Installations
npm install changelog-maker
Developer Guide
Typescript
No
Module System
ESM
Node Version
22.13.0
NPM Version
10.9.2
Score
66.7
Supply Chain
92.7
Quality
88.8
Maintenance
50
Vulnerability
97
License
Releases
Contributors
Languages
JavaScript (100%)
Love this project? Help keep it running — sponsor us today! 🚀
Developer
nodejs
Download Statistics
Total Downloads
838,719
Last Day
482
Last Week
2,943
Last Month
12,762
Last Year
178,032
GitHub Statistics
MIT License
233 Stars
231 Commits
41 Forks
15 Watchers
3 Branches
38 Contributors
Updated on Jan 27, 2025
Package Meta Information
Latest Version
4.3.3
Package Id
changelog-maker@4.3.3
Unpacked Size
53.83 kB
Size
16.15 kB
File Count
17
NPM Version
10.9.2
Node Version
22.13.0
Published on
Jan 27, 2025
Total Downloads
Cumulative downloads
Total Downloads
838,719
Last Day
32.1%
482
Compared to previous day
Last Week
51.5%
2,943
Compared to previous week
Last Month
-12.5%
12,762
Compared to previous month
Last Year
53.1%
178,032
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
changelog-maker 
A git log to CHANGELOG.md tool
Eh?
changelog-maker is a formalisation of the Node.js CHANGELOG.md entry process but flexible enough to be used on other repositories.
changelog-maker will look at the git log of the current directory, pulling entries since the last tag. Commits with just a version number in the summary are removed, as are commits prior to, and including summaries that say working on <version>
(this is an io.js / Node ism).
After collecting the list of commits, any that have PR-URL: <url>
in them are looked up on GitHub and the labels of the pull request are collected, specifically looking for labels that start with semver
(the assumption is that semver-minor
, semver-major
labels are used to indicate non-patch version bumps).
Finally, the list is formatted as Markdown and printed to stdout.
Each commit will come out something like this (on one line):
1* [[`20f8e7f17a`](https://github.com/nodejs/io.js/commit/20f8e7f17a)] - 2 **test**: remove flaky test functionality (Rod Vagg) 3 [#812](https://github.com/nodejs/io.js/pull/812)
Note:
- When running
changelog-maker
on the command-line, the default GitHub repo is computed from thepackage.json
that exists oncwd
, otherwise fallback tonodejs/node
, you can change this by supplying the user/org as the first argument and project as the second. e.gchangelog-maker joyent node
. - Commit links will go to the assumed repo (default: nodejs/node)
- If a commit summary starts with a word, followed by a
:
, this is treated as a special label and rendered in bold - Commits that have
semver*
labels on the pull request referred to in theirPR-URL
have those labels printed out at the start of the summary, in bold, upper cased. - Pull request URLs come from the
PR-URL
data, if it matches the assumed repo (default: nodejs/node) then just a#
followed by the number, if another repo then a fulluser/project#number
.
