chore(release): v0.24.1 - #306
Merged
Merged
Conversation
Patch: nothing that ships changed. The only commits since v0.24.0 are the publish workflow (#304, #305), and .github is not in the package's `files`, so the tarball is byte-identical to 0.24.0 apart from this line. Cut anyway because it is the first release to exercise the publish pipeline end to end — the path from a published release to a tarball on the registry has never actually run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan92 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 42
…and 42 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patch, not minor: nothing that ships changed. The only commits since v0.24.0 are the publish workflow (#304, #305), and
.githubis not in the package'sfileslist — so the npm tarball is byte-identical to 0.24.0 apart from the version field.Why cut it at all
It is the first release to exercise the publish pipeline end to end. The path from a published GitHub release → OIDC exchange → tarball on the registry has never actually run; the dispatch tests could only ever reach the skip-if-already-published guard.
moshcode→ Settings → Trusted Publisher → GitHub Actions, workflow filenamepublish.yml), the release will cut normally and the publish job will fail on auth. That failure is the expected signal, not a broken release.Verification
moshcode --versionreports 0.24.1🤖 Generated with Claude Code