From 823e8642a8ec55b0db7e72ce6a9642c0e3842cfe Mon Sep 17 00:00:00 2001 From: bumpy-bot <276066384+bumpy-bot@users.noreply.github.com> Date: Thu, 17 Sep 2026 19:15:55 +0000 Subject: [PATCH] Version packages fledgling@1.3.0 --- .bumpy/include-extra-packages.md | 5 ----- .bumpy/npm-otp-env-var.md | 5 ----- .bumpy/publish-boolean.md | 7 ------- .bumpy/readme-sync-framing.md | 2 -- CHANGELOG.md | 13 +++++++++++++ package.json | 2 +- 6 files changed, 14 insertions(+), 20 deletions(-) delete mode 100644 .bumpy/include-extra-packages.md delete mode 100644 .bumpy/npm-otp-env-var.md delete mode 100644 .bumpy/publish-boolean.md delete mode 100644 .bumpy/readme-sync-framing.md diff --git a/.bumpy/include-extra-packages.md b/.bumpy/include-extra-packages.md deleted file mode 100644 index 56e4e83..0000000 --- a/.bumpy/include-extra-packages.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'fledgling': minor ---- - -New `include` config option: list exact package names that have no package.json in the workspace — e.g. per-platform native binary packages published as optional dependencies — and fledgling treats them like discovered packages (claimed, trusted, synced, tab-completed). They're npm-only; `fledgling jsr` skips them. diff --git a/.bumpy/npm-otp-env-var.md b/.bumpy/npm-otp-env-var.md deleted file mode 100644 index 0787af1..0000000 --- a/.bumpy/npm-otp-env-var.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'fledgling': patch ---- - -Read npm's own `NPM_CONFIG_OTP` env var as a fallback for `--otp`, so a 2FA code supplied that way also suppresses the interactive browser-approval prompt instead of fledgling assuming it still needs one. Docs now lead with npm's browser flow — approving with a passkey or security key is how most people will do this, and npm is moving away from authenticator codes — with the `--otp` / `--otp-secret` options kept but framed as the legacy fallback. diff --git a/.bumpy/publish-boolean.md b/.bumpy/publish-boolean.md deleted file mode 100644 index 2d42406..0000000 --- a/.bumpy/publish-boolean.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'fledgling': minor ---- - -**`publish: true|false` replaces `permissions`.** npm grants every trusted publisher staged publishing (`npm stage`) — a config created with `--allow-publish` alone reads back with both permissions. The only real choice is whether the publisher may also `npm publish` directly, so the config key is now a boolean (`"publish": true`, default) with `--publish` / `--no-publish` flags. The old `permissions: publish | stage | both` still works (`stage` → `false`, the rest → `true`) with a deprecation note, and `fledgling init` asks the yes/no question. `sync` no longer reports every package as out of sync over the implied `createStagedPackage`. - -**Failed trust reads are no longer reported as "not configured".** `sync` and the wizard read each package's trust config with a captured `npm trust list --json`, which can't run npm's browser 2FA itself. When that read failed (no remembered 2FA approval), it was silently treated as an empty config — so `sync` claimed nothing was set up, and would happily offer to "fix" everything. Reads now distinguish a failure (`EOTP` etc.) from an empty config: `sync` probes right after npm's interactive approval (with a short retry for the registry's "remember for 5 minutes" grace to kick in) and stops with a clear message if the approval didn't stick; a read that fails mid-run is listed as "couldn't be read" and left alone; and the add/wizard flow fails that package instead of writing blind. diff --git a/.bumpy/readme-sync-framing.md b/.bumpy/readme-sync-framing.md deleted file mode 100644 index a845151..0000000 --- a/.bumpy/readme-sync-framing.md +++ /dev/null @@ -1,2 +0,0 @@ ---- ---- diff --git a/CHANGELOG.md b/CHANGELOG.md index d68305d..e8ba49a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,19 @@ + +## 1.3.0 +2026-09-17 + +- [#15](https://github.com/dmno-dev/fledgling/pull/15) *(minor)* + **`publish: true|false` replaces `permissions`.** npm grants every trusted publisher staged publishing (`npm stage`) — a config created with `--allow-publish` alone reads back with both permissions. The only real choice is whether the publisher may also `npm publish` directly, so the config key is now a boolean (`"publish": true`, default) with `--publish` / `--no-publish` flags. The old `permissions: publish | stage | both` still works (`stage` → `false`, the rest → `true`) with a deprecation note, and `fledgling init` asks the yes/no question. `sync` no longer reports every package as out of sync over the implied `createStagedPackage`. + + **Failed trust reads are no longer reported as "not configured".** `sync` and the wizard read each package's trust config with a captured `npm trust list --json`, which can't run npm's browser 2FA itself. When that read failed (no remembered 2FA approval), it was silently treated as an empty config — so `sync` claimed nothing was set up, and would happily offer to "fix" everything. Reads now distinguish a failure (`EOTP` etc.) from an empty config: `sync` probes right after npm's interactive approval (with a short retry for the registry's "remember for 5 minutes" grace to kick in) and stops with a clear message if the approval didn't stick; a read that fails mid-run is listed as "couldn't be read" and left alone; and the add/wizard flow fails that package instead of writing blind. +- [#16](https://github.com/dmno-dev/fledgling/pull/16) *(minor)* + New `include` config option: list exact package names that have no package.json in the workspace — e.g. per-platform native binary packages published as optional dependencies — and fledgling treats them like discovered packages (claimed, trusted, synced, tab-completed). They're npm-only; `fledgling jsr` skips them. +- [#12](https://github.com/dmno-dev/fledgling/pull/12) *(patch)* + Read npm's own `NPM_CONFIG_OTP` env var as a fallback for `--otp`, so a 2FA code supplied that way also suppresses the interactive browser-approval prompt instead of fledgling assuming it still needs one. Docs now lead with npm's browser flow — approving with a passkey or security key is how most people will do this, and npm is moving away from authenticator codes — with the `--otp` / `--otp-secret` options kept but framed as the legacy fallback. + ## 1.2.1 2026-07-30 diff --git a/package.json b/package.json index a0571fe..b640ed0 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "fledgling", - "version": "1.2.1", + "version": "1.3.0", "description": "🐣 Hatch your new npm package safely - claim the name on npm and set up / sync trusted publishing settings, for one package or a whole monorepo.", "keywords": [ "npm",