fix(deps): update dependency execa to v8 (#2914 )

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
ci(action): update actions/setup-node digest to 5e21ff4 (#2912 )
2023-08-19 17:20:09 -05:00 · 2023-08-17 15:12:45 +00:00 · 2023-08-16 23:05:46 +00:00 · 2023-08-15 16:35:49 +00:00 · 2023-08-14 16:54:11 +00:00 · 2023-08-14 12:16:26 +00:00
25 changed files with 2421 additions and 13020 deletions
@@ -1,2 +1,4 @@
 # style: prettier (#2670)
-b06c9bbe4c6be121c5561b356d8c465c1cadffba
+b06c9bbe4c6be121c5561b356d8c465c1cadffba
+# style: upgraded prettier to v3 (#2863)
+272af210523804de782b3076f05e56bcb4aeeb8f
@@ -7,23 +7,27 @@ name: Release
      - beta
      - "*.x"
 permissions:
-  contents: read #  for checkout
+  contents: read # for checkout
 jobs:
  release:
    permissions:
-      contents: write #  to be able to publish a GitHub release
-      issues: write #  to be able to comment on released issues
-      pull-requests: write #  to be able to comment on released pull requests
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
    name: release
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
        with:
          cache: npm
          node-version: lts/*
-      - run: npm ci
-      - run: npx semantic-release
+      - run: npm clean-install
+      - run: npm audit signatures
+      # pinned version updated automatically by Renovate.
+      # details at https://semantic-release.gitbook.io/semantic-release/usage/installation#global-installation
+      - run: npx semantic-release@21.0.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.SEMANTIC_RELEASE_BOT_NPM_TOKEN }}
@@ -0,0 +1,36 @@
+name: OpenSSF Scorecard
+"on":
+  schedule:
+    - cron: 31 2 * * 1
+  push:
+    branches:
+      - master
+permissions: read-all
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
+      - name: Run analysis
+        uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - name: Upload artifact
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@a09933a12a80f87b87005513f0abb1494c27a716 # v2.21.4
+        with:
+          sarif_file: results.sarif
@@ -24,13 +24,14 @@ jobs:
          - 19

    runs-on: ubuntu-latest
+    timeout-minutes: 10

    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
      - run: git config --global user.name github-actions
      - run: git config --global user.email github-actions@github.com
      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm
@@ -45,10 +46,11 @@ jobs:
    runs-on: ubuntu-latest
    needs: test_matrix
    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
        with:
          node-version: lts/*
          cache: npm
      - run: npm clean-install
+      - run: npm audit signatures
      - run: npm run lint
@@ -9,8 +9,8 @@ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:

-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.

 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
@@ -7,6 +7,9 @@
  <a href="https://github.com/semantic-release/semantic-release/actions?query=workflow%3ATest+branch%3Amaster">
    <img alt="Build states" src="https://github.com/semantic-release/semantic-release/workflows/Test/badge.svg">
  </a>
+  <a href="https://securityscorecards.dev/viewer/?uri=github.com/semantic-release/semantic-release">
+    <img alt="OpenSSF Scorecard" src="https://api.securityscorecards.dev/projects/github.com/semantic-release/semantic-release/badge">
+  </a>
  <a href="#badge">
    <img alt="semantic-release: angular" src="https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release">
  </a>
@@ -41,6 +44,7 @@ This removes the immediate connection between human emotions and version numbers
 - Avoid potential errors associated with manual releases
 - Support any [package managers and languages](docs/recipes/release-workflow/README.md#package-managers-and-languages) via [plugins](docs/usage/plugins.md)
 - Simple and reusable configuration via [shareable configurations](docs/usage/shareable-configurations.md)
+- Support for [npm package provenance](https://github.com/semantic-release/npm#npm-provenance) that promotes increased supply-chain security via signed attestations on GitHub Actions

 ## How does it work?

@@ -3,9 +3,9 @@
 ## Usage

 - [Getting started](docs/usage/getting-started.md#getting-started)
- [Installation](docs/usage/installation.md#installation)
- [CI Configuration](docs/usage/ci-configuration.md#ci-configuration)
- [Configuration](docs/usage/configuration.md#configuration)
+- [Installation](docs/usage/installation.md)
+- [CI Configuration](docs/usage/ci-configuration.md)
+- [Configuration](docs/usage/configuration.md)
 - [Plugins](docs/usage/plugins.md)
 - [Workflow configuration](docs/usage/workflow-configuration.md)
 - [Shareable configurations](docs/usage/shareable-configurations.md)
@@ -6,8 +6,8 @@
 const semanticRelease = require("semantic-release");
 const { WritableStreamBuffer } = require("stream-buffers");

