[dborgards]

semantic-release 25 depends on @semantic-release/npm, which installs the npm CLI with its own bundled undici 6.29.0, ip-address 10.7.2 and minimatch 10.2.5. Overrides can't reach bundled dependencies, and no npm release (11.21.1 or 12.2.1) ships patched copies yet.

This repo never publishes to npm, and .releaserc.json lists its plugins explicitly without @semantic-release/npm, so the plugin never runs. package.json now points it at a small local placeholder (eng/semantic-release-npm-disabled) that throws if it's ever loaded, and verify-release-config.mjs rejects it in the plugin list.

Effect on the lockfile: npm and 172 other packages drop out, nothing else changes version.

Checked locally on Node 22 after a fresh npm ci --ignore-scripts:

• npm audit: 38 findings (1 high, 37 moderate) before, 0 after
• npm ls undici minimatch ip-address: only undici@7.30.1 under @semantic-release/github remains; no npm package in the tree
• npx semantic-release --dry-run --no-ci: same plugins loaded, next version 1.4.0, release notes identical to main
• node eng/next-release-version.mjs and node eng/verify-release-config.mjs pass

Fixes #460

[cursor]

PR Summary

Low Risk
Dev-only release tooling and dependency substitution; no runtime product code, with a fail-fast stub if the npm plugin is misconfigured.

Overview
Replaces the real @semantic-release/npm package with a local stub so semantic-release 25’s dependency resolves without pulling in the full npm CLI and its bundled transitive packages (addressing audit noise from bundled undici, minimatch, ip-address, etc., per #460).

package.json pins @semantic-release/npm to file:eng/semantic-release-npm-disabled and uses npm overrides so the stub wins everywhere in the tree. The stub throws on import if anything ever loads it, since CanKit.Pro does not publish to npm and .releaserc.json never enables that plugin anyway.

eng/verify-release-config.mjs now treats @semantic-release/npm in the plugin list as explicitly DISABLED and fails verification with a pointer to the stub, instead of treating it as a resolvable plugin.

The lockfile shrinks accordingly: npm and a large set of related packages are removed; release behavior for the configured plugins is unchanged.

^{Reviewed by Cursor Bugbot for commit 1e8a911. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T20:58:35.655333Z	6cf4ab0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!