changesets/changesets

These are source observations and narrowly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include configured executable modules, package-manager subprocesses, caller-selected paths, Git writes, and authenticated GitHub requests. Release application and publication can leave partial effects when later operations fail. Artifact validation and compatibility assumptions deserve focused verification before broader reliance.

• Configured changelog and commit modules are dynamically imported from the consumer's .changeset context with a CLI-context fallback; configuration therefore selects executable code in the invoking process.
  packages/apply-release-plan/src/index.ts#L259-284packages/cli/src/commit/getCommitFunctions.ts#L19-44
• readPlanFile checks only the outer object, plan array, and version; artifact publishing then trusts entry fields and resolves tarball paths, without checking the integrity metadata in the inspected publish path.
  packages/cli/src/commands/publish-plan/getPublishPlan.ts#L60-77packages/cli/src/commands/pack/index.ts#L110-119packages/cli/src/commands/publish/index.ts#L79-90packages/cli/src/commands/publish/index.ts#L149-154
• The publish-plan source explicitly documents that registry identity is omitted and planning/publishing require matching configuration; pnpm and Yarn info queries use fetch-registry behavior rather than publishConfig.registry overrides.
  packages/cli/src/commands/publish-plan/getPublishPlan.ts#L37-44packages/cli/src/lib/pnpm.ts#L95-110packages/cli/src/lib/yarn.ts#L82-89
• applyReleasePlan writes manifests/changelogs sequentially before formatting and changeset cleanup, with no rollback in that sequence; later failures can leave earlier writes. Publishing similarly retains successful publications and tags when another package fails.
  packages/apply-release-plan/src/index.ts#L140-182packages/apply-release-plan/src/index.ts#L190-232packages/cli/src/commands/publish/index.ts#L366-419
• readPreState parses JSON without structural validation and may migrate v2 state by renaming changesets and rewriting pre.json; callers such as status can therefore mutate legacy state through a read-named API.
  packages/pre/src/index.ts#L15-40packages/pre/src/index.ts#L73-112packages/cli/src/commands/status/index.ts#L28-30
• npm pack/publish delegate lifecycle execution to an external CLI; publish passes OTP as an argument and inherits other environment values after clearing OTP variables. pack/output paths and publishConfig.directory are caller/config-selected filesystem boundaries.
  packages/cli/src/lib/npm.ts#L54-59packages/cli/src/lib/npm.ts#L232-243packages/cli/src/lib/npm.ts#L346-374packages/cli/src/commands/pack/index.ts#L52-58
• GitHub helpers can read a consumer-cwd .env and send GITHUB_TOKEN to configured GITHUB_GRAPHQL_URL; changelog commit lookup may deepen shallow clones through git fetch. These are network/credential boundaries visible in source, not actions performed in this investigation.
  packages/get-github-info/src/env.ts#L5-33packages/get-github-info/src/dataloader.ts#L91-120packages/git/src/index.ts#L129-136packages/git/src/index.ts#L186-192
• Two reporting compatibility hypotheses need reproduction: createGitTags records success without checking git.tag's false result, and release-utils.runPublish still extracts 'New tag:' text while current CLI tag formatting emits 'Created git tags:'. (inferred)
  packages/git/src/index.ts#L39-46packages/cli/src/commands/git-tag/utils.ts#L28-40packages/cli/src/commands/git-tag/utils.ts#L57-68packages/release-utils/src/run.ts#L46-85