meta(changelog): Update package versions

packages/astro-plugin/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @codecov/astro-plugin
 
+## 2.0.0
+
+### Major Changes
+
+- 1950efe: Version 2.0.0 addresses critical security issues and dependency updates. It also drops support for Node 18
+
+  Bump `@actions/core` to ^3.0.0 and `@actions/github` to ^9.0.0, and set `engines.node` to `>=20.0.0` to match upstream. **Semver major** because supported Node.js drops below 20 (breaking for anyone still on Node 18).
+
+  **@actions/core** ([actions/toolkit `packages/core/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md))
+
+  - **v3.0.0**: ESM-only release; apps that `require("@actions/core")` directly must use dynamic `import()`. **`@codecov/bundler-plugin-core` bundles `@actions/core` and `@actions/github` into `dist/index.cjs`**, so `require("@codecov/bundler-plugin-core")` (e.g. Rollup/Webpack CJS configs) keeps working.
+  - **v2.x** (between 1.x and 3.x): Node 24 support and `@actions/http-client` upgrades (including 3.x in the 2.x line).
+
+  **@actions/github** ([actions/toolkit `packages/github/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md))
+
+  - **v9.0.0**: ESM-only (same consideration as `@actions/core` for this package). Release notes also note improved TypeScript behavior with ESM and `@octokit/core/types`.
+  - **v8.0.0**: **Minimum Node.js is now 20** (previously 18); Octokit dependencies move to current major lines (`@octokit/core`, REST plugins, request stack).
+  - **v8.0.1**: Dependency updates (`undici`, `@actions/http-client`).
+
+  **Impact here**
+
+  - Runtime behavior we rely on is unchanged: `context` for GitHub Actions metadata and `getIDToken()` for OIDC uploads are still the supported APIs.
+  - **Build**: unbuild inlines `@actions/*` (and their transitive deps) like `@sentry/core`; `failOnWarn: false` suppresses expected “inlined implicit external” noise. Published `dist` is larger (~9 MB CJS) but avoids `ERR_PACKAGE_PATH_NOT_EXPORTED` for CJS consumers.
+  - **Node 18** is no longer a supported runtime for this package; use **Node 20+** (aligned with `@actions/github` 8+ and this repo’s Volta pin on Node 20).
+
+### Patch Changes
+
+- 866e31a: update GitHub Actions workflow permissions
+- Updated dependencies [1950efe]
+- Updated dependencies [866e31a]
+  - @codecov/bundler-plugin-core@2.0.0
+  - @codecov/vite-plugin@2.0.0
+
 ## 1.9.1
 
 ### Patch Changes

packages/astro-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codecov/astro-plugin",
-  "version": "1.9.1",
+  "version": "2.0.0",
   "description": "Official Codecov Astro Plugin",
   "author": "Codecov",
   "license": "MIT",

packages/bundle-analyzer/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @codecov/bundle-analyzer
 
+## 2.0.0
+
+### Major Changes
+
+- 1950efe: Version 2.0.0 addresses critical security issues and dependency updates. It also drops support for Node 18
+
+  Bump `@actions/core` to ^3.0.0 and `@actions/github` to ^9.0.0, and set `engines.node` to `>=20.0.0` to match upstream. **Semver major** because supported Node.js drops below 20 (breaking for anyone still on Node 18).
+
+  **@actions/core** ([actions/toolkit `packages/core/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md))
+
+  - **v3.0.0**: ESM-only release; apps that `require("@actions/core")` directly must use dynamic `import()`. **`@codecov/bundler-plugin-core` bundles `@actions/core` and `@actions/github` into `dist/index.cjs`**, so `require("@codecov/bundler-plugin-core")` (e.g. Rollup/Webpack CJS configs) keeps working.
+  - **v2.x** (between 1.x and 3.x): Node 24 support and `@actions/http-client` upgrades (including 3.x in the 2.x line).
+
+  **@actions/github** ([actions/toolkit `packages/github/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md))
+
+  - **v9.0.0**: ESM-only (same consideration as `@actions/core` for this package). Release notes also note improved TypeScript behavior with ESM and `@octokit/core/types`.
+  - **v8.0.0**: **Minimum Node.js is now 20** (previously 18); Octokit dependencies move to current major lines (`@octokit/core`, REST plugins, request stack).
+  - **v8.0.1**: Dependency updates (`undici`, `@actions/http-client`).
+
+  **Impact here**
+
+  - Runtime behavior we rely on is unchanged: `context` for GitHub Actions metadata and `getIDToken()` for OIDC uploads are still the supported APIs.
+  - **Build**: unbuild inlines `@actions/*` (and their transitive deps) like `@sentry/core`; `failOnWarn: false` suppresses expected “inlined implicit external” noise. Published `dist` is larger (~9 MB CJS) but avoids `ERR_PACKAGE_PATH_NOT_EXPORTED` for CJS consumers.
+  - **Node 18** is no longer a supported runtime for this package; use **Node 20+** (aligned with `@actions/github` 8+ and this repo’s Volta pin on Node 20).
+
+### Patch Changes
+
+- 866e31a: update GitHub Actions workflow permissions
+- Updated dependencies [1950efe]
+- Updated dependencies [866e31a]
+  - @codecov/bundler-plugin-core@2.0.0
+
 ## 1.9.1
 
