chore: replace deprecated standard-version with commit-and-tag-version#1557
Conversation
standard-version has been deprecated since May 2022 and its transitive dependency on handlebars@4.7.8 has a known prototype pollution vulnerability (GHSA-2qvq-rjwj-gvw9). commit-and-tag-version is the actively maintained fork with identical CLI and config format. - Remove standard-version devDependency - Install commit-and-tag-version@12.7.1 - Update 'release' script to use commit-and-tag-version - Rename 'standard-version' config key to 'commit-and-tag-version'
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
Move CADT to eslint@10/@eslint-js@10 and remove @babel/eslint-parser, which is not compatible with ESLint 10 in this codebase. Update flat config for CJS/ESM edge cases, keep intentional dynamic imports exempt, and clean up no-useless-assignment findings while preserving runtime behavior verified by v1 and v2 integration test suites.
standard-version has been deprecated since May 2022 and its transitive dependency on handlebars@4.7.8 has a known prototype pollution vulnerability (GHSA-2qvq-rjwj-gvw9). commit-and-tag-version is the actively maintained fork with identical CLI and config format.
Note
Low Risk
Low risk: primarily dev tooling upgrades (release script and ESLint 10) plus small refactors/bugfixes in retry logic and variable initialization that should not affect runtime behavior beyond avoiding subtle bugs.
Overview
Replaces deprecated
standard-versionwithcommit-and-tag-versionfor releases (updates thereleasescript, config key, and lockfile dependencies) to drop vulnerable transitive deps.Upgrades to ESLint 10 (
eslint/@eslint/js), simplifieseslint.config.mjsby removing the Babel parser, bumpsecmaVersionto 2025, addspreserve-caught-erroras a warning, and refines per-file overrides for.cjsmodule type and approved dynamic-import exceptions.Includes a few small code-quality tweaks driven by the lint upgrade (prefer
const, remove unnecessary initializers) and fixes retry recursion to useretryCount + 1(instead of mutatingretryCount) in both v1 and v2 default-org-list loaders.Written by Cursor Bugbot for commit bce41bc. This will update automatically on new commits. Configure here.