semantic-release

Automated semver compliant package publishing

semantic-release@25.0.9 was published on 2026-08-05. Its manifest declares 28 runtime dependencies and 0 peer requirements. Type declarations are bundled according to the package metadata. The declared Node.js requirement is ^22.14.0 || >= 24.10.0.

All semantic-release versions · Permanent reference to 25.0.9

Package specifications

Version	25.0.9
License declaration	MIT
Published	2026-08-05T04:43:52.217Z
Node.js requirement	^22.14.0 \|\| >= 24.10.0
Type declarations	Bundled declarations
Runtime dependency count	28
Peer requirement count	0
Optional dependency count	0
Minified size	Measurement not available yet
Minified + gzip	Measurement not available yet
Unpacked distribution size	125.34 KiB
Published file count	31
Package type	module
ES module entry	Not declared
Default entry	./index.js
Side effects declaration	Not declared
Direct advisories	0
Resolved graph dependencies	438
Repository stars	24125
Repository forks	1805

Install semantic-release 25.0.9

npm install semantic-release@25.0.9
pnpm add semantic-release@25.0.9
yarn add semantic-release@25.0.9

Runtime dependencies

debug ^4.0.0
execa ^9.0.0
yargs ^18.0.0
env-ci ^11.0.0
marked ^15.0.0
semver ^7.3.2
figures ^6.0.0
signale ^1.2.1
hook-std ^4.0.0
p-reduce ^3.0.0
lodash-es ^4.17.21
get-stream ^6.0.0
micromatch ^4.0.2
cosmiconfig ^9.0.0
resolve-from ^5.0.0
find-versions ^6.0.0
p-each-series ^3.0.0
git-log-parser ^1.2.0
aggregate-error ^5.0.0
hosted-git-info ^9.0.0
import-from-esm ^2.0.0
marked-terminal ^7.3.0
read-package-up ^12.0.0
@semantic-release/npm ^13.1.1
@semantic-release/error ^4.0.0
@semantic-release/github ^12.0.0
@semantic-release/commit-analyzer ^13.0.1
@semantic-release/release-notes-generator ^14.1.0

Peer requirements

None declared

Optional dependencies

None declared

Resolved dependency graph

This deps.dev graph describes a generic 64-bit Linux environment, not your application lockfile.

