registry / @williamthorsen/release-kit / 8.0.0

@williamthorsen/release-kit@8.0.0

Version-bumping and changelog-generation toolkit for release workflows

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 86 file(s), 231 KB of source, external domains: cli.github.com, json.schemastore.org, raw.githubusercontent.com

Source & flagged code

3 flagged

dist/esm/releasePrepare.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { buildChangelogEntries } from "./buildChangelogEntries.js";

High

Child Process

Package source references child process execution.

dist/esm/releasePrepare.jsView on unpkg · L1

3import { buildEmptyReleaseEntry } from "./buildEmptyReleaseEntry.js";

4import

Source & flagged code

3 flagged · loading source

dist/esm/releasePrepare.jsView file

1import { execSync } from 'node:child_process'; L2: import { buildChangelogEntries } from "./buildChangelogEntries.js";

High

Child Process

Package source references child process execution.

dist/esm/releasePrepare.jsView on unpkg · L1

dist/esm/loadConfig.jsView file

36} L37: const { createJiti } = await import('jiti'); L38: const jiti = createJiti(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/loadConfig.jsView on unpkg · L36

dist/esm/runGitCliff.jsView file

13} L14: return execFileSync('npx', ['--prefer-offline', '--yes', 'git-cliff', '--config', configPath, ...cliffArgs], { L15: encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/esm/runGitCliff.jsView on unpkg · L13

Findings

3 High3 Medium4 Low

HighChild Processdist/esm/releasePrepare.js

HighShell

HighRuntime Package Installdist/esm/runGitCliff.js

MediumDynamic Requiredist/esm/loadConfig.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/esm/loadConfig.jsView file

Lines 16-56javascript

16 catch (error) {

17 throw new Error(`Failed to read root ${ROOT_PACKAGE_JSON_PATH}: ${error instanceof Error ? error.message : String(error)}`);

18 }

19 let parsed;

20 try {

21 parsed = JSON.parse(contents);

22 }

23 catch (error) {

24 throw new Error(`Failed to parse root ${ROOT_PACKAGE_JSON_PATH}: ${error instanceof Error ? error.message : String(error)}`);

25 }

26 if (!isRecord(parsed)) {

27 return { exists: true, version: undefined };

28 }

29 return { exists: true, version: typeof parsed.version === 'string' ? parsed.version : undefined };

30}

31export const CONFIG_FILE_PATH = '.config/release-kit.config.ts';

32export async function loadConfig() {

33 const absoluteConfigPath = path.resolve(process.cwd(), CONFIG_FILE_PATH);

34 if (!existsSync(absoluteConfigPath)) {

35 return undefined;

36 }

37 const { createJiti } = await import('jiti');

38 const jiti = createJiti(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/loadConfig.jsView on unpkg · L36

39 const imported = await jiti.import(absoluteConfigPath);

40 if (!isRecord(imported)) {

41 throw new Error(`Config file must export an object, got ${Array.isArray(imported) ? 'array' : typeof imported}`);

42 }

43 const resolved = imported.default ?? imported.config;

44 if (resolved === undefined) {

45 throw new Error('Config file must have a default export or a named `config` export (e.g., `export default { ... }` or `export const config = { ... }`)');

46 }

47 return resolved;

48}

49export function mergeMonorepoConfig(discoveredPaths, userConfig, rootPackage) {

50 let workspaces = discoveredPaths.map((workspacePath) => deriveWorkspaceConfig(workspacePath));

51 assertUniqueTagPrefixes(workspaces);

52 if (userConfig?.workspaces !== undefined) {

53 const overrides = new Map(userConfig.workspaces.map((w) => [w.dir, w]));

54 workspaces = workspaces

55 .filter((w) => {

56 const override = overrides.get(w.dir);

dist/esm/runGitCliff.jsView file

Lines 1-32javascript

1import { execFileSync } from 'node:child_process';

2import { copyFileSync, mkdtempSync, rmSync } from 'node:fs';

3import { tmpdir } from 'node:os';

4import { join } from 'node:path';

5export function runGitCliff(cliffConfigPath, cliffArgs, stdio) {

6 let configPath = cliffConfigPath;

7 let tempDir;

8 try {

9 if (cliffConfigPath.endsWith('.template')) {

10 tempDir = mkdtempSync(join(tmpdir(), 'cliff-'));

11 configPath = join(tempDir, 'cliff.toml');

12 copyFileSync(cliffConfigPath, configPath);

13 }

14 return execFileSync('npx', ['--prefer-offline', '--yes', 'git-cliff', '--config', configPath, ...cliffArgs], {

15 encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/esm/runGitCliff.jsView on unpkg · L13

16 stdio,

17 env: { ...process.env, npm_config_progress: 'false' },

18 });

19 }

20 finally {

21 if (tempDir !== undefined) {

22 rmSync(tempDir, { recursive: true, force: true });

23 }

24 }

25}

26export function refreshGitCliffCache() {

27 execFileSync('npx', ['--yes', 'git-cliff', '--version'], {

28 stdio: ['ignore', 'pipe', 'inherit'],

29 env: { ...process.env, npm_config_progress: 'false' },

30 });

31}