Contributing Guidelines
Relevant source files
The following files were used as context for generating this wiki page:
These guidelines outline the standards and procedures for contributing to the node-semver project. The project follows the established norms of the npm organization, emphasizing code quality through automated testing, strict commit conventions, and adherence to a professional code of conduct.
The scope of contribution covers bug reports, new feature implementations, and documentation updates. However, the project maintains strict boundaries regarding third-party dependencies and core tooling automation, which are managed exclusively by the core maintenance team. Sources: CONTRIBUTING.md:1-53, CODE_OF_CONDUCT.md:1-8
Code of Conduct and Security
All contributors must adhere to the npm Code of Conduct. The npm CLI team reserves the right to moderate or remove any interactions, including issues and pull requests, to maintain a professional environment. Sources: CODE_OF_CONDUCT.md:1-8
Security vulnerabilities should never be reported via public issues. Instead, they should be directed through private channels:
- GitHub Bug Bounty Program: For eligible findings via HackerOne.
- Direct Email: For non-bounty reports via
opensource-security@github.com.
Sources: SECURITY.md:1-20
Pull Request Conventions
The project enforces specific structures for contributions to ensure maintainable history and automated versioning.
Commit Messages
node-semver utilizes Conventional Commits. Each commit or the pull request title must use specific prefixes that dictate the subsequent Semantic Versioning (SemVer) release type. Sources: CONTRIBUTING.md:21-34
| Prefix | Purpose | Resulting Version Bump |
|---|---|---|
feat | Introducing a new feature | Minor |
fix | Bug fixes | Patch |
docs | Documentation updates | Patch |
chore | Changes not affecting the published module (e.g., tests) | None |
Sources: CONTRIBUTING.md:27-34, internal/constants.js:20-28
Development Workflow
Contributors must ensure that code passes all local validation before submission. The automation pipeline follows a specific sequence of checks.
The npm test command executes the tap test suite with a 100% coverage requirement and a 30-second timeout. Linting is automatically triggered after tests pass via the posttest hook. Sources: package.json:7-14, CONTRIBUTING.md:36-44
Tooling and Restrictions
The project uses @npmcli/template-oss to manage configuration files and CI environments.
Prohibited Contributions
- Dependencies: Third-party dependency updates or pull requests are not accepted.
- Automation: Changes to files in
.github/*,.eslintrc.json, or.licensee.jsonare prohibited as these are automatically generated.
Sources: CONTRIBUTING.md:46-56
Testing Environment
The project maintains compatibility with older versions of Node.js to ensure broad stability.
Summary
Contributing to node-semver requires strict adherence to automated quality gates, including 100% test coverage and conventional commit formatting. By maintaining these standards, the project ensures that its role as a fundamental parser for the npm ecosystem remains reliable across diverse Node.js environments. Sources: CONTRIBUTING.md, package.json