docs(changelog): 1.2.5 through 1.2.7, plus the gate that should have caught it - #24
Merged
Merged
Conversation
…caught it
THE MEASURED GAPS
1. Five tags exist (v1.2.3 ... v1.2.7). One GitHub release does (v1.2.5).
2. CHANGELOG ended at 1.2.4 while npm served 1.2.7 — three releases with
no entry.
3. Unreleased commits sit on main after v1.2.7.
WHAT CHANGED
CHANGELOG: 1.2.5, 1.2.6 and 1.2.7 written from the commit log, not from
memory. Tone follows 1.2.7's own name — "honest short descriptions".
bin/changelog-gate.js: the previous prepublishOnly check only asked whether
CHANGELOG.md EXISTED. It did, continuously, while three versions shipped
without an entry. A file-exists check cannot catch that; it was green the
whole time. The new gate requires a NON-EMPTY "## [<version>]" section.
.github/workflows/release.yml: a tag now creates its GitHub release, with the
changelog section as the release notes. Writing release notes twice means
writing them differently, and then neither is authoritative.
PROVEN, not asserted:
version present + section filled -> exit 0
version absent from CHANGELOG -> exit 1
section present but empty -> exit 1
npm test green, npm audit: 0 vulnerabilities
CORRECTIONS to the task description:
· It claims TWO unreleased commits after v1.2.7. There are THREE — the extra
one is 4d6fb59 "fix: resolve high severity npm vulnerability". A security
fix is sitting on main, unpublished; npm still serves 1.2.7 without it.
Recorded under [Unreleased].
· plugin.json does not exist on main, so it cannot be at 1.2.7 as claimed.
package.json and server.json are both 1.2.7 — no drift between those two.
· The six "orphan" branches are all genuinely merged (PRs #4, #15, #17, #18,
#19, #20); only the refs remain. Deleting them is K4 — listed, not done.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
✅ Deploy Preview for strong-fudge-f04a16 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
CI was red on this PR. It is red on `main` too, for the same reason and independently of anything in this branch: a clean `main` worktree fails `npm ci` identically. npm error `npm ci` can only install packages when your package.json and npm error package-lock.json are in sync. npm error Missing: @commitlint/cli@21.2.2 from lock file npm error Missing: @modelcontextprotocol/sdk@1.30.0 from lock file npm error Missing: zod@4.4.3 from lock file ... 20 more The lock file was not merely stale. It carried NO ENTRY for either runtime dependency — @modelcontextprotocol/sdk and zod — and none for the devDependency tree at all. It pinned nothing. Every CI job died at `npm ci` before running a single test, which is why coverage, e2e, lint, security and all three test matrix legs failed within 17 seconds. Regenerated with `npm install --package-lock-only`. The resulting versions match exactly what package.json already specifies (sdk 1.30.0, zod 4.4.3), so this changes no dependency — it records the ones that were already chosen. npm ci --dry-run passes npm test green npm audit 0 vulnerabilities Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The measured gaps
v1.2.3v1.2.4v1.2.5v1.2.6v1.2.7— fivev1.2.5— one1.2.4while npm served1.2.7mainafterv1.2.7Three releases shipped to npm with no changelog entry. The
prepublishOnlycheckwas green the entire time — because it only asked whether
CHANGELOG.mdexisted.What this PR changes
CHANGELOG.md— entries for 1.2.5, 1.2.6 and 1.2.7, written from the commitlog rather than from memory. The tone follows 1.2.7's own release name, "honest
short descriptions".
bin/changelog-gate.js— replaces the file-exists check inprepublishOnly.It requires a non-empty
## [<version>]section for the version beingpublished. This is the cause of gap 2, and it is fifty lines.
.github/workflows/release.yml— a tag now creates its own GitHub release,using the changelog section as the release notes. Writing release notes twice
means writing them differently, and then neither is authoritative. Also accepts
workflow_dispatchwith a tag name, to backfill the four missing releases.Proven, not asserted
exit 0exit 1exit 1npm testnpm auditThe gate's first draft reported a filled section as empty —
restbegins withthe heading itself, so splitting on
/^##\s/mput an empty string first. Fixedand re-tested; the comment in the file records it.
🔴 Follow-up that is more urgent than this PR
4d6fb59 fix: resolve high severity npm vulnerabilitysits onmain,unpublished. npm still serves 1.2.7, which predates it — anyone installing
the package today gets the version without the fix.
npm auditreports cleanlocally, but that describes the working tree, not the published package.
It is recorded under
[Unreleased]. Cutting 1.2.8 should follow directly afterthis merge, so the new gate is in place for it.
Not in this PR
Six merged branch refs are still present (
chore/audit-fix-2026-08-03,chore/unblock-npm-audit,docs/changelog-1.2.3-1.2.4,docs/llms-install,fix/surface-a11y-warnings,release/1.2.7— PRs #17, #15, #4, #20, #18, #19).All are genuinely merged; squash-merging makes the ancestry differ, which is why
they look unmerged. Deleting them is a separate decision.
🤖 Generated with Claude Code