v5.2.0

Release scripts publish a single-package repo's root (tag v<version>) and link SSH repository URLs in changelogs

Ignore the files the consuming repo's .gitignore lists

Autodetect reads pnpm-workspace.yaml and excludes negated workspace globs

Release: one deno publish per JSR package, dependencies first, each with a fresh OIDC token

The number-input ban points to a text field with inputMode, not a slider

Checks read every Renovate config file and the ref among pin comment words, check each dependency range and dist-tag, skip attw with nothing published, and reject unknown forge keys.

Keep an en or em dash in LICENSE year ranges, add nodeLinker: node-modules to an existing .yarnrc.yml, buffer up to 64 MB of spawned output, and exit forge sync --check/init through process.exitCode.

ESLint rules

lzear/react

• no-restricted-syntax: options changed

Commits

• 79bb0b9 docs: explain Renovate's 'Rebase not applied' after housekeep
• 69b3337 chore: yarn housekeep
• 9d2449a fix(eslint-config): point the number-input ban to a text field, not a slider
• ed1e7c0 feat(eslint-config): ignore files the consuming repo's .gitignore lists
• 374ac47 fix(repo-lint): keep LICENSE range dashes, set nodeLinker in existing .yarnrc.yml
• 91d39b2 fix(configs): release a single-package repo's root; parse SSH repository URLs
• 7807979 fix(repo-lint): read every Renovate config, pin comment refs and dependency range
• 58ed909 fix(eslint-config): read pnpm-workspace.yaml and negated workspace globs in autodetect
• 5d6fd7d fix(release): publish each JSR package with its own deno publish

v5.1.0

Parser no longer sets tsconfigRootDir, so ESLint caches stay valid across checkouts.

lzear-prerelease is back: it publishes pending changesets as a beta without committing.

forge update bumps GitHub Actions pins, and takes --only/--skip to pick its steps.

ESLint rules

lzear/core

• unicorn/no-repeated-call-wrappers, unicorn/no-unnecessary-default-arguments: added, off

package-json/recommended

• package-json/no-short-flags-in-scripts: added, error

Commits

• 1c93f46 test(eslint-config): snapshot plugin names, not plugin objects
• ae94f8f fix: lint
• 8508cb0 chore: yarn housekeep
• beb6010 feat(forge): update GitHub Actions pins, pick steps with --only/--skip
• 584fd8d chore(deps): update dependency npm-check-updates to v23.1.1 (#40)
• 949a658 chore(deps): update dependency tsdown to v0.23.1 (#39)
• 6117f58 chore(deps): update dependency prettier to v3.9.10 (#38)
• 41a77e2 chore(deps): update dependency @types/node to v26.6.5 (#37)
• 97231a2 docs: fix the React tsconfig's libs and the CI example's release tags
• de0862d fix(eslint-config): leave parserOptions.tsconfigRootDir unset
• 54ce93a feat(configs): restore lzear-prerelease

v5.0.0

forge check fails on the gate; drift (forge-pins, deps-fresh, deps-audit, deps-deprecated, renovate-active) warns, --strict fails on it.

Skip checks with reasons in package.json's forge.skip, or per run with forge check --only/--skip.

forge check --fix repairs git-hooks, renovate, deps-release-age, template-sync and forge-pins failures; git-hooks chains onto prepare, replacing husky.

forge check checks renovate-active and gitignore-env; checks run concurrently, remote ones with details.

forge init (initRepo) scaffolds the missing forge files, pinned to the release, into a repo that passes its own qa: packageManager, forge's ranges (TS 6 and 7, Vite), src/, the package fields lint wants, React configs when react is a dependency; then it checks, once the dev dependencies are installed. A throwing check fails alone.

forge-pins check: forge workflow and action pins must be the latest release; latestForgeRelease() helper.

forge sync writes the templates bundled with its version, offline; --check and the template-sync check flag drift.

Codacy is opt-in: the codacy check, the CODACY_PROJECT_TOKEN secret check, forge setup and listSecrets are removed (set the secret with gh secret set CODACY_PROJECT_TOKEN). forge sync and the template-sync check update .codacy.yml only where it exists; forge init writes no Codacy badges.

Commitlint config resolves its parser preset under Bun's isolated linker.

Coverage prints a summary under a coding agent; the react tsconfig targets ES2025; new @lzear/forge/tsconfig/base export.

