Gathering detailed insights and metrics for conventional-changelog-core
Gathering detailed insights and metrics for conventional-changelog-core
Generate changelogs and release notes from a project's commit messages and metadata.
Installations
npm install conventional-changelog-coreDeveloper Guide
BETA
Typescript
No
Module System
ESM
Min. Node Version
>=18
Node Version
18.20.6
NPM Version
10.8.2
Releases
172
conventional-changelog: v7.1.1
conventional-changelog-v7.1.1
Updated on Jul 10, 2025
conventional-changelog-conventionalcommits: v9.1.0
conventional-changelog-conventionalcommits-v9.1.0
Updated on Jul 10, 2025
conventional-changelog-writer: v8.2.0
conventional-changelog-writer-v8.2.0
Updated on Jul 09, 2025
conventional-commits-parser: v6.2.0
conventional-commits-parser-v6.2.0
Updated on Jun 09, 2025
conventional-recommended-bump: v11.2.0
conventional-recommended-bump-v11.2.0
Updated on Jun 07, 2025
conventional-changelog: v7.1.0
conventional-changelog-v7.1.0
Updated on Jun 07, 2025
Languages
3
TypeScript
JavaScript
Handlebars
TypeScript (77.48%)
JavaScript (20.23%)
Handlebars (2.29%)
Developer
conventional-changelog
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
ISC License
8,156 Stars
1,786 Commits
729 Forks
54 Watchers
3 Branches
152 Contributors
Updated on Jul 11, 2025
Maintainers
5
Package Meta Information
Latest Version
9.0.0
Package Id
conventional-changelog-core@9.0.0
Unpacked Size
25.71 kB
Size
7.68 kB
File Count
8
NPM Version
10.8.2
Node Version
18.20.6
Published on
Feb 16, 2025
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
You are probably looking for the cli module. Or use one of the plugins if you are already using the tool: grunt/gulp/atom.
Usage
1$ npm install --save conventional-changelog-core
1import conventionalChangelogCore from 'conventional-changelog-core'; 2 3conventionalChangelogCore() 4 .pipe(process.stdout); // or any writable stream
API
conventionalChangelogCore([options, [context, [gitRawCommitsOpts, [parserOpts, [writerOpts]]]]])
Returns a readable stream.
Note: options.transform, options.pkg.transform and writerOpts.transform are different. If you have a better naming suggestion, please send a PR.
options
config
Type: promise, function or object
This should serve as default values for other arguments of conventionalChangelogCore so you don't need to rewrite the same or similar config across your projects. Any value in this could be overwritten.
If this is a promise (recommended if async), it should resolve with the config.
If this is a function, it expects a node style callback with the config object.
If this is an object, it is the config object. The config object should include context, gitRawCommitsOpts, parserOpts and writerOpts.
pkg
Type: object
path
Type: string Default: closest package.json.
The location of your "package.json".
transform
Type: function Default: pass through.
A function that takes package.json data as the argument and returns the modified data. Note this is performed before normalizing package.json data. Useful when you need to add a leading 'v' to your version or modify your repository url, etc.
append
Type: boolean Default: false
Should the log be appended to existing data.
releaseCount
Type: number Default: 1
How many releases of changelog you want to generate. It counts from the upcoming release. Useful when you forgot to generate any previous changelog. Set to 0 to regenerate all.
skipUnstable
Type: boolean Default: false
If set, unstable release tags will be skipped, e.g., x.x.x-rc.
debug
Type: function Default: function() {}
A debug function. EG: console.debug.bind(console)
warn
Type: function Default: options.debug
A warn function. EG: grunt.verbose.writeln
transform
Type: function Default: get the version (without leading 'v') from tag and format date.
function(commit, cb)
A transform function that applies after the parser and before the writer.
This is the place to modify the parsed commits.
####### commit
The commit from conventional-commits-parser.
####### cb
Callback when you are done.
