Bump gh-release from 7.0.2 to 8.1.0

[dependabot]

Bumps gh-release from 7.0.2 to 8.1.0.

Release notes

Sourced from gh-release's releases.

v8.1.0

8.1.0 (2026-06-17)

Features

• add --tag-prefix option (#224) (380851c)

v8.0.0

8.0.0 (2026-06-17)

Changelog formats supported as of v8.0.0 (thanks to updates in changelog-parser):

• Keep a Changelog
• Conventional Changelog
• Release Please
• Standard Version
• auto-changelog

⚠ BREAKING CHANGES

• the "publish release to github?" confirmation now defaults to yes. Pressing Enter, or any answer that is not n/no, publishes the release; previously only y/yes published and an empty answer declined.
• gh-release no longer requires a CHANGELOG.md.
  • A missing CHANGELOG.md is no longer an error; gh-release tags from the package.json version with an empty body.
  • An empty matching changelog section is no longer an error; it produces an empty-body release instead of failing with missing required options: body.
  • body is no longer a required option: it is removed from OPTIONS.required, and validate() no longer reports it missing.
  • To populate the body without changelog notes, pass --generate-notes (or generate_release_notes: true).
• This package is now ESM-only.
  • ESM: import the named export, import { ghRelease } from 'gh-release'. The default export, import ghRelease from 'gh-release', remains available for backwards compatibility.
  • CommonJS: on Node 22.12+, require('gh-release') works (require(esm) is unflagged there) but returns the module namespace rather than the function, so const ghRelease = require('gh-release') no longer works. Use const { ghRelease } = require('gh-release') or const ghRelease = require('gh-release').default.
  • The minimum supported Node.js version is now 22.12.0.
  • Authentication is now token-only: the interactive ghauth login and its OAuth app are removed, username/password (HTTP basic auth) is removed, and the Release.clientId static is removed. GitHub disabled password authentication for its API in 2020.
• drop support for Node versions <20, update deps, patch sec vulns (#196)
• drop node 14, 16, add 20

Features

• default the publish prompt to yes (#222) (6aaa08e)
• relax changelog and body requirements (#221) (62fa42c)

Bug Fixes

• handle 422 commitish, silence git stderr (#223) (76f47a2)

Miscellaneous Chores

• drop support for Node versions <20, update deps, patch sec vulns (#196) (a4e7d5b)

... (truncated)

Changelog

Sourced from gh-release's changelog.

8.1.0 (2026-06-17)

Features

• add --tag-prefix option (#224) (380851c)

8.0.0 (2026-06-17)

⚠ BREAKING CHANGES

• the "publish release to github?" confirmation now defaults to yes. Pressing Enter, or any answer that is not n/no, publishes the release; previously only y/yes published and an empty answer declined.
• gh-release no longer requires a CHANGELOG.md.
  • A missing CHANGELOG.md is no longer an error; gh-release tags from the package.json version with an empty body.
  • An empty matching changelog section is no longer an error; it produces an empty-body release instead of failing with missing required options: body.
  • body is no longer a required option: it is removed from OPTIONS.required, and validate() no longer reports it missing.
  • To populate the body without changelog notes, pass --generate-notes (or generate_release_notes: true).
• This package is now ESM-only.
  • ESM: import the named export, import { ghRelease } from 'gh-release'. The default export, import ghRelease from 'gh-release', remains available for backwards compatibility.
  • CommonJS: on Node 22.12+, require('gh-release') works (require(esm) is unflagged there) but returns the module namespace rather than the function, so const ghRelease = require('gh-release') no longer works. Use const { ghRelease } = require('gh-release') or const ghRelease = require('gh-release').default.
  • The minimum supported Node.js version is now 22.12.0.
  • Authentication is now token-only: the interactive ghauth login and its OAuth app are removed, username/password (HTTP basic auth) is removed, and the Release.clientId static is removed. GitHub disabled password authentication for its API in 2020.
• drop support for Node versions <20, update deps, patch sec vulns (#196)
• drop node 14, 16, add 20

Features

• default the publish prompt to yes (#222) (6aaa08e)
• relax changelog and body requirements (#221) (62fa42c)

Bug Fixes

• handle 422 commitish, silence git stderr (#223) (76f47a2)

Miscellaneous Chores

• drop support for Node versions <20, update deps, patch sec vulns (#196) (a4e7d5b)

Build System

• convert to TypeScript and ESM (#219) (928ea5f)

Continuous Integration

• drop node 14, 16, add 20 (6c0e586)

Commits

• 963101c chore(main): release 8.1.0 (#225)
• 380851c feat: add --tag-prefix option (#224)
• 4e20adb chore(main): release 8.0.0 (#220)
• 76f47a2 fix: handle 422 commitish, silence git stderr (#223)
• 6aaa08e feat!: default the publish prompt to yes (#222)
• 62fa42c feat!: relax changelog and body requirements (#221)
• 928ea5f build!: convert to TypeScript and ESM (#219)
• a8cfbb9 chore(deps): update @​octokit/rest requirement from ^22.0.0 to ^22.0.1 (#213)
• 89a0c81 chore(deps): update ghauth requirement from ^6.0.15 to ^6.0.19 (#216)
• b29d121 chore(deps): bump actions/checkout from 5 to 6 (#214)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for gh-release since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​gh-release@​8.1.0

View full report