fix(deps): update dependency marked to v9 (#2947)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
     name: release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
       - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
         with:
           cache: npm

.github/workflows/scorecard.yml

@@ -15,7 +15,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
         with:
           persist-credentials: false
       - name: Run analysis
@@ -25,12 +25,12 @@ jobs:
           results_format: sarif
           publish_results: true
       - name: Upload artifact
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@a09933a12a80f87b87005513f0abb1494c27a716 # v2.21.4
+        uses: github/codeql-action/upload-sarif@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8
         with:
           sarif_file: results.sarif

.github/workflows/test.yml

@@ -15,19 +15,24 @@ on:
 permissions:
   contents: read # to fetch code (actions/checkout)
 
+env:
+  FORCE_COLOR: 1
+  NPM_CONFIG_COLOR: always
+
 jobs:
   test_matrix:
     strategy:
       matrix:
         node-version:
-          - 18.0.0
-          - 19
+          - 18.17.0
+          - 20.6.1
+          - 20
 
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
       - run: git config --global user.name github-actions
       - run: git config --global user.email github-actions@github.com
       - name: Use Node.js ${{ matrix.node-version }}
@@ -45,8 +50,9 @@ jobs:
   test:
     runs-on: ubuntu-latest
     needs: test_matrix
+    if: always()
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
       - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
         with:
           node-version: lts/*
@@ -54,3 +60,9 @@ jobs:
       - run: npm clean-install
       - run: npm audit signatures
       - run: npm run lint
+      - name: All matrix versions passed
+        if: ${{ !(contains(needs.*.result, 'failure')) }}
+        run: exit 0
+      - name: Some matrix version failed
+        if: ${{ contains(needs.*.result, 'failure') }}
+        run: exit 1

.nvmrc

@@ -0,0 +1 @@
+v18

docs/extending/plugins-list.md

@@ -84,6 +84,11 @@
   - `verifyRelease`: Checks and warns (does not error by default) if the version numbers found on maven central and within the Git project differ by quite a bit
   - `prepare`: Changes the version number in the `pom.xml` (or all `pom.xml` files in maven projects with multiple `pom.xml` files) and optionally creates a commit with this version number and pushes it to `master`
   - `publish`: Runs `mvn deploy` to deploy to maven central and optionally will update to next snapshot version and merge changes to development branch
+- [maven-semantic-release](https://github.com/terrestris/maven-semantic-release) (alternative version)
+  - `verifyConditions`: Verifies that the `mvn` command exists.
+  - `prepare`: Changes version number in `pom.xml` and optionally in all child modules.
+  - `publish`: Runs one of the mvn targets `deploy`, `package jib:build` or `deploy jib:build`.
+  - `success`: Optionally sets new snapshot version and commits it.
 - [semantic-release-ado](https://github.com/lluchmk/semantic-release-ado)
   - `prepare`: Stores the version number as an Azure DevOps pipeline variable available to downstream steps on the job
 - [gradle-semantic-release](https://github.com/KengoTODA/gradle-semantic-release-plugin)

docs/recipes/ci-configurations/gitlab-ci.md

@@ -6,6 +6,11 @@ The [Authentication](../../usage/ci-configuration.md#authentication) environment
 
 **Note**: Make sure to configure your release branch as [protected](https://docs.gitlab.com/ce/user/project/protected_branches.html) in order for the CI/CD build to access the protected variables.
 
+## npm provenance
+
+Since GitLab CI is a [supported provider](https://docs.npmjs.com/generating-provenance-statements#provenance-limitations) for [npm provenance](https://docs.npmjs.com/generating-provenance-statements), it is recommended to enable this to increase supply-chain security for your npm packages.
+Find more detail about configuring npm to publish with provenance through semantic-release [in the documentation for our npm plugin](https://github.com/semantic-release/npm#npm-provenance).
+
 ## Node project configuration
 
 GitLab CI supports [Pipelines](https://docs.gitlab.com/ee/ci/pipelines.html) allowing to test on multiple Node versions and publishing a release only when all test pass.

