0.5.0 (2026-09-21)
Bot detection was partly guesswork, and the guesswork ran on the expensive side. Two definitions
existed: exclusions.ts, which decides what leaves every denominator, and identity.ts, which
suggests that two addresses might be the same person. They could drift apart, and one of them matched
on name prefixes, so any address beginning with dependabot, renovate, github-actions or
greenkeeper was a bot. dependabot.fan@gmail.com and renovate-reviewer@corp.com were bots too.
There is now one isBotIdentity, used by both, matching on the commit email rather than the author
name, and every pattern in it points at a real address: the GitHub [bot]@users.noreply.github.com
form, bot@renovateapp.com, gitlab-bot@gitlab.com and teabot@gitea.io. The four prefixes are
gone.
Measured before merging: both definitions over every commit in six repositories, 572 commits, 30
excluded by the old exclusions.ts rule and 30 by the new one, zero disagreements in either file. No
figure in any existing report moves. The version is a minor rather than a patch because what leaves a
denominator is user-visible behaviour, and for someone whose repository holds a bot this library did
not recognise before, or recognised only by name, the numbers can change.
One narrowing comes with it, and the README says so rather than leaving it to be found: exclusions.ts
no longer excludes on the author name, so a bot whose name ends in [bot] but whose address is
outside the recognised forms is counted as a contributor. That deflates the subject's share rather
than inflating it, which is the safe direction for an ownership claim.
The release gate and the release script disagreed about whether this file may carry an entry for a
version that is not out yet. release.mjs required one; release-gate.mjs forbade one on every
push. Both could not hold, so a contributor's credit could only be written at release time and never
on the day their work merged. The gate now recognises two states and says which one it found, and
this entry exists on the day it describes.
From outside the project, all three by @shivam-070208: the shared
bot identity, the evidence-backed forge patterns and the tests for both directions
(#26, closes
#10); the release-gate fix above, with a
shared version comparator so the two scripts cannot drift again
(#29, closes
#28); and the tests for the pack allowlist,
which had been enforced with nothing that would notice if it stopped enforcing. Reading an empty
packed-file list left all 63 tests passing, and now it fails two of them
(#33, closes
#30); and the fix for npm pack --dry-run --json, which returns an array on npm 11 and an object keyed by package name on npm 12, so the gate
died on npm 12 where it used to read the packed file list
(#35, closes
#31). Each of the four arrived with the mutation
that fails its own test already run and pasted.
What's Changed
Everything else
- feat(bot): unify bot identity detection by @shivam-070208 in #26
- fix: the CHANGELOG cannot carry an unreleased entry, and the gate says so by @Bubblegunn in #27
- fix(release): align release gate with changelog state by @shivam-070208 in #29
- docs: restore the 0.5.0 entry the gate used to forbid by @Bubblegunn in #32
- test(release): cover npm pack allowlist enforcement by @shivam-070208 in #33
- docs: credit #33 on the day it merged, and normalise its spacing by @Bubblegunn in #34
- fix(release): support npm pack output shapes by @shivam-070208 in #35
- docs: credit #35 on the day it merged by @Bubblegunn in #36
- fix(release): keep npm's stderr out of the version comparison by @Bubblegunn in #38
- fix(release): give the registry longer than two minutes to serve a new version by @Bubblegunn in #39
New Contributors
- @shivam-070208 made their first contribution in #26
- @Bubblegunn made their first contribution in #27
Full Changelog: v0.4.2...v0.5.0