@semantic-release/commit-analyzer@13.0.1 — direct
@semantic-release/error@4.0.0 — direct
@semantic-release/github@12.0.10 — direct
@semantic-release/npm@13.2.0 — direct
@semantic-release/release-notes-generator@14.1.1 — direct
aggregate-error@5.1.0 — direct
cosmiconfig@9.0.2 — direct
debug@4.4.3 — direct
env-ci@11.2.0 — direct
execa@9.6.1 — direct
figures@6.1.0 — direct
find-versions@6.0.0 — direct
get-stream@6.0.1 — direct
git-log-parser@1.2.1 — direct
hook-std@4.0.0 — direct
hosted-git-info@9.0.3 — direct
import-from-esm@2.0.0 — direct
lodash-es@4.18.1 — direct
marked@15.0.12 — direct
marked-terminal@7.3.0 — direct
micromatch@4.0.8 — direct
p-each-series@3.0.0 — direct
p-reduce@3.0.0 — direct
read-package-up@12.0.0 — direct
resolve-from@5.0.0 — direct
semver@7.8.5 — direct
signale@1.4.0 — direct
yargs@18.2.0 — direct
conventional-changelog-angular@8.3.1 — indirect
conventional-changelog-writer@8.4.0 — indirect
conventional-commits-filter@5.0.0 — indirect
conventional-commits-parser@6.4.0 — indirect
@octokit/core@7.0.8 — indirect
@octokit/plugin-paginate-rest@15.0.0 — indirect
@octokit/plugin-retry@8.1.1 — indirect
@octokit/plugin-throttling@11.0.5 — indirect
dir-glob@3.0.1 — indirect
http-proxy-agent@9.1.0 — indirect
https-proxy-agent@9.1.0 — indirect
issue-parser@7.0.2 — indirect
mime@4.1.2 — indirect
p-filter@4.1.0 — indirect
tinyglobby@0.2.17 — indirect
undici@7.30.1 — indirect
url-join@5.2.0 — indirect
@actions/core@3.0.1 — indirect
fs-extra@11.4.1 — indirect
nerf-dart@1.0.0 — indirect
normalize-url@9.0.1 — indirect
npm@11.21.1 — indirect
rc@1.2.8 — indirect
read-pkg@10.1.0 — indirect
registry-auth-token@5.1.1 — indirect
tempy@3.2.0 — indirect
read-package-up@11.0.0 — indirect
clean-stack@5.3.0 — indirect
indent-string@5.0.0 — indirect
env-paths@2.2.1 — indirect
import-fresh@3.3.1 — indirect
js-yaml@4.3.2 — indirect
parse-json@5.2.0 — indirect
ms@2.1.3 — indirect
execa@8.0.1 — indirect
java-properties@1.0.2 — indirect
@sindresorhus/merge-streams@4.0.0 — indirect
cross-spawn@7.0.6 — indirect
get-stream@9.0.1 — indirect
human-signals@8.0.1 — indirect
is-plain-obj@4.1.0 — indirect
is-stream@4.0.1 — indirect
npm-run-path@6.0.0 — indirect
pretty-ms@9.3.1 — indirect
signal-exit@4.1.0 — indirect
strip-final-newline@4.0.0 — indirect
yoctocolors@2.2.0 — indirect
is-unicode-supported@2.1.0 — indirect
semver-regex@4.0.5 — indirect
super-regex@1.1.0 — indirect
argv-formatter@1.0.0 — indirect
spawn-error-forwarder@1.0.0 — indirect
split2@1.0.0 — indirect
stream-combiner2@1.1.1 — indirect
through2@2.0.5 — indirect
traverse@0.6.8 — indirect
lru-cache@11.5.3 — indirect
import-meta-resolve@4.2.0 — indirect
ansi-escapes@7.3.0 — indirect
ansi-regex@6.4.0 — indirect
chalk@5.6.2 — indirect
cli-highlight@2.1.11 — indirect
cli-table3@0.6.5 — indirect
node-emoji@2.2.0 — indirect
supports-hyperlinks@3.2.0 — indirect
braces@3.0.3 — indirect
picomatch@2.3.2 — indirect
find-up-simple@1.0.1 — indirect
type-fest@5.10.0 — indirect
chalk@2.4.2 — indirect
figures@2.0.0 — indirect
pkg-conf@2.1.0 — indirect
cliui@9.0.1 — indirect
escalade@3.2.0 — indirect
get-caller-file@2.0.5 — indirect
string-width@8.3.0 — indirect
y18n@5.0.8 — indirect
yargs-parser@22.0.0 — indirect
compare-func@2.0.0 — indirect
@simple-libs/stream-utils@1.2.0 — indirect
handlebars@4.7.10 — indirect
meow@13.2.0 — indirect
@octokit/auth-token@6.0.0 — indirect
@octokit/graphql@9.0.5 — indirect
@octokit/request@10.0.16 — indirect
@octokit/request-error@7.1.2 — indirect
@octokit/types@18.0.0 — indirect
before-after-hook@4.0.0 — indirect
universal-user-agent@7.0.3 — indirect
@octokit/types@17.0.0 — indirect
@octokit/types@17.0.0 — indirect
bottleneck@2.19.5 — indirect
@octokit/types@17.0.0 — indirect
path-type@4.0.0 — indirect
agent-base@9.0.0 — indirect
proxy-agent-negotiate@1.1.0 — indirect
lodash.capitalize@4.2.1 — indirect
lodash.escaperegexp@4.1.2 — indirect
lodash.isplainobject@4.0.6 — indirect
lodash.isstring@4.0.1 — indirect
lodash.uniqby@4.7.0 — indirect
p-map@7.1.1 — indirect
fdir@6.5.0 — indirect
picomatch@4.0.7 — indirect
@actions/exec@3.0.0 — indirect
@actions/http-client@4.0.1 — indirect
graceful-fs@4.2.11 — indirect
jsonfile@6.2.1 — indirect
universalify@2.0.1 — indirect
npm>11.21.1>@isaacs/string-locale-compare@1.1.0 — indirect
npm>11.21.1>@npmcli/arborist@9.9.3 — indirect
npm>11.21.1>@npmcli/config@10.14.0 — indirect
npm>11.21.1>@npmcli/fs@5.0.0 — indirect
npm>11.21.1>@npmcli/map-workspaces@5.0.3 — indirect
npm>11.21.1>@npmcli/metavuln-calculator@9.0.3 — indirect
npm>11.21.1>@npmcli/package-json@7.0.5 — indirect
npm>11.21.1>@npmcli/promise-spawn@9.0.1 — indirect
npm>11.21.1>@npmcli/redact@4.0.0 — indirect
npm>11.21.1>@npmcli/run-script@10.0.4 — indirect
npm>11.21.1>@sigstore/tuf@4.0.2 — indirect
npm>11.21.1>abbrev@4.0.0 — indirect
npm>11.21.1>archy@1.0.0 — indirect
npm>11.21.1>cacache@20.0.4 — indirect
npm>11.21.1>chalk@5.6.2 — indirect
npm>11.21.1>ci-info@4.4.0 — indirect
npm>11.21.1>fastest-levenshtein@1.0.16 — indirect
npm>11.21.1>fs-minipass@3.0.3 — indirect
npm>11.21.1>glob@13.0.6 — indirect
npm>11.21.1>graceful-fs@4.2.11 — indirect
npm>11.21.1>hosted-git-info@9.0.3 — indirect
npm>11.21.1>ini@6.0.0 — indirect
npm>11.21.1>init-package-json@8.2.5 — indirect
npm>11.21.1>is-cidr@6.0.4 — indirect
npm>11.21.1>json-parse-even-better-errors@5.0.0 — indirect
npm>11.21.1>libnpmaccess@10.0.3 — indirect
npm>11.21.1>libnpmdiff@8.1.14 — indirect
npm>11.21.1>libnpmexec@10.3.4 — indirect
npm>11.21.1>libnpmfund@7.0.28 — indirect
npm>11.21.1>libnpmorg@8.0.1 — indirect
npm>11.21.1>libnpmpack@9.1.15 — indirect
npm>11.21.1>libnpmpublish@11.2.1 — indirect
npm>11.21.1>libnpmsearch@9.0.1 — indirect
npm>11.21.1>libnpmteam@8.0.2 — indirect
npm>11.21.1>libnpmversion@8.0.4 — indirect
npm>11.21.1>make-fetch-happen@15.0.6 — indirect
npm>11.21.1>minimatch@10.2.5 — indirect
npm>11.21.1>minipass@7.1.3 — indirect
npm>11.21.1>minipass-pipeline@1.2.4 — indirect
npm>11.21.1>ms@2.1.3 — indirect
npm>11.21.1>node-gyp@12.4.0 — indirect
npm>11.21.1>nopt@9.0.0 — indirect
npm>11.21.1>npm-audit-report@7.0.0 — indirect
npm>11.21.1>npm-install-checks@8.0.0 — indirect
npm>11.21.1>npm-package-arg@13.0.2 — indirect
npm>11.21.1>npm-pick-manifest@11.0.3 — indirect
npm>11.21.1>npm-profile@12.0.2 — indirect
npm>11.21.1>npm-registry-fetch@19.1.1 — indirect
npm>11.21.1>npm-user-validate@4.0.0 — indirect
npm>11.21.1>p-map@7.0.4 — indirect
npm>11.21.1>pacote@21.5.1 — indirect
npm>11.21.1>parse-conflict-json@5.0.1 — indirect
npm>11.21.1>proc-log@6.1.0 — indirect
npm>11.21.1>qrcode-terminal@0.12.0 — indirect
npm>11.21.1>read@5.0.1 — indirect
npm>11.21.1>semver@7.8.5 — indirect
npm>11.21.1>spdx-expression-parse@4.0.0 — indirect
npm>11.21.1>ssri@13.0.1 — indirect
npm>11.21.1>supports-color@10.2.2 — indirect
npm>11.21.1>tar@7.5.22 — indirect
npm>11.21.1>text-table@0.2.0 — indirect
npm>11.21.1>tiny-relative-date@2.0.2 — indirect
npm>11.21.1>treeverse@3.0.0 — indirect
npm>11.21.1>validate-npm-package-name@7.0.2 — indirect
npm>11.21.1>which@6.0.1 — indirect
deep-extend@0.6.0 — indirect
ini@1.3.8 — indirect
minimist@1.2.8 — indirect
strip-json-comments@2.0.1 — indirect
@types/normalize-package-data@2.4.4 — indirect
normalize-package-data@8.0.0 — indirect
parse-json@8.3.0 — indirect
unicorn-magic@0.4.1 — indirect
@pnpm/npm-conf@3.0.3 — indirect
is-stream@3.0.0 — indirect
temp-dir@3.0.0 — indirect
type-fest@2.19.0 — indirect
unique-string@3.0.0 — indirect
read-pkg@9.0.1 — indirect
type-fest@4.41.0 — indirect
escape-string-regexp@5.0.0 — indirect
parent-module@1.0.1 — indirect
resolve-from@4.0.0 — indirect
argparse@2.0.1 — indirect
@babel/code-frame@7.29.7 — indirect
