SavelevMatthew · SavelevMatthew · Mar 17, 2026 · Mar 17, 2026 · Mar 17, 2026 · Mar 17, 2026
diff --git a/.github/workflows/nodejs.packages.ci.yml b/.github/workflows/nodejs.packages.ci.yml
@@ -74,7 +74,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [ 18.x, 20.x, 22.x ]
+        node-version: [ 18.x, 20.x, 22.x, 24.x ]
         # See supported Node.js release schedule at https://nodejs.org/en/about/releases
 
     steps:

diff --git a/bin/publish.js b/bin/publish.js
@@ -31,6 +31,7 @@ publish(
                     { type: 'feat', section: '🦕 New features' },
                     { type: 'fix', section: '🐞 Bug fixes' },
                     { type: 'perf', section: '🚀 Performance increases' },
+                    { type: 'deps', section: '🌐Dependencies' },
                     { dependency: true, section: '🌐Dependencies' },
                 ],
                 breakingNoteKeywords: BREAKING_KEYWORDS,
@@ -42,6 +43,6 @@ publish(
             breakingNoteKeywords: BREAKING_KEYWORDS,
         }),
         builder,
-        npm({ provenance: true }),
+        npm({ provenance: true, trustedPublishing: true }),
     ]
 ).then(() => console.log('ALL DONE!'))
diff --git a/packages/commit-analyzer/package.json b/packages/commit-analyzer/package.json
@@ -28,7 +28,7 @@
     }
   },
   "peerDependencies": {
-    "mono-pub": "1.x"
+    "mono-pub": "^1.0.0 || ^2.0.0"
   },
   "devDependencies": {
     "@mono-pub/configs": "workspace:^",

diff --git a/packages/git/package.json b/packages/git/package.json
@@ -43,14 +43,14 @@
     }
   },
   "peerDependencies": {
-    "mono-pub": "1.x"
+    "mono-pub": "^1.0.0 || ^2.0.0"
   },
   "devDependencies": {
     "@mono-pub/configs": "workspace:^",
     "eslint": "^9.16.0",
     "fix-tsup-cjs": "^1.2.0",
     "mono-pub": "workspace:^",
-    "tmp": "^0.2.1",
+    "tmp": "^0.2.5",
     "tsup": "8.3.5",
     "typescript": "^5.0.4"
   },

diff --git a/packages/git/src/index.ts b/packages/git/src/index.ts
@@ -23,7 +23,7 @@ import type {
 
 class MonoPubGit implements MonoPubPlugin {
     name = name
-    readonly tagFormat = DEFAULT_TAG_FORMAT
+    readonly tagFormat: string = DEFAULT_TAG_FORMAT
 
     constructor(tagFormat?: string) {
         if (tagFormat) {

diff --git a/packages/github/package.json b/packages/github/package.json
@@ -28,12 +28,12 @@
     }
   },
   "peerDependencies": {
-    "mono-pub": "1.x"
+    "mono-pub": "^1.0.0 || ^2.0.0"
   },
   "devDependencies": {
     "@mono-pub/configs": "workspace:^",
     "@octokit/types": "^9.2.2",
-    "@types/lodash": "^4.14.194",
+    "@types/lodash": "^4.17.24",
     "eslint": "^9.16.0",
     "fix-tsup-cjs": "^1.2.0",
     "mono-pub": "workspace:^",
@@ -44,7 +44,7 @@
     "@mono-pub/git": "workspace:^",
     "@octokit/rest": "^19.0.7",
     "conventional-commits-parser": "^3.2.4",
-    "lodash": "^4.17.21"
+    "lodash": "^4.17.23"
   },
   "publishConfig": {
     "access": "public"

diff --git a/packages/github/src/utils.ts b/packages/github/src/utils.ts
@@ -59,7 +59,7 @@ export async function extractPrCommits(
             page: pagesFetched + 1,
         })
         if (response.status !== 200) {
-            throw new Error(`Could not fetch PR commits. Details: ${response.data}`)
+            throw new Error(`Could not fetch PR commits. Details: ${JSON.stringify(response.data)}`)
         }
         const data = get(response, 'data', [])
         pagesFetched++
@@ -76,7 +76,7 @@ export async function extractPrCommits(
                 ref: sha,
             })
             if (response.status !== 200) {
-                throw new Error(`Could not fetch commit info. Details: ${response.data}`)
+                throw new Error(`Could not fetch commit info. Details: ${JSON.stringify(response.data)}`)
             }
             const packageFilesAffected = (commitResponse.data.files ?? [])
                 .map((file) => file.filename)

