v1.4.6

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/workflows/ci.yml

@@ -12,10 +12,10 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v2
 
-      - name: Use Node.js 16
+      - name: Use Node.js 20
         uses: actions/setup-node@v1
         with:
-          node-version: 16.x
+          node-version: 20.x
 
       - name: Install Dependencies
         run: yarn --frozen-lockfile

.github/workflows/version-or-publish.yml

@@ -14,10 +14,10 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v2
 
-      - name: Use Node.js 16
+      - name: Use Node.js 20
         uses: actions/setup-node@v1
         with:
-          node-version: 16.x
+          node-version: 20.x
 
       - name: Install Dependencies
         run: yarn --frozen-lockfile

CHANGELOG.md

@@ -1,5 +1,23 @@
 # @changesets/action
 
+## 1.4.6
+
+### Patch Changes
+
+- [#350](https://github.com/changesets/action/pull/350) [`9385be9`](https://github.com/changesets/action/commit/9385be9e757839189ea5ee63ec4e3caa8a6ca71b) Thanks [@m-shaka](https://github.com/m-shaka)! - Bump the used node.js from 16 to 20
+
+## 1.4.5
+
+### Patch Changes
+
+- [#282](https://github.com/changesets/action/pull/282) [`eb19e25`](https://github.com/changesets/action/commit/eb19e25e7797cf33dc2de4caa071e85a8057a0f0) Thanks [@mark-omarov](https://github.com/mark-omarov)! - Updated a few dependencies to patch the security vulnerabilities that were reported for their older versions.
+
+## 1.4.4
+
+### Patch Changes
+
+- [#291](https://github.com/changesets/action/pull/291) [`db8a109`](https://github.com/changesets/action/commit/db8a1099bc0ba1dd6f46a5b9df4212e4f69e78c9) Thanks [@varl](https://github.com/varl)! - Wire up [`@octokit/plugin-throttling`](https://github.com/octokit/plugin-throttling.js) with all GitHub Octokit instances
+
 ## 1.4.3
 
 ### Patch Changes

README.md

@@ -43,10 +43,10 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
-      - name: Setup Node.js 16
+      - name: Setup Node.js 20
         uses: actions/setup-node@v3
         with:
-          node-version: 16
+          node-version: 20
 
       - name: Install Dependencies
         run: yarn
@@ -79,10 +79,10 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
-      - name: Setup Node.js 16.x
+      - name: Setup Node.js 20.x
         uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 20.x
 
       - name: Install Dependencies
         run: yarn
@@ -144,10 +144,10 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
-      - name: Setup Node.js 16.x
+      - name: Setup Node.js 20.x
         uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 20.x
 
       - name: Install Dependencies
         run: yarn
@@ -188,10 +188,10 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@v3
 
-      - name: Setup Node.js 16.x
+      - name: Setup Node.js 20.x
         uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 20.x
 
       - name: Install Dependencies
         run: yarn

action.yml

@@ -1,7 +1,7 @@
 name: Changesets
 description: A GitHub action to automate releases with Changesets
 runs:
-  using: "node16"
+  using: "node20"
   main: "dist/index.js"
 inputs:
   publish:

