracted from the ESLint project so that it can be shared among projects. While it's intended for use in ESLint organization projects, it is shared freely so others might use it as well.
Please note that while this project is shared freely, it is not intended to be a general-purpose utility. The functionality is highly specific to how ESLint projects handle releases and the project will remain very focused on this use case.
Warning: There are minimal tests for this project and the API is rapidly changing. Use at your own risk.
You can install the ESLint release tool using npm:
$ npm install eslint-release --save-dev
To start, you'll need to define two environment variables:
NPM_TOKEN
- a token to use for npm publish
. The token must be from a user that has permission to publish the package.ESLINT_GITHUB_TOKEN
- a token for a GitHub user that has repo
permission (used for posting release notes).The ESLint release tool is designed to be used on the command line and is divided into two phases: package generation and package publishing.
To generate a regular release:
$ eslint-generate-release
To generate a prerelease, you need to include the prerelease identifier:
$ eslint-generate-prerelease alpha
Both eslint-generate-release
and eslint-generate-prerelease
generate a new version and update the changelog but will not push back to GitHub or publish to npm. It will generate an npm package and a .eslint-release-info.json
file.
For both releases and prereleases, you can then publish the release:
$ eslint-publish-release
This command publishes the generate npm package and pushes the changes to GitHub. The .eslint-release-info.json
file is required for this step to work correctly.
You can optionally include the release tool in another Node.js script:
var ReleaseOps = require("eslint-release");
When you run the release tool for a regular release, the following steps take place:
npm test
to validate the releaseCHANGELOG.md
and commits the changesnpm version
to update the versionWhen you do a prerelease, the same steps are taken except that package is published to npm under the next
tag instead of latest
, and the GitHub release is marked as Pre-release.
This package exports two functions:
generateRelease(prereleaseId, packageTag)
- This corresponds to the CLI command eslint-generate-release
when prereleaseId
is undefined
, and the CLI command eslint-generate-prerelease prereleaseId
when prereleaseId
is a string value.publishRelease()
- This corresponds to the CLI command eslint-publish-release
.packageTag
is used as the --tag
value in the npm publish
command. It's also used to determine whether a regular release will be marked as Latest on GitHub: it will be marked as Latest only if packageTag
is "latest"
. This parameter is optional and defaults to "latest"
when prereleaseId
is undefined
, "next"
otherwise.
Publish a regular latest release:
const ReleaseOps = require("eslint-release");
ReleaseOps.generateRelease();
ReleaseOps.publishRelease();
Publish a regular release with maintenance
tag:
const ReleaseOps = require("eslint-release");
ReleaseOps.generateRelease(undefined, "maintenance");
ReleaseOps.publishRelease();
Publish an alpha
prerelease:
const ReleaseOps = require("eslint-release");
ReleaseOps.generateRelease("alpha");
ReleaseOps.publishRelease();
Issues and pull requests will be triaged and responded to as quickly as possible. We operate under the ESLint Contributor Guidelines, so please be sure to read them before contributing. If you're not sure where to dig in, check out the issues.
MIT License
Join our Chatroom
FAQs
ESLint Release Tools
The npm package eslint-release receives a total of 17,988 weekly downloads. As such, eslint-release popularity was classified as popular.
We found that eslint-release demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
A phishing attack targeted developers using a typosquatted npm domain (npnjs.com) to steal credentials via fake login pages - watch out for similar scams.
Security News
Knip hits 500 releases with v5.62.0, refining TypeScript config detection and updating plugins as monthly npm downloads approach 12M.
Security News
The EU Cyber Resilience Act is prompting compliance requests that open source maintainers may not be obligated or equipped to handle.