From 288734e21b5e8c4f631efb8d58c5af879d3165e2 Mon Sep 17 00:00:00 2001 From: Joeri van Oostveen Date: Mon, 27 Jul 2026 11:54:14 +0200 Subject: [PATCH 1/2] Update version --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 8ac6780..bd28a65 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "maquette", - "version": "4.1.4", + "version": "4.1.5", "type": "module", "description": "Minimalistic Virtual DOM implementation with support for animated transitions.", "workspaces": [ From e22d809119822b34d58ab05288c73d3c6485b85f Mon Sep 17 00:00:00 2001 From: Johan Gorter Date: Wed, 19 Aug 2026 11:44:26 +0200 Subject: [PATCH 2/2] ci: publish via npm trusted publishing, only from main, on Node 24 The NPM_TOKEN secret dates from 2024 and no longer authenticates: npm revoked classic tokens and capped write-capable granular tokens at 90 days, so `npm publish` now fails with a 404 on PUT. A trusted publisher is configured for this repo on npmjs.com, so drop the token entirely and let the action authenticate over OIDC (id-token: write was already set). Also gate the publish step on `github.event_name == 'push'`. The workflow also runs on pull_request, where github.sha is an ephemeral merge commit, so releases were being published from the PR run and tagged on a commit that is on no branch (v4.1.4 -> 5c545ee). Node 24 bundles npm 11.17, which satisfies the npm >= 11.5.1 requirement for trusted publishing. Node 20 went EOL in April 2026. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/deploy-website.yml | 4 ++-- .github/workflows/node.js.yml | 8 +++++--- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml index 25bf13c..69b7485 100644 --- a/.github/workflows/deploy-website.yml +++ b/.github/workflows/deploy-website.yml @@ -20,10 +20,10 @@ jobs: steps: - uses: actions/checkout@v6.0.2 - - name: Use Node.js 20.x + - name: Use Node.js 24.x uses: actions/setup-node@v6 with: - node-version: 20.x + node-version: 24.x cache: npm - name: Install root dependencies diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml index c6cf9ec..0918ba3 100644 --- a/.github/workflows/node.js.yml +++ b/.github/workflows/node.js.yml @@ -14,18 +14,20 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6.0.2 - - name: Use Node.js 20.x + - name: Use Node.js 24.x uses: actions/setup-node@v6 with: - node-version: 20.x + node-version: 24.x cache: 'npm' - run: npm ci - run: npm run ci + # Only publish from pushes to main. On pull_request runs github.sha is an + # ephemeral merge commit, so publishing there tags a commit that is on no branch. - name: Publish to NPM if version in package.json has changed id: publish + if: github.event_name == 'push' uses: JS-DevTools/npm-publish@v4 with: - token: ${{ secrets.NPM_TOKEN }} provenance: true - name: Create tag if: steps.publish.outputs.type