Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Manage automatic releases in a multi repo environment (comparable to lerna and lerna-semantic-release)
A prerequisite for using the automatic release according to semver standards is to stick to commits in the style of conventional changelog.
The easiest way to do this is using commitizen to replace the git commit
command.
Based on commits formatted like this
fix(my-package): description of contents
BREAKING CHANGE: description of breaking stuff
Taking these commit messages, the tool automatically
For this the following rules apply:
feat
triggers a minor releasefix
, refactor
, perf
, revert
trigger a patch releaseBREAKING
somewhere in the message (subject or body) converts this
to a major releaseAs you would expect, you can simply install the package like
npm install -D rlsr
and after that add it to your package.json
{
...
"scripts": {
"prerelease": "rlsr pre",
"release": "rlsr perform"
}
...
}
Finally, you can use it for a dry run (without any persistence)
npm run prepublish
(or rlsr pre
) and check what it has created.
For the full power you can persist these changes with git commits and tags as
well as the npm publish using npm run release
(or rlsr pre && rlsr perform
).
rlsr understands two paradigms for handling dependencies from one monorepo package to another.
5.0.0
.3.2.1 - 5
RLSR has some config values, that you can set inside your package.json in a
rlsr
section.
verbose
(boolean): true
creates a lot more output for debugging purposes.packagePath
(string): tells the system where the multi repo packages live
(defaults to ./packages
)exactRelations
(boolean): use the exact paradigm for related versions
(defaults to false)scopeToNameMap
(object): map commit message scopes to a different package
names. For example to use a shorter name in scopes or to handle renaming of
packages.additionalReleaseScope
(string): An npm scope (or orga) to use for double
publication under package-name
and @scope/package-name
. Has to start with
an @
RLSR is able to fill in the latest version of a package to dependants. A
dependant package just needs to use rlsr-latest
instead of a concrete version
in it's dependencies.
{
"my-package"
"dependencies": {
"my-dependency": "rlsr-latest"
}
}
There are currently two criteria:
feat
,
fix
, refactor
, perf
, revert
)BREAKING
in uppercaseThe easiest way to achieve this is by using commitizen
and enter something
under the BREAKING CHANGE topic.
A message of type feat(package-name)
triggers a minor release.
A message of type fix
, refactor
, perf
or revert
triggers a minor
release.
previouslyUnreleased
in the package.json mean?The two processes (pre
and perform
) are independent of each other. But they
use the main package.json as a amall data exchange layer.
pre
leaves previouslyUnreleased
as an information for perform
. It tells
the second process which components need to be published. perform
finally
removes this again. But you may stumble upon this package.json entry at times.
FAQs
create npm releses and changelogs from a multi repo
The npm package rlsr receives a total of 23 weekly downloads. As such, rlsr popularity was classified as not popular.
We found that rlsr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.