-const stdoutBuffer = WritableStreamBuffer();
-const stderrBuffer = WritableStreamBuffer();
+const stdoutBuffer = new WritableStreamBuffer();
+const stderrBuffer = new WritableStreamBuffer();

 try {
  const result = await semanticRelease(
@@ -142,7 +142,7 @@ Information related to the last release found:
 | gitTag  | `String` | The [Git tag](https://git-scm.com/book/en/v2/Git-Basics-Tagging) associated with the last release.                                  |
 | channel | `String` | The distribution channel on which the last release was initially made available (`undefined` for the default distribution channel). |

-**Notes**: If no previous release is found, `lastRelease` will be an empty `Object`.
+**Note**: If no previous release is found, `lastRelease` will be an empty `Object`.

 Example:

@@ -107,7 +107,7 @@
  - `verifyConditions`: Verify the presence and the validity of the authentication and the assets option configuration.
  - `publish`: Publish a Gitea release, optionally uploading file assets.
  - `addChannel`: Update a Gitea release's pre-release field.
- [@google/semantic-release-replace-plugin](https://github.com/google/semantic-release-replace-plugin)
+- [semantic-release-replace-plugin](https://github.com/jpoehnelt/semantic-release-replace-plugin)
  - `prepare`: Replace version strings in files using regex and glob.
 - [semantic-release-rubygem](https://github.com/Gusto/semantic-release-rubygem)
  - `verifyConditions`: Locate and validate a `.gemspec` file, locate and validate a `lib/**/version.rb` file, verify the presence of the `GEM_HOST_API_KEY` environment variable, and create a credentials file with the API key.
@@ -171,3 +171,14 @@
  - `verifyConditions` Validate configuration, `Cargo.toml`, and local cargo executable. Also, logs in into `crates.io`.
  - `prepare` Write the new version number into `Cargo.toml` file and perform `cargo check` if configured.
  - `publish` Publish the Rust crate to `crates.io`
+- [semantic-release-coralogix](https://github.com/adobe/semantic-release-coralogix)
+  - `verifyConditions` Verified that required credentials are provided and API is accessible
+  - `publish` add a release tag to Coralogix
+- [semantic-release-major-tag](https://github.com/doteric/semantic-release-major-tag)
+  - `success` Create major version tag, for example `v1`.
+- [semantic-release-yarn](https://github.com/hongaar/semantic-release-yarn)
+  - **Note**: this is an alternative to the default `@semantic-release/npm` plugin and adds support for monorepos.
+  - `verifyConditions` Verify Yarn 2 or higher is installed, verify the presence of a NPM auth token (either in an environment variable or a `.yarnrc.yml` file) and verify the authentication method is valid.
+  - `prepare` Update the `package.json` version and create the package tarball.
+  - `addChannel` Add a tag for the release.
+  - `publish` Publish to the npm registry.
@@ -6,6 +6,11 @@ The [Authentication](../../usage/ci-configuration.md#authentication) environment

 In this example a publish type [`NPM_TOKEN`](https://docs.npmjs.com/creating-and-viewing-authentication-tokens) is required to publish a package to the npm registry. GitHub Actions [automatically populate](https://help.github.com/en/articles/virtual-environments-for-github-actions#github_token-secret) a [`GITHUB_TOKEN`](https://help.github.com/en/articles/creating-a-personal-access-token-for-the-command-line) environment variable which can be used in Workflows.

