fix(deps): update dependency aggregate-error to v5 (#2956)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.git-blame-ignore-revs

@@ -1,2 +1,4 @@
 # style: prettier (#2670)
-b06c9bbe4c6be121c5561b356d8c465c1cadffba
+b06c9bbe4c6be121c5561b356d8c465c1cadffba
+# style: upgraded prettier to v3 (#2863)
+272af210523804de782b3076f05e56bcb4aeeb8f

.github/workflows/release.yml

@@ -18,14 +18,16 @@ jobs:
     name: release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
         with:
           cache: npm
           node-version: lts/*
       - run: npm clean-install
       - run: npm audit signatures
-      - run: npx semantic-release
+      # pinned version updated automatically by Renovate.
+      # details at https://semantic-release.gitbook.io/semantic-release/usage/installation#global-installation
+      - run: npx semantic-release@21.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.SEMANTIC_RELEASE_BOT_NPM_TOKEN }}

.github/workflows/scorecard.yml

@@ -0,0 +1,36 @@
+name: OpenSSF Scorecard
+"on":
+  schedule:
+    - cron: 31 2 * * 1
+  push:
+    branches:
+      - master
+permissions: read-all
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
+        with:
+          persist-credentials: false
+      - name: Run analysis
+        uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - name: Upload artifact
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@04daf014b50eaf774287bf3f0f1869d4b4c4b913 # v2.21.7
+        with:
+          sarif_file: results.sarif

.github/workflows/test.yml

@@ -27,11 +27,11 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - run: git config --global user.name github-actions
       - run: git config --global user.email github-actions@github.com
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
@@ -46,8 +46,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: test_matrix
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
         with:
           node-version: lts/*
           cache: npm

LICENSE

@@ -9,8 +9,8 @@ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

README.md

@@ -7,6 +7,9 @@
   <a href="https://github.com/semantic-release/semantic-release/actions?query=workflow%3ATest+branch%3Amaster">
     <img alt="Build states" src="https://github.com/semantic-release/semantic-release/workflows/Test/badge.svg">
   </a>
+  <a href="https://securityscorecards.dev/viewer/?uri=github.com/semantic-release/semantic-release">
+    <img alt="OpenSSF Scorecard" src="https://api.securityscorecards.dev/projects/github.com/semantic-release/semantic-release/badge">
+  </a>
   <a href="#badge">
     <img alt="semantic-release: angular" src="https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release">
   </a>
@@ -41,6 +44,7 @@ This removes the immediate connection between human emotions and version numbers
 - Avoid potential errors associated with manual releases
 - Support any [package managers and languages](docs/recipes/release-workflow/README.md#package-managers-and-languages) via [plugins](docs/usage/plugins.md)
 - Simple and reusable configuration via [shareable configurations](docs/usage/shareable-configurations.md)
+- Support for [npm package provenance](https://github.com/semantic-release/npm#npm-provenance) that promotes increased supply-chain security via signed attestations on GitHub Actions
 
 ## How does it work?
 

SUMMARY.md

@@ -3,7 +3,7 @@
 ## Usage
 
 - [Getting started](docs/usage/getting-started.md#getting-started)
-- [Installation](docs/usage/installation.md#installation)
+- [Installation](docs/usage/installation.md)
 - [CI Configuration](docs/usage/ci-configuration.md)
 - [Configuration](docs/usage/configuration.md)
 - [Plugins](docs/usage/plugins.md)

docs/developer-guide/js-api.md

@@ -142,7 +142,7 @@ Information related to the last release found:
 | gitTag  | `String` | The [Git tag](https://git-scm.com/book/en/v2/Git-Basics-Tagging) associated with the last release.                                  |
 | channel | `String` | The distribution channel on which the last release was initially made available (`undefined` for the default distribution channel). |
 
-**Notes**: If no previous release is found, `lastRelease` will be an empty `Object`.
+**Note**: If no previous release is found, `lastRelease` will be an empty `Object`.
 
 Example:
 