package.json

@@ -1,19 +1,29 @@
 {
   "name": "@changesets/action",
-  "version": "1.4.3",
+  "version": "1.4.6",
   "main": "dist/index.js",
   "license": "MIT",
   "devDependencies": {
     "@changesets/changelog-github": "^0.4.2",
     "@changesets/cli": "^2.20.0",
     "@changesets/write": "^0.1.6",
+    "@vercel/ncc": "^0.36.1",
     "fixturez": "^1.1.0",
-    "parcel": "^1.12.3",
     "prettier": "^2.0.5",
-    "typescript": "^5.0.4"
+    "typescript": "^5.0.4",
+    "@babel/core": "^7.13.10",
+    "@babel/preset-env": "^7.13.10",
+    "@babel/preset-typescript": "^7.13.0",
+    "@types/fs-extra": "^8.0.0",
+    "@types/jest": "^29.5.1",
+    "@types/node": "^20.11.17",
+    "@types/semver": "^7.5.0",
+    "babel-jest": "^29.5.0",
+    "husky": "^3.0.3",
+    "jest": "^29.5.0"
   },
   "scripts": {
-    "build": "parcel build ./src/index.ts --no-source-maps --target=node --bundle-node-modules",
+    "build": "ncc build src/index.ts -o dist --transpile-only --minify",
     "test": "jest",
     "test:watch": "yarn test --watch",
     "changeset": "changeset",
@@ -21,32 +31,22 @@
     "release": "node ./scripts/release.js"
   },
   "engines": {
-    "node": ">= 16"
+    "node": ">= 20"
   },
   "dependencies": {
     "@actions/core": "^1.10.0",
     "@actions/exec": "^1.1.1",
     "@actions/github": "^5.1.1",
-    "@babel/core": "^7.13.10",
-    "@babel/preset-env": "^7.13.10",
-    "@babel/preset-typescript": "^7.13.0",
     "@changesets/pre": "^1.0.9",
     "@changesets/read": "^0.5.3",
     "@manypkg/get-packages": "^1.1.3",
-    "@octokit/plugin-throttling": "5.1.1",
-    "@types/fs-extra": "^8.0.0",
-    "@types/jest": "^24.0.18",
-    "@types/node": "^12.7.1",
-    "@types/semver": "^6.0.2",
-    "babel-jest": "^24.9.0",
+    "@octokit/plugin-throttling": "^5.2.1",
     "fs-extra": "^8.1.0",
-    "husky": "^3.0.3",
-    "jest": "^24.9.0",
     "mdast-util-to-string": "^1.0.6",
     "remark-parse": "^7.0.1",
     "remark-stringify": "^7.0.3",
     "resolve-from": "^5.0.0",
-    "semver": "^6.3.0",
+    "semver": "^7.5.3",
     "unified": "^8.3.2"
   },
   "husky": {
@@ -54,6 +54,8 @@
   },
   "prettier": {},
   "resolutions": {
-    "**/@octokit/core": "4.2.0"
+    "**/@octokit/core": "4.2.0",
+    "trim": "^0.0.3",
+    "y18n": "^4.0.1"
   }
 }

src/__snapshots__/run.test.ts.snap

@@ -1,8 +1,8 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`version creates simple PR 1`] = `
-Array [
-  Object {
+[
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
@@ -34,8 +34,8 @@ Array [
 `;
 
 exports[`version does not include any release information if a message with simplified release info exceeds size limit 1`] = `
-Array [
-  Object {
+[
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
@@ -52,8 +52,8 @@ Array [
 `;
 
 exports[`version does not include changelog entries if full message exceeds size limit 1`] = `
-Array [
-  Object {
+[
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
@@ -74,8 +74,8 @@ Array [
 `;
 
 exports[`version doesn't include ignored package that got a dependency update in the PR body 1`] = `
-Array [
-  Object {
+[
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 
@@ -96,8 +96,8 @@ Array [
 `;
 
 exports[`version only includes bumped packages in the PR body 1`] = `
-Array [
-  Object {
+[
+  {
     "base": "some-branch",
     "body": "This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to some-branch, this PR will be updated.
 

src/__snapshots__/utils.test.ts.snap

@@ -1,18 +1,18 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`it sorts the things right 1`] = `
-Array [
-  Object {
+[
+  {
     "highestLevel": 3,
     "name": "c",
     "private": false,
   },
-  Object {
+  {
     "highestLevel": 1,
     "name": "b",
     "private": false,
   },
-  Object {
+  {
     "highestLevel": 3,
     "name": "a",
     "private": true,

src/readChangesetState.ts

@@ -11,17 +11,19 @@ export default async function readChangesetState(
   cwd: string = process.cwd()
 ): Promise<ChangesetState> {
   let preState = await readPreState(cwd);
-  let isInPreMode = preState !== undefined && preState.mode === "pre";
-
   let changesets = await readChangesets(cwd);
 