+## npm provenance
+
+Since GitHub Actions is a [supported provider](https://docs.npmjs.com/generating-provenance-statements#provenance-limitations) for [npm provenance](https://docs.npmjs.com/generating-provenance-statements), it is recommended to enable this to increase supply-chain security for your npm packages.
+Find more detail about configuring npm to publish with provenance through semantic-release [in the documentation for our npm plugin](https://github.com/semantic-release/npm#npm-provenance).
+
 ## Node project configuration

 [GitHub Actions](https://github.com/features/actions) support [Workflows](https://help.github.com/en/articles/configuring-workflows), allowing to run tests on multiple Node versions and publish a release only when all test pass.
@@ -23,10 +28,19 @@ on:
  push:
    branches:
      - master
+
+permissions:
+  contents: read # for checkout
+
 jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
    steps:
      - name: Checkout
        uses: actions/checkout@v3
@@ -37,7 +51,9 @@ jobs:
        with:
          node-version: "lts/*"
      - name: Install dependencies
-        run: npm ci
+        run: npm clean-install
+      - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
+        run: npm audit signatures
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -158,14 +158,6 @@ Or with the `publishConfig.access` key in your project's `package.json`:
 }
 ```

-## Can I use semantic-release to publish a package on Artifactory?
-
-Any npm compatible registry is supported with the [`@semantic-release/npm`](https://github.com/semantic-release/npm) plugin. For Artifactory versions prior to 5.4, the legacy authentication has to be used (with `NPM_USERNAME`, `NPM_PASSWORD` and `NPM_EMAIL` [environment variables](https://github.com/semantic-release/npm#environment-variables)).
-
-See [npm registry authentication](https://github.com/semantic-release/npm#npm-registry-authentication) for more details.
-
-See [Artifactory - npm Registry](https://www.jfrog.com/confluence/display/RTF/Npm+Registry#NpmRegistry-AuthenticatingthenpmClient) documentation for Artifactory configuration.
-
 ## Can I manually trigger the release of a specific version?

 You can trigger a release by pushing to your Git repository. You deliberately cannot trigger a _specific_ version release, because this is the whole point of semantic-release.
@@ -14,7 +14,7 @@ See our [Node Support Policy](node-support-policy.md) for our long-term promise
 The recommended approach is to run the `semantic-release` command from a CI job running on the latest available LTS version of node.
 This can either be a job used by your project to test on the latest Node LTS version or a dedicated job for the release steps.

-See [CI configuration](../usage/ci-configuration.md) and [CI configuration recipes](../recipes/release-workflow/README.md#ci-configurations) for more details.
+See [CI configuration](../usage/ci-configuration.md) and [CI configuration recipes](../recipes/ci-configurations/README.md#ci-configurations) for more details.

 ## Alternative solutions

@@ -14,7 +14,7 @@ Here are a few examples of the CI services that can be used to achieve this:
 - [Wercker Workflows](http://devcenter.wercker.com/docs/workflows)
 - [GoCD Pipelines](https://docs.gocd.org/current/introduction/concepts_in_go.html#pipeline).

-See [CI configuration recipes](../recipes/ci-configurations#ci-configurations) for more details.
+See [CI configuration recipes](../recipes/ci-configurations/README.md) for more details.

 ## Authentication

@@ -45,6 +45,6 @@ See each plugin's documentation for the environment variables required.

 The authentication token/credentials have to be made available in the CI service via environment variables.

-See [CI configuration recipes](../recipes/ci-configurations#ci-configurations) for more details on how to configure environment variables in your CI service.
+See [CI configuration recipes](../recipes/ci-configurations/README.md) for more details on how to configure environment variables in your CI service.

 **Note**: The environment variables `GH_TOKEN`, `GITHUB_TOKEN`, `GL_TOKEN` and `GITLAB_TOKEN` can be used for both the Git authentication and the API authentication required by [@semantic-release/github](https://github.com/semantic-release/github) and [@semantic-release/gitlab](https://github.com/semantic-release/gitlab).
@@ -24,9 +24,28 @@ For other type of projects we recommend installing **semantic-release** directly
 $ npx semantic-release
 ```

-**Note**: For a global installation, it's recommended to specify the major **semantic-release** version to install (for example with `npx semantic-release@18`).
-This way your build will not automatically use the next major **semantic-release** release that could possibly break your build.
-You will have to upgrade manually when a new major version is released.
+### Notes

