@semantic-release/github 5.2.0

semantic-release plugin to publish a GitHub release and comment on released Pull Requests/Issues

@semantic-release/github@5.2.0 was published on 2018-10-08. Its manifest declares 17 runtime dependencies and 1 peer requirement. Bundled type declarations are not declared in the inspected metadata. The declared Node.js requirement is >=8.3.

All @semantic-release/github versions · Permanent reference to 5.2.0 · Latest release

Package specifications

Version	5.2.0
License declaration	MIT
Published	2018-10-08T17:29:27.150Z
Node.js requirement	>=8.3
Type declarations	Not declared
Runtime dependency count	17
Peer requirement count	1
Optional dependency count	0
Minified size	Measurement not available yet
Minified + gzip	Measurement not available yet
Unpacked distribution size	53.97 KiB
Published file count	19
Package type	Not declared
ES module entry	Not declared
Default entry	index.js
Side effects declaration	Not declared
Direct advisories	0
Resolved graph dependencies	196
Repository stars	542
Repository forks	148

Install @semantic-release/github 5.2.0

npm install @semantic-release/github@5.2.0
pnpm add @semantic-release/github@5.2.0
yarn add @semantic-release/github@5.2.0

Runtime dependencies

mime ^2.0.3
debug ^4.0.0
globby ^8.0.0
lodash ^4.17.4
p-retry ^2.0.0
dir-glob ^2.0.0
fs-extra ^7.0.0
p-filter ^1.0.0
url-join ^4.0.0
bottleneck ^2.0.1
issue-parser ^3.0.0
@octokit/rest ^15.2.0
aggregate-error ^1.0.0
http-proxy-agent ^2.1.0
parse-github-url ^1.0.1
https-proxy-agent ^2.2.1
@semantic-release/error ^2.2.0

Peer requirements

semantic-release >=15.8.0 <16.0.0

Optional dependencies

None declared

Resolved dependency graph

This deps.dev graph describes a generic 64-bit Linux environment, not your application lockfile.