error-ex@1.3.4 — indirect
json-parse-even-better-errors@2.3.1 — indirect
lines-and-columns@1.2.4 — indirect
get-stream@8.0.1 — indirect
human-signals@5.0.0 — indirect
merge-stream@2.0.0 — indirect
npm-run-path@5.3.0 — indirect
onetime@6.0.0 — indirect
strip-final-newline@3.0.0 — indirect
path-key@3.1.1 — indirect
shebang-command@2.0.0 — indirect
which@2.0.2 — indirect
@sec-ant/readable-stream@0.4.1 — indirect
path-key@4.0.0 — indirect
unicorn-magic@0.3.0 — indirect
parse-ms@4.0.0 — indirect
function-timeout@1.0.2 — indirect
make-asynchronous@1.1.0 — indirect
time-span@5.1.0 — indirect
duplexer2@0.1.4 — indirect
readable-stream@2.3.8 — indirect
xtend@4.0.2 — indirect
environment@1.1.0 — indirect
chalk@4.1.2 — indirect
highlight.js@10.7.3 — indirect
mz@2.7.0 — indirect
parse5@5.1.1 — indirect
parse5-htmlparser2-tree-adapter@6.0.1 — indirect
yargs@16.2.2 — indirect
@colors/colors@1.5.0 — indirect
string-width@4.2.3 — indirect
@sindresorhus/is@4.6.0 — indirect
char-regex@1.0.2 — indirect
emojilib@2.4.0 — indirect
skin-tone@2.0.0 — indirect
has-flag@4.0.0 — indirect
supports-color@7.2.0 — indirect
fill-range@7.1.1 — indirect
tagged-tag@1.0.0 — indirect
ansi-styles@3.2.1 — indirect
escape-string-regexp@1.0.5 — indirect
supports-color@5.5.0 — indirect
find-up@2.1.0 — indirect
load-json-file@4.0.0 — indirect
string-width@7.2.0 — indirect
strip-ansi@7.2.0 — indirect
wrap-ansi@9.0.2 — indirect
get-east-asian-width@1.7.0 — indirect
array-ify@1.0.0 — indirect
dot-prop@5.3.0 — indirect
neo-async@2.6.2 — indirect
source-map@0.6.1 — indirect
uglify-js@3.19.3 — indirect
wordwrap@1.0.0 — indirect
@octokit/endpoint@11.0.5 — indirect
content-type@3.1.1 — indirect
json-with-bigint@3.5.12 — indirect
@octokit/openapi-types@29.0.1 — indirect
@octokit/openapi-types@28.0.0 — indirect
@octokit/openapi-types@28.0.0 — indirect
@octokit/openapi-types@28.0.0 — indirect
@actions/io@3.0.2 — indirect
tunnel@0.0.6 — indirect
undici@6.29.1 — indirect
npm>11.21.1>@gar/promise-retry@1.0.3 — indirect
npm>11.21.1>@npmcli/installed-package-contents@4.0.0 — indirect
npm>11.21.1>@npmcli/name-from-folder@4.0.0 — indirect
npm>11.21.1>@npmcli/node-gyp@5.0.0 — indirect
npm>11.21.1>@npmcli/query@5.0.0 — indirect
npm>11.21.1>bin-links@6.0.2 — indirect
npm>11.21.1>common-ancestor-path@2.0.0 — indirect
npm>11.21.1>json-stringify-nice@1.1.4 — indirect
npm>11.21.1>lru-cache@11.5.1 — indirect
npm>11.21.1>proggy@4.0.0 — indirect
npm>11.21.1>promise-all-reject-late@1.0.1 — indirect
npm>11.21.1>promise-call-limit@3.0.2 — indirect
npm>11.21.1>walk-up-path@4.0.0 — indirect
npm>11.21.1>@npmcli/git@7.0.2 — indirect
npm>11.21.1>@sigstore/protobuf-specs@0.5.1 — indirect
npm>11.21.1>tuf-js@4.1.0 — indirect
npm>11.21.1>minipass-collect@2.0.1 — indirect
npm>11.21.1>minipass-flush@1.0.6 — indirect
npm>11.21.1>path-scurry@2.0.2 — indirect
npm>11.21.1>promzard@3.0.1 — indirect
npm>11.21.1>cidr-regex@5.0.5 — indirect
npm>11.21.1>binary-extensions@3.1.0 — indirect
npm>11.21.1>diff@8.0.4 — indirect
npm>11.21.1>signal-exit@4.1.0 — indirect
npm>11.21.1>aproba@2.1.0 — indirect
npm>11.21.1>sigstore@4.1.1 — indirect
npm>11.21.1>@npmcli/agent@4.0.2 — indirect
npm>11.21.1>http-cache-semantics@4.3.0 — indirect
npm>11.21.1>minipass-fetch@5.0.2 — indirect
npm>11.21.1>negotiator@1.0.0 — indirect
npm>11.21.1>brace-expansion@5.0.12 — indirect
npm>11.21.1>minipass-pipeline>minipass@3.3.6 — indirect
npm>11.21.1>env-paths@2.2.1 — indirect
npm>11.21.1>exponential-backoff@3.1.3 — indirect
npm>11.21.1>tinyglobby@0.2.17 — indirect
npm>11.21.1>undici@6.29.0 — indirect
npm>11.21.1>npm-normalize-package-bin@5.0.0 — indirect
npm>11.21.1>jsonparse@1.3.1 — indirect
npm>11.21.1>minizlib@3.1.0 — indirect
npm>11.21.1>npm-packlist@10.0.4 — indirect
npm>11.21.1>just-diff@6.0.2 — indirect
npm>11.21.1>just-diff-apply@5.5.0 — indirect
