Skip to content

v1.1.0

Choose a tag to compare

View all tags
@prosdev prosdev released this 26 Oct 11:33
v1.1.0
2276984

The template now builds browser libraries and command-line tools as well as Node libraries. It publishes without any stored npm secret, checks every package before it ships, and refuses dependencies published in the last 14 days.

Added

  • Browser library example (packages/browser-example): an ES module plus a script-tag build, Playwright browser tests with an axe accessibility check, and a size budget that fails CI when the build grows.
  • Command-line example (packages/cli-example): a bin entry, a Node 24 build target, and a test that runs the built command.
  • Package checks (pnpm check:packages): each package is packed as it would publish, then checked with publint and Are The Types Wrong. CI and the release workflow both run them.
  • 14-day dependency age rule: pnpm refuses any version published in the last 14 days, including transitive ones. Renovate (opt-in, via its GitHub App) proposes weekly grouped updates once releases pass that age.
  • Agent instructions: AGENTS.md covers setup, the definition of done, lockfile hygiene and troubleshooting. CLAUDE.md imports it.

Changed

  • Publishing uses npm trusted publishing. No npm secret is stored, and public packages get provenance. The release workflow runs as four jobs; only the publish job can obtain npm credentials, and it never builds.
  • CI hardening: least-privilege permissions, and every action pinned to a commit SHA.
  • Tooling: Node 24 (Volta 24.12.0), pnpm 10.26.2, TypeScript 6.0.3, tsup 8.5.1, Turborepo 2.11.7, Biome 2.5.15, Vitest 5.0.4, Changesets 3.0.3, commitlint 21.2.3.
  • Versioning: template versions mark milestones, not compatibility, because a template is copied once and never upgraded in place. This section is where compatibility is described.

Changes for existing projects

A project created from v1.0.0 would change the following to match:

  1. Node 24 and pnpm 10. Raise engines.node to >=24. Set packageManager to pnpm@10.26.2 and the Volta pins. Reinstall to regenerate the lockfile.
  2. Builds use tsup. Packages built with tsc move to a tsup.config.ts. Add "type": "module", an exports map into dist/, and "files": ["dist"]. Without files, npm pack ships no dist/.
  3. TypeScript 6 deprecates baseUrl. Remove it from the root tsconfig.json and prefix paths with ./. Packages built with tsup 8 also need dts: { compilerOptions: { ignoreDeprecations: '6.0' } } until tsup 9.
  4. Biome 2 and Turborepo 2. Migrate biome.json (biome migrate) and rename pipeline to tasks in turbo.json.
  5. Changesets 3 no longer versions private packages by default. To keep that behavior, set "privatePackages": { "version": true, "tag": false } in .changeset/config.json.
  6. Publishing. Delete the NPM_TOKEN secret. Replace release.yml. Add a trusted publisher on npmjs.com for release.yml and the npm environment, then set the package to "disallow tokens". The README's "Setting Up npm Publishing" section covers each step.
  7. Dependency age. Add minimumReleaseAge: 20160 to pnpm-workspace.yaml. If the lockfile already holds young versions, delete node_modules and the lockfile, then reinstall.
Assets 2
Loading