chore(deps): update semantic-release monorepo (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@semantic-release/git	7.0.18 → 10.0.1
@semantic-release/git	9.0.0 → 10.0.1
@semantic-release/npm	5.3.5 → 13.1.5
@semantic-release/npm	7.0.5 → 13.1.5

---

Release Notes

semantic-release/git (@​semantic-release/git)

v10.0.1

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/error to v3 (#​295) (3e934d4)

v10.0.0

Compare Source

Features

• node-version: raised the minimum required version to v14.17 (7ab65f8)

BREAKING CHANGES

• node-version: the minimum required version of node is now v14.17

v9.0.1

Compare Source

Bug Fixes

• deps: update dependency execa to v5 (#​228) (f536d60)

v9.0.0

Compare Source

chore

• require Node.js >=10.18 (4016fcc)

BREAKING CHANGES

• Require Node.js >= 10.18

v8.0.0

Compare Source

Bug Fixes

• package: update execa to version 4.0.0 (9c1dc67)
• include deleted files in release commit (f59d20c)
• package: update aggregate-error to version 2.0.0 (3eb8f60)
• package: update execa to version 2.0.2 (9404d44)
• package: update execa to version 3.0.0 (e6af5b4)
• look for modified fiels to commit only if there files matching the globs (d97c030)
• update globby to latest version (9e2b2e5)

Features

• require Node.js >=10.13 (81955b8)
• require Node.js >=8.15 (15356b1)
• support branch parameter from semantic-release@​16.0.0 (02b1f6d)

BREAKING CHANGES

• Require Node.js >= 10.13
• Require Git 2.7.1 or higher
• Require Node.js => 8.15

semantic-release/npm (@​semantic-release/npm)

v13.1.5

Compare Source

Bug Fixes

• deps: update dependency normalize-url to v9 (#​1095) (daec492)

v13.1.4

Compare Source

Bug Fixes

• deps: update dependency @​actions/core to v3 (#​1085) (17abfe1)

v13.1.3

Compare Source

Bug Fixes

• deps: update dependency @​actions/core to v2 (#​1055) (fa4a3ab)

v13.1.2

Compare Source

Bug Fixes

• deps: update dependency read-pkg to v10 (#​1032) (f3f1a00)

v13.1.1

Compare Source

Bug Fixes

• publish-dry-run: temporarily remove the addition of dry-running the publish step (30bd176)

v13.1.0

Compare Source

Features

• trusted-publishing: verify auth, considering OIDC vs tokens from various registries (e3319f1), closes #​958
• trusted-publishing: refine the messages for related errors (316ce21), closes #​958
• trusted-publishing: make request to verify if OIDC token exchange can succeed (c80ecb0), closes #​958
• trusted-publishing: pass id-token as bearer header for github actions (d83b727), closes #​958
• trusted-publishing: pass id-token as bearer header for gitlab pipelines (6d1c3cf), closes #​958
• trusted-publishing: handle failure to retrieve id-token in the context of github actions (b673257), closes #​958
• auth-error: update messaging for auth failure to be less token specific (e24967d)
• auth: attempt a dry-run publish to determine auth status (841dc67)

Bug Fixes

• trusted-publishing: uri encode the package name for the token exchange request (3dd95d0), closes #​958
• auth: throw appropriate error when auth context fails to enable publishing (f5c8d85)
• auth: throw error if dry-run publish determines lack of auth (8f88e9d)
• verify-auth: enable the publish dry-run to work for projects publishing from a sub-directory (e7d684c)

v13.0.0

Compare Source

Features

• node-versions: drop support for node versions v20, v21, and v23
• node-versions: raise the minimum node version requirement for the v24 range (935439e)

Bug Fixes

• deps: update npm to v11 (debc7c5), closes #​966 #​966
• deps: update to the latest version of npm (1b25d6c)

