From 60ce24f4c53467294a9b52307337d670a404eec9 Mon Sep 17 00:00:00 2001 From: Aravind Kumar Date: Tue, 15 Sep 2026 10:29:58 +0530 Subject: [PATCH 01/16] Update npm-publish.yml --- .github/workflows/npm-publish.yml | 43 +++++++++++++++++-------------- 1 file changed, 23 insertions(+), 20 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 5451d01b..dac97090 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -1,22 +1,25 @@ -name: Publish Package to npmjs +name: Publish package to npmjs registry on: - release: - types: [created] + release: + types: [published] jobs: - build: - runs-on: ubuntu-latest - permissions: - contents: read - id-token: write - steps: - - uses: actions/checkout@v4 - # Setup .npmrc file to publish to npm - - uses: actions/setup-node@v4 - with: - node-version: "18" - registry-url: "https://registry.npmjs.org" - - run: npm ci - - run: npm run build - - run: npm publish --provenance --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + publish-npm: + runs-on: ubuntu-latest + permissions: + contents: read + id-token: write + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.release.tag_name }} + persist-credentials: false + - uses: actions/setup-node@v4 + with: + node-version: 24 + registry-url: https://registry.npmjs.org/ + cache: 'npm' + - run: npm ci + - name: Update npm + run: npm install -g npm@latest + - name: Release + run: npm publish --provenance --access public From 89811da4bf36528c30d2efc14c5d01594234a501 Mon Sep 17 00:00:00 2001 From: Aravind Kumar Date: Tue, 15 Sep 2026 10:33:36 +0530 Subject: [PATCH 02/16] Update npm-publish.yml --- .github/workflows/npm-publish.yml | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index dac97090..a2d93536 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -3,8 +3,30 @@ on: release: types: [published] jobs: - publish-npm: + publish: runs-on: ubuntu-latest + if: ${{ !endsWith(github.event.release.name, '-alpha') }} + permissions: + contents: read + id-token: write + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.release.tag_name }} + persist-credentials: false + - uses: actions/setup-node@v4 + with: + node-version: 24 + registry-url: https://registry.npmjs.org/ + cache: 'npm' + - run: npm ci + - name: Update npm + run: npm install -g npm@latest + - name: Release + run: npm publish --provenance --access public + publish-alpha: + runs-on: ubuntu-latest + if: ${{ endsWith(github.event.release.name, '-alpha') }} permissions: contents: read id-token: write From 71a26ad7dc3a9534c2513858a0fa574fd8940be4 Mon Sep 17 00:00:00 2001 From: Aravind Kumar Date: Tue, 15 Sep 2026 10:33:48 +0530 Subject: [PATCH 03/16] Delete .github/workflows/npm-alpha-publish.yml --- .github/workflows/npm-alpha-publish.yml | 31 ------------------------- 1 file changed, 31 deletions(-) delete mode 100644 .github/workflows/npm-alpha-publish.yml diff --git a/.github/workflows/npm-alpha-publish.yml b/.github/workflows/npm-alpha-publish.yml deleted file mode 100644 index 68541cff..00000000 --- a/.github/workflows/npm-alpha-publish.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Publish Alpha Package to npmjs -on: - push: - branches: - - "alpha/*" - tags: - - "v*.*.*-alpha.*" - -jobs: - build: - runs-on: ubuntu-latest - permissions: - contents: read - id-token: write - steps: - - uses: actions/checkout@v4 - - # Setup Node.js and npm registry - - uses: actions/setup-node@v4 - with: - node-version: "18" - registry-url: "https://registry.npmjs.org" - always-auth: true - - - run: npm ci - - run: npm run build - - # Publish package to npm under the "alpha" tag - - run: npm publish --tag alpha --provenance - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} From 76e6a9dc6748f15d459320ced52da95e403bb9bf Mon Sep 17 00:00:00 2001 From: Kirtesh Suthar Date: Wed, 16 Sep 2026 10:38:37 +0530 Subject: [PATCH 04/16] fix(release): build on prepack so dist ships in the published package v4.5.1 was published with only package.json, README.md and LICENSE. The package has no JS in it, so every consumer build fails on import while main, module, types and exports all point into dist/. The publish workflow dropped its `npm