-**Note**: `npx` is a tool bundled with `npm@>=5.2.0`. It is used to conveniently install the semantic-release binary and to execute it.
-See [What is npx](../support/FAQ.md#what-is-npx) for more details.
+1. If you've globally installed **semantic-release** then we recommend that you set the major **semantic-release** version to install.
+   For example, by using `npx semantic-release@18`.
+   This way you control which major version of **semantic-release** is used by your build, and thus avoid breaking the build when there's a new major version of **semantic-release**.
+   This also means you, or a bot, must upgrade **semantic-release** when a new major version is released.
+2. Pinning **semantic-release** to an exact version makes your releases even more deterministic.
+   But pinning also means you, or a bot, must update to newer versions of **semantic-release** more often.
+3. You can use [Renovate's regex manager](https://docs.renovatebot.com/modules/manager/regex/) to get automatic updates for **semantic-release** in either of the above scenarios.
+   Put this in your Renovate configuration file:
+   ```json
+   {
+     "regexManagers": [
+       {
+         "description": "Update semantic-release version used by npx",
+         "fileMatch": ["^\\.github/workflows/[^/]+\\.ya?ml$"],
+         "matchStrings": ["\\srun: npx semantic-release@(?<currentValue>.*?)\\s"],
+         "datasourceTemplate": "npm",
+         "depNameTemplate": "semantic-release"
+       }
+     ]
+   }
+   ```
+4. `npx` is a tool bundled with `npm@>=5.2.0`. You can use it to install (and run) the **semantic-release** binary.
+   See [What is npx](../support/FAQ.md#what-is-npx) for more details.
@@ -30,7 +30,11 @@ export default ({ branch, options: { tagFormat } }, { before } = {}) => {
  const [{ version, gitTag, channels } = {}] = branch.tags
    .filter(
      (tag) =>
-        ((branch.type === "prerelease" && tag.channels.some((channel) => isSameChannel(branch.channel, channel))) ||
+        ((branch.type === "prerelease" &&
+          tag.channels.some((channel) => isSameChannel(branch.channel, channel)) &&
+          semver
+            .parse(tag.version)
+            .prerelease.includes(branch.prerelease === true ? branch.name : branch.prerelease)) ||
          !semver.prerelease(tag.version)) &&
        (isUndefined(before) || semver.lt(tag.version, before))
    )
@@ -26,16 +26,16 @@
    "Matt Travi <npm@travi.org> (https://matt.travi.org/)"
  ],
  "dependencies": {
-    "@semantic-release/commit-analyzer": "^9.0.2",
-    "@semantic-release/error": "^3.0.0",
-    "@semantic-release/github": "^8.0.0",
+    "@semantic-release/commit-analyzer": "^10.0.0",
+    "@semantic-release/error": "^4.0.0",
+    "@semantic-release/github": "^9.0.0",
    "@semantic-release/npm": "^10.0.2",
-    "@semantic-release/release-notes-generator": "^10.0.0",
+    "@semantic-release/release-notes-generator": "^11.0.0",
    "aggregate-error": "^4.0.1",
    "cosmiconfig": "^8.0.0",
    "debug": "^4.0.0",
-    "env-ci": "^8.0.0",
-    "execa": "^6.1.0",
+    "env-ci": "^9.0.0",
+    "execa": "^8.0.0",
    "figures": "^5.0.0",
    "find-versions": "^5.1.0",
    "get-stream": "^6.0.0",
@@ -43,12 +43,12 @@
    "hook-std": "^3.0.0",
    "hosted-git-info": "^6.0.0",
    "lodash-es": "^4.17.21",
-    "marked": "^4.1.0",
+    "marked": "^5.0.0",
    "marked-terminal": "^5.1.1",
    "micromatch": "^4.0.2",
    "p-each-series": "^3.0.0",
    "p-reduce": "^3.0.0",
-    "read-pkg-up": "^9.1.0",
+    "read-pkg-up": "^10.0.0",
    "resolve-from": "^5.0.0",
    "semver": "^7.3.2",
    "semver-diff": "^4.0.0",
@@ -56,24 +56,23 @@
    "yargs": "^17.5.1"
  },
  "devDependencies": {
-    "ava": "5.1.0",
-    "c8": "7.12.0",
+    "ava": "5.3.1",
+    "c8": "8.0.1",
    "clear-module": "4.1.2",
    "codecov": "3.8.3",
-    "delay": "5.0.0",
-    "dockerode": "3.3.4",
-    "file-url": "^4.0.0",
-    "fs-extra": "^11.0.0",
-    "got": "^12.5.0",
+    "dockerode": "3.3.5",
+    "file-url": "4.0.0",
+    "fs-extra": "11.1.1",
+    "got": "13.0.0",
    "js-yaml": "4.1.0",
    "mockserver-client": "5.15.0",
-    "nock": "13.3.0",
-    "p-retry": "^5.1.1",
-    "prettier": "^2.7.1",
-    "sinon": "15.0.1",
+    "nock": "13.3.3",
+    "p-retry": "5.1.2",
+    "prettier": "3.0.2",
+    "sinon": "15.2.0",
    "stream-buffers": "3.0.2",
-    "tempy": "^3.0.0",
-    "testdouble": "3.16.8"
+    "tempy": "3.1.0",
+    "testdouble": "3.18.0"
  },
  "engines": {
    "node": ">=18"
@@ -117,7 +116,8 @@
    "trailingComma": "es5"
  },
  "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
  },
  "repository": {
    "type": "git",
@@ -43,6 +43,43 @@ test("Get the highest prerelease valid tag, ignoring other tags from other prere
  });
 });

