Repository navigation
chore(release): v0.1.3 - #71
Merged
Merged
Conversation
- Bump package.json version to 0.1.3 - Promote [Unreleased] changelog entries into the 0.1.3 section with the Human Era release date - Record the slsa-builder pin update under Changed: the publish stage now uses a pinned, digest-verified npm CLI carrying the upstream npm/cli#9882 fix, so the v0.1.3 registry attestation carries the Windlass-signed provenance statement - Recreate an empty [Unreleased] section and update comparison links Signed-off-by: Yunseo Kim <[email protected]>
Signed-off-by: Yunseo Kim <[email protected]>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release preparation PR for v0.1.3, per
docs/release.md. Contains only release-preparation changes:package.jsonversion bumped to 0.1.3[Unreleased]changelog entries promoted to## [0.1.3] - 12026-11-01(Changed: slsa-builder provenance producer update, including the publish-stage npm CLI pin that carries the upstream fix for [BUG] Trusted publishing auto-provenance silently discards the--provenance-filebundle npm/cli#9879; Security: CVE-2026-104848 and CVE-2026-104849)[Unreleased]section recreated; comparison links updatedAfter merge, the signed tag is created from the merged
maincommit per the runbook. The finalized 0.1.3 changelog section serves as the GitHub Release body.Related Issues
Change Type
Changelog
Changelog update:
CHANGELOG.md[Unreleased]updatedChecklist
General
type(scope): SummaryCI/Workflow Changes (if applicable)
Not applicable — no workflow or CI/CD configuration changes in this PR.
Protocol / Compatibility Impact
Testing
Describe test evidence:
pnpm run fmt:check,lint:ts,lint:md,typecheck: clean (thefmt:checkcoverage includes only tracked project files).pnpm run test: 68/68 passing;test:coverage: lines 97.8%, functions 100%.pnpm run buildandpnpm run verify:package: exit 0 (package artifacts, consumer typecheck, blocked subpaths, package-name smoke).pnpm run smoke:runtime:nodeandsmoke:runtime:bun: exit 0. Deno is not installed locally; the Deno smoke check runs in CI perdocs/release.md.Documentation
Rollout / Risk
Reviewer Checklist
Summary by cubic
Readies the v0.1.3 release by bumping
package.jsonto 0.1.3 and finalizing the changelog. No package behavior changes.[Unreleased]entries into the new[0.1.3]section: the slsa-builder provenance producer update (pinned npm CLI carrying the [BUG] Trusted publishing auto-provenance silently discards the--provenance-filebundle npm/cli#9879 fix) and two CVEs (CVE-2026-104848, CVE-2026-104849).[Unreleased]section and updates the version comparison links.Written for commit f1a37b5. Summary will update on new commits.