# Release Management

> Manages versioning and releases for cursor-javascript-security-skills and projects using these security skills. Use when creating a GitHub release, updating CHANGELOG, tagging versions, or when the user asks about release process for security skills.

- Skill: `leo4135/release-management` (Agent Skill)
- Install (CLI): `npx skillmds@latest add leo4135/release-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/leo4135/release-management/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: leo4135 (https://skillmd.com/u/leo4135)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/leo4135/release-management

---


# Release Management

## Semantic Versioning

This project follows [SemVer](https://semver.org/):

| Change Type | Version Bump | Examples |
|-------------|--------------|----------|
| Breaking skill API / removed skills | MAJOR (X.0.0) | Renamed skill, changed report format |
| New skills or significant additions | MINOR (0.X.0) | Added Svelte checks, new OWASP section |
| Fixes, typos, minor updates | PATCH (0.0.X) | Corrected regex, fixed broken link |

## Release Checklist

```
Release vX.Y.Z:
- [ ] All skills reviewed for accuracy
- [ ] CHANGELOG.md updated
- [ ] Version references updated in README (if applicable)
- [ ] No secrets or environment-specific paths in skills
- [ ] Git tag created: vX.Y.Z
- [ ] GitHub Release published with notes
- [ ] Release assets verified (if any)
```

## CHANGELOG Format

Follow [Keep a Changelog](https://keepachangelog.com/):

```markdown
## [X.Y.Z] - YYYY-MM-DD

### Added
- New skill: `framework-security-checks` for Hono

### Changed
- Updated OWASP checks for 2025 draft categories

### Fixed
- Corrected Express path traversal regex in audit-checklists

### Security
- Updated dependency-audit rules for npm audit v4 output
```

Categories: `Added`, `Changed`, `Deprecated`, `Removed`, `Fixed`, `Security`

## Creating a GitHub Release

```bash
# Ensure clean state
git status
git pull

# Update CHANGELOG, commit
git add CHANGELOG.md
git commit -m "chore: prepare release v1.0.0"

# Tag
git tag -a v1.0.0 -m "Release v1.0.0 — Initial public release"

# Push tag
git push origin v1.0.0
```

### GitHub CLI

```bash
gh release create v1.0.0 \
  --title "v1.0.0 — Initial Public Release" \
  --notes-file RELEASE_NOTES.md
```

### Release Notes Template

```markdown
## cursor-javascript-security-skills v1.0.0

First public release of security audit skills for Cursor IDE.

### Included Skills
- `javascript-security-audit` — Full audit orchestrator
- `audit-checklists` — Security checklists
- `threat-modeling` — STRIDE threat models
- `framework-security-checks` — React, Next.js, Express, Vue, Svelte, Hono
- `dependency-audit` — npm/yarn/pnpm vulnerability scanning
- `owasp-javascript` — OWASP Top 10 mapping
- `supply-chain-security` — Supply chain integrity
- `security-bug-reporting` — Vulnerability report format
- `release-management` — This release workflow

### Installation
\`\`\`bash
git clone https://github.com/OWNER/cursor-javascript-security-skills.git
cp -r cursor-javascript-security-skills/skills/* ~/.cursor/skills/
\`\`\`

### Full Changelog
https://github.com/OWNER/cursor-javascript-security-skills/blob/main/CHANGELOG.md
```

## Branch Strategy

| Branch | Purpose |
|--------|---------|
| `main` | Stable, release-ready |
| `develop` | Integration (optional) |
| `feature/*` | New skills or improvements |

Releases are tagged from `main`.

## Post-Release

1. Verify skills load in Cursor (copy to `~/.cursor/skills/`, test with audit prompt)
2. Monitor issues for installation problems
3. Plan next version in CHANGELOG `[Unreleased]` section

## Version in Skill Metadata

Skills do not embed version numbers in `SKILL.md` frontmatter — versioning is at repo level via git tags. Users pin by cloning a specific tag:

```bash
git clone --branch v1.0.0 https://github.com/OWNER/cursor-javascript-security-skills.git
```