run build` step when it was rewritten on 15 Sept. Nothing else builds before publish: there is no prepack or prepublishOnly script, and with no `files` field npm falls back to .gitignore, which excludes dist. No build means an empty package. Hooking the build to prepack fixes it for every publish path rather than just the one workflow, so a later workflow edit cannot silently drop it again. A failing build now fails the publish instead of shipping nothing. Co-Authored-By: Claude --- package.json | 1 + 1 file changed, 1 insertion(+) diff --git a/package.json b/package.json index 350bee73..a4ea26f6 100644 --- a/package.json +++ b/package.json @@ -31,6 +31,7 @@ "test:coverage": "vitest --coverage", "dev": "NODE_OPTIONS='--max-old-space-size=16384' tsup --watch --config tsup.config.dev.js", "prepare": "husky", + "prepack": "npm run build", "lint": "eslint src", "lint:fix": "eslint --fix", "prettier": "prettier src --check", From 86f5187abd0a861bdd8a328f9cab04df926f5c0c Mon Sep 17 00:00:00 2001 From: Kirtesh Suthar Date: Wed, 16 Sep 2026 10:58:44 +0530 Subject: [PATCH 05/16] fix(release): publish prereleases under the alpha dist-tag When npm-alpha-publish.yml was folded into this workflow the publish-alpha job came out identical to publish, losing the `--tag alpha` the old workflow had. An alpha release would move the `latest` dist-tag to the prerelease and hand it to every consumer on a caret range. This also restores the alpha channel as a rehearsal for a real publish: cut a prerelease, install it, confirm it resolves, then cut the release, all without touching `latest`. Co-Authored-By: Claude --- .github/workflows/npm-publish.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index a2d93536..7921a333 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -44,4 +44,5 @@ jobs: - name: Update npm run: npm install -g npm@latest - name: Release - run: npm publish --provenance --access public + # Without --tag alpha npm moves the latest tag to the prerelease + run: npm publish --tag alpha --provenance --access public From fd8e6af5a8b4b5c8cdd512955180b943616c0c26 Mon Sep 17 00:00:00 2001 From: Kirtesh Suthar Date: Wed, 16 Sep 2026 11:43:08 +0530 Subject: [PATCH 06/16] chore(ci): pin vitest-coverage-report-action to a commit sha A version tag is mutable, so the action owner or anyone who compromises that account can change what runs in CI without the ref changing here. Pinning to the commit sha behind v2.13.0 keeps the same code and removes that path. Co-Authored-By: Claude --- .github/workflows/unit-test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index 9ec05a51..38fd9e69 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -26,4 +26,4 @@ jobs: # Set if: always() to also generate the report if tests are failing # Only works if you set `reportOnFailure: true` in your vite config as specified above if: always() - uses: davelosert/vitest-coverage-report-action@v2 + uses: davelosert/vitest-coverage-report-action@c4bbc33a89b7ace0e63d35f1f7d4bcee31155a73 # v2.13.0 From f3af40c257ededa9ffca3fff8dc4ab79b06ba5ee Mon Sep 17 00:00:00 2001 From: Kirtesh Suthar Date: Wed, 16 Sep 2026 12:01:52 +0530 Subject: [PATCH 07/16] 4.5.2 --- CHANGELOG.md | 33 ++++++++++++++++++++++++++++++++- package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 35 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e7a59903..efcfb33f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,8 +1,25 @@ # Changelog +## [v4.5.2](https://github.com/contentstack/live-preview-sdk/compare/v4.5.1...v4.5.2) + +> 16 September 2026 + +### Fixes + +- fix(release): restore build before publish and the alpha dist-tag (Kirtesh Suthar - [#650](https://github.com/contentstack/live-preview-sdk/pull/650)) + +### Fixes + +- fix(release): publish prereleases under the alpha dist-tag (Kirtesh Suthar - [86f5187](https://github.com/contentstack/live-preview-sdk/commit/86f5187abd0a861bdd8a328f9cab04df926f5c0c)) +- fix(release): build on prepack so dist ships in the published package (Kirtesh Suthar - [76e6a9d](https://github.com/contentstack/live-preview-sdk/commit/76e6a9dc6748f15d459320ced52da95e403bb9bf)) + +### Chores