Bump metcalfc/changelog-generator from 4.7.0 to 4.8.0

[dependabot]

Bumps metcalfc/changelog-generator from 4.7.0 to 4.8.0.

Release notes

Sourced from metcalfc/changelog-generator's releases.

Release v4.8.0

Highlights

Failed changelog generation now fails the step

If the changelog could not be generated — an unresolvable ref, any git error — the action printed an ::error:: annotation and then exited 0. The step went green, outputs.changelog was never set, and downstream steps consumed an empty string without anything indicating a problem.

It now exits non-zero.

[!WARNING] This is a behavior change. A workflow that was quietly passing on a broken changelog will now fail. That is the point — but expect it to surface as new red builds rather than as new errors, since the errors were always being printed.

fetch: true no longer intermittently fails on shallow checkouts

The default fetch path chained two git fetch --depth=1 calls ahead of git fetch --unshallow. Each rewrites .git/shallow while the next has already read it, so git would intermittently abort with:

fatal: shallow file has changed since we read it

Because fetch: true is the default and the exit code was being discarded, this produced a silently empty changelog rather than a visible failure. It was happening in this repository's own CI.

Now a single fetch, requesting --unshallow only when the checkout is actually shallow.

Testing

make test previously ran npm test || echo "no tests available", where npm test was exit 1 — it reported success unconditionally. The project now has a real suite covering changelog.sh against live git fixtures, ref validation, the release scripts, and the built dist/ bundle as the runner executes it. Both fixes above were found by adding it.

Full changelog

• 98b1282 - 4.8.0
• 32f61b2 - fix: make the version bump scripts portable (#466)
• f64bf35 - build(deps-dev): bump eslint from 10.1.0 to 10.8.1 (#460)
• e5f3244 - build(deps-dev): bump brace-expansion from 5.0.5 to 5.0.7 (#448)
• 57d0aa3 - build(deps-dev): bump globals from 17.4.0 to 17.9.0 (#457)
• ce20209 - build(deps-dev): bump prettier from 3.8.1 to 3.9.6 (#454)
• 89d0cce - build(deps): bump actions/attest-build-provenance from 4.1.0 to 4.2.2 (#464)
• daae4ab - build(deps): bump the codeql-action group with 3 updates (#461)
• 58f7ad5 - fix: fail the step when the changelog cannot be generated (#465)
• 4ffdab6 - build(deps-dev): bump @​vercel/ncc from 0.38.4 to 0.44.1 (#441)
• ce7d426 - ci: bump codeql-action to v4.37.1 and group its future updates (#459)
• cbc6a25 - test: replace the no-op test target with a real suite (#458)
• f278f3b - docs: update README example to use actions/checkout v6
• 3f3af1f - fix: bump actions to Node 24-compatible versions
• 10c0451 - fix: pin codeql-action to SHA and document supply chain security

Commits

• 98b1282 4.8.0
• 32f61b2 fix: make the version bump scripts portable (#466)
• f64bf35 build(deps-dev): bump eslint from 10.1.0 to 10.8.1 (#460)
• e5f3244 build(deps-dev): bump brace-expansion from 5.0.5 to 5.0.7 (#448)
• 57d0aa3 build(deps-dev): bump globals from 17.4.0 to 17.9.0 (#457)
• ce20209 build(deps-dev): bump prettier from 3.8.1 to 3.9.6 (#454)
• 89d0cce build(deps): bump actions/attest-build-provenance from 4.1.0 to 4.2.2 (#464)
• daae4ab build(deps): bump the codeql-action group with 3 updates (#461)
• 58f7ad5 fix: fail the step when the changelog cannot be generated (#465)
• 4ffdab6 build(deps-dev): bump @​vercel/ncc from 0.38.4 to 0.44.1 (#441)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)