docs/extending/plugins-list.md

@@ -84,6 +84,11 @@
   - `verifyRelease`: Checks and warns (does not error by default) if the version numbers found on maven central and within the Git project differ by quite a bit
   - `prepare`: Changes the version number in the `pom.xml` (or all `pom.xml` files in maven projects with multiple `pom.xml` files) and optionally creates a commit with this version number and pushes it to `master`
   - `publish`: Runs `mvn deploy` to deploy to maven central and optionally will update to next snapshot version and merge changes to development branch
+- [maven-semantic-release](https://github.com/terrestris/maven-semantic-release) (alternative version)
+  - `verifyConditions`: Verifies that the `mvn` command exists.
+  - `prepare`: Changes version number in `pom.xml` and optionally in all child modules.
+  - `publish`: Runs one of the mvn targets `deploy`, `package jib:build` or `deploy jib:build`.
+  - `success`: Optionally sets new snapshot version and commits it.
 - [semantic-release-ado](https://github.com/lluchmk/semantic-release-ado)
   - `prepare`: Stores the version number as an Azure DevOps pipeline variable available to downstream steps on the job
 - [gradle-semantic-release](https://github.com/KengoTODA/gradle-semantic-release-plugin)
@@ -107,7 +112,7 @@
   - `verifyConditions`: Verify the presence and the validity of the authentication and the assets option configuration.
   - `publish`: Publish a Gitea release, optionally uploading file assets.
   - `addChannel`: Update a Gitea release's pre-release field.
-- [@google/semantic-release-replace-plugin](https://github.com/google/semantic-release-replace-plugin)
+- [semantic-release-replace-plugin](https://github.com/jpoehnelt/semantic-release-replace-plugin)
   - `prepare`: Replace version strings in files using regex and glob.
 - [semantic-release-rubygem](https://github.com/Gusto/semantic-release-rubygem)
   - `verifyConditions`: Locate and validate a `.gemspec` file, locate and validate a `lib/**/version.rb` file, verify the presence of the `GEM_HOST_API_KEY` environment variable, and create a credentials file with the API key.
@@ -174,3 +179,11 @@
 - [semantic-release-coralogix](https://github.com/adobe/semantic-release-coralogix)
   - `verifyConditions` Verified that required credentials are provided and API is accessible
   - `publish` add a release tag to Coralogix
+- [semantic-release-major-tag](https://github.com/doteric/semantic-release-major-tag)
+  - `success` Create major version tag, for example `v1`.
+- [semantic-release-yarn](https://github.com/hongaar/semantic-release-yarn)
+  - **Note**: this is an alternative to the default `@semantic-release/npm` plugin and adds support for monorepos.
+  - `verifyConditions` Verify Yarn 2 or higher is installed, verify the presence of a NPM auth token (either in an environment variable or a `.yarnrc.yml` file) and verify the authentication method is valid.
+  - `prepare` Update the `package.json` version and create the package tarball.
+  - `addChannel` Add a tag for the release.
+  - `publish` Publish to the npm registry.

docs/recipes/ci-configurations/gitlab-ci.md

@@ -6,6 +6,11 @@ The [Authentication](../../usage/ci-configuration.md#authentication) environment
 
 **Note**: Make sure to configure your release branch as [protected](https://docs.gitlab.com/ce/user/project/protected_branches.html) in order for the CI/CD build to access the protected variables.
 
+## npm provenance
+
+Since GitLab CI is a [supported provider](https://docs.npmjs.com/generating-provenance-statements#provenance-limitations) for [npm provenance](https://docs.npmjs.com/generating-provenance-statements), it is recommended to enable this to increase supply-chain security for your npm packages.
+Find more detail about configuring npm to publish with provenance through semantic-release [in the documentation for our npm plugin](https://github.com/semantic-release/npm#npm-provenance).
+
 ## Node project configuration
 
 GitLab CI supports [Pipelines](https://docs.gitlab.com/ee/ci/pipelines.html) allowing to test on multiple Node versions and publishing a release only when all test pass.

