chore(deps): update semantic-release monorepo (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@semantic-release/changelog	6.0.3 → 7.0.0
@semantic-release/exec	6.0.3 → 7.1.0
@semantic-release/git	10.0.1 → 11.0.1
@semantic-release/npm	12.0.2 → 13.1.5
semantic-release	23.1.1 → 25.0.9

---

Release Notes

semantic-release/changelog (@​semantic-release/changelog)

v7.0.0

Compare Source

Features

• ES Module (#​414) (e154214)

BREAKING CHANGES

• @semantic-release/changelog is now a native ES
  Module. It has named exports for each plugin hook (verifyConditions,
  prepare)
• the minimum required version of semantic-release to use
  @semantic-release/changelog is now
  v20.1.0

Other Notable Changes

• Replaced xo with prettier with default configuration; following
  newly established convention
• Replaced nyc with c8 for code coverage
• Replaced lodash with lodash-es for proper esm support

Related Issue

• semantic-release/semantic-release#2133
• semantic-release/semantic-release#4032

semantic-release/exec (@​semantic-release/exec)

v7.1.0

Compare Source

Features

• error: print more useful error for non-process failure (#​449) (a285bc5)

v7.0.3

Compare Source

Bug Fixes

• deps: update dependency execa to v9 (643e2eb)

v7.0.2

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/error to v4 (#​353) (471f963)

v7.0.1

Compare Source

Bug Fixes

• deps: update dependency parse-json to v8 (#​394) (080440f)

v7.0.0

Compare Source

Features

• ES Module (#​411) (b4462db)

BREAKING CHANGES

• the minimum required version of semantic-release to use @semantic-release/exec is now v24.1.0; the warn logger method/function is now available to use in plugin

• @semantic-release/exec is now a native ES Module. It has named exports for each plugin hook (verifyConditions, analyzeCommits, verifyRelease, generateNotes, prepare, publish, addChannel, success, fail)

semantic-release/git (@​semantic-release/git)

v11.0.1

Compare Source

Bug Fixes

• deps: update dependency execa to v10 (#​564) (b39d5c6)

v11.0.0

Compare Source

Features

• ES Module (#​544) (4d704a2), closes #​491 #​490

BREAKING CHANGES

• @semantic-release/git is now a native ES Module. It
  has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use
  @semantic-release/git is now v20.1.0

Other Notable Changes

• @semantic-release/error ^3 → ^4 (ESM-only)
• aggregate-error ^3 → ^5 (ESM-only, uses native AggregateError)
• execa ^5 → ^9 (ESM-only, named export)
• p-reduce ^2 → ^3 (ESM-only)
• Removed CJS-only devDeps: clear-module, file-url, fs-extra,
  get-stream, nyc
• Added c8 for coverage; bumped ava, sinon, tempy,
  semantic-release, prettier
• Engine: ^22.22.2 || >= 24.15;
• Scripts: nyc → c8, added pretest, removed test:ci

Related Issue

• semantic-release/semantic-release#2133
• semantic-release/semantic-release#4032

semantic-release/npm (@​semantic-release/npm)

v13.1.5

Compare Source

Bug Fixes

• deps: update dependency normalize-url to v9 (#​1095) (daec492)

v13.1.4

Compare Source

Bug Fixes

• deps: update dependency @​actions/core to v3 (#​1085) (17abfe1)

v13.1.3

Compare Source

Bug Fixes

• deps: update dependency @​actions/core to v2 (#​1055) (fa4a3ab)

v13.1.2

Compare Source

Bug Fixes

• deps: update dependency read-pkg to v10 (#​1032) (f3f1a00)

v13.1.1

Compare Source

Bug Fixes

• publish-dry-run: temporarily remove the addition of dry-running the publish step (30bd176)

v13.1.0

Compare Source

Features

• trusted-publishing: verify auth, considering OIDC vs tokens from various registries (e3319f1), closes #​958
• trusted-publishing: refine the messages for related errors (316ce21), closes #​958
• trusted-publishing: make request to verify if OIDC token exchange can succeed (c80ecb0), closes #​958
• trusted-publishing: pass id-token as bearer header for github actions (d83b727), closes #​958
• trusted-publishing: pass id-token as bearer header for gitlab pipelines (6d1c3cf), closes #​958
• trusted-publishing: handle failure to retrieve id-token in the context of github actions (b673257), closes #​958
• auth-error: update messaging for auth failure to be less token specific (e24967d)
• auth: attempt a dry-run publish to determine auth status (841dc67)

Bug Fixes

• trusted-publishing: uri encode the package name for the token exchange request (3dd95d0), closes #​958
• auth: throw appropriate error when auth context fails to enable publishing (f5c8d85)
• auth: throw error if dry-run publish determines lack of auth (8f88e9d)
• verify-auth: enable the publish dry-run to work for projects publishing from a sub-directory (e7d684c)

v13.0.0

Compare Source

Features

• node-versions: drop support for node versions v20, v21, and v23
• node-versions: raise the minimum node version requirement for the v24 range (935439e)