 ### Patch Changes

packages/bundle-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codecov/bundle-analyzer",
-  "version": "1.9.1",
+  "version": "2.0.0",
   "description": "Official Codecov Bundle Analyzer",
   "author": "Codecov",
   "license": "MIT",

packages/bundler-plugin-core/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @codecov/bundler-plugin-core
 
+## 2.0.0
+
+### Major Changes
+
+- 1950efe: Version 2.0.0 addresses critical security issues and dependency updates. It also drops support for Node 18
+
+  Bump `@actions/core` to ^3.0.0 and `@actions/github` to ^9.0.0, and set `engines.node` to `>=20.0.0` to match upstream. **Semver major** because supported Node.js drops below 20 (breaking for anyone still on Node 18).
+
+  **@actions/core** ([actions/toolkit `packages/core/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md))
+
+  - **v3.0.0**: ESM-only release; apps that `require("@actions/core")` directly must use dynamic `import()`. **`@codecov/bundler-plugin-core` bundles `@actions/core` and `@actions/github` into `dist/index.cjs`**, so `require("@codecov/bundler-plugin-core")` (e.g. Rollup/Webpack CJS configs) keeps working.
+  - **v2.x** (between 1.x and 3.x): Node 24 support and `@actions/http-client` upgrades (including 3.x in the 2.x line).
+
+  **@actions/github** ([actions/toolkit `packages/github/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md))
+
+  - **v9.0.0**: ESM-only (same consideration as `@actions/core` for this package). Release notes also note improved TypeScript behavior with ESM and `@octokit/core/types`.
+  - **v8.0.0**: **Minimum Node.js is now 20** (previously 18); Octokit dependencies move to current major lines (`@octokit/core`, REST plugins, request stack).
+  - **v8.0.1**: Dependency updates (`undici`, `@actions/http-client`).
+
+  **Impact here**
+
+  - Runtime behavior we rely on is unchanged: `context` for GitHub Actions metadata and `getIDToken()` for OIDC uploads are still the supported APIs.
+  - **Build**: unbuild inlines `@actions/*` (and their transitive deps) like `@sentry/core`; `failOnWarn: false` suppresses expected “inlined implicit external” noise. Published `dist` is larger (~9 MB CJS) but avoids `ERR_PACKAGE_PATH_NOT_EXPORTED` for CJS consumers.
+  - **Node 18** is no longer a supported runtime for this package; use **Node 20+** (aligned with `@actions/github` 8+ and this repo’s Volta pin on Node 20).
+
+### Patch Changes
+
+- 866e31a: update GitHub Actions workflow permissions
+
 ## 1.9.1
 
 ### Patch Changes

packages/bundler-plugin-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codecov/bundler-plugin-core",
-  "version": "1.9.1",
+  "version": "2.0.0",
   "description": "Official Codecov Bundler Plugin Core",
   "author": "Codecov",
   "license": "MIT",

packages/nextjs-webpack-plugin/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @codecov/nextjs-webpack-plugin
 
