Prepare v2026.11.06 npm release

.changeset/config.json

@@ -1,11 +1,16 @@
 {
   "$schema": "https://unpkg.com/@changesets/config@2.3.1/schema.json",
-  "changelog": ["@changesets/changelog-git", {"repo": "truecms/design-system-components"}],
+  "changelog": [
+    "@changesets/changelog-git",
+    {
+      "repo": "truecms/design-system-components"
+    }
+  ],
   "commit": false,
   "fixed": [],
   "linked": [],
   "access": "public",
-  "baseBranch": "master",
+  "baseBranch": "2.x",
   "updateInternalDependencies": "patch",
   "ignore": []
 }

.github/workflows/npm-release.yml

@@ -12,7 +12,7 @@ on:
         default: latest
         required: false
       dry_run:
-        description: 'Run Changesets publish with --dry-run to validate pipeline'
+        description: 'Pack release tarballs without publishing to npm'
         type: boolean
         default: true
   release:
@@ -22,6 +22,10 @@ on:
       - 'v*'
       - '@truecms/**'
 
+concurrency:
+  group: npm-release
+  cancel-in-progress: false
+
 jobs:
   release-validation:
     name: Release quality gates
@@ -80,7 +84,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@v3
         with:
-          version: 9
+          version: 9.12.2
 
       - name: Set up Node.js 22
         uses: actions/setup-node@v4
@@ -93,7 +97,7 @@ jobs:
       - name: Enable Corepack (pnpm shim)
         run: |
           corepack enable
-          corepack prepare pnpm@9 --activate
+          corepack prepare pnpm@9.12.2 --activate
 
       - name: Resolve release parameters
         id: release-params
@@ -118,7 +122,7 @@ jobs:
           major="${node_version#v}"
           major="${major%%.*}"
           if [ "${major}" -lt 22 ]; then
-            echo '::error::Node 22 or newer is required for publishing. Update the workflow configuration or run `nvm use 22` locally before retrying.'
+            echo '::error::Node 22 or newer is required for publishing. Update the workflow configuration or run nvm use 22 locally before retrying.'
             exit 1
           fi
 
@@ -153,6 +157,9 @@ jobs:
           fi
           echo 'No Pancake dependencies found in package manifests.'
 
+      - name: Build component packages
+        run: pnpm run build
+
       - name: Build unified package scaffold
         run: |
           set -euo pipefail
@@ -186,23 +193,11 @@ jobs:
 
           echo "Publishing with scope ${scope}, dist-tag ${dist_tag}, dry-run ${dry_run_flag}"
 
-          args=(--tag "$dist_tag")
           if [ "$dry_run_flag" = "true" ]; then
-            args+=(--dry-run)
-          fi
-
-          echo "Running: pnpm run release ${args[*]}"
-          set +e
-          pnpm run release ${args[@]} | tee changesets-publish.log
-          status=$?
-          set -e
-
-          if grep -qiE "No packages are being published|No unpublished packages found" changesets-publish.log; then
-            echo "::notice::No release plan detected. Retrying with --from-package."
-            echo "Running: pnpm changeset publish --from-package ${args[*]}"
-            pnpm changeset publish --from-package ${args[@]}
+            echo "Validating release tarballs without registry writes"
+            pnpm run pack:tarballs
           else
-            exit "$status"
+            pnpm exec changeset publish --tag "$dist_tag"
           fi
 
       - name: Post-release cleanup
@@ -212,3 +207,20 @@ jobs:
           if command -v pnpm >/dev/null 2>&1; then
             pnpm store prune || true
           fi
+
+      - name: Write publish summary
+        if: always()
+        env:
+          RELEASE_SCOPE: ${{ steps.release-params.outputs.scope }}
+          RELEASE_DIST_TAG: ${{ steps.release-params.outputs.dist_tag }}
+          RELEASE_DRY_RUN: ${{ steps.release-params.outputs.dry_run }}
+        run: |
+          {
+            echo "## npm publish"
+            echo
+            echo "- Status: ${{ job.status }}"
+            echo "- Ref: ${GITHUB_REF_NAME}"
+            echo "- Scope: ${RELEASE_SCOPE}"
+            echo "- Dist tag: ${RELEASE_DIST_TAG}"
+            echo "- Dry run: ${RELEASE_DRY_RUN}"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/reusable-quality-gates.yml

@@ -70,7 +70,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@v3
         with:
-          version: 9
+          version: 9.12.2
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
@@ -88,7 +88,7 @@ jobs:
           major="${node_version#v}"
           major="${major%%.*}"
           if [ "${major}" -lt 22 ]; then
-            echo '::error::Node 22 or newer is required for this workflow. Update the matrix entry or run `nvm use 22` locally before re-running.'
+            echo '::error::Node 22 or newer is required for this workflow. Update the matrix entry or run nvm use 22 locally before re-running.'
             exit 1
           fi
 
