fix: revert updating cosmiconfig to v9

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/scorecard.yml

@@ -31,6 +31,6 @@ jobs:
           path: results.sarif
           retention-days: 5
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
+        uses: github/codeql-action/upload-sarif@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
         with:
           sarif_file: results.sarif

README.md

@@ -69,7 +69,7 @@ The table below shows which commit message gets you which release type when `sem
 ### Automation with CI
 
 **semantic-release** is meant to be executed on the CI environment after every successful build on the release branch.
-This way no human is directly involved in the release process and the releases are guaranteed to be [unromantic and unsentimental](http://sentimentalversioning.org).
+This way no human is directly involved in the release process and the releases are guaranteed to be [unromantic and unsentimental](https://github.com/dominictarr/sentimental-versioning#readme).
 
 ### Triggering a release
 

lib/branches/normalize.js

@@ -60,7 +60,7 @@ export function release({ release }) {
     return release;
   }
 
-  // The intial lastVersion is the last release from the base branch of `FIRST_RELEASE` (1.0.0)
+  // The initial lastVersion is the last release from the base branch of `FIRST_RELEASE` (1.0.0)
   let lastVersion = getLatestVersion(tagsToVersions(release[0].tags)) || FIRST_RELEASE;
 
   return release.map(({ name, tags, channel, ...rest }, idx) => {

lib/get-config.js

@@ -1,11 +1,10 @@
-import { dirname, resolve } from "node:path";
+import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { createRequire } from "node:module";
 
 import { castArray, isNil, isPlainObject, isString, pickBy } from "lodash-es";
 import { readPackageUp } from "read-pkg-up";
 import { cosmiconfig } from "cosmiconfig";
-import resolveFrom from "resolve-from";
+import importFrom from "import-from-esm";
 import debugConfig from "debug";
 import { repoUrl } from "./git.js";
 import PLUGINS_DEFINITIONS from "./definitions/plugins.js";
@@ -14,7 +13,6 @@ import { parseConfig, validatePlugin } from "./plugins/utils.js";
 
 const debug = debugConfig("semantic-release:config");
 const __dirname = dirname(fileURLToPath(import.meta.url));
-const require = createRequire(import.meta.url);
 
 const CONFIG_NAME = "release";
 
@@ -35,7 +33,7 @@ export default async (context, cliOptions) => {
     options = {
       ...(await castArray(extendPaths).reduce(async (eventualResult, extendPath) => {
         const result = await eventualResult;
-        const extendsOptions = require(resolveFrom.silent(__dirname, extendPath) || resolveFrom(cwd, extendPath));
+        const extendsOptions = (await importFrom.silent(__dirname, extendPath)) || (await importFrom(cwd, extendPath));
 
         // For each plugin defined in a shareable config, save in `pluginsPath` the extendable config path,
         // so those plugin will be loaded relative to the config file

lib/get-git-auth-url.js

@@ -36,7 +36,7 @@ function formatAuthUrl(protocol, repositoryUrl, gitCredentials) {
  * @param {Object} context semantic-release context.
  * @param {String} authUrl Repository URL to verify
  *
- * @return {String} The authUrl as is if the connection was successfull, null otherwise
+ * @return {String} The authUrl as is if the connection was successful, null otherwise
  */
 async function ensureValidAuthUrl({ cwd, env, branch }, authUrl) {
   try {

