chore: 2.0.0-rc.1 - #1835
Merged
Merged
Conversation
Release candidate for the 2.0.0 go-live (#1818, §6). Publishes under the `next` dist-tag via the derivation added in #1834 — verified: `2.0.0-rc.1` contains a hyphen after the patch component, so it resolves to `next`, leaving `latest` on 1.0.1 untouched. The RC exists to exercise what only exists against the live registry: the `next`-tag publish path itself (newly written in #1834), provenance/OIDC minting, the `files` allowlist as npm actually packs it, and the postinstall cascade's early-exit under a real dependency install on a clean machine. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
This was referenced Aug 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release candidate for the 2.0.0 go-live — part of #1818 (§6).
This PR publishes nothing. Merging it only sets the version; publishing happens when a GitHub release is cut against the merged commit.
What happens when the release is cut
2.0.0-rc.1contains a hyphen after the patch component, so the derivation added in #1834 resolves it to thenextdist-tag:lateststays on 1.0.1 and is not touched. Before #1834 this same release would have published the RC tolatest— see that PR for why.Why bother with an RC
The runbook (§6) asks for one, and its stated value is validating what only exists against the live registry: provenance/OIDC minting, the
filesallowlist as npm actually packs it, and the postinstall cascade's early-exit under a realnpm install.Two of those are arguably already covered — phase 2 (#1815) proved OIDC publishing works on this repo, and
pack:verifydrives the real tarball end to end in a clean consumer. The reason to still do it: #1834 is newly-written code on the publish path, and thenext-tag branch has never executed. An RC exercises it against a version number nobody will miss.Verification after publish
latestremaining at 1.0.1 is the specific thing to confirm — it is what proves the tag derivation works.Diff
Two files: root
package.jsonversion and the matchingpackage-lock.jsonentries. The four clientpackage.jsons carry no version by design (single-version package), so nothing else changes.🤖 Generated with Claude Code
https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD