fix(deps): update dependency @semantic-release/release-notes-generator to v11 (#2778)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/release.yml

@@ -23,7 +23,8 @@ jobs:
         with:
           cache: npm
           node-version: lts/*
-      - run: npm ci
+      - run: npm clean-install
+      - run: npm audit signatures
       - run: npx semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yml

@@ -52,4 +52,5 @@ jobs:
           node-version: lts/*
           cache: npm
       - run: npm clean-install
+      - run: npm audit signatures
       - run: npm run lint

docs/recipes/ci-configurations/github-actions.md

@@ -6,6 +6,11 @@ The [Authentication](../../usage/ci-configuration.md#authentication) environment
 
 In this example a publish type [`NPM_TOKEN`](https://docs.npmjs.com/creating-and-viewing-authentication-tokens) is required to publish a package to the npm registry. GitHub Actions [automatically populate](https://help.github.com/en/articles/virtual-environments-for-github-actions#github_token-secret) a [`GITHUB_TOKEN`](https://help.github.com/en/articles/creating-a-personal-access-token-for-the-command-line) environment variable which can be used in Workflows.
 
+## npm provenance
+
+Since GitHub Actions is a [supported provider](https://docs.npmjs.com/generating-provenance-statements#provenance-limitations) for [npm provenance](https://docs.npmjs.com/generating-provenance-statements), it is recommended to enable this to increase supply-chain security for your npm packages.
+Find more detail about configuring npm to publish with provenance through semantic-release [in the documentation for our npm plugin](https://github.com/semantic-release/npm#npm-provenance).
+
 ## Node project configuration
 
 [GitHub Actions](https://github.com/features/actions) support [Workflows](https://help.github.com/en/articles/configuring-workflows), allowing to run tests on multiple Node versions and publish a release only when all test pass.
@@ -23,10 +28,19 @@ on:
   push:
     branches:
       - master
+
+permissions:
+  contents: read # for checkout
+
 jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -37,7 +51,9 @@ jobs:
         with:
           node-version: "lts/*"
       - name: Install dependencies
-        run: npm ci
+        run: npm clean-install
+      - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
+        run: npm audit signatures
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

docs/support/FAQ.md

@@ -158,14 +158,6 @@ Or with the `publishConfig.access` key in your project's `package.json`:
 }
 ```
 
-## Can I use semantic-release to publish a package on Artifactory?
-
-Any npm compatible registry is supported with the [`@semantic-release/npm`](https://github.com/semantic-release/npm) plugin. For Artifactory versions prior to 5.4, the legacy authentication has to be used (with `NPM_USERNAME`, `NPM_PASSWORD` and `NPM_EMAIL` [environment variables](https://github.com/semantic-release/npm#environment-variables)).
-
-See [npm registry authentication](https://github.com/semantic-release/npm#npm-registry-authentication) for more details.
-
-See [Artifactory - npm Registry](https://www.jfrog.com/confluence/display/RTF/Npm+Registry#NpmRegistry-AuthenticatingthenpmClient) documentation for Artifactory configuration.
-
 ## Can I manually trigger the release of a specific version?
 
 You can trigger a release by pushing to your Git repository. You deliberately cannot trigger a _specific_ version release, because this is the whole point of semantic-release.

package.json

@@ -30,11 +30,11 @@
     "@semantic-release/error": "^3.0.0",
     "@semantic-release/github": "^8.0.0",
     "@semantic-release/npm": "^10.0.2",
-    "@semantic-release/release-notes-generator": "^10.0.0",
+    "@semantic-release/release-notes-generator": "^11.0.0",
     "aggregate-error": "^4.0.1",
     "cosmiconfig": "^8.0.0",
     "debug": "^4.0.0",
-    "env-ci": "^8.0.0",
+    "env-ci": "^9.0.0",
     "execa": "^7.0.0",
     "figures": "^5.0.0",
     "find-versions": "^5.1.0",
@@ -62,18 +62,18 @@
     "codecov": "3.8.3",
     "delay": "5.0.0",
     "dockerode": "3.3.5",
-    "file-url": "^4.0.0",
-    "fs-extra": "^11.0.0",
-    "got": "^12.5.0",
+    "file-url": "4.0.0",
+    "fs-extra": "11.1.1",
+    "got": "12.6.0",
     "js-yaml": "4.1.0",
     "mockserver-client": "5.15.0",
     "nock": "13.3.0",
-    "p-retry": "^5.1.1",
-    "prettier": "^2.7.1",
-    "sinon": "15.0.2",
+    "p-retry": "5.1.2",
+    "prettier": "2.8.7",
+    "sinon": "15.0.4",
     "stream-buffers": "3.0.2",
-    "tempy": "^3.0.0",
-    "testdouble": "3.17.0"
+    "tempy": "3.0.0",
+    "testdouble": "3.17.2"
   },
   "engines": {
     "node": ">=18"