docs/usage/installation.md

@@ -24,9 +24,28 @@ For other type of projects we recommend installing **semantic-release** directly
 $ npx semantic-release
 ```
 
-**Note**: For a global installation, it's recommended to specify the major **semantic-release** version to install (for example with `npx semantic-release@18`).
-This way your build will not automatically use the next major **semantic-release** release that could possibly break your build.
-You will have to upgrade manually when a new major version is released.
+### Notes
 
-**Note**: `npx` is a tool bundled with `npm@>=5.2.0`. It is used to conveniently install the semantic-release binary and to execute it.
-See [What is npx](../support/FAQ.md#what-is-npx) for more details.
+1. If you've globally installed **semantic-release** then we recommend that you set the major **semantic-release** version to install.
+   For example, by using `npx semantic-release@18`.
+   This way you control which major version of **semantic-release** is used by your build, and thus avoid breaking the build when there's a new major version of **semantic-release**.
+   This also means you, or a bot, must upgrade **semantic-release** when a new major version is released.
+2. Pinning **semantic-release** to an exact version makes your releases even more deterministic.
+   But pinning also means you, or a bot, must update to newer versions of **semantic-release** more often.
+3. You can use [Renovate's regex manager](https://docs.renovatebot.com/modules/manager/regex/) to get automatic updates for **semantic-release** in either of the above scenarios.
+   Put this in your Renovate configuration file:
+   ```json
+   {
+     "regexManagers": [
+       {
+         "description": "Update semantic-release version used by npx",
+         "fileMatch": ["^\\.github/workflows/[^/]+\\.ya?ml$"],
+         "matchStrings": ["\\srun: npx semantic-release@(?<currentValue>.*?)\\s"],
+         "datasourceTemplate": "npm",
+         "depNameTemplate": "semantic-release"
+       }
+     ]
+   }
+   ```
+4. `npx` is a tool bundled with `npm@>=5.2.0`. You can use it to install (and run) the **semantic-release** binary.
+   See [What is npx](../support/FAQ.md#what-is-npx) for more details.

index.d.ts

@@ -0,0 +1,711 @@
+declare interface AggregateError extends Error {
+  errors: any[];
+}
+
+declare module "semantic-release" {
+  import { Signale } from "signale";
+  export interface EnvCi {
+    /**
+     * Boolean, true if the environment is a CI environment
+     */
+    isCi: boolean;
+
+    /**
+     * Commit hash
+     */
+    commit: string;
+
+    /**
+     * Current branch name
+     */
+    branch: string;
+  }
+
+  /**
+   * Base context used in every semantic release step.
+   */
+  export interface BaseContext {
+    /**
+     * stdout for semantic-release process
+     */
+    stdout: NodeJS.WriteStream;
+
+    /**
+     * stderr for semantic-release process
+     */
+    stderr: NodeJS.WriteStream;
+
+    /**
+     * Signale console loger instance.
+     *
+     * Has error, log and success methods.
+     */
+    logger: Signale<"error" | "log" | "success">;
+  }
+
+  /**
+   * Context used for the verify conditions step.
+   */
+  export interface VerifyConditionsContext extends BaseContext {
+    /**
+     * The current working directory to use. It should be configured to
+     * the root of the Git repository to release from.
+     *
+     * It allows to run semantic-release from a specific path without
+     * having to change the local process cwd with process.chdir().
+     *
+     * @default process.cwd
+     */
+    cwd?: string | undefined;
+
+    /**
+     * The environment variables to use.
+     *
+     * It allows to run semantic-release with specific environment
+     * variables without having to modify the local process.env.
+     *
+     * @default process.env
+     */
+    env: Record<string, string>;
+
+    /**
+     * Information about the CI environment.
+     */
+    envCi: EnvCi;
+
+    /**
+     * Information of the current branch
+     */
+    branch: BranchObject;
+
+    /**
+     * Information on branches
+     */
+    branches: ReadonlyArray<BranchObject>;
+  }
+
+  /**
+   * Context used for the analyze commits step.
+   */
+  export interface AnalyzeCommitsContext extends VerifyConditionsContext {
+    /**
+     * List of commits taken into account when determining the new version.
+     */
+    commits: ReadonlyArray<Commit>;
+
+    /**
+     * List of releases
+     */
+    releases: ReadonlyArray<Release>;
+
+    /**
+     * Last release
+     */
+    lastRelease: LastRelease;
+  }
+
+  /**
+   * Context used for the verify release step.
+   */
+  export interface VerifyReleaseContext extends AnalyzeCommitsContext {
+    /**
+     * The next release.
+     */
+    nextRelease: NextRelease;
+  }
+
+  /**
+   * Context used for the generate notes step.
+   */
+  export type GenerateNotesContext = VerifyReleaseContext;
+
+  /**
+   * Context used for the add channel step.
+   */
+  export type AddChannelContext = VerifyReleaseContext;
+
+  /**
+   * Context used for the prepare step.
+   */
+  export type PrepareContext = VerifyReleaseContext;
+
+  /**
+   * Context used for the publish step.
+   */
+  export type PublishContext = VerifyReleaseContext;
+
+  /**
+   * Context used for the success step.
+   */
+  export type SuccessContext = VerifyReleaseContext;
+
+  export interface FailContext extends BaseContext {
+    /**
+     * Errors that occurred during the release process.
+     */
+    errors: AggregateError;
+  }
+
+  export interface Commit {
+    /**
+     * The commit abbreviated and full hash.
+     */
+    commit: {
+      /**
+       * The commit hash.
+       */
+      long: string;
