release: v4.8.7

[jaredwray]

Release summary

Dependency upgrades, supply chain hardening, and OIDC publishing migration.

ecto@4.8.7 — 2026-05-25

Dependency upgrades, supply chain hardening, and OIDC publishing migration.

Internal

• migrate release workflow to OIDC with provenance (904bc8e, Migrate release workflow to OIDC with provenance #370)
• remove pnpm cache from release workflow (62e5a74, Migrate release workflow to OIDC with provenance #370)
• remove registry-url from setup-node for pure OIDC publishing (658e90e, Migrate release workflow to OIDC with provenance #370)
• upgrade code quality dependencies (d870ee6, ecto - chore: upgrade code quality dependencies #371)
• upgrade TypeScript and build tooling (b1cc58d, ecto - chore: upgrade TypeScript and build tooling #372)
• upgrade GitHub Actions (49f6e40, ecto - chore: upgrade GitHub Actions (breaking) #373)
• upgrade docula (9f4f7aa, ecto - chore: upgrade docula (breaking) #374)
• harden pnpm-workspace.yaml with supply chain controls (89602d0, ecto - chore: harden pnpm-workspace.yaml with supply chain controls #375)

Contributors

• @jaredwray (8)

Full List of Changes

• Migrate release workflow to OIDC with provenance by @jaredwray in Migrate release workflow to OIDC with provenance #370
• ecto - chore: upgrade code quality dependencies by @jaredwray in ecto - chore: upgrade code quality dependencies #371
• ecto - chore: upgrade TypeScript and build tooling by @jaredwray in ecto - chore: upgrade TypeScript and build tooling #372
• ecto - chore: upgrade GitHub Actions (breaking) by @jaredwray in ecto - chore: upgrade GitHub Actions (breaking) #373
• ecto - chore: upgrade docula (breaking) by @jaredwray in ecto - chore: upgrade docula (breaking) #374
• ecto - chore: harden pnpm-workspace.yaml with supply chain controls by @jaredwray in ecto - chore: harden pnpm-workspace.yaml with supply chain controls #375

Full diff: v4.8.6...v4.8.7

Verification

• pnpm install --frozen-lockfile succeeds
• pnpm build succeeds
• pnpm test passes (237 tests, 100% coverage)
• No uncommitted changes outside the version bump

Post-merge

Merge, then create a GitHub Release at tag v4.8.7 — the release.yaml workflow publishes to npm with OIDC provenance.

---

Generated by Claude Code

[gemini-code-assist]

Code Review

This pull request updates the version of the 'ecto' package from 4.8.6 to 4.8.7 in package.json. There are no review comments, and I have no feedback to provide.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (3ec0044) to head (305b75e).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #376   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines          413       413           
  Branches        96        96           
=========================================
  Hits           413       413           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.