@@ -234,9 +234,9 @@ jobs:
           fi
         shell: bash
 
-      - name: Dry run publish with Changesets
+      - name: Pack release tarballs without publishing
         if: ${{ inputs.run_release_dry_run }}
-        run: pnpm run release -- --dry-run
+        run: pnpm run pack:tarballs
 
       - name: Generate Changesets summary (tolerant)
         if: ${{ inputs.write_changesets_summary }}

.gitignore

@@ -32,3 +32,5 @@ coverage/
 Thumbs.db
 *.tmp
 *.swp
+
+.logs/

docs/publishing.md

@@ -4,17 +4,17 @@ This document outlines how releases are produced for the design system component
 
 ## Prerequisites
 
-- Node.js 22 (`nvm use 22` locally) and pnpm 9+
+- Node.js 22.13+ in the 22.x line, or Node.js 24+, and the pinned pnpm 9.12.2
 - GitHub Actions secret `NPM_TOKEN_TRUECMS` containing an npm Access Token with publish rights to the `@truecms` scope
 - Changesets entry for every change destined for release
 - Clean working tree (`pnpm install --frozen-lockfile` succeeds without modifications)
 
 ## Release Workflow Overview
 
-1. Merge approved pull requests into `master` (or `main` if your fork still uses it).
-2. Run `pnpm changeset` to create or update release notes.
-3. Commit and push the changeset file, then open a pull request.
-4. Once merged, trigger the **npm Release** workflow from the Actions tab or tag a version (`git tag vX.Y.Z && git push --tags`). When dispatching manually, confirm the inputs:
+1. Collect release notes with `pnpm changeset`, then run `pnpm run prepare:version`.
+2. Refresh the lockfile with `pnpm install --lockfile-only` and complete local verification.
+3. Commit the package versions, changelogs, and lockfile; merge the release pull request into `2.x`.
+4. Create the dated GitHub release from the exact merged commit. Alternatively, dispatch the **npm Release** workflow once with the intended ref. When dispatching manually, confirm the inputs:
    - `npm_scope` defaults to `@truecms` and rarely needs to change.
    - `dist_tag` defaults to `latest`; use `next`, `dev`, or a custom tag to stage releases.
    - `dry_run` defaults to `true`; set to `false` only when you are ready to publish for real.
@@ -24,7 +24,7 @@ Pre-release smoke tags ending in `-dev`, `-next`, `-rc`, `-beta`, or `-alpha` au
 The workflow performs the following checks automatically:
 
 - Installs dependencies using Node 22 and pnpm
-- Builds packages and runs the full test suite
+- Builds all component packages in both validation and publication jobs, and runs the full test suite
 - Executes `pnpm run build:site-dist` to ensure documentation assets still build
 - Audits production dependencies and fails on any vulnerability
 - Publishes via Changesets with provenance metadata when the npm token is present
@@ -35,7 +35,7 @@ The workflow performs the following checks automatically:
 Every pull request also triggers the **Dry run release validation** job inside `install-check.yml`. This job:
 
 - Rebuilds packages, reruns the full test suite, and rebuilds the documentation bundle on Node 22.
-- Executes `pnpm run release -- --dry-run` to confirm Changesets can publish without contacting npm.
+- Executes `pnpm run pack:tarballs` to validate packaging without registry writes. Changesets does not support a publish dry-run flag.
 - Packs every workspace tarball, installs them in a disposable workspace, and records the results in `dist/tarballs/pack-summary.json`.
 - Persists `changesets-summary.json` (the raw release plan) and `dist/tarballs/pack-summary.json` as workflow artifacts for auditing.
 
@@ -75,3 +75,8 @@ Ensure `NPM_TOKEN_TRUECMS` is available in the environment before running `pnpm
 - Verify the publish summary in the workflow logs to confirm each package version incremented as expected.
 - Run `pnpm outdated` locally to ensure no unexpected regressions remain.
 - Notify consumers via the release notes channel (`#design-system-releases` on Slack) and update any dependent repositories.
+
+Release tags follow the dated `vYYYY.MM.DD` series. Package versions use
+individual semantic versions managed by Changesets. Create the GitHub release
+from the exact release commit to trigger publication; do not also dispatch a
+second publish run for the same release.

packages/accordion/CHANGELOG.md

@@ -1,5 +1,14 @@
 @truecms/accordion CHANGELOG
 
+## 9.0.2
+
+### Patch Changes
+
+- Refresh security dependencies and rebuild component distributions with the updated toolchain.
+- Updated dependencies
+  - @truecms/animate@3.0.1
+  - @truecms/core@6.0.2
+
 ## 9.0.1
 