+
+      /**
+       * The commit abbreviated hash.
+       */
+      short: string;
+    };
+
+    /**
+     * The commit abbreviated and full tree hash.
+     */
+    tree: {
+      /**
+       * The commit tree hash.
+       */
+      long: string;
+
+      /**
+       * The commit abbreviated tree hash.
+       */
+      short: string;
+    };
+
+    /**
+     * The commit author information.
+     */
+    author: {
+      /**
+       * The commit author name.
+       */
+      name: string;
+
+      /**
+       * The commit author email.
+       */
+      email: string;
+
+      /**
+       * The commit author date.
+       */
+      short: string;
+    };
+
+    /**
+     * The committer information.
+     */
+    committer: {
+      /**
+       * The committer name.
+       */
+      name: string;
+
+      /**
+       * The committer email.
+       */
+      email: string;
+
+      /**
+       * The committer date.
+       */
+      short: string;
+    };
+
+    /**
+     * The commit subject.
+     */
+    subject: string;
+
+    /**
+     * The commit body.
+     */
+    body: string;
+
+    /**
+     * The commit full message (subject and body).
+     */
+    message: string;
+
+    /**
+     * The commit hash.
+     */
+    hash: string;
+
+    /**
+     * The committer date.
+     */
+    committerDate: string;
+  }
+
+  export interface BranchObject {
+    /**
+     * The name of git branch.
+     *
+     * A `name` is required for all types of branch. It can be defined as a
+     * [glob](https://github.com/micromatch/micromatch#matching-features)
+     * in which case the definition will be expanded to one per matching
+     * branch existing in the repository.
+     *
+     * If `name` doesn't match any branch existing in the repository, the
+     * definition will be ignored. For example, the default configuration
+     * includes the definition `next` and `next-major` which will become
+     * active only  when the branches `next` and/or `next-major` are
+     * created in the repository.
+     */
+    name: string;
+
+    /**
+     * The distribution channel on which to publish releases from this
+     * branch.
+     *
+     * If this field is set to `false`, then the branch will be released
+     * on the default distribution channel (for example the `@latest`
+     * [dist-tag](https://docs.npmjs.com/cli/dist-tag) for npm). This is
+     * also the default behavior for the first
+     * [release branch](https://semantic-release.gitbook.io/semantic-release/usage/workflow-configuration#release-branches)
+     * if the channel property is not set.
+     *
+     * For all other branches, if the channel property is not set, then the
+     * channel name will be the same as the branch name.
+     *
+     * The value of `channel`, if defined as a string, is generated with
+     * [Lodash template](https://lodash.com/docs#template) with the
+     * variable `name` set to the branch name.
+     *
+     * For example `{name: 'next', channel: 'channel-${name}'}` will be
+     * expanded to `{name: 'next', channel: 'channel-next'}`.
+     */
+    channel?: string | false | undefined;
+
+    /**
+     * The range of [semantic versions](https://semver.org/) to support on
+     * this branch.
+     *
+     * A `range` only applies to maintenance branches and must be formatted
+     * like `N.N.x` or `N.x` (`N` is a number). If no range is specified
+     * but the `name` is formatted as a range, then the branch will be
+     * considered a maintenance branch and the `name` value will be used
+     * for the `range`.
+     *
+     * Required for maintenance branches, unless `name` is formatted like
+     * `N.N.x` or `N.x` (`N` is a number).
+     */
+    range?: string | undefined;
+
+    /**
+     * The pre-release identifier to append to [semantic versions](https://semver.org/)
+     * released from this branch.
+     *
+     * A `prerelease` property applies only to pre-release branches and
+     * the `prerelease` value must be valid per the [Semantic Versioning
+     * Specification](https://semver.org/#spec-item-9). It will determine
+     * the name of versions. For example if `prerelease` is set to
+     * `"beta"`, the version will be formatted like `2.0.0-beta.1`,
+     * `2.0.0-beta.2`, etc.
+     *
+     * The value of `prerelease`, if defined as a string, is generated with
+     * [Lodash template](https://lodash.com/docs#template) with the
+     * variable `name` set to the name of the branch.
+     *
+     * If the `prerelease property is set to `true` then the name of the
+     * branch is used as the pre-release identifier.
+     *
+     * Required for pre-release branches.
+     */
+    prerelease?: string | boolean | undefined;
+  }
+
+  /**
+   * Specifies a git branch holding commits to analyze and code to release.
+   *
+   * Each branch may be defined either by a string or an object. Specifying
+   * a string is a shortcut for specifying that string as the `name` field,
+   * for example `"master"` expands to `{name: "master"}`.
+   */
+  export type BranchSpec = string | BranchObject;
+
+  /**
+   * A semver release type.
+   * See https://github.com/semantic-release/commit-analyzer/blob/master/lib/default-release-types.js
+   */
+  export type ReleaseType = "prerelease" | "prepatch" | "patch" | "preminor" | "minor" | "premajor" | "major";
+
+  /**
+   * Details of a release published by a publish plugin.
+   */
+  export interface Release {
+    /**
+     * The release name, only if set by the corresponding publish plugin.
+     */
+    name?: string | undefined;
+
+    /**
+     * The release URL, only if set by the corresponding publish plugin.
+     */
+    url?: string | undefined;
+
+    /**
+     * The semver export type of the release.
