axios-redmine/CHANGES.md

axios-redmine is a nodejs library which supports 100% features of Redmine's REST API.

# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Changed
- Enhanced npm scripts for better developer experience:
  - Added `type-check` script to validate TypeScript type definitions
  - Added `clean` script to remove generated files (coverage, .nyc_output) using rimraf for cross-platform compatibility
  - Added `prepublishOnly` script to ensure lint and tests pass before publishing
- Enhanced tsconfig.json for proper type checking:
  - Added ES2020 target and lib for modern JavaScript features
  - Added strict type checking options
  - Configured to include lib/, test/, and type definitions
- Enhanced package.json metadata for better npm discoverability:
  - Added "files" field to explicitly specify published files (lib/, index.d.ts, LICENSE, README.md, CHANGES.md)
  - Expanded keywords: added "redmine-api", "rest-api", "api-client", "typescript", "project-management", "issue-tracking"
  - Converted repository to object format with type and url
  - Added "bugs" field with issues URL
  - Added "homepage" field linking to README

### Fixed
- Fixed CI workflow to properly generate coverage reports before uploading to Codecov
  - Split test execution: run `yarn test` for Node 20.x and 22.x, `yarn coverage` for LTS
  - Added explicit coverage file path (`./coverage/lcov.info`) to Codecov action
  - Previously, coverage upload was attempting to run without generating coverage first

### Security
- **BREAKING**: Removed Grunt and migrated to native npm scripts
  - Eliminated 26 security vulnerabilities (2 Critical, 12 High, 9 Moderate, 3 Low)
  - Migrated from grunt-based testing to native mocha
  - Replaced istanbul with c8 for modern code coverage
  - Removed vulnerable packages: grunt, grunt-eslint, grunt-mocha-cli, grunt-mocha-istanbul, grunt-mocha-test, istanbul, load-grunt-configs, load-grunt-tasks, time-grunt
  - Added yarn resolutions for braces (>=3.0.3) and brace-expansion (>=1.1.12) to fix remaining transitive vulnerabilities
  - All security vulnerabilities now resolved (0 vulnerabilities)

### Changed
- Simplified test infrastructure by removing Grunt dependency
  - Updated test script to use mocha directly with equivalent options
  - Updated coverage script to use c8 with lcov and text reporters
  - Removed Gruntfile.js and grunt/ configuration directory
  - Maintained same test coverage (82.08%) and all tests passing

### Removed
- Grunt and all grunt-related packages (breaking change for build/test scripts)
- Gruntfile.js and grunt/ configuration directory

## [0.1.54] - 2025-11-22

### Changed
- **BREAKING**: Migrated to release-please for automated releases:
  - Uses Conventional Commits to determine version bumps
  - Automatically creates/updates Release PRs with version and changelog updates
  - Publishes to npm when Release PR is merged
  - Works seamlessly with branch protection rules (creates PRs instead of direct pushes)
  - Added id-token: write permission for npm provenance
  - Replaced manual tag-based workflow with automated release-please workflow
  - Pinned googleapis/release-please-action to v4.4.0 for security
  - Removed unnecessary ${{ }} wrapper in if conditions
- Updated configuration files:
  - Fixed typo in .editorconfig comment ("dirrerent" → "different")
  - Added Markdown-specific rule to .editorconfig (preserve trailing whitespace)
  - Updated .npmignore to reference eslint.config.js instead of .eslintrc.js
  - Removed obsolete .travis.yml reference from .npmignore
  - Added editor directories (.vscode, .idea) to .npmignore and .gitignore
  - Enhanced .gitignore with Docker Compose and additional environment file patterns

## [0.1.54] - 2025-11-22

### Changed
- Updated publish workflow (.github/workflows/publish.yml):
  - Updated checkout action from v3 to v4
  - Updated setup-node action from v3 to v4
  - Added explicit check for merged PRs only
  - Improved step naming and added explicit shell specifications
  - Added --frozen-lockfile flag to yarn install
  - Added --non-interactive flag to yarn publish
  - Added cache: yarn to setup-node for faster builds
  - Pinned action versions instead of using @master/@latest (security best practice):
    - phips28/gh-action-bump-version@v11.0.3 (was @master)
    - marvinpinto/action-automatic-releases@v1.2.1 (was @latest)
  - Changed checkout ref to fetch-depth: 0 for full git history
- Fixed actionlint and yamllint warnings:
  - Removed unnecessary `${{ }}` from if conditions in ci.yml
  - Changed `branches: - '!master'` to `branches-ignore:` in reviewdog.yml
  - Changed `secrets.github_token` to `secrets.GITHUB_TOKEN` (uppercase) in reviewdog.yml
  - Removed trailing blank lines from workflow files