+test("Get the correct prerelease tag, when other prereleases share the same git HEAD", (t) => {
+  const testConfig = {
+    branch: {
+      name: "alpha",
+      prerelease: "alpha",
+      channel: "alpha",
+      tags: [
+        { version: "1.0.0-beta.1", gitTag: "v1.0.0-beta.1", gitHead: "v1.0.0-beta.1", channels: ["beta"] },
+        { version: "1.0.0-beta.2", gitTag: "v1.0.0-beta.2", gitHead: "v1.0.0-alpha.1", channels: ["alpha", "beta"] },
+        { version: "1.0.0-alpha.1", gitTag: "v1.0.0-alpha.1", gitHead: "v1.0.0-alpha.1", channels: ["alpha", "beta"] },
+      ],
+      type: "prerelease",
+    },
+    options: { tagFormat: `v\${version}`, debug: true },
+  };
+  const firstResult = getLastRelease(testConfig);
+
+  t.deepEqual(firstResult, {
+    version: "1.0.0-alpha.1",
+    gitTag: "v1.0.0-alpha.1",
+    name: "v1.0.0-alpha.1",
+    gitHead: "v1.0.0-alpha.1",
+    channels: ["alpha", "beta"],
+  });
+
+  testConfig.branch.prerelease = true;
+  const secondResult = getLastRelease(testConfig);
+
+  t.deepEqual(secondResult, {
+    version: "1.0.0-alpha.1",
+    gitTag: "v1.0.0-alpha.1",
+    name: "v1.0.0-alpha.1",
+    gitHead: "v1.0.0-alpha.1",
+    channels: ["alpha", "beta"],
+  });
+});
+
 test("Return empty object if no valid tag is found", (t) => {
  const result = getLastRelease({
    branch: {
@@ -275,3 +275,24 @@ test("Increase version for release on prerelease branch when there is no regular
    "1.0.0-beta.2"
  );
 });
+
+test("Increase patch when previous version shares HEAD with other releases", (t) => {
+  t.is(
+    getNextVersion({
+      branch: {
+        name: "alpha",
+        type: "prerelease",
+        prerelease: "alpha",
+        tags: [
+          { gitTag: "v1.0.0-beta.1", version: "1.0.0-beta.1", channels: ["beta"] },
+          { gitTag: "v1.0.0-beta.2", version: "1.0.0-beta.2", channels: ["alpha", "beta"] },
+          { gitTag: "v1.0.0-alpha.1", version: "1.0.0-alpha.1", channels: ["alpha", "beta"] },
+        ],
+      },
+      nextRelease: { type: "patch", channel: "alpha" },
+      lastRelease: { version: "v1.0.0-alpha.1", channels: ["alpha", "beta"] },
+      logger: t.context.logger,
+    }),
+    "1.0.0-alpha.2"
+  );
+});
@@ -90,9 +90,7 @@ export async function gitCommits(messages, execaOptions) {
  await pEachSeries(
    messages,
    async (message) =>
-      (
-        await execa("git", ["commit", "-m", message, "--allow-empty", "--no-gpg-sign"], execaOptions)
-      ).stdout
+      (await execa("git", ["commit", "-m", message, "--allow-empty", "--no-gpg-sign"], execaOptions)).stdout
  );
  return (await gitGetCommits(undefined, execaOptions)).slice(0, messages.length);
 }
@@ -1,5 +1,4 @@
 import Docker from "dockerode";
-import getStream from "get-stream";
 import pRetry from "p-retry";
 import { gitShallowClone, initBareRepo } from "./git-utils.js";

