pnpm-workspace catalog changes now trigger version bumps
The release script now detects when catalog entries change in pnpm-workspace.yaml and correctly marks affected packages for version bumps.
The release pipeline's version bumping script only tracked changes to individual package.json files—but not to shared workspace configuration. In pnpm monorepos, packages can reference dependencies using catalog specifiers like "catalog:" or "catalog:my-catalog". When a security patch updated these catalog entries, the script didn't detect the change, so packages weren't flagged for version bumps. The fix parses pnpm-workspace.yaml alongside the git tag to compare catalog entries, then marks dependent packages dirty when their catalog dependencies change. Security updates can now flow through the release pipeline without requiring dummy changes to package contents.
View Original GitHub Description
Description
Backport of #28503 to release-candidate/2.16.x.
Checklist for the author (@Matsuuu) to go through.
- Review the backport changes
- Fix possible conflicts
- Merge to target branch
After this PR has been merged, it will be picked up in the next patch release for release track.
Original description
Summary
The current version of bump-versions.mjs used in the release pipeline only accounts for changes to the actual packages we publish. But as more and more packages rely on catalog: entries from the pnpm workspace, we need to also count changes to that file as package changes.
Without accounting for it, we are not able to push security updates on packages without actually modifying the package contents themselves, which causes a lot of headache.
Also did some general cleanup on the whole file.
Related Linear tickets, Github issues, and Community forum posts
https://linear.app/n8n/issue/CAT-2817/
Review / Merge checklist
- I have seen this code, I have run this code, and I take responsibility for this code.
- PR title and summary are descriptive. (conventions) <!-- **Remember, the title automatically goes into the changelog. Use `(no-changelog)` otherwise.** -->
- Docs updated or follow-up ticket created.
- Tests included. <!-- A bug is not considered fixed, unless a test is added to prevent it from happening again. A feature is not complete without tests. -->
- PR Labeled with
Backport to Beta,Backport to Stable, orBackport to v1(if the PR is an urgent fix that needs to be backported)