chore(deps): bump changesets/action from 1 to 2

[dependabot]

Bumps changesets/action from 1 to 2.

Release notes

Sourced from changesets/action's releases.

v2.0.0

Major Changes

• #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

  Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

  Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

• #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

  If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

• #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

• #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

  Inputs:

  • version -> version-script
  • publish -> publish-script
  • commit -> commit-message
  • title -> pr-title
  • branch -> pr-base-branch

  Outputs:

  • pull-request-number -> pr-number

• #674 164652b Thanks @​bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.

• #659 5649ff4 Thanks @​bluwy! - Remove cwd option for changesets/action. Use the step working-directory option instead to change the directory.

• #673 823cf74 Thanks @​bluwy! - Update to Changesets v3 packages

• #695 469993c Thanks @​bluwy! - Removed .npmrc handling when the NPM_TOKEN environment variable is set.

  Authentication should be handled via Trusted Publishing instead. If a token is still needed, use actions/setup-node to set it up instead via the registry-url option. Check out the updated action README for more information of setting up npm authentication in GitHub Actions.

• #668 0eae789 Thanks @​bluwy! - Rename the input and output names to kebab-case instead of camelCase to match the official GitHub actions pattern

Minor Changes

• #656 a12d90d Thanks @​bluwy! - Add new /select-mode, /version, and /publish sub-actions to better control version and publish steps

• #678 f71ae04 Thanks @​Andarist! - Published packages detection done through stdout parsing was replaced with one based on the shared output file using CHANGESETS_OUTPUT environment variable. When using custom scripts this environment variable should always be passed down to the Changesets CLI invocations.

Patch Changes

• #699 5b307d3 Thanks @​Andarist! - Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to changesets/action@v1.

... (truncated)

Changelog

Sourced from changesets/action's changelog.

@​changesets/action

2.1.1

Patch Changes

• #721 da1ea29 Thanks @​KEBABSELLER6! - Fixed typo in renamed inputs from v1 to v2

2.1.0

Minor Changes

• #718 3b7c71c Thanks @​bluwy! - Add a cwd input to the root action, /select-mode, /version, /pack, and /publish sub-actions to set the current working directory to execute Changesets in. This input existed in v1 but was incorrectly removed.

Patch Changes

• #716 6f58ba3 Thanks @​bluwy! - Update pr-status message to link to the new faq page

2.0.0

Major Changes

• #692 cb3f011 Thanks @​Andarist! - Release commits and tags are now pushed using the GitHub API by default.

  Replace the commit-mode input with the boolean push-with-git-cli input. Set push-with-git-cli: true to continue using the Git CLI.

  Regardless of the push mode, custom GitHub tokens must be passed explicitly through the github-token input. The GITHUB_TOKEN environment variable and credentials configured by actions/checkout or embedded in remote URLs are not substitutes for this input. When the Git CLI is enabled, github-token takes precedence over those repository credentials.

• #680 ca57073 Thanks @​bluwy! - Add a new push-git-tags option that complements create-github-releases to control specifically if git tags should be created but not GitHub releases.

  If create-github-releases was previously set to false, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set push-git-tags to false explicitly.

• #657 4f718b5 Thanks @​Andarist! - Removed compatibility support for old Changesets v1.

• #681 7359107 Thanks @​bluwy! - Rename the root action inputs and outputs to better match the sub-actions' conventions.

  Inputs:

  • version -> version-script
  • publish -> publish-script
  • commit -> commit-message
  • title -> pr-title
  • branch -> pr-base-branch

  Outputs:

  • pull-request-number -> pr-number

• #674 164652b Thanks @​bluwy! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the github-token input instead.

... (truncated)

Commits

• 8488615 v2.1.1
• d7669c8 Version Packages (#722)
• da1ea29 Fix typo in renamed inputs (#721)
• 7545547 Version Packages (#719)
• 3043070 Prevent test warning annotations (#720)
• 3b7c71c Add back cwd input (#718)
• 6f58ba3 Update pr-status message links to new faq (#716)
• e52ce9e Version Packages (#715)
• 78fdc6b Exit pre mode (#714)
• 187a104 Update deps for stable (#709)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ This is a major version update. Please review carefully before merging.

[os-support-ai]

⛔ Blocking: this bump silently disables the release lane as written

Measured against changesets/action's action.yml on both tags, and this repo's .github/workflows/changeset-release.yml on main. v2 renamed every input this workflow passes, and none of the old names exist in v2:

workflow passes (v1 name)	exists in v2?	v2's name
version: pnpm changeset:version	no	version-script:
publish: pnpm changeset:publish	no	publish-script:
title: 'chore: release packages'	no	pr-title:
commit: 'chore: release packages'	no	commit-message:

GitHub does not fail a workflow for unknown with: keys — at most an "Unexpected input(s)" warning annotation. So merging this bump unchanged does not go red; it goes inert.