@@ -15,15 +14,27 @@ let container;
 export const gitCredential = `${GIT_USERNAME}:${GIT_PASSWORD}`;

 /**
- * Download the `gitbox` Docker image, create a new container and start it.
+ * Download the `gitbox` Docker image
+ */
+export function pull() {
+  return docker.pull(IMAGE).then((stream) => {
+    return new Promise((resolve, reject) => {
+      docker.modem.followProgress(stream, (err, res) => (err ? reject(err) : resolve(res)));
+    });
+  });
+}
+
+/**
+ * create a new container and start it.
 */
 export async function start() {
-  await getStream(await docker.pull(IMAGE));
-
  container = await docker.createContainer({
    Tty: true,
    Image: IMAGE,
-    PortBindings: { [`${SERVER_PORT}/tcp`]: [{ HostPort: `${HOST_PORT}` }] },
+    HostConfig: {
+      PortBindings: { [`${SERVER_PORT}/tcp`]: [{ HostPort: `${HOST_PORT}` }] },
+    },
+    ExposedPorts: { [`${SERVER_PORT}/tcp`]: {} },
  });
  await container.start();

@@ -1,5 +1,4 @@
 import Docker from "dockerode";
-import getStream from "get-stream";
 import got from "got";
 import pRetry from "p-retry";
 import { mockServerClient } from "mockserver-client";
@@ -11,15 +10,27 @@ const docker = new Docker();
 let container;

 /**
- * Download the `mockserver` Docker image, create a new container and start it.
+ * Download the `mockserver` Docker image,
+ */
+export function pull() {
+  return docker.pull(IMAGE).then((stream) => {
+    return new Promise((resolve, reject) => {
+      docker.modem.followProgress(stream, (err, res) => (err ? reject(err) : resolve(res)));
+    });
+  });
+}
+
+/**
+ * create a new container and start it.
 */
 export async function start() {
-  await getStream(await docker.pull(IMAGE));
-
  container = await docker.createContainer({
    Tty: true,
    Image: IMAGE,
-    PortBindings: { [`${MOCK_SERVER_PORT}/tcp`]: [{ HostPort: `${MOCK_SERVER_PORT}` }] },
+    HostConfig: {
+      PortBindings: { [`${MOCK_SERVER_PORT}/tcp`]: [{ HostPort: `${MOCK_SERVER_PORT}` }] },
+    },
+    ExposedPorts: { [`${MOCK_SERVER_PORT}/tcp`]: {} },
  });
  await container.start();

@@ -1,9 +1,8 @@
 import path, { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { setTimeout } from "node:timers/promises";
 import Docker from "dockerode";
-import getStream from "get-stream";
 import got from "got";
-import delay from "delay";
 import pRetry from "p-retry";

 const IMAGE = "verdaccio/verdaccio:5";
@@ -17,20 +16,32 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 let container, npmToken;

 /**
- * Download the `npm-registry-docker` Docker image, create a new container and start it.
+ * Download the `npm-registry-docker` Docker image
+ */
+export function pull() {
+  return docker.pull(IMAGE).then((stream) => {
+    return new Promise((resolve, reject) => {
+      docker.modem.followProgress(stream, (err, res) => (err ? reject(err) : resolve(res)));
+    });
+  });
+}
+
+/**
+ * create a new container and start it.
 */
 export async function start() {
-  await getStream(await docker.pull(IMAGE));
-
  container = await docker.createContainer({
    Tty: true,
    Image: IMAGE,
-    PortBindings: { [`${REGISTRY_PORT}/tcp`]: [{ HostPort: `${REGISTRY_PORT}` }] },
-    Binds: [`${path.join(__dirname, "config.yaml")}:/verdaccio/conf/config.yaml`],
+    HostConfig: {
+      PortBindings: { [`${REGISTRY_PORT}/tcp`]: [{ HostPort: `${REGISTRY_PORT}` }] },
+      Binds: [`${path.join(__dirname, "config.yaml")}:/verdaccio/conf/config.yaml`],
+    },
+    ExposedPorts: { [`${REGISTRY_PORT}/tcp`]: {} },
  });

  await container.start();
-  await delay(4000);
+  await setTimeout(4000);

  try {
    // Wait for the registry to be ready
@@ -39,7 +39,11 @@ test.beforeEach((t) => {
  };
 });