package.json

@@ -43,13 +43,14 @@
     "git-log-parser": "^1.2.0",
     "hook-std": "^3.0.0",
     "hosted-git-info": "^7.0.0",
+    "import-from-esm": "^1.3.1",
     "lodash-es": "^4.17.21",
     "marked": "^9.0.0",
     "marked-terminal": "^6.0.0",
     "micromatch": "^4.0.2",
     "p-each-series": "^3.0.0",
     "p-reduce": "^3.0.0",
-    "read-pkg-up": "^10.0.0",
+    "read-pkg-up": "^11.0.0",
     "resolve-from": "^5.0.0",
     "semver": "^7.3.2",
     "semver-diff": "^4.0.0",
@@ -57,28 +58,28 @@
     "yargs": "^17.5.1"
   },
   "devDependencies": {
-    "ava": "5.3.1",
+    "ava": "6.0.0",
     "c8": "8.0.1",
     "clear-module": "4.1.2",
     "codecov": "3.8.3",
     "cz-conventional-changelog": "3.3.0",
     "dockerode": "4.0.0",
     "file-url": "4.0.0",
-    "fs-extra": "11.1.1",
-    "got": "13.0.0",
+    "fs-extra": "11.2.0",
+    "got": "14.0.0",
     "js-yaml": "4.1.0",
     "lockfile-lint": "4.12.1",
-    "ls-engines": "0.9.0",
+    "ls-engines": "0.9.1",
     "mockserver-client": "5.15.0",
-    "nock": "13.3.7",
+    "nock": "13.4.0",
     "npm-run-all2": "6.1.1",
     "p-retry": "6.1.0",
-    "prettier": "3.0.3",
-    "publint": "0.2.5",
-    "sinon": "17.0.0",
+    "prettier": "3.1.0",
+    "publint": "0.2.6",
+    "sinon": "17.0.1",
     "stream-buffers": "3.0.2",
     "tempy": "3.1.0",
-    "testdouble": "3.20.0"
+    "testdouble": "3.20.1"
   },
   "engines": {
     "node": "^18.17 || >=20.6.1"

test/get-config.test.js

@@ -389,6 +389,92 @@ test.serial('Read configuration from an array of paths in "extends"', async (t)
   t.deepEqual(result, { options: expectedOptions, plugins: pluginsConfig });
 });
 
+test.serial('Read configuration from an array of CJS files in "extends"', async (t) => {
+  // Create a git repository, set the current working directory at the root of the repo
+  const { cwd } = await gitRepo();
+  const pkgOptions = { extends: ["./shareable1.cjs", "./shareable2.cjs"] };
+  const options1 = {
+    verifyRelease: "verifyRelease1",
+    analyzeCommits: { path: "analyzeCommits1", param: "analyzeCommits_param1" },
+    branches: ["test_branch"],
+    repositoryUrl: "https://host.null/owner/module.git",
+  };
+  const options2 = {
+    verifyRelease: "verifyRelease2",
+    generateNotes: "generateNotes2",
+    analyzeCommits: { path: "analyzeCommits2", param: "analyzeCommits_param2" },
+    branches: ["test_branch"],
+    tagFormat: `v\${version}`,
+    plugins: false,
+  };
+  // Create package.json and shareable.json in repository root
+  await outputJson(path.resolve(cwd, "package.json"), { release: pkgOptions });
+  await writeFile(path.resolve(cwd, "shareable1.cjs"), `module.exports = ${JSON.stringify(options1)}`);
+  await writeFile(path.resolve(cwd, "shareable2.cjs"), `module.exports = ${JSON.stringify(options2)}`);
+  const expectedOptions = { ...options1, ...options2, branches: ["test_branch"] };
+  // Verify the plugins module is called with the plugin options from shareable1.mjs and shareable2.mjs
+  td.when(
+    plugins(
+      { options: expectedOptions, cwd },
+      {
+        verifyRelease1: "./shareable1.cjs",
+        verifyRelease2: "./shareable2.cjs",
+        generateNotes2: "./shareable2.cjs",
+        analyzeCommits1: "./shareable1.cjs",
+        analyzeCommits2: "./shareable2.cjs",
+      }
+    )
+  ).thenResolve(pluginsConfig);
+
+  const result = await t.context.getConfig({ cwd });
+
+  // Verify the options contains the plugin config from shareable1.json and shareable2.json
+  t.deepEqual(result, { options: expectedOptions, plugins: pluginsConfig });
+});
+
+test.serial('Read configuration from an array of ESM files in "extends"', async (t) => {
+  // Create a git repository, set the current working directory at the root of the repo
+  const { cwd } = await gitRepo();
+  const pkgOptions = { extends: ["./shareable1.mjs", "./shareable2.mjs"] };
+  const options1 = {
+    verifyRelease: "verifyRelease1",
+    analyzeCommits: { path: "analyzeCommits1", param: "analyzeCommits_param1" },
+    branches: ["test_branch"],
+    repositoryUrl: "https://host.null/owner/module.git",
+  };
+  const options2 = {
+    verifyRelease: "verifyRelease2",
+    generateNotes: "generateNotes2",
+    analyzeCommits: { path: "analyzeCommits2", param: "analyzeCommits_param2" },
+    branches: ["test_branch"],
+    tagFormat: `v\${version}`,
+    plugins: false,
+  };
+  // Create package.json and shareable.json in repository root
+  await outputJson(path.resolve(cwd, "package.json"), { release: pkgOptions });
+  await writeFile(path.resolve(cwd, "shareable1.mjs"), `export default ${JSON.stringify(options1)}`);
+  await writeFile(path.resolve(cwd, "shareable2.mjs"), `export default ${JSON.stringify(options2)}`);
+  const expectedOptions = { ...options1, ...options2, branches: ["test_branch"] };
+  // Verify the plugins module is called with the plugin options from shareable1.mjs and shareable2.mjs
+  td.when(
+    plugins(
+      { options: expectedOptions, cwd },
+      {
+        verifyRelease1: "./shareable1.mjs",
+        verifyRelease2: "./shareable2.mjs",
+        generateNotes2: "./shareable2.mjs",
+        analyzeCommits1: "./shareable1.mjs",
+        analyzeCommits2: "./shareable2.mjs",
+      }
+    )
+  ).thenResolve(pluginsConfig);
+
+  const result = await t.context.getConfig({ cwd });
+
+  // Verify the options contains the plugin config from shareable1.json and shareable2.json
+  t.deepEqual(result, { options: expectedOptions, plugins: pluginsConfig });
+});
+
 test.serial('Prioritize configuration from config file over "extends"', async (t) => {
   // Create a git repository, set the current working directory at the root of the repo
   const { cwd } = await gitRepo();

test/helpers/git-utils.js

@@ -98,7 +98,7 @@ export async function gitCommits(messages, execaOptions) {
 /**
  * Get the list of parsed commits since a git reference.
  *
- * @param {String} [from] Git reference from which to seach commits.
+ * @param {String} [from] Git reference from which to search commits.
  * @param {Object} [execaOpts] Options to pass to `execa`.
  *
  * @return {Array<Object>} The list of parsed commits.
@@ -240,7 +240,7 @@ export async function gitTagHead(tagName, execaOptions) {
  * Get the first commit sha referenced by the tag `tagName` in the remote repository.
  *
  * @param {String} repositoryUrl The repository remote URL.
- * @param {String} tagName The tag name to seach for.
+ * @param {String} tagName The tag name to search for.
  * @param {Object} [execaOpts] Options to pass to `execa`.
  *
  * @return {String} The sha of the commit associated with `tagName` on the remote repository.

test/hide-sensitive.test.js

@@ -11,7 +11,7 @@ test("Replace multiple sensitive environment variable values", (t) => {
   );
 });
 
-test("Replace multiple occurences of sensitive environment variable values", (t) => {
+test("Replace multiple occurrences of sensitive environment variable values", (t) => {
   const env = { secretKey: "secret" };
   t.is(
     hideSensitive(env)(`https://user:${env.secretKey}@host.com?token=${env.secretKey}`),

test/plugins/normalize.test.js

@@ -96,7 +96,7 @@ test("Normalize and load plugin from function", async (t) => {
   t.is(typeof plugin, "function");
 });
 
-test("Normalize and load plugin that retuns multiple functions", async (t) => {
+test("Normalize and load plugin that returns multiple functions", async (t) => {
   const plugin = await normalize(
     { cwd, options: {}, logger: t.context.logger },
     "verifyConditions",

test/plugins/utils.test.js

@@ -52,7 +52,7 @@ test("validateStep: optional plugin configuration", (t) => {
   t.true(validateStep(type, { path: () => {}, options: "value" }));
   t.false(validateStep(type, { path: null }));
 
-  // Considered as an Array of 2 definitions and not as one Array definition in case of a muliple plugin type
+  // Considered as an Array of 2 definitions and not as one Array definition in case of a multiple plugin type
   t.false(validateStep(type, [() => {}, { options: "value" }]));
   t.false(validateStep(type, ["plugin-path.js", { options: "value" }]));
 
@@ -134,7 +134,7 @@ test("validateStep: required plugin configuration", (t) => {
   t.true(validateStep(type, { path: () => {}, options: "value" }));
   t.false(validateStep(type, { path: null }));
 
-  // Considered as an Array of 2 definitions and not as one Array definition in the case of a muliple plugin type
+  // Considered as an Array of 2 definitions and not as one Array definition in the case of a multiple plugin type
   t.false(validateStep(type, [() => {}, { options: "value" }]));
   t.false(validateStep(type, ["plugin-path.js", { options: "value" }]));