Fix forge check in consumer repos: Bun's audit fails on high severity only, workspace packages skip npm lookups, publint packs with the root's manager, remote checks need a GitHub repo, --json keeps long output.

defineReactConfig and the @vitejs/plugin-react peer removed: add react() and forgePlugin() to your Vite config's plugins.

eslint-plugin-react-compiler removed: react-hooks' recommended rules run the compiler's checks. Rename react-compiler/react-compiler in your config and disable comments to the react-hooks/* rule that reports.

• Release drops the snapshot-branch input and its snapshot job.
• lzear-prerelease is gone: changeset pre enter|exit remains.

./tsdown (tsdown config factories) replaces ./tsup; its tsup peer and the base tsconfig's ignoreDeprecations are gone.

react, typescript and vitest default to whether the cwd's manifests (root and workspaces) depend on them (typescript also on a tsconfig.json); breaking only for a repo that relied on a layer it doesn't depend on: pass it explicitly.

Lint JSON, Markdown (and its code blocks) and YAML: json, markdown, yaml layers, on by default.

Own consumers' repeated overrides: TanStack's only-throw-error allow, Node builtins off on JSX/TSX, default-export-style separate, sonarjs duplicates of TS and aws-* off, RESTRICTED_SYNTAX export, detected React version.

forge update holds the package manager, Node and Bun to the release-age gate, keeps corepack's hash, updates every Bun workspace keeping its ranges, and runs its network steps concurrently. Workspaces resolve from pnpm-workspace.yaml, ** globs and ! negations.

The lefthook template's pre-commit lints md, yml, yaml and jsonc files with ESLint too, and runs gitleaks on the staged changes when it is installed, naming a leak's file, line and rule.

• monorepo-lint reads pnpm-workspace.yaml, so it runs sherif on pnpm-only workspaces.
• The forge field takes repo (owner/name), used before the origin remote for remote checks and forge init.

The type="number" ban applies to <input> only.

The TypeScript import resolver matches the types@>=5.5 export condition.

• CI drops its advisory steps (forge check, fallow, e18e analyze) and the run-check input.
• The Vitest config no longer writes the json coverage report.

Upgrade from 4:

• forge update moves the ^4 ranges to ^5 (ncu crosses majors).
• forge check --fix repins forge's workflows, syncs lefthook.yml (gitleaks, Markdown, YAML and JSON lint) and writes the release-age gate.
• eslint --fix for the JSON, Markdown and YAML layers.
• .codacy.yml is no longer required.

ESLint rules

lzear/core

• sonarjs/argument-type: off → error
• sonarjs/aws-apigateway-public-api, sonarjs/aws-ec2-rds-dms-public, sonarjs/aws-ec2-unencrypted-ebs-volume, sonarjs/aws-efs-unencrypted, sonarjs/aws-iam-all-privileges, sonarjs/aws-iam-privilege-escalation, sonarjs/aws-iam-public-access, sonarjs/aws-opensearchservice-domain, sonarjs/aws-rds-unencrypted-databases, sonarjs/aws-restricted-ip-admin-access, sonarjs/aws-s3-bucket-granted-access, sonarjs/aws-s3-bucket-insecure-http, sonarjs/aws-s3-bucket-public-access, sonarjs/aws-s3-bucket-versioning, sonarjs/aws-sagemaker-unencrypted-notebook, sonarjs/aws-sns-unencrypted-topics, sonarjs/aws-sqs-unencrypted-queue: error → off
• unicorn/default-export-style: options none → { "functions": "separate" }

lzear/react

• no-restricted-syntax: options changed
• react-compiler/react-compiler: removed

lzear/node-browser

• new block, 1 rule

lzear/typescript

• @typescript-eslint/only-throw-error: added, error
• sonarjs/argument-type, sonarjs/deprecation, sonarjs/different-types-comparison, sonarjs/in-operator-type-error, sonarjs/no-array-delete, sonarjs/no-unused-vars, sonarjs/no-useless-intersection, sonarjs/unused-import: added, off

