docs(changelog): record what 2.3.0 ships - #12
Merged
Conversation
The entries for the work since 2.2.0 were never written, so the release has no editorial text and step one of the checklist has nothing to read. The eight commits on main since the tag touch three things a consumer sees: the entry point map and the packaging metadata, the tarball no longer carrying the tests under src, and the RSA host function answering correctly inside a browser bundle. The dependency work is absent on purpose, because every lift landed in the lockfile while the declared ranges already admitted the patched releases, so an install resolves them either way and the release delivers nothing there.
There was a problem hiding this comment.
Pull request overview
Adds the retroactive changelog entry needed to prepare the 2.3.0 release.
Changes:
- Documents package export and metadata changes.
- Records browser RSA verification fix.
- Notes publishing provenance and tarball cleanup.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Eight commits sit on
mainsincev2.2.0and none of them wrote aCHANGELOG.mdentry, so step one ofRELEASING.mdhas nothing to read and no release can be composed. This writes that entry retroactively, which is a deviation from the documented flow: the entry belongs in the PR that makes the change, and each of those PRs should have carried its own line.Three things in that range are visible to a consumer. The
exportsmap and the packaging metadata, the tarball no longer shipping the tests undersrc, andverify_rsa_sha256_siganswering correctly inside a browser bundle.The dependency work is deliberately absent. Every lift landed in the lockfile while the declared ranges already admitted the patched releases, so a consumer install resolves them either way and the release delivers nothing there. Claiming a security fix the release does not carry would be worse than the omission.
The
exportsmap is filed under## Upgradingrather than## Breaking changes. It restricts subpath imports, so anyone reaching intodisthas to move to the package entry, but 2.3.0 was chosen as a minor on the usual convention for adding an entry point map.Validation
scripts/release-notes.sh v2.3.0 HEADcomposes the body cleanly: summary, the three sections, the nine-line commit list, and the compare link last.scripts/release-notes.test.shpasses 12/12.