v4.0.0

The v4 release updates the action runtime to Node 24, but there have been no usage changes to the action.

Immutable releases have been enabled for this repository. As a security practice, we recommend pinning to an exact release:

- uses: JS-DevTools/[email protected]
  with:
    token: ${{ secrets.NPM_TOKEN }}

⚠ BREAKING CHANGES

• The action now runs on Node 24 with npm 11
• The library and CLI now require Node >= 20, Node 16 and 18 are no longer supported
• The library is now ESM only

Features

• update action runtime to Node 24 (#231) (0b36106)

Bug Fixes

• deps: bump the production group across 1 directory with 5 updates (#238) (314ae61)
• deps: update tar and semver dependencies (#194) (cd26c94)
• update dry-run and publish conflict logic for npm>=10 (#232) (62716ea)
• windows: allow spawning npm cli on windows (#199) (f45e793), closes #198

Code Refactoring

• switch module format to ESM (#234) (e081941)

v3.1.1

Bug fixes

• include registry URL pathname in npm config (#186)

v3.1.0

Features

• dry-run: always print publish results in dry run (#185), closes #184

Performance Improvements

• action: decrease bundle size (#166)

v3.0.1

Bug fixes

• errors: improve message when version validation fails (#161), closes #160

v3.0.0

The v3 release updates the action's runtime to Node.js v20, but otherwise, there are no public API changes.

BREAKING CHANGES

• The action will now run on Node.js v20 instead of v16

Bug fixes

• action: update runtime to Node.js v20 (#150)

v2.2.2

Bug Fixes

• use validated package.json version for comparisons (#147), closes #139

v2.2.1

Bug Fixes

• action: update semver dep, esbuild and vitest dev deps (#114)
• npm: do not assume error code is a string (#120), closes #119

v2.2.0

Features

• Allow --ignore-scripts to be disabled in order to support publish lifecycle hooks (#102)

v2.1.0

Features

• Add explicit support for --provenance (#92), closes #88

Bug Fixes

• Handle missing latest tag during version check (#90), closes #89

v2.0.0

Welcome to v2 of JS-DevTools/npm-publish! We've been doing some spring cleaning to fix all our (known) bugs and knock out some longstanding feature requests. This release has some breaking changes, so please read carefully!

BREAKING CHANGES

• The type output is now an empty string instead of none when no release occurs

  - - if: ${{ steps.publish.outputs.type != 'none' }}
  + - if: ${{ steps.publish.outputs.type }}
      run:  echo "Version changed!"

• The check-version and greater-version-only options have been removed and replaced with strategy.

  • Use strategy: all (default) to publish all versions that do not yet exist in the registry.

      with:
        token: ${{ secrets.NPM_TOKEN }}
    -   check-version: true
    -   greater-version-only: false
    +   strategy: all

  • Use strategy: upgrade to only publish versions that upgrade the selected tag.

      with:
        token: ${{ secrets.NPM_TOKEN }}
    -   check-version: true
    -   greater-version-only: true
    +   strategy: upgrade

  • check-version: false has been removed. You don't need this action if you're not checking already published versions; use npm directly, instead.

• The library and CLI now require Node v16 or later. They may technically work in earlier versions, but they're not tested in CI and you will have to tell your package manager to ignore the engines requirement.

• The library and CLI no longer read the user's ~/.npmrc file, so the token option is now required.

Features

• tag, access, and registry now fall back to publishConfig in package.json, if specified. (#36)
• The package argument may now be a directory, and is passed to npm publish as its package_spec argument. (#59)
• The package argument may also be a pre-packed .tgz archive (#81)

Bug fixes

• The user's ~/.npmrc file is no longer modified. Instead, a temporary .npmrc file is used. (#15)
• npm is now always called with --ignore-scripts for security (#47)
• npm is now always called in the current working directory (#51)
• The action was updated to use the Node v16 runtime. (#61)
• The @actions/core dependency was upgraded to fix deprecation warnings. (#67)