BREAKING CHANGES

• node-versions: the minimum node version for the v24 range is now v24.10.0
• deps: a minimum of node v22.14 is now required

v12.0.2

Compare Source

Bug Fixes

• deps: update npm to ^10.9.3 (#​972) (93e0937)

v12.0.1

Compare Source

Bug Fixes

• deps: update dependency execa to v9 (9ac5ed0)

v12.0.0

Compare Source

Features

• exports: defined exports to point at ./index.js (9e193c2)
• node-versions: dropped support for node v18 and v19 (2df962b)

BREAKING CHANGES

• exports: exports has been defined, which prevents access to private apis (which arent
  intended for consumption anyway)
• node-versions: node v18 and v19 are no longer supported

v11.0.3

Compare Source

Bug Fixes

• deps: raised the minimum accepted range of npm to v10.5.0 (#​759) (a0313f8), closes semantic-release/semantic-release#3202

even though our existing range allowed anyone to update as soon as the new npm version was available, this will encourage being on a version that does not report the ip vulnerability a bit more forcefully

v11.0.2

Compare Source

Bug Fixes

• deps: update dependency npm to v10.2.5 (42b5dec)

v11.0.1

Compare Source

Bug Fixes

• deps: update dependency read-pkg to v9 (#​703) (6e84013)

v11.0.0

Compare Source

Bug Fixes

• deps: update dependency npm to v10 (819f257)

Features

• node-versions: raised the minimum required node version to v18.17 and dropped v19 support (6413130)

BREAKING CHANGES

• node-versions: node v18.17 is now the minimum required version and support for v19 has been dropped

v10.0.6

Compare Source

Bug Fixes

• deps: update dependency aggregate-error to v5 (#​676) (f2bc9e7)

v10.0.5

Compare Source

Bug Fixes

• deps: update dependency execa to v8 (#​659) (502d5ba)

v10.0.4

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/error to v4 (#​628) (53a1012)

v10.0.3

Compare Source

Bug Fixes

• deps: update dependency read-pkg to v8 (#​602) (aaddc5c)

v10.0.2

Compare Source

Bug Fixes

• deps: update dependency fs-extra to v11.1.1 (#​591) (31e0e27)

v10.0.1

Compare Source

Bug Fixes

• deps: update dependency execa to v7 (#​575) (4c11706)

v10.0.0

Compare Source

Bug Fixes

• aggregate-error: upgraded to the latest version (7285e05)
• deps: upgraded npm to v9 (2a79f80)
• execa: upgraded to the latest version (7c74660)
• normalize-url: upgraded to the latest version (b55bb01)
• remove support for legacy auth (51ab3c8)
• tempy: upgraded to the latest version of tempy (f1992a5)

Code Refactoring

• esm: converted the package to esm (2d8ff15)

Features

• node-versions: dropped support for node versions below v18 (aff3574)
• semantic-release-peer: raised the minimum peer requirement to the first version that supports loading esm plugins (22e70ad)

BREAKING CHANGES

• deps: the direct dependency on npm has been upgraded to v9. details of breaking changes
  can be found at https://github.com/npm/cli/releases/tag/v9.0.0
• semantic-release-peer: the required version of semantic-release has been
  raised to v20.1.0 in order to support loading of ESM plugins
• aggregate-error: due to the aggregate-error upgrade, thrown errors are no longer iterable, but instead list the errors under an errors property
• legacy authentication using NPM_USERNAME and NPM_PASSWORD is no longer supported. Use NPM_TOKEN instead.
• node-versions: node v18 is now the minimum required node version
• esm: @semantic-release/npm is now a native ES Module. It
  has named exports for each plugin hook (verifyConditions, prepare,
  publish, addChannel)

v9.0.2

Compare Source

Bug Fixes

• deps: update dependency fs-extra to v11 (7157d76)
• deps: update dependency npm to v9 (28265ec)
• deps: update dependency registry-auth-token to v5 (187671f)
• revert): "fix(deps: update dependency npm to v9" (#​561) (c28a848)

v9.0.1

Compare Source

Bug Fixes

• add missed preferLocal option for execa call (#​458) (c817a88)

v9.0.0

Compare Source

Bug Fixes

• add preferLocal option to allow execa to use local npm version (#​445) (002439e)
• updated the peer requirement for semantic-release to the new stable version (575a5a4)
• updated the peer requirement on semantic-release to a version matching the engines definition of this package (2d1f5f2)
• upgrade npm dependency to v8 (a12d6e5)