-test("Plugins are called with expected values", async (t) => {
+test.afterEach.always((t) => {
+  td.reset();
+});
+
+test.serial("Plugins are called with expected values", async (t) => {
  // Create a git repository, set the current working directory at the root of the repo
  const { cwd, repositoryUrl } = await gitRepo(true);
  // Add commits to the master branch
@@ -1849,10 +1853,19 @@ test.serial("Throw an Error if plugin returns an unexpected value", async (t) =>
  await td.replaceEsm("../lib/get-logger.js", null, () => t.context.logger);
  await td.replaceEsm("env-ci", null, () => ({ isCi: true, branch: "master", isPr: false }));
  const semanticRelease = (await import("../index.js")).default;
-  const error = await t.throwsAsync(
-    semanticRelease(options, { cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer() }),
-    { instanceOf: SemanticReleaseError }
-  );
+
+  let error;
+  try {
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    });
+  } catch (e) {
+    error = e;
+  }
+  t.is(error.code, "EANALYZECOMMITSOUTPUT");
  t.regex(error.details, /string/);
 });

@@ -1,11 +1,11 @@
-import path from "path";
+import path from "node:path";
+import { setTimeout } from "node:timers/promises";
 import test from "ava";
 import * as td from "testdouble";
 import { escapeRegExp } from "lodash-es";
 import fsExtra from "fs-extra";
 import { execa } from "execa";
 import { WritableStreamBuffer } from "stream-buffers";
-import delay from "delay";

 import getAuthUrl from "../lib/get-git-auth-url.js";
 import { SECRET_REPLACEMENT } from "../lib/definitions/constants.js";
@@ -47,6 +47,7 @@ const pluginLogEnv = path.resolve("./test/fixtures/plugin-log-env");
 const pluginEsmNamedExports = path.resolve("./test/fixtures/plugin-esm-named-exports");

 test.before(async () => {
+  await Promise.all([gitbox.pull(), npmRegistry.pull(), mockServer.pull()]);
  await Promise.all([gitbox.start(), npmRegistry.start(), mockServer.start()]);

  env = {
@@ -295,7 +296,7 @@ test("Release patch, minor and major versions", async (t) => {
  t.is(exitCode, 0);

  // Wait for 3s as the change of dist-tag takes time to be reflected in the registry
-  await delay(3000);
+  await setTimeout(3000);
  // Retrieve the published package from the registry and check version and gitHead
  ({
    "dist-tags": { latest: releasedVersion },
@@ -598,7 +599,7 @@ test("Log unexpected errors from plugins and exit with 1", async (t) => {
  // Verify the type and message are logged
  t.regex(stderr, /Error: a/);
  // Verify the the stacktrace is logged
-  t.regex(stderr, new RegExp(pluginError));
+  t.regex(stderr, new RegExp(process.platform === "win32" ? pluginError.replace(/\\/g, "\\\\") : pluginError));
  // Verify the Error properties are logged
  t.regex(stderr, /errorProperty: 'errorProperty'/);
  t.is(exitCode, 1);
@@ -687,6 +688,7 @@ test("Use the valid git credentials when multiple are provided", async (t) => {
        BB_TOKEN_BASIC_AUTH: gitbox.gitCredential,
        GIT_ASKPASS: "echo",
        GIT_TERMINAL_PROMPT: 0,
+        GIT_CONFIG_PARAMETERS: "'credential.helper='",
      },
      branch: { name: "master" },
      options: { repositoryUrl: "http://toto@localhost:2080/git/test-auth.git" },
@@ -707,6 +709,7 @@ test("Use the repository URL as is if none of the given git credentials are vali
        GITLAB_TOKEN: "trash",
        GIT_ASKPASS: "echo",
        GIT_TERMINAL_PROMPT: 0,
+        GIT_CONFIG_PARAMETERS: "'credential.helper='",
      },
      branch: { name: "master" },
      options: { repositoryUrl: dummyUrl },
@@ -716,7 +719,7 @@ test("Use the repository URL as is if none of the given git credentials are vali
 });

 test("ESM Plugin with named exports", async (t) => {
-  const packageName = "log-secret";
+  const packageName = "plugin-exports";
  // Create a git repository, set the current working directory at the root of the repo
  t.log("Create git repository");
  const { cwd, repositoryUrl } = await gitbox.createRepo(packageName);