-  if (isInPreMode) {
+  if (preState !== undefined && preState.mode === "pre") {
     let changesetsToFilter = new Set(preState.changesets);
-    changesets = changesets.filter((x) => !changesetsToFilter.has(x.id));
+
+    return {
+      preState,
+      changesets: changesets.filter((x) => !changesetsToFilter.has(x.id)),
+    };
   }
 
   return {
-    preState: isInPreMode ? preState : undefined,
+    preState: undefined,
     changesets,
   };
 }

src/run.test.ts

@@ -1,5 +1,6 @@
 import fixturez from "fixturez";
 import * as github from "@actions/github";
+import * as githubUtils from "@actions/github/lib/utils";
 import fs from "fs-extra";
 import path from "path";
 import writeChangeset from "@changesets/write";
@@ -15,7 +16,19 @@ jest.mock("@actions/github", () => ({
     ref: "refs/heads/some-branch",
     sha: "xeac7",
   },
-  getOctokit: jest.fn(),
+}));
+jest.mock("@actions/github/lib/utils", () => ({
+    GitHub: {
+        plugin: () => {
+            // function necessary to be used as constructor
+            return function() {
+                return {
+                    rest: mockedGithubMethods,
+                }
+            }
+        },
+    },
+    getOctokitOptions: jest.fn(),
 }));
 jest.mock("./gitUtils");
 
@@ -30,9 +43,6 @@ let mockedGithubMethods = {
     createRelease: jest.fn(),
   },
 };
-(github.getOctokit as any).mockImplementation(() => ({
-  rest: mockedGithubMethods,
-}));
 
 let f = fixturez(__dirname);
 

src/run.ts

@@ -17,8 +17,6 @@ import * as gitUtils from "./gitUtils";
 import readChangesetState from "./readChangesetState";
 import resolveFrom from "resolve-from";
 import { throttling } from "@octokit/plugin-throttling";
-// temporary workaround for https://github.com/octokit/plugin-throttling.js/pull/590
-import type {} from "@octokit/plugin-throttling/dist-types/types.d";
 
 // GitHub Issues/PRs messages have a max size limit on the
 // message body payload.
@@ -26,64 +24,8 @@ import type {} from "@octokit/plugin-throttling/dist-types/types.d";
 // To avoid that, we ensure to cap the message to 60k chars.
 const MAX_CHARACTERS_PER_MESSAGE = 60000;
 
