
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
generator-release
Advanced tools
Yeoman generator for handling Bower/NPM releases.
npm install -g yo generator-release
A config file, ~/.config/generator-release
, needs to be created. This is standard CommonJS module exporting github authentication options. The easiest way to configure the authentication is to go to the GitHub admin panel and create a Personal Access Token, then set it as the token
in your config.
Optionally the module may export a linkFilter
method that allows for parsing of links included in the body of notes issues and pull requests.
module.exports = {
auth: 'oauth',
token: 'GitHub OAuth token',
linkFilter: function(link) {
return /atlassian\.net/.test(link.url);
}
};
generator-release can work against GitHub enterprise hosts when defined in the hosts
key.
module.exports = {
auth: 'oauth',
token: 'GitHub OAuth token',
hosts: {
'my.host': {
token: 'Enterprise GitHub OAuth token',
apiUrl: 'https://my.host/api/v3'
}
}
};
When operating against a matching host, the entire object will be used to extend the base config object, allowing for any config object to be overridden per host. In the example above this is akin to _.extend(module.exports, module.exports.hosts['my.host'])
.
yo release:notes
Will generate a template for the release notes including:
This should be manually edited to ensure that only relevant content is display and any additional gotchas and upgrade concerns noted. If the $EDITOR
environment variable is setup the generator will automate the checkin of the updated notes.
Additional options:
--dry-run
— finds the changes that will be recorded and log to the console rather than disk.--rebuild
- specifes that we want to create notes for the existing versionyo release:release [major|minor|patch|prerelease]
Will increment the release version per the semver action passed in and tag and pushes to the upstream repository.
If publishing to npm the npm publish
command is still required.
The increment parameter is optional and not recommended if the release notes were just updated for the project.
Additional options:
--skip-tests
— skips tests (this is not recommended but can be used to work around environmental issues)yo release
Shorthand for the tasks above. Will execute both the notes and release tasks via a single command. Note that the $EDITOR
environment variable must be set to a supporting editor to use this mode.
npm
yo release:collect-versions npm > oldVersion.json
yo release:diff oldVersion.json npm
bower
yo release:collect-versions bower > oldVersion.json
yo release:diff oldVersion.json bower
Generates a report of the versions that have changed for all packages. Includes release notes for packages that include them.
Note that the arguments to release:diff
may be any combination of files or npm
/bower
meta commands.
yo release:publish [cdnjs|components] projectName sourceDir
Pushes a particular directory of artifacts to cdnjs or the github components project, optionally creating pull requests if the executing user does not have adequate permissions to directly push.
Note that at this time only frontend publishing is possible. NPM publishing should still be done directly through the npm publish
command.
Enterprise hosts may be published to using the --host=$server
option.
FAQs
A release generator for Yeoman
We found that generator-release demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.