Skip to content

v61.3.0

Choose a tag to compare

View all tags
@CKEditorBot CKEditorBot released this 01 Oct 11:12
· 147 commits to master since this release
v61.3.0
This tag was signed with the committer’s verified signature.
CKEditorBot CKEditor Bot
GPG key ID: 3F615B600F38B27B
Verified
Learn about vigilant mode.
736760b
This commit was signed with the committer’s verified signature.
CKEditorBot CKEditor Bot
GPG key ID: 3F615B600F38B27B
Verified
Learn about vigilant mode.

Features

  • release-tools: Introduced the useOidc option in the reassignNpmTags() task to support npm Trusted Publishing. When enabled, the task no longer verifies the npm account with npm whoami and the npmOwner option is not required. Instead, the task verifies that the NPM_ID_TOKEN environment variable is set. Changing dist-tags with OIDC requires npm 11.21.0 or newer and a trusted publisher that allows the npm dist-tag command.

Bug fixes

  • release-tools: The publishPackages() and reassignNpmTags() tasks no longer fail on CircleCI when a release with npm Trusted Publishing (useOidc) takes longer than 5 minutes. See ckeditor/ckeditor5-internal#4658.

    • npm accepts a CircleCI OIDC token only for 5 minutes after it was issued. Before, the remaining packages failed with 401 unauthorized.
    • On CircleCI, the tasks now request a fresh token with the CircleCI CLI (circleci) right before each npm publish and npm dist-tag add call.
    • Without the CircleCI CLI, or outside CircleCI, the tasks use the NPM_ID_TOKEN environment variable, as before.
    • When no token can be obtained, the tasks stop before processing any package.
    • The new getNpmIdToken() function returns the token that the tasks use. It is exported from the package.

Released packages

Check out the Versioning policy guide for more information.

Released packages (summary)

Releases containing new features:

Other releases:

Assets 2
Loading