+     */
+    type: ReleaseType;
+
+    /**
+     * The version of the release.
+     */
+    version: string;
+
+    /**
+     * The sha of the last commit being part of the release.
+     */
+    gitHead: string;
+
+    /**
+     * The Git tag associated with the release.
+     */
+    gitTag: string;
+
+    /**
+     * The release notes for the release.
+     */
+    notes: string;
+
+    /**
+     * The name of the plugin that published the release.
+     */
+    pluginName: string;
+  }
+
+  export interface LastRelease {
+    /**
+     * The version name of the release.
+     */
+    version: string;
+
+    /**
+     * The Git tag of the release.
+     */
+    gitTag: string;
+
+    /**
+     * List of channels the release was published to.
+     */
+    channels: string[];
+
+    /**
+     * The Git checksum of the last commit of the release.
+     */
+    gitHead: string;
+
+    /**
+     * The Release name
+     */
+    name: string;
+  }
+
+  export interface NextRelease extends Omit<LastRelease, "channels"> {
+    /**
+     * The semver export type of the release.
+     */
+    type: ReleaseType;
+
+    /**
+     * The release channel of the release.
+     */
+    channel: string;
+
+    /**
+     * The release notes of the next release.
+     */
+    notes?: string | undefined;
+  }
+
+  /**
+   * Specifies a plugin to use.
+   *
+   * The plugin is specified by its module name.
+   *
+   * To pass options to a plugin, specify an array containing the plugin module
+   * name and an options object.
+   */
+  export type PluginSpec<T = any> = string | [string, T];
+
+  /**
+   * semantic-release options, after normalization and defaults have been
+   * applied.
+   */
+  export interface GlobalConfig extends Options {
+    /**
+     * The branches on which releases should happen. By default
+     * **semantic-release** will release:
+     *
+     *  * regular releases to the default distribution channel from the
+     *    branch `master`
+     *  * regular releases to a distribution channel matching the branch
+     *    name from any existing branch with a name matching a maintenance
+     *    release range (`N.N.x` or `N.x.x` or `N.x` with `N` being a
+     *    number)
+     *  * regular releases to the `next` distribution channel from the
+     *    branch `next` if it exists
+     *  * regular releases to the `next-major` distribution channel from
+     *    the branch `next-major` if it exists.
+     *  * prereleases to the `beta` distribution channel from the branch
+     *    `beta` if it exists
+     *  * prereleases to the `alpha` distribution channel from the branch
+     *    `alpha` if it exists
+     *
+     * **Note**: If your repository does not have a release branch, then
+     * **semantic-release** will fail with an `ERELEASEBRANCHES` error
+     * message. If you are using the default configuration, you can fix
+     * this error by pushing a `master` branch.
+     *
+     * **Note**: Once **semantic-release** is configured, any user with the
+     * permission to push commits on one of those branches will be able to
+     * publish a release. It is recommended to protect those branches, for
+     * example with [GitHub protected branches](https://help.github.com/articles/about-protected-branches).
+     *
+     * See [Workflow configuration](https://semantic-release.gitbook.io/semantic-release/usage/workflow-configuration#workflow-configuration)
+     * for more details.
+     */
+    branches: ReadonlyArray<BranchSpec> | BranchSpec;
+
+    /**
+     * The git repository URL.
+     *
+     * Any valid git url format is supported (see
+     * [git protocols](https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols))
+     *
+     * Default: `repository` property in `package.json`, or git origin url.
+     */
+    repositoryUrl: string;
+
+    /**
+     * The git tag format used by **semantic-release** to identify
+     * releases. The tag name is generated with [Lodash template](https://lodash.com/docs#template)
+     * and will be compiled with the `version` variable.
+     *
+     * **Note**: The `tagFormat` must contain the `version` variable
+     * exactly once and compile to a
+     * [valid git reference](https://git-scm.com/docs/git-check-ref-format#_description).
+     */
+    tagFormat: string;
+
+    /**
+     * Define the list of plugins to use. Plugins will run in series, in
+     * the order defined, for each [step](https://semantic-release.gitbook.io/semantic-release/#release-steps)
+     * if they implement it.
+     *
+     * Plugins configuration can be defined by wrapping the name and an
+     * options object in an array.
+     *
+     * See [Plugins configuration](https://semantic-release.gitbook.io/semantic-release/usage/plugins#plugins)
+     * for more details.
+     *
+     * Default: `[
+     *     "@semantic-release/commit-analyzer",
+     *     "@semantic-release/release-notes-generator",
+     *     "@semantic-release/npm",
+     *     "@semantic-release/github"
+     * ]`
+     */
+    plugins: ReadonlyArray<PluginSpec>;
+  }
+
+  /** semantic-release configuration specific for API usage. */
+  export interface Config {
+    /**
+     * The current working directory to use. It should be configured to
+     * the root of the Git repository to release from.
+     *
+     * It allows to run semantic-release from a specific path without
+     * having to change the local process cwd with process.chdir().
+     *
+     * @default process.cwd
+     */
+    cwd?: string | undefined;
+
+    /**
+     * The environment variables to use.
+     *
+     * It allows to run semantic-release with specific environment
+     * variables without having to modify the local process.env.