And Housekeeping + +- chore(ci): pin vitest-coverage-report-action to a commit sha (Kirtesh Suthar - [fd8e6af](https://github.com/contentstack/live-preview-sdk/commit/fd8e6af5a8b4b5c8cdd512955180b943616c0c26)) + ## [v4.5.1](https://github.com/contentstack/live-preview-sdk/compare/v4.5.0...v4.5.1) -> 10 September 2026 +> 15 September 2026 ### Fixes @@ -11,15 +28,22 @@ ### Chores And Housekeeping +- chore(release): v4.5.1 (Kirtesh Suthar - [#646](https://github.com/contentstack/live-preview-sdk/pull/646)) - chore: sync develop_v4 with stage_v4 (Kirtesh Suthar - [#645](https://github.com/contentstack/live-preview-sdk/pull/645)) - chore(tests): standardize api key placeholder values in specs (Hitesh Shetty - [#639](https://github.com/contentstack/live-preview-sdk/pull/639)) ### General Changes +- release: v4.5.1 (Kirtesh Suthar - [#647](https://github.com/contentstack/live-preview-sdk/pull/647)) - Develop v4 (Kirtesh Suthar - [#640](https://github.com/contentstack/live-preview-sdk/pull/640)) +### Fixes + +- fix: update CDN version to 4.5.1 in README (Kirtesh Suthar - [e93cc36](https://github.com/contentstack/live-preview-sdk/commit/e93cc36a182d084fed01b3ee5b3262a51fb159fd)) + ### Chores And Housekeeping +- chore: merge main into stage_v4 release branch (Kirtesh Suthar - [3d2e823](https://github.com/contentstack/live-preview-sdk/commit/3d2e8231f7e6cf21a8648d6435499f3773367510)) - chore: merge stage_v4 into develop_v4 (Kirtesh Suthar - [e1dee0f](https://github.com/contentstack/live-preview-sdk/commit/e1dee0f33c15fbbeb9d7842ad70aba7610801524)) - chore(deps): apply npm audit fix (hitesh-shetty-cstk - [ec144b9](https://github.com/contentstack/live-preview-sdk/commit/ec144b934935185f40efccfdcd09d4ac153222c8)) @@ -27,6 +51,13 @@ - refactor(utils): one list for live preview's own query params (Kirtesh Suthar - [c179114](https://github.com/contentstack/live-preview-sdk/commit/c1791141dd7f22430f4f96d8070f4354dc9b641e)) +### General Changes + +- Update npm-publish.yml (Aravind Kumar - [60ce24f](https://github.com/contentstack/live-preview-sdk/commit/60ce24f4c53467294a9b52307337d670a404eec9)) +- Delete .github/workflows/npm-alpha-publish.yml (Aravind Kumar - [71a26ad](https://github.com/contentstack/live-preview-sdk/commit/71a26ad7dc3a9534c2513858a0fa574fd8940be4)) +- Update npm-publish.yml (Aravind Kumar - [89811da](https://github.com/contentstack/live-preview-sdk/commit/89811da4bf36528c30d2efc14c5d01594234a501)) +- Updated codeowners (Aravind Kumar - [4183387](https://github.com/contentstack/live-preview-sdk/commit/41833878124126b1cf74d92d8501f1d1eda1c06f)) + ## [v4.5.0](https://github.com/contentstack/live-preview-sdk/compare/v4.4.5...v4.5.0) > 11 August 2026 diff --git a/package-lock.json b/package-lock.json index 15b27b0c..c4d7d09e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@contentstack/live-preview-utils", - "version": "4.5.1", + "version": "4.5.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@contentstack/live-preview-utils", - "version": "4.5.1", + "version": "4.5.2", "license": "MIT", "dependencies": { "@floating-ui/dom": "^1.7.2", diff --git a/package.json b/package.json index a4ea26f6..9c7b86b2 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@contentstack/live-preview-utils", - "version": "4.5.1", + "version": "4.5.2", "description": "Contentstack provides the Live Preview SDK to establish a communication channel between the various Contentstack SDKs and your website, transmitting live changes to the preview pane.", "type": "module", "types": "dist/legacy/index.d.ts", From 514013d8cf6cb2e6c65c0da11be39df1476a7444 Mon Sep 17 00:00:00 2001 From: Kirtesh Suthar Date: Wed, 16 Sep 2026 12:02:09 +0530 Subject: [PATCH 08/16] fix: update CDN version to 4.5.2 in README Co-Authored-By: Claude --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a136de21..64eb53b6 100644 --- a/README.md +++ b/README.md @@ -29,11 +29,11 @@ npm install @contentstack/live-preview-utils ### Load from a CDN (advanced) -Pin the version to match your app (update `4.5.1` when you upgrade): +Pin the version to match your app (update `4.5.2` when you upgrade): ```html