Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
semantic-release-yarn
Advanced tools
semantic-release plugin to publish a npm package with Yarn.
Use this plugin instead of the default @semantic-release/npm if you want to use Yarn instead of the NPM CLI to publish your packages to the NPM registry.
As an added bonus, this plugin will also publish some simple monorepo patterns (currently WIP).
yarn add --dev semantic-release-yarn
⚠️
Please note this plugin only works with Yarn 2 and higher.
The plugin must be added in the semantic-release configuration, for example:
{
"plugins": [
"@semantic-release/commit-analyzer",
"@semantic-release/release-notes-generator",
"semantic-release-yarn",
"@semantic-release/github"
]
}
The NPM authentication configuration is required and can be set either via
environment variables or the
.yarnrc.yml
file.
⚠️
When two-factor authentication is enabled on your NPM account and enabled for writes (default setting), the token needs to be of type Automation.
⚠️
Only thenpmAuthToken
is supported. The legacynpmAuthIdent
(username:password
) authentication is strongly discouraged and not supported by this plugin.
Variable | Description |
---|---|
YARN_NPM_AUTH_TOKEN | NPM token. Translates to the npmAuthToken .yarnrc.yml option. |
YARN_NPM_PUBLISH_REGISTRY | NPM registry to use. Translates to the npmPublishRegistry .yarnrc.yml option. |
Most other Yarn options could be specified as environment variables as well. Just prefix the names and write them in snake case. Refer to the Yarnrc files documentation to see all options.
⚠️
The configuration set by environment variables will take precedence over configuration set in the.yarnrc.yml
file.
.yarnrc.yml
fileOptions can also be set in a .yarnrc.yml
file. See
Yarnrc files for the complete list
of option.
package.json
fileThe
registry
can be configured in the package.json
and will take precedence over the
configuration in environment variables and the .yarnrc.yml
file.
{
"publishConfig": {
"registry": "https://registry.npmjs.org/"
}
}
⚠️
The@semantic-release/npm
plugin supports setting thepublishConfig.tag
option. However, Yarn 2 doesn't seem to > support this.
These options can be added to the semantic-release configuration, for example:
{
"plugins": [
"@semantic-release/commit-analyzer",
"@semantic-release/release-notes-generator",
[
"semantic-release-yarn",
{
"npmPublish": false
}
],
"@semantic-release/github"
]
}
Options | Description | Default |
---|---|---|
npmPublish | Whether to publish the NPM package to the registry. If false the package.json version will still be updated. | false if the package.json private property is true , true otherwise. |
pkgRoot | Directory path to publish. | . |
tarballDir | Directory path in which to write the package tarball. If false the tarball is not kept on the file system. | false |
⚠️
ThepkgRoot
directory must contain apackage.json
. The version will be updated only in thepackage.json
within thepkgRoot
directory.
The npmPublish
and tarballDir
option can be used to skip the publishing to
the NPM registry and instead release the package tarball with another plugin.
For example with the
@semantic-release/github plugin:
{
"plugins": [
"@semantic-release/commit-analyzer",
"@semantic-release/release-notes-generator",
[
"semantic-release-yarn",
{
"npmPublish": false,
"tarballDir": "dist"
}
],
[
"@semantic-release/github",
{
"assets": "dist/*.tgz"
}
]
]
}
Step | Description |
---|---|
verifyConditions | Verify Yarn 2 or higher is installed, verify the presence of an NPM auth token (either in an environment variable or an .yarnrc.yml file) and verify the authentication method is valid. |
prepare | Update the package.json version and create the package tarball. |
addChannel | Add a tag for the release. |
publish | Publish to the npm registry. |
semantic-release
is
not picking up our error stack and we get a generic error message instead
of a well formatted one. Hope this can be fixed once
upstream PR #2631
lands©️ Copyright 2022 Joram van den Boezem
♻️ Licensed under the MIT license
⚡ Powered by Node.js and TypeScript (and a lot of
amazing open source packages)
🚀 This plugin is forked from the core
@semantic-release/npm plugin.
FAQs
semantic-release plugin to publish a npm package with yarn
The npm package semantic-release-yarn receives a total of 5,177 weekly downloads. As such, semantic-release-yarn popularity was classified as popular.
We found that semantic-release-yarn demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.