+     *
+     * @default process.env
+     */
+    env?: Record<string, any> | undefined;
+
+    /**
+     * The writable stream used to log information.
+     *
+     * It allows to configure semantic-release to write logs to a specific
+     * stream rather than the local process.stdout.
+     *
+     * @default process.stdout
+     */
+    stdout?: NodeJS.WriteStream | undefined;
+
+    /**
+     * The writable stream used to log errors.
+     *
+     * It allows to configure semantic-release to write errors to a
+     * specific stream rather than the local process.stderr.
+     *
+     * @default process.stderr
+     */
+    stderr?: NodeJS.WriteStream | undefined;
+  }
+
+  /**
+   * semantic-release options.
+   *
+   * Can be used to set any core option or plugin options.
+   * Each option will take precedence over options configured in the
+   * configuration file and shareable configurations.
+   */
+  export interface Options {
+    /**
+     * List of modules or file paths containing a
+     * [shareable configuration](https://semantic-release.gitbook.io/semantic-release/usage/shareable-configurations).
+     * If multiple shareable configurations are set, they will be imported
+     * in the order defined with each configuration option taking
+     * precedence over the options defined in a previous shareable
+     * configuration.
+     *
+     * **Note**: Options defined via CLI arguments or in the configuration
+     * file will take precedence over the ones defined in any shareable
+     * configuration.
+     */
+    extends?: ReadonlyArray<string> | string | undefined;
+
+    /**
+     * The branches on which releases should happen. By default
+     * **semantic-release** will release:
+     *
+     *  * regular releases to the default distribution channel from the
+     *    branch `master`
+     *  * regular releases to a distribution channel matching the branch
+     *    name from any existing branch with a name matching a maintenance
+     *    release range (`N.N.x` or `N.x.x` or `N.x` with `N` being a
+     *    number)
+     *  * regular releases to the `next` distribution channel from the
+     *    branch `next` if it exists
+     *  * regular releases to the `next-major` distribution channel from
+     *    the branch `next-major` if it exists.
+     *  * prereleases to the `beta` distribution channel from the branch
+     *    `beta` if it exists
+     *  * prereleases to the `alpha` distribution channel from the branch
+     *    `alpha` if it exists
+     *
+     * **Note**: If your repository does not have a release branch, then
+     * **semantic-release** will fail with an `ERELEASEBRANCHES` error
+     * message. If you are using the default configuration, you can fix
+     * this error by pushing a `master` branch.
+     *
+     * **Note**: Once **semantic-release** is configured, any user with the
+     * permission to push commits on one of those branches will be able to
+     * publish a release. It is recommended to protect those branches, for
+     * example with [GitHub protected branches](https://help.github.com/articles/about-protected-branches).
+     *
+     * See [Workflow configuration](https://semantic-release.gitbook.io/semantic-release/usage/workflow-configuration#workflow-configuration)
+     * for more details.
+     */
+    branches?: ReadonlyArray<BranchSpec> | BranchSpec | undefined;
+
+    /**
+     * The git repository URL.
+     *
+     * Any valid git url format is supported (see
+     * [git protocols](https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols))
+     *
+     * Default: `repository` property in `package.json`, or git origin url.
+     */
+    repositoryUrl?: string | undefined;
+
+    /**
+     * The git tag format used by **semantic-release** to identify
+     * releases. The tag name is generated with [Lodash template](https://lodash.com/docs#template)
+     * and will be compiled with the `version` variable.
+     *
+     * **Note**: The `tagFormat` must contain the `version` variable
+     * exactly once and compile to a
+     * [valid git reference](https://git-scm.com/docs/git-check-ref-format#_description).
+     */
+    tagFormat?: string | undefined;
+
+    /**
+     * Define the list of plugins to use. Plugins will run in series, in
+     * the order defined, for each [step](https://semantic-release.gitbook.io/semantic-release/#release-steps)
+     * if they implement it.
+     *
+     * Plugins configuration can be defined by wrapping the name and an
+     * options object in an array.
+     *
+     * See [Plugins configuration](https://semantic-release.gitbook.io/semantic-release/usage/plugins#plugins)
+     * for more details.
+     *
+     * Default: `[
+     *     "@semantic-release/commit-analyzer",
+     *     "@semantic-release/release-notes-generator",
+     *     "@semantic-release/npm",
+     *     "@semantic-release/github"
+     * ]`
+     */
+    plugins?: ReadonlyArray<PluginSpec> | undefined;
+
+    /**
+     * Dry-run mode, skip publishing, print next version and release notes.
+     */
+    dryRun?: boolean | undefined;
+
+    /**
+     * Set to false to skip Continuous Integration environment verifications.
+     * This allows for making releases from a local machine.
+     */
+    ci?: boolean | undefined;
+
+    /**
+     * Any other options supported by plugins.
+     */
+    [name: string]: any;
+  }
+
+  /**
+   * An object with details of the release if a release was published, or
+   * false if no release was published.
+   */
+  export type Result =
+    | false
+    | {
+        /**
+         * Information related to the last release found.
+         */
+        lastRelease: LastRelease;
+
+        /**
+         * The list of commits included in the new release.