npm>11.21.1>mute-stream@3.0.0 — indirect
npm>11.21.1>spdx-exceptions@2.5.0 — indirect
npm>11.21.1>spdx-license-ids@3.0.23 — indirect
npm>11.21.1>@isaacs/fs-minipass@4.0.1 — indirect
npm>11.21.1>chownr@3.0.0 — indirect
npm>11.21.1>yallist@5.0.0 — indirect
npm>11.21.1>isexe@4.0.0 — indirect
validate-npm-package-license@3.0.4 — indirect
index-to-position@1.2.0 — indirect
type-fest@4.41.0 — indirect
@pnpm/config.env-replace@1.1.0 — indirect
@pnpm/network.ca-file@1.0.2 — indirect
config-chain@1.1.13 — indirect
crypto-random-string@4.0.0 — indirect
normalize-package-data@6.0.2 — indirect
unicorn-magic@0.1.0 — indirect
callsites@3.1.0 — indirect
@babel/helper-validator-identifier@7.29.7 — indirect
js-tokens@4.0.0 — indirect
picocolors@1.1.1 — indirect
is-arrayish@0.2.1 — indirect
path-key@4.0.0 — indirect
mimic-fn@4.0.0 — indirect
shebang-regex@3.0.0 — indirect
isexe@2.0.0 — indirect
p-event@6.0.1 — indirect
type-fest@4.41.0 — indirect
web-worker@1.5.0 — indirect
convert-hrtime@5.0.0 — indirect
core-util-is@1.0.3 — indirect
inherits@2.0.4 — indirect
isarray@1.0.0 — indirect
process-nextick-args@2.0.1 — indirect
safe-buffer@5.1.2 — indirect
string_decoder@1.1.1 — indirect
util-deprecate@1.0.2 — indirect
ansi-styles@4.3.0 — indirect
any-promise@1.3.0 — indirect
object-assign@4.1.1 — indirect
thenify-all@1.6.0 — indirect
parse5@6.0.1 — indirect
cliui@7.0.4 — indirect
require-directory@2.1.1 — indirect
yargs-parser@20.2.9 — indirect
emoji-regex@8.0.0 — indirect
is-fullwidth-code-point@3.0.0 — indirect
strip-ansi@6.0.1 — indirect
unicode-emoji-modifier-base@1.0.0 — indirect
to-regex-range@5.0.1 — indirect
color-convert@1.9.3 — indirect
has-flag@3.0.0 — indirect
locate-path@2.0.0 — indirect
parse-json@4.0.0 — indirect
pify@3.0.0 — indirect
strip-bom@3.0.0 — indirect
emoji-regex@10.6.0 — indirect
ansi-styles@6.2.3 — indirect
string-width@7.2.0 — indirect
is-obj@2.0.0 — indirect
npm>11.21.1>npm-bundled@5.0.0 — indirect
npm>11.21.1>postcss-selector-parser@7.1.6 — indirect
npm>11.21.1>cmd-shim@8.0.0 — indirect
npm>11.21.1>read-cmd-shim@6.0.0 — indirect
npm>11.21.1>write-file-atomic@7.0.1 — indirect
npm>11.21.1>@tufjs/models@4.1.0 — indirect
npm>11.21.1>debug@4.4.3 — indirect
npm>11.21.1>@sigstore/bundle@4.0.0 — indirect
npm>11.21.1>@sigstore/core@3.2.1 — indirect
npm>11.21.1>@sigstore/sign@4.1.1 — indirect
npm>11.21.1>@sigstore/verify@3.1.1 — indirect
npm>11.21.1>agent-base@7.1.4 — indirect
npm>11.21.1>http-proxy-agent@7.0.2 — indirect
npm>11.21.1>https-proxy-agent@7.0.6 — indirect
npm>11.21.1>socks-proxy-agent@8.0.5 — indirect
npm>11.21.1>iconv-lite@0.7.2 — indirect
npm>11.21.1>minipass-sized@2.0.0 — indirect
npm>11.21.1>balanced-match@4.0.4 — indirect
npm>11.21.1>minipass-pipeline>yallist@4.0.0 — indirect
npm>11.21.1>tinyglobby>fdir@6.5.0 — indirect
npm>11.21.1>tinyglobby>picomatch@4.0.4 — indirect
npm>11.21.1>ignore-walk@8.0.0 — indirect
spdx-correct@3.2.0 — indirect
spdx-expression-parse@3.0.1 — indirect
graceful-fs@4.2.10 — indirect
proto-list@1.2.4 — indirect
type-fest@1.4.0 — indirect
hosted-git-info@7.0.2 — indirect
p-timeout@6.1.4 — indirect
color-convert@2.0.1 — indirect
thenify@3.3.1 — indirect
wrap-ansi@7.0.0 — indirect
ansi-regex@5.0.1 — indirect
is-number@7.0.0 — indirect
color-name@1.1.3 — indirect
p-locate@2.0.0 — indirect
path-exists@3.0.0 — indirect
json-parse-better-errors@1.0.2 — indirect
npm>11.21.1>cssesc@3.0.0 — indirect
npm>11.21.1>util-deprecate@1.0.2 — indirect
npm>11.21.1>@tufjs/canonical-json@2.0.0 — indirect
npm>11.21.1>socks@2.8.9 — indirect
npm>11.21.1>safer-buffer@2.1.2 — indirect
spdx-license-ids@3.0.24 — indirect
spdx-exceptions@2.5.0 — indirect
lru-cache@10.4.3 — indirect
color-name@1.1.4 — indirect
p-limit@1.3.0 — indirect
npm>11.21.1>ip-address@10.7.2 — indirect
npm>11.21.1>smart-buffer@4.2.0 — indirect
p-try@1.0.0 — indirect

