chore(deps): update dependency semantic-release to v22

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
semantic-release	^19.0.2 → ^22.0.12

---

Release Notes

semantic-release/semantic-release (semantic-release)

v22.0.12

Compare Source

Bug Fixes

• Revert "fix(deps): update dependency cosmiconfig to v9" (#​3104) (f6f1bf1)

v22.0.11

Compare Source

Bug Fixes

• deps: update dependency cosmiconfig to v9 (b38cd2e)

v22.0.10

Compare Source

Bug Fixes

• revert updating cosmiconfig to v9 (88efead)

v22.0.9

Compare Source

Bug Fixes

• deps: update dependency cosmiconfig to v9 (#​3072) (8b0dbd2)

v22.0.8

Compare Source

Bug Fixes

• support windows absolute extends (#​3062) (0d06f62)

v22.0.7

Compare Source

Bug Fixes

• deps: update dependency read-pkg-up to v11 (#​3047) (f09e55f)

Features

• support extending ESM configuration files (#​3036)(6900865)

v22.0.6

Compare Source

Bug Fixes

• deps: update dependency figures to v6 (#​3033) (305674d)

v22.0.5

Compare Source

Bug Fixes

• deps: update dependency env-ci to v10 (#​2983) (e759493)

v22.0.4

Compare Source

Bug Fixes

• deps: update dependency marked to v9 (#​2947) (84f2ee9)

v22.0.3

Compare Source

Bug Fixes

• exports: removed the exports definition for the time being (561e2d6), closes #​2968. see #​2978 for more information.

v22.0.2

Compare Source

Bug Fixes

• deps: update dependency marked-terminal to v6 (8a7befe)

v22.0.1

Compare Source

Bug Fixes

• deps: upgraded release-notes-generator and commit-analyzer plugins to stable versions (041e4f7), closes #​2934

v22.0.0

Compare Source

Bug Fixes

• deps: updated to the latest beta of the commit analyzer plugin (03a687b)
• deps: updated to the latest betas of the commit-analyzer and release-notes-generator plugins (de8e4e0)
• deps: upgraded to the latest version of the npm plugin with npm v10 (a23b718)

Features

• conventional-changelog-presets: supported new preset format (07a79ea)
• defined exports for the package (72ab317)
• node-versions: raised the minimum node v20 requirement to v20.6 (e623cc6)
• node-versions: raised the minimum required node version to v18.17 and dropped v19 support (b9f294d)
• node-versions: raised the minimum supported node version w/in the v20 range to v20.6.1 (b93bef4)

BREAKING CHANGES

• node-versions: the minimum supported version for the v20 range of node has been raised slightly to
  v20.6.1 to avoid a known node bug
• node-versions: the minimum supported node version in the v20 major range is now v20.6
• node-versions: node v18.17 is now the minimum supported node version and support for v19 has been dropped
• exports prevents access to internal files, but they arent intended for public use anyway
• conventional-changelog-presets: the new preset format is a breaking change when compared to the previous preset format. updating to support the new format means that the old preset format is no longer supported. update your preset to the latest version to maintain compatibility. this is also important if you are using a preset outside of the list of official conventional-changelog presets since your preset will need to be updated to export async functions to match the expected preset signature.

v21.1.2

Compare Source

Bug Fixes

• deps: update dependency aggregate-error to v5 (#​2956) (1017e1a)

v21.1.1

Compare Source

Bug Fixes

• types: included the definitions file in the published package (#​2920) (4c95c97)

v21.1.0

Compare Source

Features

• Added TypeScript definitions (#​2916) (c21a1ac)

v21.0.9

Compare Source

Bug Fixes

• deps: update dependency hosted-git-info to v7 (#​2908) (eba86ac)

v21.0.8

Compare Source

Bug Fixes

• deps: update dependency execa to v8 (#​2914) (7bc21fc)

v21.0.7

Compare Source

Bug Fixes

• deps: update dependency read-pkg-up to v10 (#​2862) (70996e0)

v21.0.6

Compare Source

Bug Fixes

• get correct version if prerelease branch shares version with ... (#​2416) (e4229f9)

v21.0.5

Compare Source

Bug Fixes

• deps: update dependency marked to v5 (452e1fa)

v21.0.4

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/error to v4 (d259350)

v21.0.3

Compare Source

Bug Fixes

• bump @semantic-release/commit-analyzer to v10.0.0-beta.1 (4a6b31f)
• bump @semantic-release/github to 9.0.0-beta.2 (#​2818) (6f19d77)
• deps: updated the beta plugins to stable versions (3941018)

v21.0.2

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/release-notes-generator to v11 (#​2778) (ac40804)

v21.0.1

Compare Source

Bug Fixes

• deps: update dependency env-ci to v9 (#​2757) (4bddb37)

v21.0.0

Compare Source

BREAKING CHANGES

• deps: the npm plugin has updated the npm dependency to v9
• legacy authentication using NPM_USERNAME and NPM_PASSWORD is no longer supported. Use NPM_TOKEN instead.

Bug Fixes

• deps: bump @semantic-release/npm to ^10.0.0 (d647433)

v20.1.3

Compare Source

Bug Fixes

• deps: update dependency execa to v7.1.1 (c38b53a)

v20.1.2

Compare Source

Bug Fixes

• deps: update dependency cosmiconfig to v8.1.2 (fbede54)

v20.1.1

Compare Source

Bug Fixes

• deps: update dependency execa to v7 (#​2709) (31d9bfe)

v20.1.0

Compare Source

Features

• plugins: add support for loading ESM plugins (#​2688) (d170f73)

v20.0.4

Compare Source

Bug Fixes

• windows: fixed issues preventing execution from windows (#​2672) (5df624c)

v20.0.3

Compare Source

Reverts

• Revert "chore(deps): update dependency ava to v5.1.1" (#​2682) (914b0a2), closes #​2682

v20.0.2

Compare Source

Bug Fixes

• deps: update dependency semver-diff to v4 (#​1915) (cb45d27)

v20.0.1

Compare Source

Bug Fixes

• deps: update dependency cosmiconfig to v8 (f914c1e)
• deps: update dependency hosted-git-info to v6 (c4da008)

v20.0.0

Compare Source

BREAKING CHANGES

• esm: semantic-release is now ESM-only. since it is used through its own executable, the impact on consuming projects should be minimal
• esm: references to plugin files in configs need to include the file extension because of executing in an ESM context
• node-versions: node v18 is now the minimum required version of node. this is in line with our node support policy. please see our recommendations for releasing with a different node version than your project normally uses, if necessary.

Features

• esm: convert to esm (#​2569) (9eab1ad), closes #​2543
• node-versions: raised the minimum required node version to v18 (#​2620) (8a0d8be)

Bug Fixes

• env-ci: updated to the stable esm-only version (#​2632) (918eb59)
• secrets-masking: used the proper named import from hook-std to enable masking for stderr (#​2619) (cf6befa)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 3am on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate using a curated preset maintained by . View repository job log here

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	semantic-release@​19.0.5 ⏵ 22.0.12	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @pnpm/network.ca-file is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/semantic-release@22.0.12 → npm/@pnpm/network.ca-file@1.0.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@pnpm/network.ca-file@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm npm is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/semantic-release@22.0.12 → npm/npm@10.9.8 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@10.9.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm npm is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/semantic-release@22.0.12 → npm/npm@10.9.8 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@10.9.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report