chore(main): release 6.27.0

[lwasser]

🤖 I have created a release beep boop

6.27.0 (2026-03-09)

🔥 Bug Fixes

• add provenance back (#489) (fc75f67)
• dash not a dot after package version (#488) (b526eb2)
• Fixing issues with commands introduced in #403 (#440) (797e167)
• Ignore linting of .all-contributorsrc file and the CHANGELOG file (#484) (5354e88)
• Incorrectly formatted Github urls (#466) (846582b)
• release candidate try 2 (#487) (1a271b2)
• release please settings for tag format (#479) (58378f3)
• release please token name wrong (#450) (d0786d1)
• Update NPM and also node to ensure trusted publishing works (#490) (06f824c)

📚 Documentation

• add davepagurek as a contributor for bug (#410) (a35bf7b)
• add jdalrymple as a contributor for security, and bug (#381) (86631e5)
• add JimMadge as a contributor for code, and review (#463) (741aff8)
• add JoshuaKGoldberg as a contributor for ideas, and code (#357) (74bc388)
• add KibbeWater as a contributor for code, and bug (#467) (eca20df)
• add lwasser as a contributor for doc (#380) (36cbc0d)
• add lwasser as a contributor for security (#384) (05ba5a8)
• add marcelpanse as a contributor for security (#379) (29d8d1d)
• add michaelfaith as a contributor for bug, review, and code (#480) (349a7f2)

⚙️ Chores

• add docs for codecov and secret to workflow (e85e9df)
• add Knip to check for unused code and deps (#424) (0ccc048)
• add manifest and update version (7ffde6c)
• adjust codecov settings (#441) (55acdee)
• check in package-lock.json (#434) (5de78d9)
• ci, docs: update actions to use npm and update / cleanup dev guide (#449) (6f8e311)
• ci: add codecov upload to tests GHA run & update dev guide (#433) (e85e9df)
• ci: Add empty ci workflow so we can test in a pr safely (#398) (54f0694)
• ci: add test run to ci workflow (#401) (ed9bfe6)
• ci: allow deploy for release candidate (#485) (daff4f6)
• ci: Configure Dependabot for npm & actions and update settings (#383) (649b88e)
• ci: fixing semantic release node requirement (#388) (a69b495)
• ci: setup trusted publishing (#475) (d7cb240)
• ci: Update Codecov pipeline to use circle CI orb (#386) (084d2ee)
• deps-dev: bump minimatch from 3.1.2 to 3.1.5 (#457) (c5a19d1)
• deps-dev: bump nock from 12.0.3 to 14.0.10 in the development-dependencies group (#426) (75a35de)
• deps-dev: bump nock in the development-dependencies group (75a35de)
• deps-dev: bump semantic-release (4bac7a6)
• deps-dev: bump semantic-release from 17.4.7 to 25.0.2 in the npm_and_yarn group across 1 directory (#382) (4bac7a6)
• deps-dev: bump the development-dependencies group across 1 directory with 4 updates (#473) (e035a36)
• deps: bump inquirer from 7.3.3 to 13.3.0 (#460) (d547e43)
• deps: bump rollup from 4.57.1 to 4.59.0 (#458) (066ce8d)
• deps: bump the github-actions group with 2 updates (#425) (0cafdd9)
• deps: bump the github-actions group with 2 updates (#461) (64e783a)
• deps: remove last kcd scripts call and update deps (#446) (9422781)
• deps: update yargs, chalk, prettier dependencies manually given tests aren't running in ci. (#399) (31b751a)
• double check cov file exists? (e85e9df)
• lint (7ffde6c)
• migrate build/ babel to native configuration (#437) (1cc7e3f)
• migrate from CJS to ESM (#456) (8b11060)
• migrate tests from Jest to Vitest (#436) (ba555a8)
• release 6.27.0 (462755b)
• Remove dependency on lodash (#421) (9dc28d6)
• remove kbd-scripts in favor of native linting config with ESlint (#402) (296b12a)
• Remove kcd-scripts validate script (#414) (d6fb233)
• Remove node-fetch dep (#468) (a4e1407)
• Remove Pify dependency & test cleanup (#465) (ed5b6a6)
• setup release please to support changelog development (#443) (7ffde6c)
• update branch name to main (#377) (03cbb15)
• update config settings and review comments (1cc7e3f)
• update token name (349d5c5)
• Update yargs to v18 (#431) (75264bb)
• Updating kcd-scripts to gain access to the latest jest versions (#412) (73198d1)