@octokit/rest@15.18.3 — direct
@semantic-release/error@2.2.0 — direct
aggregate-error@1.0.0 — direct
bottleneck@2.19.5 — direct
debug@4.4.3 — direct
dir-glob@2.2.2 — direct
fs-extra@7.0.1 — direct
globby@8.0.2 — direct
http-proxy-agent@2.1.0 — direct
https-proxy-agent@2.2.4 — direct
issue-parser@3.0.1 — direct
lodash@4.18.1 — direct
mime@2.6.0 — direct
p-filter@1.0.0 — direct
p-retry@2.0.0 — direct
parse-github-url@1.0.4 — direct
url-join@4.0.1 — direct
before-after-hook@1.4.0 — indirect
btoa-lite@1.0.0 — indirect
debug@3.2.7 — indirect
node-fetch@2.7.0 — indirect
universal-user-agent@2.1.0 — indirect
url-template@2.0.8 — indirect
clean-stack@1.3.0 — indirect
indent-string@3.2.0 — indirect
ms@2.1.3 — indirect
path-type@3.0.0 — indirect
graceful-fs@4.2.11 — indirect
jsonfile@4.0.0 — indirect
universalify@0.1.2 — indirect
array-union@1.0.2 — indirect
dir-glob@2.0.0 — indirect
fast-glob@2.2.7 — indirect
glob@7.2.3 — indirect
ignore@3.3.10 — indirect
pify@3.0.0 — indirect
slash@1.0.0 — indirect
agent-base@4.3.0 — indirect
debug@3.1.0 — indirect
debug@3.2.7 — indirect
lodash.capitalize@4.2.1 — indirect
lodash.escaperegexp@4.1.2 — indirect
lodash.isplainobject@4.0.6 — indirect
lodash.isstring@4.0.1 — indirect
lodash.uniqby@4.7.0 — indirect
p-map@1.2.0 — indirect
retry@0.12.0 — indirect
whatwg-url@5.0.0 — indirect
os-name@3.1.0 — indirect
array-uniq@1.0.3 — indirect
arrify@1.0.1 — indirect
@mrmlnc/readdir-enhanced@2.2.1 — indirect
@nodelib/fs.stat@1.1.3 — indirect
glob-parent@3.1.0 — indirect
is-glob@4.0.3 — indirect
merge2@1.4.1 — indirect
micromatch@3.1.10 — indirect
fs.realpath@1.0.0 — indirect
inflight@1.0.6 — indirect
inherits@2.0.4 — indirect
minimatch@3.1.5 — indirect
once@1.4.0 — indirect
path-is-absolute@1.0.1 — indirect
es6-promisify@5.0.0 — indirect
ms@2.0.0 — indirect
tr46@0.0.3 — indirect
webidl-conversions@3.0.1 — indirect
macos-release@2.5.1 — indirect
windows-release@3.3.3 — indirect
call-me-maybe@1.0.2 — indirect
glob-to-regexp@0.3.0 — indirect
is-glob@3.1.0 — indirect
path-dirname@1.0.2 — indirect
is-extglob@2.1.1 — indirect
arr-diff@4.0.0 — indirect
array-unique@0.3.2 — indirect
braces@2.3.2 — indirect
define-property@2.0.2 — indirect
extend-shallow@3.0.2 — indirect
extglob@2.0.4 — indirect
fragment-cache@0.2.1 — indirect
kind-of@6.0.3 — indirect
nanomatch@1.2.13 — indirect
object.pick@1.3.0 — indirect
regex-not@1.0.2 — indirect
snapdragon@0.8.2 — indirect
to-regex@3.0.2 — indirect
wrappy@1.0.2 — indirect
brace-expansion@1.1.21 — indirect
es6-promise@4.2.8 — indirect
execa@1.0.0 — indirect
arr-flatten@1.1.0 — indirect
extend-shallow@2.0.1 — indirect
fill-range@4.0.0 — indirect
isobject@3.0.1 — indirect
repeat-element@1.1.4 — indirect
snapdragon-node@2.1.1 — indirect
split-string@3.1.0 — indirect
is-descriptor@1.0.4 — indirect
assign-symbols@1.0.0 — indirect
is-extendable@1.0.1 — indirect
define-property@1.0.0 — indirect
expand-brackets@2.1.4 — indirect
extend-shallow@2.0.1 — indirect
map-cache@0.2.2 — indirect
is-windows@1.0.2 — indirect
safe-regex@1.1.0 — indirect
base@0.11.2 — indirect
debug@2.6.9 — indirect
define-property@0.2.5 — indirect
extend-shallow@2.0.1 — indirect
source-map@0.5.7 — indirect
source-map-resolve@0.5.3 — indirect
use@3.1.1 — indirect
balanced-match@1.0.2 — indirect
concat-map@0.0.1 — indirect
cross-spawn@6.0.6 — indirect
get-stream@4.1.0 — indirect
is-stream@1.1.0 — indirect
npm-run-path@2.0.2 — indirect
p-finally@1.0.0 — indirect
signal-exit@3.0.7 — indirect
strip-eof@1.0.0 — indirect
is-extendable@0.1.1 — indirect
extend-shallow@2.0.1 — indirect
is-number@3.0.0 — indirect
repeat-string@1.6.1 — indirect
to-regex-range@2.1.1 — indirect
define-property@1.0.0 — indirect
snapdragon-util@3.0.1 — indirect
is-accessor-descriptor@1.0.2 — indirect
is-data-descriptor@1.0.1 — indirect
is-plain-object@2.0.4 — indirect
is-descriptor@1.0.4 — indirect
debug@2.6.9 — indirect
define-property@0.2.5 — indirect
extend-shallow@2.0.1 — indirect
posix-character-classes@0.1.1 — indirect
ret@0.1.15 — indirect
cache-base@1.0.1 — indirect
class-utils@0.3.6 — indirect
component-emitter@1.3.1 — indirect
define-property@1.0.0 — indirect
mixin-deep@1.3.2 — indirect
pascalcase@0.1.1 — indirect
ms@2.0.0 — indirect
is-descriptor@0.1.8 — indirect
atob@2.1.2 — indirect
decode-uri-component@0.2.2 — indirect
resolve-url@0.2.1 — indirect
source-map-url@0.4.1 — indirect
urix@0.1.0 — indirect
nice-try@1.0.5 — indirect
path-key@2.0.1 — indirect
semver@5.7.2 — indirect
shebang-command@1.2.0 — indirect
which@1.3.1 — indirect
pump@3.0.4 — indirect
kind-of@3.2.2 — indirect
is-descriptor@1.0.4 — indirect
kind-of@3.2.2 — indirect
hasown@2.0.4 — indirect
ms@2.0.0 — indirect
collection-visit@1.0.0 — indirect
get-value@2.0.6 — indirect
has-value@1.0.0 — indirect
set-value@2.0.1 — indirect
to-object-path@0.3.0 — indirect
union-value@1.0.1 — indirect
unset-value@1.0.0 — indirect
arr-union@3.1.0 — indirect
define-property@0.2.5 — indirect
static-extend@0.1.2 — indirect
is-descriptor@1.0.4 — indirect
for-in@1.0.2 — indirect
is-extendable@1.0.1 — indirect
shebang-regex@1.0.0 — indirect
isexe@2.0.0 — indirect
end-of-stream@1.4.5 — indirect
is-buffer@1.1.6 — indirect
function-bind@1.1.2 — indirect
map-visit@1.0.0 — indirect
object-visit@1.0.1 — indirect
has-values@1.0.0 — indirect
extend-shallow@2.0.1 — indirect
kind-of@3.2.2 — indirect
has-value@0.3.1 — indirect
define-property@0.2.5 — indirect
object-copy@0.1.0 — indirect
kind-of@4.0.0 — indirect
has-values@0.1.4 — indirect
isobject@2.1.0 — indirect
copy-descriptor@0.1.1 — indirect
define-property@0.2.5 — indirect
kind-of@3.2.2 — indirect
isarray@1.0.0 — indirect