How to interpret the specifications

Bundlephobia measurements use its standard package build and may exclude peer dependencies. Unpacked npm distribution size includes shipped files and is a different measurement. Module declarations do not prove tree-shaking or runtime compatibility.

Advisories apply to this package version directly; transitive dependencies need separate inspection. Repository signals describe the whole repository and are current observations, including on historical-version pages.

OpenSSF repository checks

Provider assessment: 2026-08-24T00:00:00Z. These are repository checks, not a jsL maintenance score.

Maintained	10/10 — 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Code-Review	10/10 — all changesets reviewed
Dangerous-Workflow	10/10 — no dangerous workflow patterns detected
Binary-Artifacts	10/10 — no binaries found in the repo
Token-Permissions	10/10 — GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	4/10 — dependency not pinned by hash detected -- score normalized to 4
CII-Best-Practices	0/10 — no effort to earn an OpenSSF best practices badge detected
License	10/10 — license file detected
Fuzzing	0/10 — project is not fuzzed
Security-Policy	10/10 — security policy file detected
Branch-Protection	5/10 — branch protection is not maximal on development and all release branches
Packaging	10/10 — packaging workflow detected
SAST	9/10 — SAST tool is not run on all commits -- score normalized to 9

Evidence and freshness

https://registry.npmjs.org/semantic-release/25.0.9 — retrieved 2026-10-29T08:18:26.770Z (stale snapshot; refresh pending)
https://api.deps.dev/v3/projects/github.com%2Fsemantic-release%2Fsemantic-release — retrieved 2026-10-29T08:18:27.396Z
https://api.deps.dev/v3/systems/npm/packages/semantic-release/versions/25.0.9 — retrieved 2026-10-29T09:02:38.016Z
https://api.deps.dev/v3/systems/npm/packages/semantic-release/versions/25.0.9:dependencies — retrieved 2026-10-29T09:02:38.073Z