Repository navigation
chore: release 1.2.3 - #47
Merged
Merged
Conversation
`obsidian` pins `moment` to exactly 2.29.4, so Dependabot's security update for alert #35 fails with "latest possible version ... is 2.29.4". Force the patched release with an npm `overrides` entry instead. `moment` is only consumed for the type declarations in obsidian.d.ts; src/ never imports it and esbuild never bundles it (Obsidian provides its own copy at runtime). Type-check and lint pass, and the production main.js / styles.css are byte-identical before and after. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The release docs already said to keep package.json's version in sync with manifest.json, but nothing checked it, and it stayed at 1.1.5 through the 1.2.0, 1.2.1 and 1.2.2 releases. Bump package.json / package-lock.json to 1.2.2 and make scripts/validate.mjs fail CI when either disagrees with manifest.version. List the package.json bump (`npm version <x.y.z> --no-git-tag-version`) as an explicit step in CONTRIBUTING.md, docs/DEVELOPMENT.md, CLAUDE.md and the release PR checklist. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- src/main.ts is ~1,850 lines now, not ~900. - dependabot.yml still described the plugin as "plain CommonJS with no build step", which predates the TypeScript + esbuild toolchain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-g3hv-75wg-m249) The globParts-amplification DoS is only fixed in minimatch 11.0.1, and no upstream release (not even eslint 10) accepts 11, so Dependabot's security update fails. Override minimatch to ^11.0.1 under the consumers that only use the named `Minimatch` / `minimatch` exports, which 11 keeps: eslint, @eslint/config-array, @eslint/eslintrc, @typescript-eslint/typescript-estree, eslint-plugin-n This replaces the copies that actually contain the vulnerable code (9.0.9, 10.2.5) and moves ESLint's own file/config matching to 11.0.3. Left alone on purpose: eslint-plugin-import / eslint-plugin-react (3.x) and eslint-plugin-json-schema-validator (8.x, pinned by eslint-plugin-obsidianmd) call the module itself or its default export. minimatch >= 10 exports a plain object, so forcing 11 there would crash them. 3.x predates the vulnerable preprocessing, and the json-schema-validator rules are not enabled for src/. A callable shim via a `file:` override was tried and dropped: npm 11 resolves `file:` overrides relative to each consumer, which produces broken links. Verification: - differential test, minimatch 3.1.5 vs 11.0.3, on the option sets ESLint and eslint-plugin-n pass: 3300 cases, only diffs are patterns containing `..` (11 normalizes them), which our config does not use - `eslint --print-config src/main.ts` is identical before and after, and the same files are linted - full CI gate passes; production main.js is unaffected (dev toolchain only) Rationale and removal criteria are documented in docs/DEVELOPMENT.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dev-toolchain security maintenance (moment / minimatch overrides, lockfile bumps #43–#45) and the package.json version check. No behaviour change: the production main.js / styles.css are byte-identical to the 1.2.2 release assets. manifest.json, package.json / package-lock.json → 1.2.3; versions.json "1.2.3": "1.6.6"; CHANGELOG dated section. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Version bump for 1.2.3. Stacked on #46: merge #46 first. After that, this PR's diff shrinks to the bump commit alone.
Version lockstep
manifest.json1.2.3package.json/package-lock.json1.2.3.validate.mjsnow enforces this (chore: patch moment/minimatch advisories, sync package.json version, refresh stale docs #46).versions.json:"1.2.3": "1.6.6".minAppVersionunchanged.CHANGELOG.md: dated## [1.2.3] - 2026-11-02section and compare links.What 1.2.3 ships
Dev-toolchain security maintenance only:
No behaviour change. The built
main.js/styles.cssare byte-identical to the 1.2.2 release assets (sha113e6603…/5a58451…).Gate
npm ci·npm run lint·npm run build·node --check main.js·node scripts/validate.mjs— all green.After merge
Open the release PR
dev→main(templaterelease.md). The Release workflow then tags1.2.3and publishes the release. After that, back-mergemain→dev.🤖 Generated with Claude Code