 ### Patch Changes

packages/accordion/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@truecms/accordion",
-  "version": "9.0.1",
+  "version": "9.0.2",
   "description": "Allow the user to toggle the visibility of an element",
   "keywords": [
     "auds",
@@ -33,8 +33,8 @@
     "@truecms/core": "workspace:*"
   },
   "peerDependencies": {
-    "@truecms/animate": "^3.0.0",
-    "@truecms/core": "^6.0.1"
+    "@truecms/animate": "^3.0.1",
+    "@truecms/core": "^6.0.2"
   },
   "devDependencies": {
     "@babel/core": "^7.29.7",

packages/animate/CHANGELOG.md

@@ -1,5 +1,11 @@
 @truecms/animate CHANGELOG
 
+## 3.0.1
+
+### Patch Changes
+
+- Refresh security dependencies and rebuild component distributions with the updated toolchain.
+
 ## 3.0.0
 
 ### Major Changes

packages/animate/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@truecms/animate",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "A JavaScript function to animate CSS properties of page elements.",
   "keywords": [
     "auds",

packages/body/CHANGELOG.md

@@ -1,5 +1,13 @@
 @truecms/body CHANGELOG
 
+## 4.0.2
+
+### Patch Changes
+
+- Refresh security dependencies and rebuild component distributions with the updated toolchain.
+- Updated dependencies
+  - @truecms/core@6.0.2
+
 ## 4.0.1
 
 ### Patch Changes

packages/body/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@truecms/body",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "Basic body styles for body HTML elements",
   "keywords": [
     "auds",
@@ -33,7 +33,7 @@
     "@truecms/core": "workspace:*"
   },
   "peerDependencies": {
-    "@truecms/core": "^6.0.1"
+    "@truecms/core": "^6.0.2"
   },
   "devDependencies": {
     "browser-sync": "^3.0.4",

packages/breadcrumbs/CHANGELOG.md

@@ -1,5 +1,14 @@
 @truecms/breadcrumbs CHANGELOG
 
+## 5.0.3
+
+### Patch Changes
+
+- Refresh security dependencies and rebuild component distributions with the updated toolchain.
+- Updated dependencies
+  - @truecms/core@6.0.2
+  - @truecms/link-list@5.0.3
+
 ## 5.0.2
 
 ### Patch Changes

packages/breadcrumbs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@truecms/breadcrumbs",
-  "version": "5.0.2",
+  "version": "5.0.3",
   "description": "Breadcrumbs help users understand where they are in the service and how they got there.",
   "keywords": [
     "auds",
@@ -35,8 +35,8 @@
     "@truecms/link-list": "workspace:*"
   },
   "peerDependencies": {
-    "@truecms/core": "^6.0.1",
-    "@truecms/link-list": "^5.0.2"
+    "@truecms/core": "^6.0.2",
+    "@truecms/link-list": "^5.0.3"
   },
   "devDependencies": {
     "@babel/core": "^7.29.7",

packages/buttons/CHANGELOG.md

@@ -1,5 +1,13 @@
 @truecms/buttons CHANGELOG
 
+## 5.0.3
+
+### Patch Changes
+
+- Refresh security dependencies and rebuild component distributions with the updated toolchain.
+- Updated dependencies
+  - @truecms/core@6.0.2
+
 ## 5.0.2
 
 ### Patch Changes

packages/buttons/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@truecms/buttons",
-  "version": "5.0.2",
+  "version": "5.0.3",
   "description": "Buttons signal action. Use them to move the user through the service.",
   "keywords": [
     "auds",
@@ -32,7 +32,7 @@
     "@truecms/core": "workspace:*"
   },
   "peerDependencies": {
-    "@truecms/core": "^6.0.1"
+    "@truecms/core": "^6.0.2"
   },
   "devDependencies": {
     "@babel/core": "^7.29.7",

packages/callout/CHANGELOG.md

@@ -1,5 +1,13 @@
 @truecms/callout CHANGELOG
 
+## 5.0.2
+
+### Patch Changes
+
+- Refresh security dependencies and rebuild component distributions with the updated toolchain.
+- Updated dependencies
+  - @truecms/core@6.0.2
+
 ## 5.0.1
 
 ### Patch Changes

packages/callout/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@truecms/callout",
-  "version": "5.0.1",
+  "version": "5.0.2",
   "description": "Use callout to notify and alert users of important snippets of information.",
   "keywords": [
     "auds",
@@ -36,7 +36,7 @@
     "@truecms/core": "workspace:*"
   },
   "peerDependencies": {
-    "@truecms/core": "^6.0.1"
+    "@truecms/core": "^6.0.2"
   },
   "devDependencies": {
     "@babel/core": "^7.29.7",