When printing to a console some special behaviours are invoked:
- Commits with a summary that starts with
doc:
are rendered in grey - Commits that have a
semver*
label on the pull request referred to in theirPR-URL
are rendered in bold green
Install
1npm i changelog-maker -g
Usage
changelog-maker [--plaintext|p] [--markdown|md] [--sha] [--group|-g] [--reverse] [--find-matching-prs] [--commit-url=<url/with/{ref}>] [--start-ref=<ref>] [--end-ref=<ref>] [github-user[, github-project]]
github-user
and github-project
should point to the GitHub repository that can be used to find the PR-URL
data if just an issue number is provided and will also impact how the PR-URL issue numbers are displayed
--format
: dictates what formatting the output will have. Possible options are:simple
,markdown
,plaintext
,messageonly
andsha
. The default is to print asimple
output suitable for stdout.simple
: don't print full markdown output, good for console printing without the additional fluff.sha
: print only the 10-character truncated commit hashes.plaintext
: a very simple form, without commit details, implies--group
.markdown
: a Markdown formatted from, with links and proper escaping.messageonly
: displays the commit message only, implies--group
--sha
: same as--format=sha
.--plaintext
: same as--format=plaintext
.--markdown
: same as--format=markdown
.--messageonly
: same as--format=messageonly
.--group
: reorder commits so that they are listed in groups where thexyz:
prefix of the commit message defines the group. Commits are listed in original order within group.--reverse
: reverse the order of commits when printed, does not work with--reverse
--commit-url
: pass in a url template which will be used to generate commit URLs for a repository not hosted in Github.{ref}
is the placeholder that will be replaced with the commit, i.e.--commit-url=https://gitlab.com/myUser/myRepo/commit/{ref}
--start-ref=<ref>
: use the given git<ref>
as a starting point rather than the last tag. The<ref>
can be anything commit-ish including a commit sha, tag, branch name. If you specify a--start-ref
argument the commit log will not be pruned so that version commits andworking on <version>
commits are left in the list.--end-ref=<ref>
: use the given git<ref>
as a end-point rather than the now. The<ref>
can be anything commit-ish including a commit sha, tag, branch name.--filter-release
: exclude Node-style release commits from the list. e.g. "Working on v1.0.0" or "2015-10-21 Version 2.0.0" and also "npm version X" style commits containing only anx.y.z
semver designator.--find-matching-prs
: use the GitHub API to find the pull requests that match commits that don't have thePR-URL
metadata in their message text. Without metadata, it may be necessary to also pass the org/user and repo name on the commandline (as thegithub-user
andgithub-project
arguments as demonstrated above, it may also be necessary to use--find-matching-prs=true
in this case).--quiet
or-q
: do not print toprocess.stdout
--all
or-a
: process all commits since beginning, instead of last tag.--help
or-h
: show usage and help.
Development
Tests require GitHub authentication in order to fetch pull request metadata. ghauth will generate, store and load a personal access token in your local user configuration when changelog-maker is run during normal operation. To run the tests, you will need to ensure that you have a token in place. There are two ways to do this:
-
Run
node ./changelog-maker.js -a
to cause changelog-maker to fetch metadata on a commit with aPR-URL
. -
Manually generate a personal access token with
public_repo
scope. Then create a config.json file:1{ 2 "user": "MY_GITHUB_USERNAME", 3 "token": "MY_SECRET_TOKEN" 4}
user
is your username, andtoken
is the token you generated above. The location ofconfig.json
depends on the OS, please see https://github.com/LinusU/node-application-config#config-location
License
changelog-maker is Copyright (c) 2015 Rod Vagg @rvagg and licenced under the MIT licence. All rights not explicitly granted in the MIT license are reserved. See the included LICENSE.md file for more details.

No vulnerabilities found.
Reason
no binaries found in the repo
Reason
no dangerous workflow patterns detected
Reason
17 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE.md:0
- Info: FSF or OSI recognized license: MIT License: LICENSE.md:0
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/nodejs/.github/SECURITY.md:1
- Info: Found linked content: github.com/nodejs/.github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/nodejs/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/nodejs/.github/SECURITY.md:1
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/test-and-release.yml:46
Reason
Found 5/19 approved changesets -- score normalized to 2
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-and-release.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/changelog-maker/test-and-release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-and-release.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/changelog-maker/test-and-release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-and-release.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/changelog-maker/test-and-release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-and-release.yml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/changelog-maker/test-and-release.yml/main?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/test-and-release.yml:41
- Warn: npmCommand not pinned by hash: .github/workflows/test-and-release.yml:64
- Warn: npmCommand not pinned by hash: .github/workflows/test-and-release.yml:70
- Info: 0 out of 4 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 3 npmCommand dependencies pinned
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/test-and-release.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 16 are checked with a SAST tool
Score
6
/10
Last Scanned on 2025-02-10
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn MoreOther packages similar to changelog-maker
@bengl/changelog-maker
A git log to CHANGELOG.md tool
@agilgur5/changelog-maker
A git log to release changelog tool
@bscotch/gamemaker-releases
Utility for combining GameMaker release data into a single feed.
github-changelogs-maker
Generate changelogs between 2 latest releases