Skip to content

feat: Add option to use Oxfmt for formatting changelog#283

Merged
Mrtenz merged 4 commits intomainfrom
mrtenz/oxfmt-option
Apr 13, 2026
Merged

feat: Add option to use Oxfmt for formatting changelog#283
Mrtenz merged 4 commits intomainfrom
mrtenz/oxfmt-option

Conversation

@Mrtenz
Copy link
Copy Markdown
Member

@Mrtenz Mrtenz commented Apr 13, 2026

This adds a new --formatter option, which can be set to either "prettier" or "oxfmt", and deprecates the --prettier option. I've also refactored the logic to load Prettier dynamically, so both Oxfmt and Prettier are now optional peer dependencies.

Tested in MetaMask/core:


Note

Medium Risk
Moderate risk: changes CLI flags and formatting behavior via dynamic imports, which could affect consumers relying on the deprecated --prettier flag or missing optional peer deps at runtime.

Overview
Adds a new --formatter CLI option to choose changelog formatting (prettier or oxfmt, with none for validate) and deprecates the legacy --prettier flag (which still takes precedence when provided).

Refactors changelog formatting to route through new src/formatters.ts helpers that dynamically import Prettier/Oxfmt and throw clearer errors when the chosen formatter isn’t installed, and updates tests and package metadata to treat prettier/oxfmt as optional peer dependencies.

Reviewed by Cursor Bugbot for commit b0fc35a. Bugbot is set up for automated code reviews on this repo. Configure here.

@Mrtenz
Copy link
Copy Markdown
Member Author

Mrtenz commented Apr 13, 2026

@metamaskbot publish-preview

@socket-security
Copy link
Copy Markdown

socket-security bot commented Apr 13, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedoxfmt@​0.45.0901008996100

View full report

@socket-security
Copy link
Copy Markdown

socket-security bot commented Apr 13, 2026

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
System shell access: npm oxfmt in module child_process

Module: child_process

Location: Package overview

From: package.jsonnpm/oxfmt@0.45.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxfmt@0.45.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@Mrtenz
Copy link
Copy Markdown
Member Author

Mrtenz commented Apr 13, 2026

@metamaskbot publish-preview

@github-actions
Copy link
Copy Markdown
Contributor

A preview build for this branch has been published.

You can configure your project to use the preview build with this identifier:

npm:@metamask-previews/auto-changelog@6.0.0-preview-7ee0be4

See these instructions for more information about preview builds.

@Mrtenz
Copy link
Copy Markdown
Member Author

Mrtenz commented Apr 13, 2026

@metamaskbot publish-preview

@github-actions
Copy link
Copy Markdown
Contributor

A preview build for this branch has been published.

You can configure your project to use the preview build with this identifier:

npm:@metamask-previews/auto-changelog@6.0.0-preview-b0fc35a

See these instructions for more information about preview builds.

@Mrtenz Mrtenz marked this pull request as ready for review April 13, 2026 20:40
@Mrtenz Mrtenz requested a review from a team as a code owner April 13, 2026 20:40
Comment thread src/cli.ts
Comment on lines +404 to +419
// If the deprecated `--prettier` flag is used, it takes precedence over the
// `--formatter` option. Otherwise, use the specified formatter, unless it's
// "none".
if (typeof usePrettier === 'boolean') {
if (usePrettier) {
return await format(changelog, 'prettier');
}

return changelog;
}

if (formatterOption && formatterOption !== 'none') {
return await format(changelog, formatterOption as FormatterName);
}

return changelog;
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a little bit verbose, but needed for backwards compatibility with --no-prettier.

Copy link
Copy Markdown
Contributor

@mcmire mcmire left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested these changes in core and they seem to work well.

LGTM.

@Mrtenz Mrtenz merged commit 1216239 into main Apr 13, 2026
25 of 26 checks passed
@Mrtenz Mrtenz deleted the mrtenz/oxfmt-option branch April 13, 2026 20:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants