Repository navigation
Tags
Tags
chore(release): 1.10.0 (#341) * chore(release): 1.10.0 * ci: publish to npm with provenance Attaches a signed attestation linking each published tarball to the exact commit and workflow run that built it, which npm surfaces as a Provenance badge on the package page. The value is not that it prevents a bad publish. It is that it makes one visible: a version pushed from a stolen NPM_TOKEN on someone's laptop carries no attestation, and the gap is public. Needs id-token: write, since the attestation is signed with a GitHub OIDC token. Without that permission the publish fails outright rather than quietly shipping unsigned, which is the behaviour we want.
chore(release): 1.8.2 Bump version to 1.8.2 across package.json, version constants, and lockfile (regenerated via lock:linux to preserve cross-platform entries), and add the 1.8.2 CHANGELOG entry. Also correct inaccurate "MSW / Mock Service Worker" references in the npm description and README (TWD uses its own built-in service worker, not the MSW library), improve npm keywords for discoverability, and remove em-dashes from the README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011GdS2hnMHyzYsFRoXVHEV5
PreviousNext