Concretely, with publish-script unset, hasPublishScript is false, and src/index.ts's switch resolves differently:

case !hasChangesets && !hasPublishScript:   → "no changesets found and no publish script" → nothing
case hasChangesets:                          → runVersion, with no version script

The lane keeps reporting success while publishing nothing and versioning nothing. Given #5442 (16 of 90 versioned releases already never reached npm), a silently inert release lane is the last thing this repo can afford.

To land this bump, the with: block must be renamed in the same PR:

- uses: changesets/action@v2
  with:
    version-script: pnpm changeset:version
    publish-script: pnpm changeset:publish
    pr-title: 'chore: release packages'
    commit-message: 'chore: release packages'

Two other axes checked, both clear

• npm auth is not affected. v2 deletes v1's ~/.npmrc-from-NPM_TOKEN block entirely (counter-probed: the same npmrc|NPM_TOKEN|_authToken|OIDC grep returns 10 hits on v1/src/index.ts and 0 across every v2 source file that exists — so the removal is a real reading, not a broken probe). It does not matter here: this workflow's actions/setup-node@v7 already sets registry-url: 'https://registry.npmjs.org' and the job passes NODE_AUTH_TOKEN, so setup-node writes the npmrc itself. v1's block was redundant for this repo, not load-bearing.
• Renamed outputs are unread. v2 also renames publishedPackages → published-packages, hasChangesets → has-changesets, pullRequestNumber → pr-number. This workflow reads none of them (grepped for outputs. — no hits), so nothing downstream breaks.

What this bump does not do

It does not fix #5442. The publish trigger is unchanged between v1 and v2 — the same four-case switch, still gated on .changeset/ being completely empty:

!hasChangesets && !hasPublishScript          → nothing
!hasChangesets && hasPublishScript           → publish
hasChangesets && !hasNonEmptyChangesets      → "All changesets are empty; not creating PR"
hasChangesets                                 → runVersion

So #5442 needs its own fix on its own merits, whichever way this PR goes.

Scope of this check: I compared the two action.yml input sets, the src/index.ts branch logic, and npmrc/auth handling across v2's source files. I did not audit run.ts for other behavioural differences, so treat this as "these three axes are settled", not "v2 is otherwise identical".

---

Generated by Claude Code

[github-actions]

⚠️ This is a major version update. Please review carefully before merging.

[os-zhuang]

⚠️ Cross-PR interaction: merging this would invalidate the safety argument of open PR #5774

Note from the domain:devx @ objectui seat (#5748). ⛔ Nothing on this PR has been touched — no label, no push, no state change. This is information for whoever merges it; the decision is not this seat's.

PR #5774 (fix(release): key the publish lane on npm presence, not on pending changesets, #5442, maintainer-ruled 2026-08-22) rewrites the same two steps this PR bumps, in .github/workflows/changeset-release.yml — Publish to npm and Refresh the version PR. So there is a merge conflict here whichever lands second, but the conflict is the mild half.

The part that is not mechanical

#5774 introduces a step that deletes the pending changeset files from the runner's working tree (161 of them today) in order to force changesets/action down its publish branch, because the action picks publish-vs-version from repository state rather than from an input. That step is only safe because of a property of v1 that was verified by reading changesets/action@v1's own source:

src/run.ts
  runPublish  (83–198): the only git operation is  git.pushTag(tagName)
  runVersion (273–440): git.prepareBranch(...)  and  git.pushChanges({branch, message})

runPublish never commits and never pushes a branch, so those deletions cannot reach main. That is a v1 reading. Under v2, if the dispatch table or runPublish's behaviour changed, the same step could commit or push the deletion of every pending changeset in the repository — and neither PR's diff would show it, because each is individually reasonable.

#5774's other two load-bearing claims are also v1 readings: the !hasChangesets && hasPublishScript → runPublish dispatch, and the lane job's deliberate mirror of readChangesetState.

Suggested order (a proposal, not an instruction — this is not my PR)

Whichever way round, the second one needs re-deriving rather than rebasing:

• This PR first → fix(release): key the publish lane on npm presence, not on pending changesets (#5442) #5774 must be re-derived against v2's source before it merges: the dispatch table re-read, the runPublish no-commit property re-verified, and the readChangesetState mirror re-checked against v2's @changesets/read.
• fix(release): key the publish lane on npm presence, not on pending changesets (#5442) #5774 first → this bump stops being routine. It would be changing the semantics of a publish lane whose correctness was just established against v1, so it deserves the same scrutiny fix(release): key the publish lane on npm presence, not on pending changesets (#5442) #5774 got, not a dependabot rubber-stamp.

