🦋 A way to manage your versioning and changelogs with a focus on monorepos
Installations
npm install @changesets/get-dependents-graphReleases
@changesets/release-utils@0.2.2
Published on 20 Nov 2024
@changesets/read@0.6.2
Published on 20 Nov 2024
@changesets/config@3.0.4
Published on 20 Nov 2024
@changesets/git@3.0.2
Published on 20 Nov 2024
@changesets/get-release-plan@4.0.5
Published on 20 Nov 2024
@changesets/cli@2.27.10
Published on 20 Nov 2024
Developer
changesets
Developer Guide
Module System
CommonJS, ESM
Min. Node Version
Typescript Support
Yes
Node Version
20.17.0
NPM Version
10.8.2
Statistics
9,057 Stars
593 Commits
562 Forks
34 Watching
41 Branches
140 Contributors
Updated on 27 Nov 2024
Languages
TypeScript (99.84%)
JavaScript (0.16%)
Total Downloads
Cumulative downloads
Total Downloads
64,798,972
Last day
23.9%
278,932
Compared to previous day
Last week
8.9%
1,344,233
Compared to previous week
Last month
12.2%
5,269,556
Compared to previous month
Last year
119.8%
37,924,226
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dev Dependencies
1
A tool to manage versioning and changelogs
with a focus on multi-package repositories
The changesets workflow is designed to help when people are making changes, all the way through to publishing. It lets contributors declare how their changes should be released, then we automate updating package versions, and changelogs, and publishing new versions of packages based on the provided information.
Changesets has a focus on solving these problems for multi-package repositories, and keeps packages that rely on each other within the multi-package repository up-to-date, as well as making it easy to make changes to groups of packages.
How do we do that?
A changeset is an intent to release a set of packages at particular semver bump types with a summary of the changes made.
The @changesets/cli package allows you to write changeset files as you make changes, then combine any number of changesets into a release, that flattens the bump-types into a single release per package, handles internal dependencies in a multi-package-repository, and updates changelogs, as well as release all updated packages from a mono-repository with one command.
How do I get started?
If you just want to jump in to using changesets, the Intro to using changesets and @changesets/cli docs are where you should head.
If you want a detailed explanation of the concepts behind changesets, or to understand how you would build on top of changesets, check out our detailed-explanation.
We also have a dictionary.
Integrating with CI
While changesets can be an entirely manual process, we recommend integrating it with how your CI works.
To check that PRs contain a changeset, we recommend using the changeset bot, or if you want to fail builds on a changesets failure, run yarn changeset status in CI.
To make releasing easier, you can use this changesets github action to automate creating versioning pull requests, and optionally publishing packages.
Documentation
- Intro to using changesets
- Detailed explanation
- Common questions
- Adding a changeset
- Automating changesets
- Checking for changesets
- Command line options
- Config file options
- Decisions
- Dictionary
- Fixed packages
- Linked packages
- Modifying changelog format
- Prereleases
- Problems publishing in monorepos
- Snapshot releases
- Versioning applications and other non-npm packages
- Experimental Options
Cool Projects already using Changesets for versioning and changelogs
- atlaskit
- emotion
- keystone
- react-select
- XState
- pnpm
- filbert-js
- tinyhttp
- Firebase Javascript SDK
- Formik
- MobX
- Nhost
- verdaccio
- Chakra UI
- Astro
- SvelteKit
- Hydrogen
- react-pdf
- GraphQL Code Generator
- GraphQL Yoga
- GraphQL-Mesh
- GraphiQL
- wagmi
- refine
- Modern Web
- Atomizer
- Medusa
- OpenZeppelin Contracts
- Block Protocol
- Remix
- Clerk
- Hey API
- neverthrow
Thanks/Inspiration
- bolt - Brought us a strong concept of how packages in a mono-repo should be able to interconnect, and provided the initial infrastructure to get inter-package information.
- Atlassian - The original idea/sponsor of the changesets code, and where many of the ideas and processes were fermented. It was originally implemented by the team behind atlaskit.
- lerna-semantic-release - put down many of the initial patterns around updating packages within a multi-package-repository, and started us thinking about how to manage dependent packages.
- Thinkmill - For sponsoring the focused open sourcing of this project, and the version two rearchitecture.
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
all changesets reviewed
Reason
30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Warn: no linked content found
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/changeset-version.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:9
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/changeset-version.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/changesets/changesets/changeset-version.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/changeset-version.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/changesets/changesets/changeset-version.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/changesets/changesets/ci.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/changesets/changesets/ci.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/changesets/changesets/ci.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/changesets/changesets/ci.yml/main?enable=pin
- Info: 0 out of 4 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 2 third-party GitHubAction dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 30 are checked with a SAST tool
Reason
25 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-v88g-cgmw-v5xw
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-4q6p-r6v2-jvc5
- Warn: Project is vulnerable to: GHSA-ww39-953v-wcq6
- Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
- Warn: Project is vulnerable to: GHSA-qqgx-2p2h-9c37
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m / GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-w7rc-rwvf-8q5r
- Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
- Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
- Warn: Project is vulnerable to: GHSA-g6ww-v8xp-vmwg
- Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-w5p7-h5w8-2hfq
- Warn: Project is vulnerable to: GHSA-7p7h-4mm5-852v
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-m95q-7qp3-xv42
Score
5.1
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More