[mtrezza]

Closes #932

Upgrades semantic-release from 25.0.3 to 25.0.9. It is a dev dependency that runs only in the release-automated.yml workflow, on Node 22 (the latest run used Node v22.23.3). Its required Node range (^22.14.0 || >= 24.10.0) and its dependency ranges are unchanged, so the lock file only updates the semantic-release entries.

Changes

• 25.0.4: The release notes list a code quality fix that adds a missing comma in the context object (semantic-release/semantic-release@493d6cd). The published package also shipped the release engine refactor: most of lib/ was removed, and index.js delegated to @semantic-release/core, which 25.0.4 did not declare as a dependency.
• 25.0.5: Reverted that refactor, including the comma fix (fix(revert): next semantic-release/semantic-release#4200). The net effect of 25.0.4 and 25.0.5 is none: index.js is identical in 25.0.3 and 25.0.9.
• 25.0.6:
  • Encoded secrets are now masked (semantic-release/semantic-release@8e28dd3).
  • Not listed in the release notes: the documentation links in error messages, including the Node version error of the CLI, now point to https://semantic-release.org, and lib/definitions/errors.js loads package.json with a JSON import attribute (with { type: "json" }), which the Node 22 release workflow supports.
• 25.0.7: Fixed argument injection via repositoryUrl in package.json (fix: argument Injection via repositoryUrl in package.json semantic-release/semantic-release#4245). A repositoryUrl that begins with - is rejected with the new EINVALIDREPOURL error, and git commands now pass -- before the URL.
• 25.0.8:
  • Handle potential null values when trimming commit messages and git tags (semantic-release/semantic-release@0a60004)
  • Mask environment variables whose names contain key, auth or webhook (semantic-release/semantic-release@973d763)
  • Mask sensitive environment variables and improve commit handling (fix: mask sensitive environment variables and improve commit handling semantic-release/semantic-release#4252)
  • Prevent template evaluation syntax in branch expansion and tag formatting (semantic-release/semantic-release@f121540). tagFormat and branch properties are now compiled with lodash template and { evaluate: false, escape: false }, so <% %> code blocks no longer run. ${...} interpolation still works.
• 25.0.9: The authenticated repository URL is no longer shown in EGITNOPERMISSION errors (fix: do not expose the authenticated repository URL in EGITNOPERMISSION errors semantic-release/semantic-release#4283).

Impact on this repository

• release.config.js sets tagFormat: '${version}'. The tag code of 25.0.9 was run against lodash-es 4.18.1, the version in the lock file (tarball integrity checked against the lock):

  Check (25.0.9 code path)	25.0.3	25.0.9
  makeTag with version 3.1.2 (lib/utils.js)	3.1.2	3.1.2
  version placeholder count (lib/verify.js, ETAGNOVERSION unless 1)	1	1
  Tag regex (lib/branches/get-tags.js)	^(.+)	^(.+)
  Version parsed from tag 3.1.1	3.1.1	3.1.1

  A <% %> block in a template is run by 25.0.3 and left as text by 25.0.9, which confirms that the new options are in effect.

• The branches entries have no wildcards or template values, so the branch expansion change does not apply.

• The successComment and releasedLabels templates are rendered by @semantic-release/github 12.0.6, which this PR does not change.

• repository.url in package.json is https://github.com/parse-community/parse-server-example, which passes the new repositoryUrl check.

• The masking of environment variables whose names contain key, auth or webhook (25.0.8) applies not only to log output but also to the generated release notes, which feed CHANGELOG.md and the GitHub release body, to the releases passed to success plugins and to the errors passed to fail plugins. On CI, the values of the default GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL (semantic-release-bot) now match auth, so they would show as [secure] in those places. This has no effect in this repository: the .releaserc templates use no author or committer fields, and CHANGELOG.md does not contain semantic-release-bot.

• All six @semantic-release/* plugins accept 25.0.9 as a peer (ranges from >=18.0.0 to >=24.1.0).

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement.

Lock file

The lock file was regenerated on the current master. Only the semantic-release entries change. Compared to Dependabot's lock diff, npm also records "license": "MIT" on the node_modules/semantic-release entry.

Summary by CodeRabbit

• Chores
  • Updated behind-the-scenes release tooling. No user-facing changes are included in this update.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 73309477-ebad-49f0-86b8-9114aeb61d6b

Commits

Reviewing files that changed from the base of the PR and between 4fe4139 and effd1dd.

Files selected for processing: 2

• package-lock.json
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 2 remain after this review.

Walkthrough

The development dependency semantic-release is upgraded from 25.0.3 to 25.0.9. The lockfile records the new version, registry URL, and integrity hash.

Changes: Release Tooling

Layer / File(s)	Summary
Update semantic-release version package.json, package-lock.json	The development dependency and its lockfile records change from semantic-release 25.0.3 to 25.0.9.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: Minimal · up to effd1

No actionable merge-blocking risk was identified in this dependency-only upgrade.

Pre-merge checks: 7

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title begins with the allowed prefix "refactor:" and uses a capitalized first letter in "Bump." It accurately describes the semantic-release dependency upgrade.
Linked Issues check		Issue [#932] requires semantic-release 25.0.3 to be upgraded to 25.0.9. package.json now declares 25.0.9. package-lock.json updates the root dependency and both semantic-release records to 25.…
Out of Scope Changes check		The whole-PR diff changes only the semantic-release declaration in package.json and its corresponding lockfile records. The added lockfile license metadata supports the dependency update. No unr…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check		No security-vulnerable code pattern was introduced. The PR changes only the exact dev dependency semantic-release from 25.0.3 to 25.0.9 and matching lockfile records. The package remains pinned to t…
Engage In Review Feedback		No review feedback comments were returned, and the current review produced zero actionable findings. Therefore, there was no feedback for the user to ignore or resolve without engagement.

Full details: Linked Issues check

Explanation

Issue [#932] requires semantic-release 25.0.3 to be upgraded to 25.0.9. package.json now declares 25.0.9. package-lock.json updates the root dependency and both semantic-release records to 25.0.9 with the matching registry URL and integrity. No additional coding or test requirement appears in the issue.

Full details: Out of Scope Changes check

Explanation

The whole-PR diff changes only the semantic-release declaration in package.json and its corresponding lockfile records. The added lockfile license metadata supports the dependency update. No unrelated source, configuration, or workflow change is present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Security Check

Explanation

No security-vulnerable code pattern was introduced. The PR changes only the exact dev dependency semantic-release from 25.0.3 to 25.0.9 and matching lockfile records. The package remains pinned to the npm registry with an integrity hash. No application code, release configuration, workflow, permissions, or runtime dependencies changed. The supplied release notes identify security fixes in the new version, including repository URL argument-injection protection and improved secret and authenticated-URL masking.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}