⌨️ Code Refactoring

• Remove babel dependency (#471) (fb1eea9)
• Update calls to prettier functions to account for latest async API (#403) (7d8c2bf)

🧪 Testing

• add-contributors-list: Improve the clarity of the add-contributors-list tests (#396) (84ac3ed)
• prompt.js: enhance prompt.js test coverage (#438) (03eb6e8)

🛠️ Build System

• release please changelog organization (#455) (68e33ee)

---

This PR was generated with Release Please. See documentation.

[michaelfaith]

This looks much better 👌

[lwasser]

Ok, this looks like a better PR, but for all the work we've done and the significant dependency updates, I think this should be a minor, if not major, release after 3 years. @jdalrymple any thoughts on this? I can read through the docs again to understand how we ensure that at least 6.27 is the new version.

[michaelfaith]

One way is to merge a commit with

Release-As: 6.27.0

On the last line and it'll override the autodetection

[lwasser]

OH - that's amazing. I'll try that @michaelfaith I am testing a release candidate / pre release now to test out trusted publishing. i'll try to push an empty commit with that message.

[lwasser]

It worked perfectly!! i'll update our docs!

[jdalrymple]

It would def say major

[lwasser]

Ok, maybe 7.x doesn't make sense here, but at least 6.27 does, given how long it's been since the last release and the significant dependency updates that could warrant breaking changes in a user's environment. I'm not sure, but 6.27 seems reasonable. Even looking at the commit history, it wouldn't follow a typical semantic minor bump.

[lwasser]

This looks much better 👌

It does!! Thank you so much for noticing this. I need to look at which commit types would trigger a minor vs. major release. What is unclear here is that it's been ~3 years since a release was made! And we made some significant updates to dependencies. But it's not breaking for users because the front-end API hasn't changed, only the backend.

[michaelfaith]

I need to look at which commit types would trigger a minor vs. major release.

feat! = major
feat = minor
fix = patch

[jdalrymple]

Ok, maybe 7.x doesn't make sense here, but at least 6.27 does, given how long it's been since the last release and the significant dependency updates that could warrant breaking changes in a user's environment. I'm not sure, but 6.27 seems reasonable. Even looking at the commit history, it wouldn't follow a typical semantic minor bump.

Wouldnt i be breaking simply by the fact that the nodejs versions supported has changed? Also our switch to pure ESM vs commonjs will break any consumers who are commonjs only

[lwasser]

Ok, maybe 7.x doesn't make sense here, but at least 6.27 does, given how long it's been since the last release and the significant dependency updates that could warrant breaking changes in a user's environment. I'm not sure, but 6.27 seems reasonable. Even looking at the commit history, it wouldn't follow a typical semantic minor bump.

Wouldn't I be breaking simply by the fact that the NodeJS versions supported have changed? Also our switch to pure ESM vs commonjs will break any consumers who are CommonJS only

That's a good point. So we should have created a fix!: for the commit around the ESM to CJS syntax as that would trigger a major bump? Thanks to Michael, it's very easy to push an empty commit that bumps the version, so we just need to decide on the most appropriate version.

I am very close to getting the release to work, so I'm totally ok with deleting and creating a new one 😆 I've only done it like 6 times so far. I didn't actually know that the ESM migration would break consumers workflows using pure CJS so that does seem fair to me.