Gathering detailed insights and metrics for semantic-release
Gathering detailed insights and metrics for semantic-release
Gathering detailed insights and metrics for semantic-release
Gathering detailed insights and metrics for semantic-release
@semantic-release/npm
semantic-release plugin to publish a npm package
@semantic-release/github
semantic-release plugin to publish a GitHub release and comment on released Pull Requests/Issues
@semantic-release/release-notes-generator
semantic-release plugin to generate changelog content with conventional-changelog
@semantic-release/error
errors with more than just a message
📦🚀 Fully automated version management and package publishing
npm install semantic-release
Typescript
Module System
Min. Node Version
Node Version
NPM Version
v24.2.7
Updated on Jul 11, 2025
v25.0.0-alpha.4
Updated on Jul 10, 2025
v25.0.0-alpha.3
Updated on Jul 10, 2025
v25.0.0-alpha.2
Updated on Jul 09, 2025
v25.0.0-alpha.1
Updated on Jul 09, 2025
v25.0.0-beta.3
Updated on Jul 03, 2025
JavaScript (100%)
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
MIT License
22,223 Stars
1,807 Commits
1,747 Forks
59 Watchers
14 Branches
245 Contributors
Updated on Jul 13, 2025
Latest Version
24.2.7
Package Id
semantic-release@24.2.7
Unpacked Size
285.93 kB
Size
72.32 kB
File Count
66
NPM Version
10.9.3
Node Version
22.17.0
Published on
Jul 11, 2025
Cumulative downloads
Total Downloads
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
29
semantic-release automates the whole package release workflow including: determining the next version number, generating the release notes, and publishing the package.
This removes the immediate connection between human emotions and version numbers, strictly following the Semantic Versioning specification and communicating the impact of changes to consumers.
Trust us, this will change your workflow for the better. – egghead.io
semantic-release uses the commit messages to determine the consumer impact of changes in the codebase. Following formalized conventions for commit messages, semantic-release automatically determines the next semantic version number, generates a changelog and publishes the release.
By default, semantic-release uses Angular Commit Message Conventions.
The commit message format can be changed with the preset
or config
options of the @semantic-release/commit-analyzer and @semantic-release/release-notes-generator plugins.
Tools such as commitizen or commitlint can be used to help contributors and enforce valid commit messages.
The table below shows which commit message gets you which release type when semantic-release
runs (using the default configuration):
Commit message | Release type |
---|---|
fix(pencil): stop graphite breaking when too much pressure applied | |
feat(pencil): add 'graphiteWidth' option | |
perf(pencil): remove graphiteWidth option BREAKING CHANGE: The graphiteWidth option has been removed. The default graphite width of 10mm is always used for performance reasons. | (Note that the BREAKING CHANGE: token must be in the footer of the commit) |
semantic-release is meant to be executed on the CI environment after every successful build on the release branch. This way no human is directly involved in the release process and the releases are guaranteed to be unromantic and unsentimental.
For each new commit added to one of the release branches (for example: master
, main
, next
, beta
), with git push
or by merging a pull request or merging from another branch, a CI build is triggered and runs the semantic-release
command to make a release if there are codebase changes since the last release that affect the package functionalities.
semantic-release offers various ways to control the timing, the content and the audience of published releases. See example workflows in the following recipes:
After running the tests, the command semantic-release
will execute the following steps:
Step | Description |
---|---|
Verify Conditions | Verify all the conditions to proceed with the release. |
Get last release | Obtain the commit corresponding to the last release by analyzing Git tags. |
Analyze commits | Determine the type of release based on the commits added since the last release. |
Verify release | Verify the release conformity. |
Generate notes | Generate release notes for the commits added since the last release. |
Create Git tag | Create a Git tag corresponding to the new release version. |
Prepare | Prepare the release. |
Publish | Publish the release. |
Notify | Notify of new releases or errors. |
In order to use semantic-release you need:
Let people know that your package is published using semantic-release and which commit-convention is followed by including this badge in your readme.
1[](https://github.com/semantic-release/semantic-release)
![]() | ![]() | ![]() |
---|---|---|
Gregor Martynus | Pierre Vanduynslager | Matt Travi |
![]() | ![]() | ![]() | ![]() | ![]() |
---|---|---|---|---|
Stephan Bönnemann | Rolf Erik Lekang | Johannes Jörg Schmidt | Finn Pauls | Christoph Witzko |
8.1/10
Summary
Secret disclosure when containing characters that become URI encoded
Affected Versions
<= 17.2.2
Patched Versions
17.2.3
4.4/10
Summary
Exposure of Sensitive Information to an Unauthorized Actor in semantic-release
Affected Versions
>= 17.0.4, < 19.0.3
Patched Versions
19.0.3
Reason
no dangerous workflow patterns detected
Reason
30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Reason
all changesets reviewed
Reason
no binaries found in the repo
Reason
GitHub workflow tokens follow principle of least privilege
Details
Reason
update tool detected
Details
Reason
license file detected
Details
Reason
packaging workflow detected
Details
Reason
security policy file detected
Details
Reason
0 existing vulnerabilities detected
Reason
30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Reason
project has 29 contributing companies or organizations
Details
Reason
SAST tool is not run on all commits -- score normalized to 9
Details
Reason
dependency not pinned by hash detected -- score normalized to 4
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
Score
Last Scanned on 2025-07-12T21:47:57Z
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More