How to interpret the specifications

Bundlephobia measurements use its standard package build and may exclude peer dependencies. Unpacked npm distribution size includes shipped files and is a different measurement. Module declarations do not prove tree-shaking or runtime compatibility.

Advisories apply to this package version directly; transitive dependencies need separate inspection. Repository signals describe the whole repository and are current observations, including on historical-version pages.

OpenSSF repository checks

Provider assessment: 2026-08-24T00:00:00Z. These are repository checks, not a jsL maintenance score.

Code-Review	5/10 — Found 1/2 approved changesets -- score normalized to 5
Maintained	10/10 — 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	10/10 — no dangerous workflow patterns detected
Binary-Artifacts	10/10 — no binaries found in the repo
Token-Permissions	0/10 — detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	6/10 — dependency not pinned by hash detected -- score normalized to 6
CII-Best-Practices	0/10 — no effort to earn an OpenSSF best practices badge detected
Fuzzing	0/10 — project is not fuzzed
License	10/10 — license file detected
Security-Policy	10/10 — security policy file detected
Packaging	10/10 — packaging workflow detected
SAST	0/10 — SAST tool is not run on all commits -- score normalized to 0

Evidence and freshness

https://registry.npmjs.org/%40semantic-release%2Fgithub/5.2.0 — retrieved 2026-10-29T11:47:27.025Z
https://api.deps.dev/v3/projects/github.com%2Fsemantic-release%2Fgithub — retrieved 2026-10-29T10:33:20.902Z
https://api.deps.dev/v3/systems/npm/packages/%40semantic-release%2Fgithub/versions/5.2.0 — retrieved 2026-10-29T11:47:27.606Z
https://api.deps.dev/v3/systems/npm/packages/%40semantic-release%2Fgithub/versions/5.2.0:dependencies — retrieved 2026-10-29T11:47:27.631Z