-const createRelease = async (
-  octokit: ReturnType<typeof github.getOctokit>,
-  { pkg, tagName }: { pkg: Package; tagName: string }
-) => {
-  try {
-    let changelogFileName = path.join(pkg.dir, "CHANGELOG.md");
-
-    let changelog = await fs.readFile(changelogFileName, "utf8");
-
-    let changelogEntry = getChangelogEntry(changelog, pkg.packageJson.version);
-    if (!changelogEntry) {
-      // we can find a changelog but not the entry for this version
-      // if this is true, something has probably gone wrong
-      throw new Error(
-        `Could not find changelog entry for ${pkg.packageJson.name}@${pkg.packageJson.version}`
-      );
-    }
-
-    await octokit.rest.repos.createRelease({
-      name: tagName,
-      tag_name: tagName,
-      body: changelogEntry.content,
-      prerelease: pkg.packageJson.version.includes("-"),
-      ...github.context.repo,
-    });
-  } catch (err) {
-    // if we can't find a changelog, the user has probably disabled changelogs
-    if (err.code !== "ENOENT") {
-      throw err;
-    }
-  }
-};
-
-type PublishOptions = {
-  script: string;
-  githubToken: string;
-  createGithubReleases: boolean;
-  cwd?: string;
-};
-
-type PublishedPackage = { name: string; version: string };
-
-type PublishResult =
-  | {
-      published: true;
-      publishedPackages: PublishedPackage[];
-    }
-  | {
-      published: false;
-    };
-
-export async function runPublish({
-  script,
-  githubToken,
-  createGithubReleases,
-  cwd = process.cwd(),
-}: PublishOptions): Promise<PublishResult> {
-  const octokit = new (GitHub.plugin(throttling))(
+const setupOctokit = (githubToken: string) => {
+  return new (GitHub.plugin(throttling))(
     getOctokitOptions(githubToken, {
       throttle: {
         onRateLimit: (retryAfter, options: any, octokit, retryCount) => {
@@ -114,6 +56,71 @@ export async function runPublish({
       },
     })
   );
+};
+
+const createRelease = async (
+  octokit: ReturnType<typeof setupOctokit>,
+  { pkg, tagName }: { pkg: Package; tagName: string }
+) => {
+  try {
+    let changelogFileName = path.join(pkg.dir, "CHANGELOG.md");
+
+    let changelog = await fs.readFile(changelogFileName, "utf8");
+
+    let changelogEntry = getChangelogEntry(changelog, pkg.packageJson.version);
+    if (!changelogEntry) {
+      // we can find a changelog but not the entry for this version
+      // if this is true, something has probably gone wrong
+      throw new Error(
+        `Could not find changelog entry for ${pkg.packageJson.name}@${pkg.packageJson.version}`
+      );
+    }
+
+    await octokit.rest.repos.createRelease({
+      name: tagName,
+      tag_name: tagName,
+      body: changelogEntry.content,
+      prerelease: pkg.packageJson.version.includes("-"),
+      ...github.context.repo,
+    });
+  } catch (err) {
+    // if we can't find a changelog, the user has probably disabled changelogs
+    if (
+      err &&
+      typeof err === "object" &&
+      "code" in err &&
+      err.code !== "ENOENT"
+    ) {
+      throw err;
+    }
+  }
+};
+
+type PublishOptions = {
+  script: string;
+  githubToken: string;
+  createGithubReleases: boolean;
+  cwd?: string;
+};
+
+type PublishedPackage = { name: string; version: string };
+
+type PublishResult =
+  | {
+      published: true;
+      publishedPackages: PublishedPackage[];
+    }
+  | {
+      published: false;
+    };
+
+export async function runPublish({
+  script,
+  githubToken,
+  createGithubReleases,
+  cwd = process.cwd(),
+}: PublishOptions): Promise<PublishResult> {
+  const octokit = setupOctokit(githubToken);
 
   let [publishCommand, ...publishArgs] = script.split(/\s+/);
 
@@ -201,7 +208,12 @@ const requireChangesetsCliPkgJson = (cwd: string) => {
   try {
     return require(resolveFrom(cwd, "@changesets/cli/package.json"));
   } catch (err) {
-    if (err && err.code === "MODULE_NOT_FOUND") {
+    if (
+      err &&
+      typeof err === "object" &&
+      "code" in err &&
+      err.code === "MODULE_NOT_FOUND"
+    ) {
       throw new Error(
         `Have you forgotten to install \`@changesets/cli\` in "${cwd}"?`
       );
@@ -302,10 +314,12 @@ export async function runVersion({
   hasPublishScript = false,
   prBodyMaxCharacters = MAX_CHARACTERS_PER_MESSAGE,
 }: VersionOptions): Promise<RunVersionResult> {
+  const octokit = setupOctokit(githubToken);
+
   let repo = `${github.context.repo.owner}/${github.context.repo.repo}`;
   let branch = github.context.ref.replace("refs/heads/", "");
   let versionBranch = `changeset-release/${branch}`;
-  let octokit = github.getOctokit(githubToken);
+
   let { preState } = await readChangesetState(cwd);
 
   await gitUtils.switchToMaybeExistingBranch(versionBranch);

src/utils.ts

@@ -3,7 +3,6 @@ import remarkParse from "remark-parse";
 import remarkStringify from "remark-stringify";
 // @ts-ignore
 import mdastToString from "mdast-util-to-string";
-import { exec } from "@actions/exec";
 import { getPackages, Package } from "@manypkg/get-packages";
 
 export const BumpLevels = {