docs: document npm 12 install script blocking - #9838
Merged
Conversation
Add the omitted breaking-change note explaining that dependency lifecycle scripts are blocked by default and how to approve and run them.\n\nFixes #9750\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: f1b70f0a-a8ab-42ae-9f8a-5188817ce956
martinrrm
approved these changes
Aug 3, 2026
twada
added a commit
to twada/power-assert-monorepo
that referenced
this pull request
Aug 26, 2026
…n report Document how squash-merge setups preserve (or lose) BREAKING CHANGE footer details in changelogs: Google's title-only practice, npm's PR_BODY preset carrying footers into squash bodies (verified end-to-end against npm/cli d36945d and its v12.0.0 changelog), the BLANK-preset merge-dialog escape hatch with BEGIN_COMMIT_OVERRIDE as the retroactive fix, and npm/cli#9838's documented omission-and-recovery case. Note the hidden advantage of this repository's plain-merge strategy: branch commits' footers survive unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
twada
added a commit
to twada/power-assert-monorepo
that referenced
this pull request
Aug 27, 2026
* docs: document trigger conditions for duplicate changelog entries Research into googleapis/release-please#2476 and the splitMessages() implementation shows the duplication is deterministic: release-please deliberately splits commit bodies on paragraph-leading Conventional Commits lines, so a plain merge commit whose PR title is in Conventional Commits form with a changelog-visible type duplicates the branch commits' entries. Earlier merges that seemed equivalent did not duplicate because their types are hidden from the changelog (chore/ci/docs) or they predate release-please's scan range. Replace the "trigger conditions are not fully understood" wording in RELEASING.md and ADR-010 with the identified conditions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: add investigation report on changelog duplication and ecosystem practices Record the full research behind the trigger-condition update: the splitMessages() mechanism and its regex subtleties, why Electron/Vite/ Excalidraw are unaffected (CC PR titles + squash, but no release-please), and verified setups combining PR-title linting with release-please under squash merge (googleapis org, npm template-oss, absinthe), including the lessons on pinning squash presets as code and the BLANK vs PR_BODY body preset trade-off. Link the report from ADR-010. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: add BREAKING CHANGE handling under squash merge to investigation report Document how squash-merge setups preserve (or lose) BREAKING CHANGE footer details in changelogs: Google's title-only practice, npm's PR_BODY preset carrying footers into squash bodies (verified end-to-end against npm/cli d36945d and its v12.0.0 changelog), the BLANK-preset merge-dialog escape hatch with BEGIN_COMMIT_OVERRIDE as the retroactive fix, and npm/cli#9838's documented omission-and-recovery case. Note the hidden advantage of this repository's plain-merge strategy: branch commits' footers survive unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: document the commit-override marker pitfall in investigation report release-please extracts the override with a naive substring split on the merged PR body, so a prose mention of the literal marker arms the mechanism, a missing end marker captures the rest of the body, and the extracted text silently replaces the messages of every commit associated with the PR. Record the pitfall, the plain-merge fallback nuance, and the rule of thumb: never spell the marker in a PR body. Discovered first-hand on this report's own pull request (body since reworded). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add the omitted npm 12 breaking-change note explaining that dependency lifecycle scripts are blocked by default unless covered by
allowScripts, including the approval and rebuild workflow.Cause
The change was introduced in
5cd5150. Although its message described a v12-only default flip, it usedfeat:instead offeat!:and did not include aBREAKING CHANGE:footer. Release Please therefore classified it as a regular feature and omitted it from the aggregated npm 12 breaking-change notes.Release notes
The published
v12.0.0GitHub release was corrected manually with the same breaking-change entry. This PR corrects the source-controlled changelog used by the npm documentation site.Manual correction process
If a breaking change is omitted from release notes in the future:
Do not rewrite the merged commit. Add the missing entry under the released version’s
⚠️ BREAKING CHANGESsection in the rootCHANGELOG.mdand submit a documentation PR.After the PR merges, the npm documentation repository’s scheduled Update CLI workflow copies the root changelog into the corresponding CLI documentation page and publishes it. Dispatch that workflow manually if the docs need to update immediately.
Update the existing GitHub release separately because a changelog PR cannot modify an already-published release. Preserve the complete current release body before editing it because
gh release edit --notes-filereplaces the entire body:Verify that the source changelog, npm documentation page, and GitHub release contain identical wording.
To prevent the omission, breaking commits must use a conventional-commit breaking marker such as
feat!:and include aBREAKING CHANGE:footer describing the user-visible impact.Fixes #9750