registry / @williamthorsen/release-kit / 8.0.0

@williamthorsen/release-kit@8.0.0

Version-bumping and changelog-generation toolkit for release workflows

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 86 file(s), 231 KB of source, external domains: cli.github.com, json.schemastore.org, raw.githubusercontent.com

Source & flagged code

3 flagged

dist/esm/releasePrepare.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { buildChangelogEntries } from "./buildChangelogEntries.js";

High

Child Process

Package source references child process execution.

dist/esm/releasePrepare.jsView on unpkg · L1

3import { buildEmptyReleaseEntry } from "./buildEmptyReleaseEntry.js";

4import { bumpAllVersions, setAllVersions } from "./bumpAllVersions.js";

5import { mergeChangelogEntriesWithDisk, resolveChangelogJsonPath, upsertChangelogJsonAndReturn, } from "./changelogJsonFile.js";

6import { applyChangelogOverrides, formatStaleOverrideKeyWarning, loadOverridesForScopes, } from "./changelogOverrides.js";

7import { createPolicyViolationCollector } from "./collectPolicyViolations.js";

8import { isForwardVersion } from "./compareVersions.js";

9import { DEFAULT_BREAKING_POLICIES, DEFAULT_VERSION_PATTERNS, DEFAULT_WORK_TYPES } from "./defaults.js";

10import { determineBumpFromCommits } from "./determineBumpFromCommits.js";

11import { getCommitsSinceTarget } from "./getCommitsSinceTarget.js";

12import { hasPrettierConfig } from "./hasPrettierConfig.js";

13import { resolveWorkTypes } from "./loadConfig.js";

14import { readCurrentVersion } from "./readCurrentVersion.js";

15import { writeChangelogMarkdown } from "./renderChangelogMarkdown.js";

16import { deriveSectionOrder } from "./resolveReleaseNotesConfig.js";

17import { refreshGitCliffCache } from "./runGitCliff.js";

18import { writeReleaseNotesPreviews } from "./writeReleaseNotesPreviews.js";

19export function releasePrepare(config, options) {

20 const { dryRun, bumpOverride, setVersion, withReleaseNotes } = options;

21 const workTypes = config.workTypes ?? { ...DEFAULT_WORK_TYPES };

dist/esm/loadConfig.jsView file

Lines 16-56javascript

16 catch (error) {

17 throw new Error(`Failed to read root ${ROOT_PACKAGE_JSON_PATH}: ${error instanceof Error ? error.message : String(error)}`);

18 }

dist/esm/runGitCliff.jsView file

Lines 1-32javascript

1import { execFileSync } from 'node:child_process';

2import { copyFileSync, mkdtempSync, rmSync } from 'node:fs';

3import { tmpdir } from 'node:os';

4import { join } from 'node:path';

5export function runGitCliff(cliffConfigPath

Source & flagged code

3 flagged · loading source

dist/esm/releasePrepare.jsView file

1import { execSync } from 'node:child_process'; L2: import { buildChangelogEntries } from "./buildChangelogEntries.js";

High

Child Process

Package source references child process execution.

dist/esm/releasePrepare.jsView on unpkg · L1

dist/esm/loadConfig.jsView file

36} L37: const { createJiti } = await import('jiti'); L38: const jiti = createJiti(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/loadConfig.jsView on unpkg · L36

dist/esm/runGitCliff.jsView file

13} L14: return execFileSync('npx', ['--prefer-offline', '--yes', 'git-cliff', '--config', configPath, ...cliffArgs], { L15: encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/esm/runGitCliff.jsView on unpkg · L13

Findings

3 High3 Medium4 Low

HighChild Processdist/esm/releasePrepare.js

HighShell

HighRuntime Package Installdist/esm/runGitCliff.js

MediumDynamic Requiredist/esm/loadConfig.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/esm/releasePrepare.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { buildChangelogEntries } from "./buildChangelogEntries.js";

High

Child Process

Package source references child process execution.

dist/esm/releasePrepare.jsView on unpkg · L1

3import { buildEmptyReleaseEntry } from "./buildEmptyReleaseEntry.js";

4import { bumpAllVersions, setAllVersions } from "./bumpAllVersions.js";

5import { mergeChangelogEntriesWithDisk, resolveChangelogJsonPath, upsertChangelogJsonAndReturn, } from "./changelogJsonFile.js";

6import { applyChangelogOverrides, formatStaleOverrideKeyWarning, loadOverridesForScopes, } from "./changelogOverrides.js";

7import { createPolicyViolationCollector } from "./collectPolicyViolations.js";

8import { isForwardVersion } from "./compareVersions.js";

9import { DEFAULT_BREAKING_POLICIES, DEFAULT_VERSION_PATTERNS, DEFAULT_WORK_TYPES } from "./defaults.js";

10import { determineBumpFromCommits } from "./determineBumpFromCommits.js";

11import { getCommitsSinceTarget } from "./getCommitsSinceTarget.js";

12import { hasPrettierConfig } from "./hasPrettierConfig.js";

13import { resolveWorkTypes } from "./loadConfig.js";

14import { readCurrentVersion } from "./readCurrentVersion.js";

15import { writeChangelogMarkdown } from "./renderChangelogMarkdown.js";

16import { deriveSectionOrder } from "./resolveReleaseNotesConfig.js";

17import { refreshGitCliffCache } from "./runGitCliff.js";

18import { writeReleaseNotesPreviews } from "./writeReleaseNotesPreviews.js";

19export function releasePrepare(config, options) {

20 const { dryRun, bumpOverride, setVersion, withReleaseNotes } = options;

21 const workTypes = config.workTypes ?? { ...DEFAULT_WORK_TYPES };

dist/esm/loadConfig.jsView file

Lines 16-56javascript

16 catch (error) {

17 throw new Error(`Failed to read root ${ROOT_PACKAGE_JSON_PATH}: ${error instanceof Error ? error.message : String(error)}`);

18 }

dist/esm/runGitCliff.jsView file

Lines 1-32javascript

1import { execFileSync } from 'node:child_process';

2import { copyFileSync, mkdtempSync, rmSync } from 'node:fs';

3import { tmpdir } from 'node:os';

4import { join } from 'node:path';

5export function runGitCliff(cliffConfigPath