Also worth knowing for whoever picks this up: #5775 (filed today) records that the lane job's mirror already understates what @changesets/read@1.0.0 actually ignores — dormant today, but it is the same class of "our copy of the action's behaviour drifted from the action" that a major bump makes live.

For the record on urgency: this repo's dependabot-auto-merge.yml allows only semver-patch/semver-minor to merge automatically and gives semver-major a review comment instead, so this PR is not at risk of landing on its own. Recorded so the interaction is visible rather than discovered afterwards.

---

Generated by Claude Code

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[os-zhuang]

Disposition recorded — closed by the maintainer 2026-08-23, mirroring objectstack#9208

Recording the reason on the PR so this is not re-litigated when Dependabot re-offers, per the precedent this follows. Closed at 07:59:25Z, not merged. ⛔ Nothing on this PR was changed by this seat.

The precedent

objectstack#9208 is the identical bump, closed 2026-08-19 on a maintainer decision quoted verbatim there as 「同意 9208」: do not upgrade, record the reason, and write the re-verification requirement next to the pin (objectstack#9916). objectstack's release.yml:316 is still changesets/action@v1 — measured, not recalled. objectui now matches.

The core of that reasoning transfers unchanged: the v1 pin encodes a safety property asserted against v1's source, and upgrading a safety pin you cannot verify replaces verification with hope — where the failure mode is a publish nobody asked for, visible on npm rather than in CI.

What this repo can add to that record — v2's own release notes answer several of the questions

objectstack's decision noted nobody had read v2's source (a compiled Action, its repository outside the reviewing session's scope). That is still true of the source — but v2.0.0's changelog is explicit about five changes that would each break this repo's workflow as written, and those need no source reading:

v2 change	what it does to changeset-release.yml
#681 + #668 — inputs renamed: version→version-script, publish→publish-script, commit→commit-message, title→pr-title, all kebab-case	This repo passes all four of the old names. Under v2 they are unknown inputs. The publish lane would silently stop publishing; the refresh lane would fall back to bare changeset version, which breaks the sync-quick-reference-release pin (objectui#5394).
#692 — release commits and tags are now pushed via the GitHub API by default (commit-mode replaced by push-with-git-cli)	Directly undercuts the property verified for PR #5774: "runPublish only does git.pushTag()" is a statement about the git-CLI path. An API push path has to be re-derived from scratch.
#674 — GITHUB_TOKEN environment variable no longer accepted; must use the github-token input	Both lanes here pass it through env:.
#695 — .npmrc handling removed when NPM_TOKEN is set	The publish lane's auth would change shape. (This repo does already set registry-url via actions/setup-node, so it is closest to being fine.)
#678 — published-package detection moved from stdout parsing to a CHANGESETS_OUTPUT file	Custom scripts must forward that env var; this repo uses pnpm changeset:publish.

One correction to a natural assumption, measured: v2.1.1's note "Validate that projects use Changesets CLI v3 and direct Changesets CLI v2 users to changesets/action@v1" does not apply as a blocker here — package.json pins @changesets/cli: ^3.0.0, resolved to 3.0.1 in the lockfile, and objectstack is on ^3.0.0 too. So the CLI generation is not the reason to stay on v1; the unverified safety property and the five breakages above are. Worth stating plainly so nobody later "fixes" this by pointing at the CLI version.

Deliberately NOT adding a dependabot.yml ignore

Same reasoning as objectstack#9208: ignore typically suppresses security updates for that dependency too, which is a bad trade for an action pinned to an older major. The weekly re-offer is cheap now that the answer is written down.

What a future upgrade must do

Not "merge this and see". In order: read v2's source for the dispatch table and the commit/push behaviour of the publish path; rename all four inputs; move GITHUB_TOKEN to the github-token input; re-verify that the refresh lane still cannot publish (its two denials are structural today and both are v1-shaped); and re-verify PR #5774's clear-step safety against the API push path. objectui has no equivalent of objectstack#9916 — the requirement written beside the pin — and that gap is being closed inside PR #5774, which is already rewriting that exact region and is what adds the second property.

Related: #5775 (the lane job's mirror of readChangesetState understates what the installed @changesets/read ignores) is the same class of drift and becomes live under any bump.

---

Generated by Claude Code