When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

https://github.com/changesets/changesets/releases/tag/%40changesets/cli%403.0.3

Key Changes:

• Fixed semver ranges (such as >=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies (PR #2297)
• Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages (PR #2276)

Updated Dependencies:

• @​changesets/apply-release-plan@​8.1.1
• @​changesets/config@​4.0.1

• Risk: 🟢 Low
• Known vulnerabilities: None found. No CVE or GHSA advisories affecting @​changesets/cli versions 3.0.2 or 3.0.3.
• Supply-chain notes: No red flags detected. Package is maintained by the established Changesets team. No unexpected new dependencies, no lifecycle scripts, no maintainer changes. This is a legitimate patch release addressing compatibility issues.

Background on the pnpm/npm compatibility fix: This release addresses a crash that occurred when using pnpm 10 with npm 12+ in CI environments. The issue was that pnpm ≤10 delegates pnpm view commands to the underlying npm binary, and npm 12 changed its response format to array-wrap certain fields. The parser in @​changesets/cli didn't handle this format, causing changeset publish to crash. This is now fixed.

None. This is a patch release with only bug fixes.

🐛 Bug Fixes

1. Semver Range Preservation

   • Issue: When updating internal dependencies, semver ranges like >=1.0.0 <2.0.0 were being incorrectly truncated to >=2.0.0
   • Fix: Semver ranges are now preserved correctly during dependency updates
   • Impact: Ensures accurate version constraints in monorepo internal dependencies

2. pnpm 10 + npm 12 Compatibility

   • Issue: changeset publish crashed when using pnpm 10 with npm 12+ due to changed response format
   • Fix: Parser now correctly handles npm 12's array-wrapped response format
   • Impact: Allows CI pipelines using pnpm 10 with npm 12 to publish successfully

📁 Usage Locations

@​changesets/cli is used in the following 5 files:

1. package.json

   "@​changesets/cli": "3.0.3"

   • Feature used: Package installation as devDependency
   • Impact: None — version updated only

2. .changeset/config.json

   "$schema": "https://unpkg.com/@​changesets/config@​4.0.0/schema.json"

   • Feature used: Configuration schema reference
   • Impact: None — schema reference is to @​changesets/config (a separate package), not @​changesets/cli

3. .github/workflows/release.yml

   - name: Create Release PR or Publish
     id: changesets
     uses: changesets/action@​ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
     with:
       publish-script: "pnpm changeset publish"

   • Feature used: changeset publish command in release workflow
   • Impact: Positive — The pnpm 10/npm 12 compatibility fix directly benefits this workflow, preventing potential publish failures

4. .github/workflows/changeset-check.yml

   pnpm changeset status --since "origin/$BASE_REF"

   • Feature used: changeset status command for validating changesets in PRs
   • Impact: None — status command not affected by these fixes

5. .github/workflows/changeset-check.yml

   pnpm changeset version

   • Feature used: changeset version command for dry-run version bumps
   • Impact: Positive — The semver range fix ensures correct version constraint updates during this dry-run

Additional Usage Patterns:

• Developers use pnpm changeset locally to create changeset files (documented in README.md and docs/)
• The .changeset/ directory contains changeset configuration and files managed by this tool
• Multiple GitHub workflows reference changeset concepts but don't directly invoke the CLI

Verification Completed:

• ✅ Executed comprehensive search for @​changesets/cli and changeset command usage
• ✅ Verified all workflow files using changesets CLI
• ✅ Confirmed package.json dependency entry
• ✅ Checked configuration files for changeset references
• ✅ No indirect dependencies requiring code changes