+         */
+        commits: Commit[];
+
+        /**
+         * Information related to the newly published release.
+         */
+        nextRelease: NextRelease;
+
+        /**
+         * The list of releases published, one release per publish plugin.
+         */
+        releases: Release[];
+      };
+
+  /**
+   * Run semantic-release and returns a Promise that resolves to a Result
+   * object.
+   * @async
+   */
+  export default function (options: Options, environment?: Config): Promise<Result>;
+}

lib/get-last-release.js

@@ -30,7 +30,11 @@ export default ({ branch, options: { tagFormat } }, { before } = {}) => {
   const [{ version, gitTag, channels } = {}] = branch.tags
     .filter(
       (tag) =>
-        ((branch.type === "prerelease" && tag.channels.some((channel) => isSameChannel(branch.channel, channel))) ||
+        ((branch.type === "prerelease" &&
+          tag.channels.some((channel) => isSameChannel(branch.channel, channel)) &&
+          semver
+            .parse(tag.version)
+            .prerelease.includes(branch.prerelease === true ? branch.name : branch.prerelease)) ||
           !semver.prerelease(tag.version)) &&
         (isUndefined(before) || semver.lt(tag.version, before))
     )

package.json

@@ -26,29 +26,29 @@
     "Matt Travi <npm@travi.org> (https://matt.travi.org/)"
   ],
   "dependencies": {
-    "@semantic-release/commit-analyzer": "^9.0.2",
-    "@semantic-release/error": "^3.0.0",
-    "@semantic-release/github": "^8.0.0",
+    "@semantic-release/commit-analyzer": "^10.0.0",
+    "@semantic-release/error": "^4.0.0",
+    "@semantic-release/github": "^9.0.0",
     "@semantic-release/npm": "^10.0.2",
     "@semantic-release/release-notes-generator": "^11.0.0",
-    "aggregate-error": "^4.0.1",
+    "aggregate-error": "^5.0.0",
     "cosmiconfig": "^8.0.0",
     "debug": "^4.0.0",
     "env-ci": "^9.0.0",
-    "execa": "^7.0.0",
+    "execa": "^8.0.0",
     "figures": "^5.0.0",
     "find-versions": "^5.1.0",
     "get-stream": "^6.0.0",
     "git-log-parser": "^1.2.0",
     "hook-std": "^3.0.0",
-    "hosted-git-info": "^6.0.0",
+    "hosted-git-info": "^7.0.0",
     "lodash-es": "^4.17.21",
-    "marked": "^4.1.0",
+    "marked": "^5.0.0",
     "marked-terminal": "^5.1.1",
     "micromatch": "^4.0.2",
     "p-each-series": "^3.0.0",
     "p-reduce": "^3.0.0",
-    "read-pkg-up": "^9.1.0",
+    "read-pkg-up": "^10.0.0",
     "resolve-from": "^5.0.0",
     "semver": "^7.3.2",
     "semver-diff": "^4.0.0",
@@ -56,24 +56,23 @@
     "yargs": "^17.5.1"
   },
   "devDependencies": {
-    "ava": "5.2.0",
-    "c8": "7.13.0",
+    "ava": "5.3.1",
+    "c8": "8.0.1",
     "clear-module": "4.1.2",
     "codecov": "3.8.3",
-    "delay": "5.0.0",
     "dockerode": "3.3.5",
     "file-url": "4.0.0",
     "fs-extra": "11.1.1",
-    "got": "12.6.0",
+    "got": "13.0.0",
     "js-yaml": "4.1.0",
     "mockserver-client": "5.15.0",
-    "nock": "13.3.0",
-    "p-retry": "5.1.2",
-    "prettier": "2.8.7",
-    "sinon": "15.0.4",
+    "nock": "13.3.3",
+    "p-retry": "6.0.0",
+    "prettier": "3.0.3",
+    "sinon": "16.0.0",
     "stream-buffers": "3.0.2",
-    "tempy": "3.0.0",
-    "testdouble": "3.17.2"
+    "tempy": "3.1.0",
+    "testdouble": "3.18.0"
   },
   "engines": {
     "node": ">=18"
@@ -82,6 +81,7 @@
     "bin",
     "docs",
     "lib",
+    "index.d.ts",
     "index.js",
     "cli.js"
   ],
@@ -99,6 +99,7 @@
   ],
   "license": "MIT",
   "main": "index.js",
+  "types": "index.d.ts",
   "c8": {
     "include": [
       "lib/**/*.js",

test/get-last-release.test.js

@@ -43,6 +43,43 @@ test("Get the highest prerelease valid tag, ignoring other tags from other prere
   });
 });
 
+test("Get the correct prerelease tag, when other prereleases share the same git HEAD", (t) => {
+  const testConfig = {
+    branch: {
+      name: "alpha",
+      prerelease: "alpha",
+      channel: "alpha",
+      tags: [
+        { version: "1.0.0-beta.1", gitTag: "v1.0.0-beta.1", gitHead: "v1.0.0-beta.1", channels: ["beta"] },
+        { version: "1.0.0-beta.2", gitTag: "v1.0.0-beta.2", gitHead: "v1.0.0-alpha.1", channels: ["alpha", "beta"] },
+        { version: "1.0.0-alpha.1", gitTag: "v1.0.0-alpha.1", gitHead: "v1.0.0-alpha.1", channels: ["alpha", "beta"] },
+      ],
+      type: "prerelease",
+    },
+    options: { tagFormat: `v\${version}`, debug: true },
+  };
+  const firstResult = getLastRelease(testConfig);
+
+  t.deepEqual(firstResult, {
+    version: "1.0.0-alpha.1",
+    gitTag: "v1.0.0-alpha.1",
+    name: "v1.0.0-alpha.1",
+    gitHead: "v1.0.0-alpha.1",
+    channels: ["alpha", "beta"],
+  });
+
+  testConfig.branch.prerelease = true;
+  const secondResult = getLastRelease(testConfig);
+
+  t.deepEqual(secondResult, {
+    version: "1.0.0-alpha.1",
+    gitTag: "v1.0.0-alpha.1",
+    name: "v1.0.0-alpha.1",
+    gitHead: "v1.0.0-alpha.1",
+    channels: ["alpha", "beta"],
+  });
+});
+
 test("Return empty object if no valid tag is found", (t) => {
   const result = getLastRelease({
     branch: {

test/get-next-version.test.js

@@ -275,3 +275,24 @@ test("Increase version for release on prerelease branch when there is no regular
     "1.0.0-beta.2"
   );
 });
+
+test("Increase patch when previous version shares HEAD with other releases", (t) => {
+  t.is(
+    getNextVersion({
+      branch: {
+        name: "alpha",
+        type: "prerelease",
+        prerelease: "alpha",
+        tags: [
+          { gitTag: "v1.0.0-beta.1", version: "1.0.0-beta.1", channels: ["beta"] },
+          { gitTag: "v1.0.0-beta.2", version: "1.0.0-beta.2", channels: ["alpha", "beta"] },
+          { gitTag: "v1.0.0-alpha.1", version: "1.0.0-alpha.1", channels: ["alpha", "beta"] },
+        ],
+      },
