Bump @metamask/auto-changelog from 2.5.0 to 3.0.0

[dependabot]

Bumps @metamask/auto-changelog from 2.5.0 to 3.0.0.

Release notes

Sourced from @​metamask/auto-changelog's releases.

3.0.0

Added

• Support alternate tag prefixes (#120)

Changed

• BREAKING: Update minimum Node.js version to v14 (#117)
• Get package version from manifest (#121)

2.6.1

Fixed

• When fetching remote tags, order by date to account for miniscule time differences between tags created within automated tests (#113)

2.6.0

Changed

• Read repository URL from package.json if npm_package_repository_url is not set (#111)
  • This makes this package compatible with Yarn >1.

Changelog

Sourced from @​metamask/auto-changelog's changelog.

[3.0.0]

Added

• Support alternate tag prefixes (#120)

Changed

• BREAKING: Update minimum Node.js version to v14 (#117)
• Get package version from manifest (#121)

[2.6.1]

Fixed

• When fetching remote tags, order by date to account for miniscule time differences between tags created within automated tests (#113)

[2.6.0]

Changed

• Read repository URL from package.json if npm_package_repository_url is not set (#111)
  • This makes this package compatible with Yarn >1.

Commits

• d0180b1 3.0.0 (#128)
• a07faff Make prepack.sh script executable (#126)
• ba6a56f Update GitHub actions to match module template (#125)
• f9a33a7 Refactor: return on same line as error (#122)
• f5c527c Get package version from manifest (#121)
• 9b92825 Migrate to Yarn v3 (#123)
• 5cc4d22 Support alternate tag prefixes (#120)
• 53a6d42 Update ESLint configuration and packages (#118)
• 391806b Update GitHub actions to resolve deprecation warnings (#119)
• 2b1d934 Update minimum Node.js version to v14 (#117)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by metamaskbot, a new releaser for @​metamask/auto-changelog since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Socket Security Pull Request Report

Dependency issues detected. If you merge this pull request, you will not be alerted to the instances of these issues again.

😵‍💫 Bin script confusion

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack

Consider removing one of the conflicting packages. Packages should only export bin scripts with their name

Package	Bin script	Location
[email protected] (added)	jest	package.json
[email protected] (added)	jest	package.json via [email protected]

Pull request report summary

Issue	Status
Install scripts	✅ 0 issues
Native code	✅ 0 issues
Bin script confusion	⚠️ 2 issues
Bin script shell injection	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] [email protected]

• @SocketSecurity ignore [email protected]
• @SocketSecurity ignore [email protected]

Powered by socket.dev

[Gudahtt]

@SocketSecurity ignore [email protected] [email protected]

False positive; these were not changed here. And in this case, the jest bin script points directly at jest-cli so they're equivalent.

[Gudahtt]

LGTM!

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.