lzear/json

• new block, 4 rules

lzear/jsonc

• new block, 4 rules

lzear/json5

• new block, 4 rules

lzear/markdown

• new block, 17 rules

lzear/markdown/code-blocks

• new block, 74 rules

lzear/yaml

• new block, 20 rules

lzear/prettier/deno-json

• new block, 1 rule

lzear/prettier/yarnrc

• new block, 1 rule

lzear/prettier/markdown-code

• new block, 1 rule

Commits

• a2e38aa chore(deps): update actions/setup-node action to v7.1.0
• ee48f08 chore: build before housekeep runs forge update
• 45488d1 docs(changeset): fold duplicate and internal-only entries into user-facing ones
• 4464091 docs(changeset): add the forge 4 to 5 upgrade note
• c6d7054 chore: yarn housekeep
• baa292d feat(repo-lint): warn on drift checks, fail on them with --strict
• 706a67d feat(repo-lint): pick forge init's React configs from the react dependency
• 700e3b1 feat(configs)!: remove defineReactConfig
• 65ad89f feat(forge)!: remove forge setup
• 68f023d feat(eslint-config)!: drop eslint-plugin-react-compiler
• 7fa47a9 fix(repo-lint): make forge check pass in consumer repos
• 01a9e5b test: add an end-to-end check of forge init's scaffolds
• 52da195 fix(repo-lint): make forge init scaffold a repo that passes its own qa
• f9963b2 feat(repo-lint)!: make Codacy opt-in
• 7d65da0 feat(repo-lint): scan staged changes with gitleaks on pre-commit
• 2e3fa57 feat(repo-lint)!: drop the secret-scanning and workflow-token-read checks
• 5066690 feat(release)!: drop snapshot releases and lzear-prerelease
• 0008d47 feat(ci)!: drop the advisory CI steps nobody reads
• 9eeaca3 docs: note that an exported regex fails the dts build
• 7ac04d4 feat(repo-lint): name the GitHub repo in the forge config
• 5ca605f fix(repo-lint): sync .codacy.yml only into repos that publish
• 0f1bd68 fix(repo-lint): run sherif on pnpm-only workspaces
• f9313a2 style(repo-lint): format the README with Prettier
• 3bee5ca docs: document the gitleaks job and the CI trigger events
• 2fe6658 feat(repo-lint): lint md, yml, yaml and jsonc files on pre-commit
• 48b5893 fix(repo-lint): forge init records the packageManager field
• 7a14e5a feat(forge): forge init scaffolds a repo in one command
• 422024e feat(repo-lint): check GitHub settings, Renovate activity and .env ignore
• f45eb22 fix(repo-lint): git-hooks fix replaces husky in prepare
• 4682a2d chore: yarn zizmor script passing --config .github/zizmor.yml
• 95fe8af feat(configs): coverage summary under coding agents, react tsconfig on ES2025, forge tsconfig/base
• 492bb05 feat(eslint-config): note rule changes in the release changelog
• 75d7bd9 feat(repo-lint): forge check --fix repairs f...

v4.10.0

unicorn/no-top-level-side-effects is off in *.config.* files.

no-restricted-syntax rejects type="number" in JSX.

forge update skips workspaces that are git submodules.

Commits

• 68d7d13 fix: lint
• a1b0335 feat(eslint-config): allow top-level side effects in config files
• 5a1d0ac chore: yarn housekeep
• c45e7d2 feat(eslint-config): reject number inputs in JSX
• ae98a3b feat(repo-lint): forge update skips git submodule workspaces

v4.9.0

@typescript-eslint/consistent-type-definitions takes type: --fix rewrites interfaces.

package-json/no-nested-exports skips the cwd's workspace manifests.

Commits

• ade6cc4 feat(eslint-config): prefer type aliases over interfaces
• a9aaded fix(eslint-config): allow exports in workspace package.json files

v4.8.2

lzear/prefer-relative-imports keeps an import's query (?url) in its fix.

Commits

• dff5c62 fix(eslint-config): keep import query in prefer-relative-imports fix

v4.8.1

deps-release-age reads Yarn's gate under FORCE_COLOR.

Commits

• a8d31cc fix(repo-lint): read yarn age gate as JSON so FORCE_COLOR can't zero it

v4.8.0

Quiet under coding agents: silent tsup, Vite warnings only, forge check failures only.

defineBinConfig drops its shebang banner: the bin source carries its own.

ESLint 10 plugins only: jsx-a11y-x replaces jsx-a11y under the same rule names; @eslint-react covers react, dropped with react-perf.

forgePlugin() for framework Vite configs: agent log level, dev 404 for /.well-known/*.

git-hooks check: lefthook.yml exists and gets installed.

Type-only imports take import type: verbatimModuleSyntax kept import { type A } from 'x' as import 'x'.

Declare the typescript peer the plugins need.