diff --git a/packages/mono-pub/package.json b/packages/mono-pub/package.json
@@ -56,18 +56,18 @@
   "devDependencies": {
     "@faker-js/faker": "^8.0.1",
     "@mono-pub/configs": "workspace:^",
-    "@types/lodash": "^4.14.194",
+    "@types/lodash": "^4.17.24",
     "@types/signale": "^1.4.4",
     "eslint": "^9.16.0",
     "fix-tsup-cjs": "^1.2.0",
-    "tmp": "^0.2.1",
+    "tmp": "^0.2.5",
     "tslib": "^2.5.0",
     "tsup": "8.3.5",
     "typescript": "^5.0.4"
   },
   "dependencies": {
     "globby": "^11.1.0",
-    "lodash": "^4.17.21",
+    "lodash": "^4.17.23",
     "signale": "^1.4.0"
   },
   "publishConfig": {

diff --git a/packages/npm/package.json b/packages/npm/package.json
@@ -28,11 +28,11 @@
     }
   },
   "peerDependencies": {
-    "mono-pub": "1.x"
+    "mono-pub": "^1.0.0 || ^2.0.0"
   },
   "devDependencies": {
     "@mono-pub/configs": "workspace:^",
-    "@types/tmp": "^0.2.3",
+    "@types/tmp": "^0.2.6",
     "eslint": "^9.16.0",
     "fix-tsup-cjs": "^1.2.0",
     "mono-pub": "workspace:^",
@@ -41,7 +41,7 @@
   },
   "dependencies": {
     "execa": "^5",
-    "tmp": "^0.2.1"
+    "tmp": "^0.2.5"
   },
   "publishConfig": {
     "access": "public"

diff --git a/packages/npm/src/index.ts b/packages/npm/src/index.ts
@@ -11,6 +11,7 @@ interface MonoPubNpmConfig {
     distTag: string
     dryRun: boolean
     provenance: boolean
+    trustedPublishing: boolean
 }
 
 const DEFAULT_NPM_REGISTRY = 'https://registry.npmjs.org'
@@ -20,6 +21,7 @@ const DEFAULT_NPM_CONFIG: MonoPubNpmConfig = {
     distTag: 'latest',
     dryRun: false,
     provenance: false,
+    trustedPublishing: false,
 }
 
 class MonoPubNpm implements MonoPubPlugin {
@@ -36,14 +38,18 @@ class MonoPubNpm implements MonoPubPlugin {
 
     async setup(ctx: MonoPubContext): Promise<boolean> {
         const npmToken = ctx.env[this.config.envTokenKey]
-        if (!npmToken) {
+        if (!npmToken && !this.config.trustedPublishing) {
             ctx.logger.error(
                 `No npm token found in mono-pub environment (key: "${this.config.envTokenKey}"). ` +
                     `Make sure you specified it in env and provided "envTokenKey" in plugin config in case it is stored not under "${DEFAULT_NPM_CONFIG.envTokenKey}" key`
             )
             return false
         }
 
+        if (!npmToken || this.config.trustedPublishing) {
+            return true
+        }
+
         const url = new URL(DEFAULT_NPM_REGISTRY)
         const hostPrefix = `//${url.host}/:`
         fs.writeFileSync(this.npmConfigFile, `${hostPrefix}_authToken=\${NPM_TOKEN}`)
@@ -67,15 +73,21 @@ class MonoPubNpm implements MonoPubPlugin {
     async publish(packageInfo: BasePackageInfo, ctx: MonoPubContext): Promise<void> {
         const npmToken = ctx.env[this.config.envTokenKey]
         const runDir = path.dirname(packageInfo.location)
-        const args = ['publish', '--tag', this.config.distTag, '--userconfig', this.npmConfigFile, '--no-workspaces']
+        const args = ['publish', '--tag', this.config.distTag, '--no-workspaces']
+        const env = this.config.trustedPublishing ? {} : { NPM_TOKEN: npmToken }
+
+        if (fs.existsSync(this.npmConfigFile)) {
+            args.push('--userconfig', this.npmConfigFile)
+        }
+
         if (this.config.dryRun) {
             args.push('--dry-run')
         }
         if (this.config.provenance) {
             args.push('--provenance')
         }
 
-        await execa('npm', args, { cwd: runDir, env: { NPM_TOKEN: npmToken } })
+        await execa('npm', args, { cwd: runDir, env })
     }
 }