BREAKING CHANGES

• the minimum required peer of semantic-release has been raised to match the engines.node requirements of this package
• npm v8 dropped support for node v15, so it is no longer supported in this plugin. this should be low impact since node v15 is already EOL

Co-authored-by: Matt Travi programmer@travi.org

v8.0.3

Compare Source

Reverts

• Revert "chore(deps): update dependency p-retry to v5 (#​424)" (#​425) (df11027), closes #​424 #​425

v8.0.2

Compare Source

Bug Fixes

• README: correct docs on authentication (#​413) (f089d9d)

v8.0.1

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/error to v3 (#​402) (60832fb)

v8.0.0

Compare Source

Features

• node-version: raised the minimum required version to v14.17 (#​387) (#​399) (f65e49d)

BREAKING CHANGES

• node-version: the minimum required version of node is now v14.17

Co-authored-by: Matt Travi programmer@travi.org

v7.1.3

Compare Source

Bug Fixes

• use NPM_CONFIG_USERCONFIG in get-registry to match auth (#​362) (13200ca)

v7.1.2

Compare Source

Bug Fixes

• deps: update dependency fs-extra to v10 (80fde1e)

v7.1.1

Compare Source

Bug Fixes

• deps: update dependency normalize-url to v6 (97ca719)

v7.1.0

Compare Source

Features

• use npm v7 (#​304) (a15c017)

v7.0.10

Compare Source

Bug Fixes

• improve error message text for npm tokens (#​323) (88e5862)

v7.0.9

Compare Source

Bug Fixes

• deps: update dependency execa to v5 (#​299) (d4e5bb2)

v7.0.8

Compare Source

Bug Fixes

• deps: update dependency tempy to v1 (#​289) (5a1dbb8)

v7.0.7

Compare Source

Bug Fixes

• deps: update dependency tempy to ^0.7.0 (#​287) (dd25707)

v7.0.6

Compare Source

Bug Fixes

• update required node and npm version (#​273) (493fbad)

v7.0.5

Compare Source

Bug Fixes

• package: update fs-extra to version 9.0.0 (67a3109)

v7.0.4

Compare Source

Bug Fixes

• package: update tempy to version 0.5.0 (6ffff19)

v7.0.3

Compare Source

Bug Fixes

• package: update tempy to version 0.4.0 (4874bf6)

v7.0.2

Compare Source

Bug Fixes

• package: update normalize-url to version 5.0.0 (a554580)

v7.0.1

Compare Source

Bug Fixes

• package: update semver to version 7.1.2 (a58b30b)

v7.0.0

Compare Source

chore

• require Node.js >=10.18 (8140f0f)

BREAKING CHANGES

• Require Node.js >= 10.18

v6.0.0

Compare Source

Bug Fixes

• package: update execa to version 4.0.0 (d97dee5)
• package: update semver to version 6.3.0 (c515862)
• add dist-tag to publish and add-channel logs (db6ccd2)
• use correct peerDependencies for semantic-release (8b47e7b)
• package: pin npm to 6.5.0 (ddab7b7)
• package: update aggregate-error to version 2.0.0 (df53298)
• package: update aggregate-error to version 3.0.0 (3e0d5d0)
• package: update execa to version 3.0.0 (b1780c1)
• package: update npm to version 6.8.0 (2b0492e)
• package: update read-pkg to version 5.0.0 (877ce40)
• package: update vulnerable dependencies (#​185) (a96c6da)
• skip tarball move if config is cwd (a224497)
• package: update execa to version 2.0.2 (d2932ba)
• package: update registry-auth-token to version 4.0.0 (2868b2c)
• add dist-tag to publish log (2de37a1)
• Honor NPM_CONFIG_USERCONFIG setting (932ea5e)
• package: update fs-extra to version 8.0.0 (bf603e5)
• return false if the npm publish is skipped (4a41228)
• return false in addChannel if package is not published on npm (5434bab)

