fix(deps): Require find-versions ^4.0.0 (#1722)

This new version includes a fix for a ReDoS vulnerability in
`semver-regex` that is flagged by some source composition analysis tools
like Snyk:

https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1047770

It's a major version because it drops support for Node.js 6.x. This
doesn't affect us since we already require Node.js >=10.18.

docs/extending/plugins-list.md

@@ -113,3 +113,14 @@
   - `verifyConditions`: Verify the presence and the validity of the npm authentication and release configuration for multiple registries
   - `prepare`: Update the package.json version and create the npm package tarball
   - `publish`: Publish the package on the npm registry for multiple registries
+- [semantic-release-license](https://github.com/cbhq/semantic-release-license) Automatically update dates and more in your license file for new releases.
+  - `verifyConditions`: Verify the presence of a license file
+  - `prepare`: Update the license file based on its type
+- [semantic-release-pypi](https://github.com/abichinger/semantic-release-pypi)
+  - `verifyConditions`: Verify the environment variable ```PYPI_TOKEN``` and installation of build tools
+  - `prepare`: Update the version in ```setup.cfg``` and create the distribution packages
+  - `publish`: Publish the python package to a repository (default: pypi)
+- [semantic-release-helm](https://github.com/m1pl/semantic-release-helm)
+  - `verifyConditions`: Validate configuration and (if present) credentials
+  - `prepare`: Update version and appVersion in ```Chart.yaml```
+  - `publish`: Publish the chart to a registry (if configured)

docs/recipes/github-actions.md

@@ -4,7 +4,7 @@
 
 The [Authentication](../usage/ci-configuration.md#authentication) environment variables can be configured with [Secret Variables](https://help.github.com/en/articles/virtual-environments-for-github-actions#creating-and-using-secrets-encrypted-variables).
 
-In this example an [`NPM_TOKEN`](https://docs.npmjs.com/creating-and-viewing-authentication-tokens) is required to publish a package to the npm registry. GitHub Actions [automatically populate](https://help.github.com/en/articles/virtual-environments-for-github-actions#github_token-secret) a [`GITHUB_TOKEN`](https://help.github.com/en/articles/creating-a-personal-access-token-for-the-command-line) environment variable which can be used in Workflows.
+In this example a publish type [`NPM_TOKEN`](https://docs.npmjs.com/creating-and-viewing-authentication-tokens) is required to publish a package to the npm registry. GitHub Actions [automatically populate](https://help.github.com/en/articles/virtual-environments-for-github-actions#github_token-secret) a [`GITHUB_TOKEN`](https://help.github.com/en/articles/creating-a-personal-access-token-for-the-command-line) environment variable which can be used in Workflows.
 
 ## Node project configuration
 

lib/hide-sensitive.js

@@ -12,7 +12,7 @@ module.exports = (env) => {
   });
 
   const regexp = new RegExp(
-    toReplace.map((envVar) => `${escapeRegExp(env[envVar])}|${encodeURI(escapeRegExp(env[envVar]))}`).join('|'),
+    toReplace.map((envVar) => `${escapeRegExp(env[envVar])}|${escapeRegExp(encodeURI(env[envVar]))}`).join('|'),
     'g'
   );
   return (output) =>

media/semantic-release-logo.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="530px" height="500px" viewBox="0 0 530 500" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <title>semantic-release-logo</title>
+    <desc>Created with Sketch.</desc>
+    <g id="semantic-release-logo" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
+        <path d="M265,300 C237.385763,300 215,277.614237 215,250 C215,222.385763 237.385763,200 265,200 C292.614237,200 315,222.385763 315,250 C315,277.614237 292.614237,300 265,300 Z M265,285 C284.329966,285 300,269.329966 300,250 C300,230.670034 284.329966,215 265,215 C245.670034,215 230,230.670034 230,250 C230,269.329966 245.670034,285 265,285 Z M189.000329,65.2403903 C188.735843,74.8097173 187.789784,91.8126705 189.063568,101.364143 C190.525406,112.325741 210.229645,156.413574 224,182.11536 C205.822021,168.897491 166.460815,138.916283 154.532196,124.016029 C144.386757,111.343179 140.471577,101.013967 138.27655,94.5257779 L67.4936491,135.392305 L67.4936491,221.416812 C75.70945,226.485387 89.6365324,235.558433 98.3968671,239.169872 C108.620808,243.384682 156.654111,248.364228 185.797688,249.289643 C165.261689,258.4233 119.616597,277.5205 100.74829,280.400861 C85.0249878,282.801118 74.2405506,281.146683 67.4936491,279.815488 L67.4936491,364.607695 L136.385575,404.382467 C144.921121,399.789873 159.526093,392.355786 166.960336,386.631446 C175.722439,379.884659 204.051503,340.77637 219.424725,316 C217.066704,338.351526 210.782819,387.429934 203.843131,405.210548 C198.129099,419.850831 191.397729,428.335995 186.871704,433.530648 L266,479.21539 L339.488885,436.786563 C339.680455,427.59622 340.80544,409.239923 339.462313,399.168483 C338.000475,388.206886 318.296236,344.119052 304.525881,318.417266 C322.70386,331.635135 362.065066,361.616344 373.993685,376.516597 C384.808925,390.026108 388.544108,400.872311 390.662883,407.241241 L464.506351,364.607695 L464.506351,280.839881 C456.814912,276.224155 441.003684,265.702718 431.400821,261.743946 C421.17688,257.529136 373.143577,252.549591 344,251.624176 C364.535999,242.490519 410.181091,223.393319 429.049398,220.512958 C446.610988,217.832076 458.01135,220.209416 464.506351,221.544989 L464.506351,135.392305 L395.40349,95.4957494 C387.052842,100.028294 371.568068,107.82975 363.837352,113.782373 C355.075249,120.52916 326.746185,159.637448 311.372963,184.413819 C313.730984,162.062293 320.014869,112.983884 326.954557,95.2032704 C332.946763,79.8502605 340.057772,71.2662505 344.570949,66.147568 L266,20.7846097 L189.000329,65.2403903 L189.000329,65.2403903 Z M266,0 L482.506351,125 L482.506351,375 L266,500 L49.4936491,375 L49.4936491,125 L266,0 Z" id="semantic-release-logo-shape" fill="#494949" fill-rule="nonzero"></path>
+    </g>
+</svg>

package.json

@@ -31,7 +31,7 @@
     "env-ci": "^5.0.0",
     "execa": "^4.0.0",
     "figures": "^3.0.0",
-    "find-versions": "^3.0.0",
+    "find-versions": "^4.0.0",
     "get-stream": "^5.0.0",
     "git-log-parser": "^1.2.0",
     "hook-std": "^2.0.0",

test/hide-sensitive.test.js

@@ -40,6 +40,14 @@ test('Escape regexp special characters', (t) => {
   );
 });
 
+test('Escape regexp special characters in url-encoded environment variable', (t) => {
+  const env = {SOME_PASSWORD: 'secret password p$^{.+}\\w[a-z]o.*rd)('};
+  t.is(
+    hideSensitive(env)(`https://user:${encodeURI(env.SOME_PASSWORD)}@host.com`),
+    `https://user:${SECRET_REPLACEMENT}@host.com`
+  );
+});
+
 test('Accept "undefined" input', (t) => {
   t.is(hideSensitive({})(), undefined);
 });