package.json

@@ -8,6 +8,7 @@
     "files": [
       "test/**/*.test.js"
     ],
+    "failFast": true,
     "nodeArguments": [
       "--loader=testdouble",
       "--no-warnings"
@@ -26,12 +27,12 @@
     "Matt Travi <npm@travi.org> (https://matt.travi.org/)"
   ],
   "dependencies": {
-    "@semantic-release/commit-analyzer": "^10.0.0",
+    "@semantic-release/commit-analyzer": "^11.0.0",
     "@semantic-release/error": "^4.0.0",
     "@semantic-release/github": "^9.0.0",
-    "@semantic-release/npm": "^10.0.2",
-    "@semantic-release/release-notes-generator": "^11.0.0",
-    "aggregate-error": "^4.0.1",
+    "@semantic-release/npm": "^11.0.0",
+    "@semantic-release/release-notes-generator": "^12.0.0",
+    "aggregate-error": "^5.0.0",
     "cosmiconfig": "^8.0.0",
     "debug": "^4.0.0",
     "env-ci": "^9.0.0",
@@ -43,8 +44,8 @@
     "hook-std": "^3.0.0",
     "hosted-git-info": "^7.0.0",
     "lodash-es": "^4.17.21",
-    "marked": "^5.0.0",
-    "marked-terminal": "^5.1.1",
+    "marked": "^9.0.0",
+    "marked-terminal": "^6.0.0",
     "micromatch": "^4.0.2",
     "p-each-series": "^3.0.0",
     "p-reduce": "^3.0.0",
@@ -67,20 +68,21 @@
     "js-yaml": "4.1.0",
     "mockserver-client": "5.15.0",
     "nock": "13.3.3",
-    "p-retry": "5.1.2",
-    "prettier": "3.0.2",
-    "sinon": "15.2.0",
+    "p-retry": "6.0.0",
+    "prettier": "3.0.3",
+    "sinon": "16.0.0",
     "stream-buffers": "3.0.2",
     "tempy": "3.1.0",
-    "testdouble": "3.18.0"
+    "testdouble": "3.19.0"
   },
   "engines": {
-    "node": ">=18"
+    "node": "^18.17 || >=20.6.1"
   },
   "files": [
     "bin",
     "docs",
     "lib",
+    "index.d.ts",
     "index.js",
     "cli.js"
   ],
@@ -97,7 +99,7 @@
     "version"
   ],
   "license": "MIT",
-  "main": "index.js",
+  "main": "./index.js",
   "types": "index.d.ts",
   "c8": {
     "include": [

test/helpers/git-utils.js

@@ -43,7 +43,7 @@ export async function initGit(withRemote) {
  *
  * @param {Boolean} withRemote `true` to create a shallow clone of a bare repository.
  * @param {String} [branch='master'] The branch to initialize.
- * @return {String} The path of the clone if `withRemote` is `true`, the path of the repository otherwise.
+ * @return {Promise<Object>} The path of the clone if `withRemote` is `true`, the path of the repository otherwise.
  */
 export async function gitRepo(withRemote, branch = "master") {
   let { cwd, repositoryUrl } = await initGit(withRemote);

test/integration.test.js

@@ -35,7 +35,7 @@ let env;
 
 // Environment variables used only for the local npm command used to do verification
 const npmTestEnv = {
-  ...process.env,
+  ...processEnvWithoutGitHubActionsVariables,
   ...npmRegistry.authEnv(),
   npm_config_registry: npmRegistry.url,
 };
@@ -516,8 +516,8 @@ test("Pass options via CLI arguments", async (t) => {
 });
 
 test("Run via JS API", async (t) => {
-  td.replace("../lib/logger", { log: () => {}, error: () => {}, stdout: () => {} });
-  td.replace("env-ci", () => ({ isCi: true, branch: "master", isPr: false }));
+  await td.replaceEsm("../lib/logger", null, { log: () => {}, error: () => {}, stdout: () => {} });
+  await td.replaceEsm("env-ci", null, () => ({ isCi: true, branch: "master", isPr: false }));
   const semanticRelease = (await import("../index.js")).default;
   const packageName = "test-js-api";
   const owner = "git";