## [0.1.53] - 2025-11-22

### Security
- Updated axios from ^0.30.0 to ^1.7.0 to address multiple security vulnerabilities (CVE-2023-45857, CVE-2024-39338)
- Removed codecov package dependency (functionality handled by CI workflow)
- Updated devDependencies to latest versions to address security advisories
  - eslint: ^7.32.0 → ^9.17.0 (migrated to flat config format)
  - mocha: ^9.0.3 → ^10.8.2
  - typescript: ^4.3.5 → ^5.7.2
  - And other dependency updates for security patches

### Added
- Added CONTRIBUTING.md with comprehensive contribution guidelines
- Added pull request template (.github/pull_request_template.md)
- Added TypeScript type definitions (index.d.ts) for better TypeScript support
  - Comprehensive definitions for all 68 API methods
  - Practical TypeScript examples with complete workflow demonstrations
  - Export functionality for reusable functions
- Added npm scripts: `lint`, `lint:fix`, `coverage`, `serve` for better development workflow
- Added additional CI quality checks:
  - ESLint check on LTS Node.js version
  - npm security audit (moderate level, non-blocking)
- Added more badges to README:
  - npm version badge
  - Node.js version requirement badge
  - License badge
- Added "Features" section to README highlighting key capabilities
- Added "Requirements" section to README documenting Node.js >= 20.0.0

### Changed
- **BREAKING**: Dropped Node.js 18.x support (EOL April 2025). Minimum version is now Node.js 20.0.0
- Updated Node.js version support: now supports 20.x, 22.x, and LTS (removed EOL versions 12.x, 14.x, 16.x, and 18.x)
- Added engines field to package.json to enforce minimum Node.js version
- Updated GitHub Actions to latest versions (checkout@v4, setup-node@v4, codecov-action@v4)
- Improved CI workflow with explicit permissions and better step naming
- Changed Codecov to non-blocking (fail_ci_if_error: false) and only run on LTS version
- Removed hardcoded API keys from example files and README for better security
- Migrated ESLint configuration from legacy .eslintrc.js to modern flat config format (eslint.config.js)
- Enhanced ESLint rules with stricter code quality checks (with Mocha-compatible overrides for test files)
- Improved SECURITY.md with GitHub Security Advisories, scope clarification, and no bounty program notice
- Improved README.md structure and formatting
  - Better organized sections
  - Added emoji icons for visual clarity
  - Clearer feature highlights
  - More professional presentation
- Updated GitHub Actions workflows to latest versions:
  - reviewdog.yml: Updated checkout action from v3 to v4
  - codeql-analysis.yml: Updated checkout from v2 to v4, CodeQL actions from v1 to v3
  - Improved workflow formatting and consistency

### Fixed
- Fixed constructor error handling to properly throw errors instead of returning them
- Fixed test suite to properly validate error throwing behavior

### Removed
- Removed Greenkeeper badge from README
- Removed unused commented code in lib/redmine.js
- Removed unnecessary `"private": false` from package.json

## [0.1.49] - 2025-11-22

### Changed
- Updated dependency axios to v0.30.2

## [0.1.0] - Initial Release

### Added
- Initialize node-redmine

[Unreleased]: https://github.com/lupinthe14th/axios-redmine/compare/v0.1.54...HEAD
[0.1.54]: https://github.com/lupinthe14th/axios-redmine/compare/v0.1.53...v0.1.54
[0.1.53]: https://github.com/lupinthe14th/axios-redmine/compare/v0.1.49...v0.1.53
[0.1.49]: https://github.com/lupinthe14th/axios-redmine/releases/tag/v0.1.49
[0.1.0]: https://github.com/lupinthe14th/axios-redmine/releases/tag/v0.1.0