Do not depend on github-changes

[nicolasstucki]

Last version was published 2 years ago and it has transitive dependencies that have security warnings .

https://www.npmjs.com/package/github-changes

[nicolasstucki]

We only use it here

vscode-scala-syntax/bin/ci-release.sh

Line 31 in 17a7bdb

yarn github-changes -o scala -r vscode-scala-syntax --no-merges -t "Scala Syntax (official) Changelog" -k $GITHUB_TOKEN

[nicolasstucki]

This code was copied from
https://github.com/scalameta/metals-vscode/blob/65cf8d10638f437b966a216a9d27225b362dee46/.travis.yml#L29

@gabro do you remember what this command did exactly? I wonder if there is a newer library that would do the same.

[gabro]

@nicolasstucki that command generates https://github.com/scalameta/metals-vscode/blob/master/CHANGELOG.md

The library was picked arbitrarily (literally the first one that did the job I needed) so there may be newer alternatives.

That said, the library is not even used by the plugin, so you can avoid the security warning by removing the dependency and installing it ad-hoc in the CI.

Something like:

npx github-changes -o scalameta -r metals-vscode --no-merges -t "VSCode Extension Changelog" -k $GITHUB_TOKEN