[BOTOOM]

Description

Stacked on #90. #90 unblocks releases by pinning conventional-changelog-conventionalcommits back to 9.x. This PR goes back to the 10.x preset and keeps the stable @semantic-release/release-notes-generator@14.1.1. The generator still declares conventional-changelog-writer@^8, and preset 10 needs writer 9, so this PR forces writer 9 only under the generator:

// package.json → pnpm.overrides
"@semantic-release/release-notes-generator>conventional-changelog-writer": "9.2.1"

// apps/backend + apps/extension
"conventional-changelog-conventionalcommits": "10.4.0"

• Both versions are exact pins because 10.4.1 and writer 9.3.0 were published on 2026-10-05, inside the 7-day supply-chain window. They can be bumped once they are old enough.
• The override is scoped: commit-analyzer keeps its own writer 8.2.0.
• The override is a combination outside the generator's declared range. Remove it, and move to @semantic-release/release-notes-generator@15, once 15 is stable: 15 depends on writer ^9 and conventionalcommits ^10 natively.
• In the lockfile, the eslint-plugin-import snapshot key is re-rendered by pnpm with an expanded peer key. It is still the same version (2.32.0) with the same dependencies.

Type of Change

• Dependency update

Related Issues

Follow-up to #90 / regression from #82.

Checklist

• pnpm install --frozen-lockfile passes
• Ran the real workspace-installed release-notes-generator (generateNotes) and commit-analyzer (analyzeCommits) with each app's own release config (apps/backend/.releaserc.cjs, apps/extension/.releaserc.json):
  • generateNotes renders the 1.11.0 notes (Breaking changes, Features, Bug Fixes, Maintenance);
  • analyzeCommits returns major with a breaking change and minor without one.
• Full semantic-release run (only on master with release credentials)

Link to Devin session: https://app.devin.ai/sessions/8b2b838f60104769933e2c0c4c7d3eb9
Open in Devin Desktop: https://app.devin.ai/desktop/session/8b2b838f60104769933e2c0c4c7d3eb9?variant=devin
Requested by: @BOTOOM

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access that start with 'Devin'.

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
devmentorai-website-cli	Ignored	Preview	Oct 8, 2026 4:17pm UTC

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.