Commits

• 0c210fa chore: yarn housekeep
• 854fb7e feat(configs): forgePlugin for framework Vite configs
• 2bd43ac fix(eslint-config): flag type imports kept as side effects
• fcf2f8f fix(configs): keep the bin source's shebang instead of a banner
• 3a1ba20 fix: clear yarn install's peer warnings
• f751512 feat(eslint-config): use only plugins that support ESLint 10
• 327e5ab feat: quiet builds and forge check under coding agents
• cd35904 feat(repo-lint): check git hooks are installed
• 5cbfd0e feat(template): lint staged files, run hooks under any package manager
• 3af94aa docs: slim CLAUDE.md, add gotchas

v4.7.0

lzear-prerelease publishes an alpha or beta of the pending changesets.

eslint-package-json back to v1 until v2 is 3 days old.

Commits

• 72b0c81 fix(eslint-config): revert eslint-package-json to v1
• c6222c6 feat(configs): add lzear-prerelease
• 95cfbe0 refactor(configs): extract readStatus from lzear-changelog

v4.6.0

lib and app tsconfigs target ES2025.

README documents presets, defaults and bin flags.

lzear-publish titles GitHub releases with their tag.

Base tsconfig enables erasableSyntaxOnly and noImplicitOverride, and makes unreachable code and unused labels errors.

lzear-sync-jsr excludes tests from JSR when they only live in src subfolders.

vitest/react extends vitest, so it also writes coverage-final.json for fallow health.

Remove the repo-lint CLI, checkRepo and forge check --repos/--dir; run forge check inside each repo.

e18e/ban-dependencies flags package.json deps with a native or micro-utility replacement.

eslint-package-json v2: adds package-json/no-node-modules-bin-paths.

README documents options, layers and rules.

lzear/major-version-only keeps 0.x ranges up to their first non-zero part: ~0.5.4 → ~0.5, ^0.0.2 unchanged.

forge setup pipes secrets to gh via stdin and reports a failed gh secret set.

forge setup detects repos with a dot in their name; @lzear/repo-lint exports detectRepo.

forge sync reports each file as unchanged, created or updated; --dry previews which.

README vite example uses defineReactConfig(); there is no default export.

checkLocal({ dir }) reads the repo name from dir's origin, not the cwd's.

ci-workflow also applies to repos that publish nothing.

deps-fresh runs forge update's ncu step dry, so it honours .ncurc, peer deps and { "packages": [...] } workspaces.

Export listSecrets.

README lists the jsr-config check.

forge update skips versions under 3 days old, except own packages; new deps-release-age check requires the package manager to do the same.

renovate requires extending the github>lzear/forge preset.

pkg-size-limit runs the repo's size-limit wherever it is configured.

forge update keeps a version file's precision (v22 → v26) and leaves aliases like lts/* alone.

Commits

• 2b570ad docs: adopt steps and workflow inputs in README
• 9bf2a7e docs(configs): document presets, defaults and bin flags
• cd6c99e docs(eslint-config): document options, layers and rules
• e34ecc3 fix(configs): title GitHub releases with their tag
• 86d1907 feat: wait 3 days before adopting new versions
• c4ac11a test(forge): strip colors from captured CLI output
• 78b9d06 feat(eslint-config): bump eslint-package-json to v2
• b1f2816 refactor(forge): reuse repo-lint's listSecrets in forge setup
• 243d598 fix(forge): detect repos with a dot in their name
• 50365bd feat: ship the github>lzear/forge Renovate preset and require it
• cf56f96 docs: slim READMEs and CLAUDE.md
• c8c68dc feat(repo-lint): require the forge CI in unpublished repos too
• 25c41c4 feat(ci): run Bun repos in the reusable CI
• 9cb2c64 chore(renovate): bump npx-pinned CLIs in workflows
• 1361fef feat: add e18e
• 605875e feat: make tsconfig stricter
• 3aff351 feat: remove the repo-lint CLI and checkRepo
• ea87a37 fix(repo-lint): detect the origin of checkLocal's dir
• 1d44741 fix(forge): make forge sync --dry show what would change
• fa32d90 fix(ci): skip nested node_modules when merging coverage for fallow
• ed0ba4f fix(configs): find nested tests in lzear-sync-jsr
• d1b2b5f refactor(repo-lint): share the package.json readers of checks and update
• 62c993d fix(repo-lint): keep the precision of node and bun version files
• aa0e6df fix(forge): pipe secrets to gh via stdin and report failures
• a7f7d03 docs(repo-lint): list the jsr-config check
• f196c63 fix(repo-lint): share forge update's ncu step with deps-fresh
• b9493b0 docs: fix the vite and vitest/react README examples
• 5362cb1 fix(configs): extend the base vitest config in vitest/react
• 8b377db fix(eslint-config): keep ^0.x and ^0.0.x ranges in major-version-only