Bug Fixes

• deps: update npm to v11 (debc7c5), closes #​966 #​966
• deps: update to the latest version of npm (1b25d6c)

BREAKING CHANGES

• node-versions: the minimum node version for the v24 range is now v24.10.0
• deps: a minimum of node v22.14 is now required

semantic-release/semantic-release (semantic-release)

v25.0.9

Compare Source

Bug Fixes

• do not expose the authenticated repository URL in EGITNOPERMISSION errors (#​4283) (8d905a5)

v25.0.8

Compare Source

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#​4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

v25.0.7

Compare Source

Bug Fixes

• argument Injection via repositoryUrl in package.json (#​4245) (c46dbda)

v25.0.6

Compare Source

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

v25.0.5

Compare Source

Bug Fixes

• revert: next (#​4200) (db8ffaa)

v25.0.4

Compare Source

Bug Fixes

• code-quality: add missing comma in context object for consistency (493d6cd)

v25.0.3

Compare Source

Bug Fixes

• deps: remove deprecated semver-diff (#​3980) (f404124)

v25.0.2

Compare Source

Bug Fixes

• deps: update dependency read-package-up to v12 (#​3935) (1494cb9)

v25.0.1

Compare Source

Bug Fixes

• deps: update to the latest version of the npm plugin to add trusted publishing support (fad173e), closes semantic-release/npm#958

v25.0.0

Compare Source

Bug Fixes

• deps: update dependency hosted-git-info to v9 (9fa04f8)
• deps: update dependency yargs to v18 (#​3745) (cde9a72)
• deps: update to the stable version of the github plugin (f12cf81)
• deps: update to the stable version of the release-notes-generator plugin (d9def72)
• deps: updated to the stable version of the commit-analyzer plugin (291533b)
• deps: upgrade to the new major version of the npm plugin, which upgrades npm to v11 for publishing (1be8290)

Features

• node-versions: drop support for node versions v20, v21, and v23 (56d16f4)
• node-versions: raise the minimum node version for the v24 range (116a188)

BREAKING CHANGES

• node-versions: the minimum node version for the v24 range is now v24.10.0
• node-versions: a minimum of node v22.14 is now required

v24.2.9

Compare Source

Bug Fixes

• deps: update dependency semver-diff to v5 (#​3867) (a834948)

v24.2.8

Compare Source

Bug Fixes

• deps: update dependency hook-std to v4 (#​3859) (67abe56)

v24.2.7

Compare Source

Performance Improvements

• get-tags.js: bulk get for tags notes (#​3732) (85187e2)

v24.2.6

Compare Source

Bug Fixes

• deps: update @​semantic-release/npm to ^12.0.2 (#​3791) (93177d0)

v24.2.5

Compare Source

Bug Fixes

• deps: raise the minimum of the defined range for marked-terminal (#​3742) (fb1ccd4)

v24.2.4

Compare Source

Bug Fixes

• deps: update dependency marked to v15 (#​3499) (e45040e)

v24.2.3

Compare Source

Bug Fixes

• types: fixed typescript definition (0e08b5c), closes #​3601

v24.2.2

Compare Source

Bug Fixes

• get-git-auth-url.js: Added debug for success (#​3595) (2616d93)

v24.2.1

Compare Source

Bug Fixes

• deps: update dependency import-from-esm to v2 (#​3556) (f15019c)

v24.2.0

Compare Source

Features

• clarify branch existence requirement in error messages (#​3462) (05a2ea9)

v24.1.3

Compare Source

Bug Fixes

• branch-naming: prevent non-range versions from being identified as maintenance branches (07f2672)

v24.1.2

Compare Source

Bug Fixes

• deps: update @semantic-release/github to v11.0.0 (#​3460) (43df51b)

v24.1.1

Compare Source

Bug Fixes

• deps: update dependency hosted-git-info to v8 (#​3436) (ab10ac1)

v24.1.0

Compare Source

Features

• add warn type to global context.logger (#​3423) (bcc663c)

v24.0.0

Compare Source

Bug Fixes

• deps: upgraded to the beta of the commit-analyzer plugin (dfc3d91)
• deps: upgraded to the beta of the release-notes-generator plugin (4a4cd92)

BREAKING CHANGES

• deps: the commit-analyzer plugin now expects to be used with the latest major versions of
  conventional-changelog packages. if you are installing any of these packages in addition to
  semantic-release, be sure to update them as well
• deps: the release-notes-generator plugin now expects to be used with the latest major
  versions of conventional-changelog packages. if you are installing any of these packages in addition
  to semantic-release, be sure to update them as well

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 2am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn cli npm v12.0.2 does not support Node.js v20.20.2. This version of npm supports the following node versions: `^22.22.2 || ^24.15.0 || >=26.0.0`. You can find the latest version at https://nodejs.org/.
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/npm/-/npm-11.19.1.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-15T18_32_57_624Z-debug-0.log