The pairing
release.yml uses changesets/action@master. GitHub reports this on every run of the workflow:
The workflow file using changesets/action is currently using @master as the version. This branch has been frozen and deprecated. Please update your workflow to either use @v1 or a specific commit SHA that is tagged.
That branch is frozen at 41adcfa1 (2021-11-26, "Deprecate master branch"), and its action.yml still declares:
Meanwhile Renovate moved this repo from @changesets/cli 2.29.8 to 3.0.1 in August and to 3.0.2 on 4 September. Changesets CLI v3 was released 2026-08-11.
changesets/action v2 is the line built for CLI v3. Its release notes say so directly, in the patch note for #699:
Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to changesets/action@v1.
So @v1 is the CLI v2 line and @v2 is the CLI v3 line, and this repo is currently running a 2021 build of the action against a CLI major it was never written for. That combination has not actually executed yet: the only Release run since the CLI v3 bump failed earlier, at Install Dependencies (#2674, PR #2675).
Why this is not a one line bump
Moving to @v2 is a migration, not a version bump. From the v2.0.0 release notes:
-
Inputs renamed: publish to publish-script, version to version-script, commit to commit-message, title to pr-title, branch to pr-base-branch. This workflow passes publish and commit.
-
Release commits and tags are pushed through the GitHub API by default, and a custom token must be passed explicitly via the github-token input. The GITHUB_TOKEN environment variable is no longer a substitute.
-
.npmrc handling was removed when NPM_TOKEN is set:
Authentication should be handled via Trusted Publishing instead. If a token is still needed, use actions/setup-node to set it up instead via the registry-url option.
This workflow authenticates only by passing NPM_TOKEN as an env var, so that is exactly the line v2 drops.
That last point overlaps #2532, which is waiting on an npm side setting that cannot be changed from outside the org, so I do not think this should be attempted blind.
Two adjacent observations
@changesets/cli v3 declares engines of node ^22.11 || ^24 || >=26, npm >=10.9.0, pnpm >=10.0.0. ci.yml currently runs a Node 18 and 20 matrix.publish: yarn release invokes Yarn Classic, and CLI v3's release notes list "Removed Yarn Classic support". The script is only being run through yarn rather than yarn being used as the workspace's package manager, so this may well be harmless, but it seems worth confirming before the next publish rather than during it.
What I am asking
Not for a decision now, only that the mismatch is recorded somewhere. If you would like the v2 migration attempted, I am happy to open it, but the npm authentication half needs a call from someone who can see the npm side.
The pairing
release.ymluseschangesets/action@master. GitHub reports this on every run of the workflow:That branch is frozen at
41adcfa1(2021-11-26, "Deprecatemasterbranch"), and itsaction.ymlstill declares:Meanwhile Renovate moved this repo from
@changesets/cli2.29.8 to 3.0.1 in August and to 3.0.2 on 4 September. Changesets CLI v3 was released 2026-08-11.changesets/actionv2 is the line built for CLI v3. Its release notes say so directly, in the patch note for #699:So
@v1is the CLI v2 line and@v2is the CLI v3 line, and this repo is currently running a 2021 build of the action against a CLI major it was never written for. That combination has not actually executed yet: the only Release run since the CLI v3 bump failed earlier, atInstall Dependencies(#2674, PR #2675).Why this is not a one line bump
Moving to
@v2is a migration, not a version bump. From the v2.0.0 release notes:Inputs renamed:
publishtopublish-script,versiontoversion-script,committocommit-message,titletopr-title,branchtopr-base-branch. This workflow passespublishandcommit.Release commits and tags are pushed through the GitHub API by default, and a custom token must be passed explicitly via the
github-tokeninput. TheGITHUB_TOKENenvironment variable is no longer a substitute..npmrchandling was removed whenNPM_TOKENis set:This workflow authenticates only by passing
NPM_TOKENas an env var, so that is exactly the line v2 drops.That last point overlaps #2532, which is waiting on an npm side setting that cannot be changed from outside the org, so I do not think this should be attempted blind.
Two adjacent observations
@changesets/cliv3 declaresenginesof node^22.11 || ^24 || >=26, npm>=10.9.0, pnpm>=10.0.0.ci.ymlcurrently runs a Node 18 and 20 matrix.publish: yarn releaseinvokes Yarn Classic, and CLI v3's release notes list "Removed Yarn Classic support". The script is only being run through yarn rather than yarn being used as the workspace's package manager, so this may well be harmless, but it seems worth confirming before the next publish rather than during it.What I am asking
Not for a decision now, only that the mismatch is recorded somewhere. If you would like the v2 migration attempted, I am happy to open it, but the npm authentication half needs a call from someone who can see the npm side.