####### this
this arg of transform handler of a stream.
outputUnreleased
Type: boolean Default: true if a different version than last release is given. Otherwise false.
If this value is true and context.version equals last release then context.version will be changed to 'Unreleased'.
NOTE: You may want to combine this option with releaseCount set to 0 to always overwrite the whole CHANGELOG. conventional-changelog only outputs a CHANGELOG but doesn't read any existing one.
lernaPackage
Specify a package in lerna-style monorepo that the CHANGELOG should be generated for.
Lerna tags releases in the format foo-package@1.0.0 and assumes that packages
are stored in the directory structure ./packages/foo-package.
tagPrefix
Specify a prefix for the git tag that will be taken into account during the comparison.
For instance if your version tag is prefixed by version/ instead of v you would specify --tagPrefix=version/
context
See the conventional-changelog-writer docs. There are some defaults or changes:
host
Default: normalized host found in package.json.
version
Default: version found in package.json.
owner
Default: extracted from normalized package.json repository.url field.
repository
Default: extracted from normalized package.json repository.url field.
repoUrl
Default: The whole normalized repository url in package.json.
gitSemverTags
Type: array
All git semver tags found in the repository. You can't overwrite this value.
previousTag
Type: string Default: previous semver tag or the first commit hash if no previous tag.
currentTag
Type: string Default: current semver tag or 'v' + version if no current tag.
packageData
Type: object
Your package.json data. You can't overwrite this value.
linkCompare
Type: boolean Default: true if previousTag and currentTag are truthy.
Should link to the page that compares current tag with previous tag?
gitRawCommitsOpts
See the git-raw-commits docs. There are some defaults:
format
Default: '%B%n-hash-%n%H%n-gitTags-%n%d%n-committerDate-%n%ci'
from
Default: based on options.releaseCount.
reverse
Default: true if options.append is truthy.
debug
Type: function Default: options.debug
parserOpts
See the conventional-commits-parser docs.
warn
Default: options.warn
writerOpts
See the conventional-changelog-writer docs. There are some defaults:
finalizeContext
Finalize context is used for generating above context.
NOTE: If you overwrite this value the above context defaults will be gone.
debug
Type: function Default: options.debug
reverse
Default: options.append
doFlush
Default: options.outputUnreleased
Notes for parent modules
This module has options append and releaseCount. However, it doesn't read your previous changelog. Reasons being:
- The old logs is just to be appended or prepended to the newly generated logs, which is a very simple thing that could be done in the parent module.
- We want it to be very flexible for the parent module. You could create a readable stream from the file or you could just read the file.
- We want the duty of this module to be very minimum.
So, when you build a parent module, you need to read the old logs and append or prepend to them based on options.append. However, if options.releaseCount is 0 you need to ignore any previous logs. Please see conventional-github-releaser as an example.
Arguments passed to conventionalChangelogCore will be mutated.
License
MIT
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE.md:0
- Info: FSF or OSI recognized license: ISC License: LICENSE.md:0
Reason
1 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99
Reason
Found 2/25 approved changesets -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/checks.yml:1
- Warn: no topLevel permission defined: .github/workflows/commit.yml:1
- Warn: no topLevel permission defined: .github/workflows/release.yml:1
- Warn: no topLevel permission defined: .github/workflows/tests.yaml:1
- Info: no jobLevel write permissions found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/checks.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/checks.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/checks.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/checks.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/checks.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/checks.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/checks.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/checks.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/checks.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/checks.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/commit.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/commit.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/commit.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/commit.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/commit.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/commit.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/release.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/release.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/release.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/release.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:85: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/tests.yaml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/tests.yaml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/tests.yaml:113: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/tests.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/tests.yaml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/tests.yaml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yaml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/tests.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/conventional-changelog/conventional-changelog/tests.yaml/master?enable=pin
- Info: 0 out of 17 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 14 third-party GitHubAction dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 10 are checked with a SAST tool
Score
4.7
/10
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More