webpack-asset-relocator-loader

Publishes to npm via trusted publishing (GitHub Actions OIDC) instead of the long-lived secret. ⚠️ Required manual step before merging npm does not let you register a trusted publisher from CI — it has to be done in the npmjs.com UI, and until it exists the OIDC token exchange fails and falls back to token auth (which this PR removes). So the next release after merge will fail unless this is done first. On the package settings page, under Trusted Publisher, add a GitHub Actions publisher: These fields are case-sensitive and npm doesn't validate them at save time — mistakes only surface as at publish time. Note the workflow filename is the file that runs the publish, which is here, not a path. Once a release has published successfully, the secret can be deleted and Publishing access can be tightened to Require two-factor authentication and disallow tokens (that setting only affects token auth, so OIDC keeps working). Changes Added so the scoped package keeps publishing publicly. Bumped → . OIDC token exchange landed in v13.1.0, which is only pulled in by semantic-release v25. v13 also bundles npm 11.x, satisfying the npm >= 11.5.1 requirement regardless of the runner's npm. No change was needed to — npm normalizes the shorthand to , which is what the registry already has on record for v1.10.0 and what the OIDC repository check compares against. Split the release out of the test matrix into its own job gated on and push-to-main. This keeps scoped to the publish step rather than granting it to every matrix leg on every PR. Added an explicit permissions block: at the workflow level, and on the release job (GitHub release + tag), / (release comments), (OIDC). Removed . now calls and exchanges it for a short-lived registry token; returns early on success and never reads . Added to the release checkout, per the semantic-release GitHub Actions recipe. Bumped the test matrix from Node 18 to Node 22.** This one is forced rather than chosen: semantic-release v25 declares , and yarn v1 hard-errors () on an engine mismatch rather than warning — so leaving the matrix on Node 18 breaks on every leg. npm trusted publishing itself also requires Node >= 22.14.0. Node 18 went EOL in April 2025. If you'd rather keep Node 18 test coverage, the alternative is in the test job — happy to switch. Provenance attestations are generated automatically for public packages published from a public repo over OIDC, so no flag or is needed. Verification — 85/85 passing on Node 22. Confirmed the installed tree is / with npm hoisted, and that the plugin's reads the Actions OIDC token that provides. Workflow YAML parsed and asserted: two jobs, correct permissions, no remaining reference. The end-to-end publish can't be exercised from a PR — OIDC only works on to — so the first real validation is the next release. 🤖 Generated with Claude Code

This is necessary for trusted publishing

Summary Re-resolve from 1.1.11 to 1.1.18 in to clear CVE-2026-69152 (unbounded intermediate arrays / DoS). Lockfile-only, 3 lines. Why no manifest change 1.1.18 is the maintenance-v1 fix and is already inside the declared range, so no or edit is needed. A plain will not pick it up either — yarn v1 keeps any existing lockfile entry that still satisfies its range — so the entry was dropped and re-resolved to force the bump. The only other range in the tree, , was already at 5.0.9. Those are the two entries in the lockfile, and both are now at or above the fixed versions for this advisory. Dropped from this PR This PR originally upgraded v7 → v10 and v26 → v29. Both were reverted. They did not clear the advisory. jest still depends on glob v7 (, , ) and on , so stays in the tree either way. Re-resolving that range is what actually fixes it. The glob bump silently broke asset emission. glob v7 matched patterns against the returned paths, and every call site here passes an absolute pattern, so the relative pattern never matched — the option was a no-op. glob v9+ matches relative to , so for a build whose dependencies live in (the normal case) it matches everything under it. All three call sites — the two calls in and the shared-library glob in — returned nothing: failed on : sharp's native binaries were no longer emitted, so lost its reference and lost , and . webpack still reported zero errors, so this broke at runtime rather than at build time. is a runtime entry of a package consumed by ncc, so a major bump is breaking for downstream consumers and belongs in its own PR — one targeting v13 (v10 is itself deprecated on npm) with Windows coverage, since v9+ also changed backslash escaping and result separators. Not covered here (pulled in by v25 → v13) vendors brace-expansion 5.0.7 as a bundled dependency. Bundled deps do not appear in , so lockfile scanners will not flag it and it cannot be overridden from here. It clears when npm ships a release bundling 5.0.9. Verification On Node 22: 85/85 passing, meeting thresholds, clean from scratch, and emitting the same asset set as . Original vulnerability report and first commit by OrbisAI Security. Co-authored-by: Anupam Mediratta