Features

• add addChannel plugin step (fb96126)
• require Node.js >=10.13 (6426458)
• require Node.js >=8.15 (4caf538)
• support nextRelease.channel property in publish step (b8deba7)

BREAKING CHANGES

• Require Node.js >= 10.13
• Require Node.js => 8.15

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

➤ YN0000: ┌ Resolution step
➤ YN0060: │ @dcpm/cli@workspace:cli provides semantic-release (pa77f6) with version 17.0.4, which doesn't satisfy what @semantic-release/git requests
➤ YN0060: │ @dcpm/cli@workspace:cli provides semantic-release (pa316d) with version 17.0.4, which doesn't satisfy what @semantic-release/npm requests
➤ YN0002: │ @dcpm/frontend@workspace:frontend doesn't provide @types/node (p72969), requested by ts-node
➤ YN0060: │ @dcpm/frontend@workspace:frontend provides react (p5b86c) with version 17.0.2, which doesn't satisfy what @hot-loader/react-dom requests
➤ YN0060: │ @dcpm/frontend@workspace:frontend provides react (p57493) with version 17.0.2, which doesn't satisfy what react-markdown and some of its descendants request
➤ YN0060: │ @dcpm/frontend@workspace:frontend provides semantic-release (p04ade) with version 15.14.0, which doesn't satisfy what @semantic-release/git requests
➤ YN0060: │ @dcpm/frontend@workspace:frontend provides semantic-release (pb2b64) with version 15.14.0, which doesn't satisfy what @semantic-release/npm requests
➤ YN0060: │ @dcpm/frontend@workspace:frontend provides semantic-release (pbffd9) with version 15.14.0, which doesn't satisfy what hweeks-semantic-release-monorepo and some of its descendants request
➤ YN0002: │ @octokit/rest@npm:16.43.2 doesn't provide @octokit/core (p84523), requested by @octokit/plugin-request-log
➤ YN0060: │ semantic-release@npm:17.0.4 provides marked (p53cc6) with version 0.8.2, which doesn't satisfy what marked-terminal requests
➤ YN0000: │ Some peer dependencies are incorrectly met; run yarn explain peer-requirements <hash> for details, where <hash> is the six-letter p-prefixed code
➤ YN0000: └ Completed in 3s 690ms
➤ YN0000: ┌ Fetch step
➤ YN0013: │ 1893 packages were already cached, 191 had to be fetched
➤ YN0019: │ 8 packages appeared to be unused and were removed
➤ YN0000: └ Completed in 6s 536ms
➤ YN0000: ┌ Link step
➤ YN0001: │ TypeError: Failed to open the cache entry for fsevents@patch:fsevents@npm%3A2.3.2#~builtin<compat/fsevents>::version=2.3.2&hash=18f3a7: (0 , QO.isDate) is not a function
    at ihe (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:10860)
    at Jr.utimesImpl (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:28773)
    at Jr.utimesSync (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:28366)
    at Jr.mkdirpSync (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:312:13525)
    at Jr.mkdirSync (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:28953)
    at g (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:330)
    at Jr.baseFs (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:2835)
    at /tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:2907
    at Mv (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:382:4076)
    at oh.factory (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:2898)
➤ YN0000: └ Completed in 0s 769ms
➤ YN0000: Failed with errors in 11s 159ms