build(deps-dev): bump @metamask/auto-changelog from 3.4.4 to 5.1.0

[dependabot]

Bumps @metamask/auto-changelog from 3.4.4 to 5.1.0.

Release notes

Sourced from @​metamask/auto-changelog's releases.

5.1.0

Added

• Add --useChangelogEntry to auto-changelog update (#247)
  • This will read the PR referenced in each commit message, look for CHANGELOG entry: in the PR description, and use this as the new changelog entry in the changelog (or skip if the no-changelog label is present on the PR)
  • Note that GITHUB_TOKEN must be set in order to use this option
  • The updateChangelog function also supports this option
• Add --useShortPrLink to auto-changelog update (#247)
  • This will generate short references to PRs, e.g. [#123](https://github.com/MetaMask/auto-changelog/issues/123) instead of [#123](https://some/repo)
  • The updateChangelog function also supports this option

Changed

• Update auto-changelog update --autoCategorize to exclude entries with certain phrases or Conventional Commit prefixes (#247)
  • If commit messages have the following prefixes they will not be automatically added to the changelog:
    • style
    • refactor
    • test
    • build
    • ci
    • release
  • If commit messages have the following phrases they will not be automatically added to the changelog:
    • Bump main version to
    • changelog
    • cherry-pick
    • cp-
    • e2e
    • flaky test
    • INFRA-
    • merge
    • New Crowdin translations

5.0.2

Fixed

• Fix --autoCategorize so that commit messages with Conventional Commit prefixes are categorized correctly when the prefix contains a scope (e.g. feat(scope): ...) (#240)

5.0.1

Fixed

• Fix CLI path (#235)

5.0.0

Added

• JavaScript sources and TypeScript declarations are now available in both CommonJS- and ESM-compatible variants (#226)
• Add option to changelog validation to ensure that each entry in the changelog links to one or more originating PRs (#222)
  • Pass --pr-links to the CLI, or pass ensureValidPrLinksPresent to validateChangelog to enable this behavior, ideally in your lint package script or CI workflow
• Add an optional shouldExtractPrLinks option to parseChangelog (#222)
  • When true, this will extract pull request links from the text of each entry, identify the pull numbers, and keep them in a separate array
  • See note on Changelog.getReleaseChanges below for more

Changed

• BREAKING: Changelog.getReleaseChanges now returns an object whose values are objects of shape { description: string; prNumbers: string[] } rather than simply string (the description) (#222)
  • This affects parseChangelog as well, since it returns an instance of Changelog

... (truncated)

Changelog

Sourced from @​metamask/auto-changelog's changelog.

[5.1.0]

Added

• Add --useChangelogEntry to auto-changelog update (#247)
  • This will read the PR referenced in each commit message, look for CHANGELOG entry: in the PR description, and use this as the new changelog entry in the changelog (or skip if the no-changelog label is present on the PR)
  • Note that GITHUB_TOKEN must be set in order to use this option
  • The updateChangelog function also supports this option
• Add --useShortPrLink to auto-changelog update (#247)
  • This will generate short references to PRs, e.g. [#123](https://github.com/MetaMask/auto-changelog/issues/123) instead of [#123](https://some/repo)
  • The updateChangelog function also supports this option

Changed

• Update auto-changelog update --autoCategorize to exclude entries with certain phrases or Conventional Commit prefixes (#247)
  • If commit messages have the following prefixes they will not be automatically added to the changelog:
    • style
    • refactor
    • test
    • build
    • ci
    • release
  • If commit messages have the following phrases they will not be automatically added to the changelog:
    • Bump main version to
    • changelog
    • cherry-pick
    • cp-
    • e2e
    • flaky test
    • INFRA-
    • merge
    • New Crowdin translations

[5.0.2]

Fixed

• Fix --autoCategorize so that commit messages with Conventional Commit prefixes are categorized correctly when the prefix contains a scope (e.g. feat(scope): ...) (#240)

[5.0.1]

Fixed

• Fix CLI path (#235)

[5.0.0]

Added

• JavaScript sources and TypeScript declarations are now available in both CommonJS- and ESM-compatible variants (#226)
• Add option to changelog validation to ensure that each entry in the changelog links to one or more originating PRs (#222)

... (truncated)

Commits

• 47346f4 5.1.0 (#250)
• dcc88e3 fix: make useChangelogEntry and useShortPrLink optional (#249)
• f8c5f7d feat: parse CHANGELOG entry: and no-changelog (#247)
• 3d17386 fix: problems running auto-changelog on Windows (#246)
• 24fcaf3 5.0.2 (#241)
• 7c440fc chore: formatting changelog (#242)
• c5a1264 fix: allow category extraction when scope is used (#240)
• 308220b chore: update security-code-scanner@main to action-security-code-scanner@v1 (...
• 92b933d 5.0.1 (#236)
• 69835c9 Fix CLI path (#235)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	universal-user-agent@​6.0.1
	@​octokit/​openapi-types@​24.2.0
	deprecation@​2.3.1
	@​octokit/​plugin-request-log@​4.0.1
	before-after-hook@​2.2.3
	@​octokit/​auth-token@​4.0.0
	@​octokit/​rest@​20.1.2
	@​octokit/​request-error@​5.1.1
	@​octokit/​endpoint@​9.0.6
	@​octokit/​graphql@​7.1.1
	@​octokit/​plugin-rest-endpoint-methods@​13.3.2-cjs.1
	@​octokit/​plugin-paginate-rest@​11.4.4-cjs.2
	@​octokit/​core@​5.2.2
	@​octokit/​request@​8.4.1
	@​metamask/​auto-changelog@​3.4.4 ⏵ 5.1.0	+2		+1	+13

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• @octokit/[email protected]

View full report

[rekmarks]

@SocketSecurity ignore npm/@octokit/[email protected]

It's a dev dependency published by GitHub that needs network access to do its job.