Skip to content

chore(deps): bump changesets/action from 1.9.0 to 2.1.2 - #67

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/changesets/action-2.1.2
Open

chore(deps): bump changesets/action from 1.9.0 to 2.1.2#67
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/changesets/action-2.1.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps changesets/action from 1.9.0 to 2.1.2.

Release notes

Sourced from changesets/action's releases.

v2.1.2

Patch Changes

v2.1.1

Patch Changes

v2.1.0

Minor Changes

  • #718 3b7c71c Thanks @​bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

v2.0.0

Major Changes

  • #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

    Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

    Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

  • #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

    If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

  • #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

  • #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

    Inputs:

    • version -> version-script
    • publish -> publish-script
    • commit -> commit-message
    • title -> pr-title
    • branch -> pr-base-branch

... (truncated)

Changelog

Sourced from changesets/action's changelog.

@​changesets/action

2.1.2

Patch Changes

2.1.1

Patch Changes

2.1.0

Minor Changes

  • #718 3b7c71c Thanks @​bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

2.0.0

Major Changes

  • #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

    Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

    Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

  • #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

    If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

  • #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

  • #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

    Inputs:

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 19, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/changesets/action-2.1.2 branch 2 times, most recently from 65a5421 to 8b9d96e Compare September 20, 2026 07:47
This was referenced Sep 20, 2026
Closed
Merged
@eknowledger

eknowledger commented Sep 20, 2026

Copy link
Copy Markdown
Owner

Holding this one, and it is not a judgement about the version. v2 of this action requires Changesets CLI v3, and this repository is on @changesets/cli@2.29.8. The action validates that and directs CLI v2 users back to changesets/action@v1 (changesets/action#699).

Merging the SHA alone would also break release.yml in five other ways, because v2 renamed everything this repository passes:

We pass v2 name
version: pnpm changeset version version-script
commit: "chore: version packages" commit-message
title: "Release: version packages" pr-title
publish: pnpm release publish-script
GITHUB_TOKEN as an env var github-token input; the env var is no longer accepted

And the "Say what happened" step reads steps.changesets.outputs.publishedPackages, which became published-packages when the outputs moved to kebab-case.

There is one more that is easy to miss. Published-package detection no longer parses stdout: it uses a shared file via a CHANGESETS_OUTPUT environment variable, which "should always be passed down to the Changesets CLI invocations". This repository publishes through a custom script (publish: pnpm release, which is pnpm build && changeset publish), so that path needs checking rather than assuming environment inheritance covers it.

The order this has to happen in

  1. Bump @changesets/cli from 2.29.8 to 3.x, on its own, with its own breaking-change review. 3.0.3 is latest on npm today.
  2. Then this action, with all five renames and the token moved to an input in the same commit.
  3. Verify against a real release, because the parts that matter here (the version pull request, the tag, the npm publish) only run on main and are not exercised by any pull request.

Step 3 is the reason this is worth doing deliberately rather than quickly: the publish job is the one place where getting it wrong is not repealable.

Leaving this open as the record. actions/checkout and actions/setup-node are handled in #90, which also covers the pages.yml pins that #68 and #69 both miss.

eknowledger added a commit that referenced this pull request Sep 20, 2026
@eknowledger
chore: bump checkout and setup-node to v7 in every workflow (#90)
e37ddcb 
Supersedes #68 and #69, which are both correct and both incomplete: Dependabot
generated them before pages.yml existed, so between them they update 6 of the 7
checkout pins and 5 of the 6 setup-node pins. Leaving the Pages workflow a major
behind means two sets of pins in one repository until the robot notices again.

Both majors were read rather than assumed safe:

  - checkout v7 blocks checking out a fork PR under pull_request_target and
    workflow_run. Neither trigger appears in any workflow here.
  - checkout v6 moved credential persistence to a separate file. Nothing here reads
    .git/config for a token.
  - setup-node v6 disabled AUTOMATIC caching for pnpm and yarn. It did not remove
    the feature, and every job here passes `cache: pnpm` explicitly, which is the
    supported form. This is the one that looked like a problem and is not.
  - setup-node v7 removed a dummy NODE_AUTH_TOKEN export. Publishing authenticates
    with an OIDC token from a trusted publisher, so there is nothing to remove.

All three SHAs in the robot's pull requests were checked against their tags through
the API before being used, because a pin whose comment lies is worse than no pin.
That is not hypothetical here: a fabricated version comment shipped once already.

⚠️ release.yml is changed but cannot be exercised by this pull request. It triggers
on push to main only, so its two checkout steps and its setup-node step first run
after this merges. The risk is small, since the same versions are proven by the
other three workflows on this branch, but it is not zero and it is worth knowing
which line of the change CI did not cover.

changesets/action is deliberately not here. See #67 and #89.

Closes #89

Co-authored-by: Ahmed Elmalt <6933715+eknowledger@users.noreply.github.com>
@dependabot
chore(deps): bump changesets/action from 1.9.0 to 2.1.2
64b0d2b 
Bumps [changesets/action](https://github.com/changesets/action) from 1.9.0 to 2.1.2.
- [Release notes](https://github.com/changesets/action/releases)
- [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md)
- [Commits](changesets/action@a45c4d5...ae32849)

---
updated-dependencies:
- dependency-name: changesets/action
  dependency-version: 2.1.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/changesets/action-2.1.2 branch from 8b9d96e to 64b0d2b Compare September 20, 2026 10:24

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@eknowledger