+      nextRelease: { type: "patch", channel: "alpha" },
+      lastRelease: { version: "v1.0.0-alpha.1", channels: ["alpha", "beta"] },
+      logger: t.context.logger,
+    }),
+    "1.0.0-alpha.2"
+  );
+});

test/helpers/git-utils.js

@@ -90,9 +90,7 @@ export async function gitCommits(messages, execaOptions) {
   await pEachSeries(
     messages,
     async (message) =>
-      (
-        await execa("git", ["commit", "-m", message, "--allow-empty", "--no-gpg-sign"], execaOptions)
-      ).stdout
+      (await execa("git", ["commit", "-m", message, "--allow-empty", "--no-gpg-sign"], execaOptions)).stdout
   );
   return (await gitGetCommits(undefined, execaOptions)).slice(0, messages.length);
 }

test/helpers/gitbox.js

@@ -1,5 +1,4 @@
 import Docker from "dockerode";
-import getStream from "get-stream";
 import pRetry from "p-retry";
 import { gitShallowClone, initBareRepo } from "./git-utils.js";
 
@@ -15,11 +14,20 @@ let container;
 export const gitCredential = `${GIT_USERNAME}:${GIT_PASSWORD}`;
 
 /**
- * Download the `gitbox` Docker image, create a new container and start it.
+ * Download the `gitbox` Docker image
+ */
+export function pull() {
+  return docker.pull(IMAGE).then((stream) => {
+    return new Promise((resolve, reject) => {
+      docker.modem.followProgress(stream, (err, res) => (err ? reject(err) : resolve(res)));
+    });
+  });
+}
+
+/**
+ * create a new container and start it.
  */
 export async function start() {
-  await getStream(await docker.pull(IMAGE));
-
   container = await docker.createContainer({
     Tty: true,
     Image: IMAGE,

test/helpers/mockserver.js

@@ -1,5 +1,4 @@
 import Docker from "dockerode";
-import getStream from "get-stream";
 import got from "got";
 import pRetry from "p-retry";
 import { mockServerClient } from "mockserver-client";
@@ -11,11 +10,20 @@ const docker = new Docker();
 let container;
 
 /**
- * Download the `mockserver` Docker image, create a new container and start it.
+ * Download the `mockserver` Docker image,
+ */
+export function pull() {
+  return docker.pull(IMAGE).then((stream) => {
+    return new Promise((resolve, reject) => {
+      docker.modem.followProgress(stream, (err, res) => (err ? reject(err) : resolve(res)));
+    });
+  });
+}
+
+/**
+ * create a new container and start it.
  */
 export async function start() {
-  await getStream(await docker.pull(IMAGE));
-
   container = await docker.createContainer({
     Tty: true,
     Image: IMAGE,

test/helpers/npm-registry.js

@@ -1,9 +1,8 @@
 import path, { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { setTimeout } from "node:timers/promises";
 import Docker from "dockerode";
-import getStream from "get-stream";
 import got from "got";
-import delay from "delay";
 import pRetry from "p-retry";
 
 const IMAGE = "verdaccio/verdaccio:5";
@@ -17,11 +16,20 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 let container, npmToken;
 
 /**
- * Download the `npm-registry-docker` Docker image, create a new container and start it.
+ * Download the `npm-registry-docker` Docker image
+ */
+export function pull() {
+  return docker.pull(IMAGE).then((stream) => {
+    return new Promise((resolve, reject) => {
+      docker.modem.followProgress(stream, (err, res) => (err ? reject(err) : resolve(res)));
+    });
+  });
+}
+
+/**
+ * create a new container and start it.
  */
 export async function start() {
-  await getStream(await docker.pull(IMAGE));
-
   container = await docker.createContainer({
     Tty: true,
     Image: IMAGE,
@@ -33,7 +41,7 @@ export async function start() {
   });
 
   await container.start();
-  await delay(4000);
+  await setTimeout(4000);
 
   try {
     // Wait for the registry to be ready

test/index.test.js

@@ -1853,10 +1853,19 @@ test.serial("Throw an Error if plugin returns an unexpected value", async (t) =>
   await td.replaceEsm("../lib/get-logger.js", null, () => t.context.logger);
   await td.replaceEsm("env-ci", null, () => ({ isCi: true, branch: "master", isPr: false }));
   const semanticRelease = (await import("../index.js")).default;
-  const error = await t.throwsAsync(
-    semanticRelease(options, { cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer() }),
-    { instanceOf: SemanticReleaseError }
-  );
+
+  let error;
+  try {
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    });
+  } catch (e) {
+    error = e;
+  }
+  t.is(error.code, "EANALYZECOMMITSOUTPUT");
   t.regex(error.details, /string/);
 });
 

test/integration.test.js

@@ -1,11 +1,11 @@
-import path from "path";
+import path from "node:path";
+import { setTimeout } from "node:timers/promises";
 import test from "ava";
 import * as td from "testdouble";
 import { escapeRegExp } from "lodash-es";
 import fsExtra from "fs-extra";
 import { execa } from "execa";
 import { WritableStreamBuffer } from "stream-buffers";
-import delay from "delay";
 
 import getAuthUrl from "../lib/get-git-auth-url.js";
 import { SECRET_REPLACEMENT } from "../lib/definitions/constants.js";
@@ -47,6 +47,7 @@ const pluginLogEnv = path.resolve("./test/fixtures/plugin-log-env");
 const pluginEsmNamedExports = path.resolve("./test/fixtures/plugin-esm-named-exports");
 
 test.before(async () => {
+  await Promise.all([gitbox.pull(), npmRegistry.pull(), mockServer.pull()]);
   await Promise.all([gitbox.start(), npmRegistry.start(), mockServer.start()]);
 
   env = {
@@ -295,7 +296,7 @@ test("Release patch, minor and major versions", async (t) => {
   t.is(exitCode, 0);
 
   // Wait for 3s as the change of dist-tag takes time to be reflected in the registry
-  await delay(3000);
+  await setTimeout(3000);
   // Retrieve the published package from the registry and check version and gitHead
   ({
     "dist-tags": { latest: releasedVersion },