
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
release2hub
Advanced tools
The origin project is hosted on transferwise/release-to-github-with-changelog, this project is an enhancement of the original, adding some features, such as the support of Windows.
Keep the released npm package in sync with the GitHub repo master branch:
CHANGELOG.md item is in sync with the last release on Github, with corresponding version tagpackage.json version is in sync with the master branch version tag
The sources of truth are CHANGELOG.md and package.json.
Your interface is your CHANGELOG.md.
Usage: release2hub [options]
Options:
--branch [branchName] Default is master.
--remote [isUseRemoteUrl] Default is false, if set true, the change log will send to git origin remote url, otherwise, it will use the field of repository.url form package.json.
You can include a check of your CHANGELOG.md format in your test command by using the provided release-check4hub command.
Every CHANGELOG.md item should represent a release note of the version it describes:
# v0.2.0 //version tag
## The release title
// The release description in markdown
# v0.1.9
...
Don't forget the
repository.url. It will be parsed to extract the repository full name (myOrg/myRepoin this example).
{
"version": "0.2.0",
"respository": {
"type": "git",
"url": "git+https://github.com/myOrg/myRepo.git"
},
"files": ["dist"],
"scripts": {
"build": // build dist files
"release": "npm publish && npm run release2hub",
"release": "npm publish && npm run release2hub --branch=releases", // optional branch name
"test": "release-check4hub && karma start"
}
}
# v0.2.0
## We can fly
Great news! The machine can now also fly!
# v0.1.0
## We can move
### What the machine does
It can move, a bit slowly but still it moves.
//...
FAQs
Parses CHANGELOG.md to publish a new release resource to the Github api
We found that release2hub demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.