+## 2.0.0
+
+### Major Changes
+
+- 1950efe: Version 2.0.0 addresses critical security issues and dependency updates. It also drops support for Node 18
+
+  Bump `@actions/core` to ^3.0.0 and `@actions/github` to ^9.0.0, and set `engines.node` to `>=20.0.0` to match upstream. **Semver major** because supported Node.js drops below 20 (breaking for anyone still on Node 18).
+
+  **@actions/core** ([actions/toolkit `packages/core/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md))
+
+  - **v3.0.0**: ESM-only release; apps that `require("@actions/core")` directly must use dynamic `import()`. **`@codecov/bundler-plugin-core` bundles `@actions/core` and `@actions/github` into `dist/index.cjs`**, so `require("@codecov/bundler-plugin-core")` (e.g. Rollup/Webpack CJS configs) keeps working.
+  - **v2.x** (between 1.x and 3.x): Node 24 support and `@actions/http-client` upgrades (including 3.x in the 2.x line).
+
+  **@actions/github** ([actions/toolkit `packages/github/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md))
+
+  - **v9.0.0**: ESM-only (same consideration as `@actions/core` for this package). Release notes also note improved TypeScript behavior with ESM and `@octokit/core/types`.
+  - **v8.0.0**: **Minimum Node.js is now 20** (previously 18); Octokit dependencies move to current major lines (`@octokit/core`, REST plugins, request stack).
+  - **v8.0.1**: Dependency updates (`undici`, `@actions/http-client`).
+
+  **Impact here**
+
+  - Runtime behavior we rely on is unchanged: `context` for GitHub Actions metadata and `getIDToken()` for OIDC uploads are still the supported APIs.
+  - **Build**: unbuild inlines `@actions/*` (and their transitive deps) like `@sentry/core`; `failOnWarn: false` suppresses expected “inlined implicit external” noise. Published `dist` is larger (~9 MB CJS) but avoids `ERR_PACKAGE_PATH_NOT_EXPORTED` for CJS consumers.
+  - **Node 18** is no longer a supported runtime for this package; use **Node 20+** (aligned with `@actions/github` 8+ and this repo’s Volta pin on Node 20).
+
+### Patch Changes
+
+- 866e31a: update GitHub Actions workflow permissions
+- Updated dependencies [1950efe]
+- Updated dependencies [866e31a]
+  - @codecov/bundler-plugin-core@2.0.0
+  - @codecov/webpack-plugin@2.0.0
+
 ## 1.9.1
 
 ### Patch Changes

packages/nextjs-webpack-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codecov/nextjs-webpack-plugin",
-  "version": "1.9.1",
+  "version": "2.0.0",
   "description": "Official Codecov NextJS (Webpack) plugin",
   "author": "Codecov",
   "license": "MIT",

packages/nuxt-plugin/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @codecov/nuxt-plugin
 
+## 2.0.0
+
+### Major Changes
+
+- 1950efe: Version 2.0.0 addresses critical security issues and dependency updates. It also drops support for Node 18
+
+  Bump `@actions/core` to ^3.0.0 and `@actions/github` to ^9.0.0, and set `engines.node` to `>=20.0.0` to match upstream. **Semver major** because supported Node.js drops below 20 (breaking for anyone still on Node 18).
+
+  **@actions/core** ([actions/toolkit `packages/core/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md))
+
+  - **v3.0.0**: ESM-only release; apps that `require("@actions/core")` directly must use dynamic `import()`. **`@codecov/bundler-plugin-core` bundles `@actions/core` and `@actions/github` into `dist/index.cjs`**, so `require("@codecov/bundler-plugin-core")` (e.g. Rollup/Webpack CJS configs) keeps working.
+  - **v2.x** (between 1.x and 3.x): Node 24 support and `@actions/http-client` upgrades (including 3.x in the 2.x line).
+
+  **@actions/github** ([actions/toolkit `packages/github/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md))
+
+  - **v9.0.0**: ESM-only (same consideration as `@actions/core` for this package). Release notes also note improved TypeScript behavior with ESM and `@octokit/core/types`.
+  - **v8.0.0**: **Minimum Node.js is now 20** (previously 18); Octokit dependencies move to current major lines (`@octokit/core`, REST plugins, request stack).
+  - **v8.0.1**: Dependency updates (`undici`, `@actions/http-client`).
+
+  **Impact here**
+
+  - Runtime behavior we rely on is unchanged: `context` for GitHub Actions metadata and `getIDToken()` for OIDC uploads are still the supported APIs.
+  - **Build**: unbuild inlines `@actions/*` (and their transitive deps) like `@sentry/core`; `failOnWarn: false` suppresses expected “inlined implicit external” noise. Published `dist` is larger (~9 MB CJS) but avoids `ERR_PACKAGE_PATH_NOT_EXPORTED` for CJS consumers.
+  - **Node 18** is no longer a supported runtime for this package; use **Node 20+** (aligned with `@actions/github` 8+ and this repo’s Volta pin on Node 20).
+
+### Patch Changes
+
+- 866e31a: update GitHub Actions workflow permissions
+- Updated dependencies [1950efe]
+- Updated dependencies [866e31a]
+  - @codecov/bundler-plugin-core@2.0.0
+  - @codecov/vite-plugin@2.0.0
+
 ## 1.9.1
 
 ### Patch Changes

packages/nuxt-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codecov/nuxt-plugin",
-  "version": "1.9.1",
+  "version": "2.0.0",
   "description": "Official Codecov Nuxt plugin",
   "author": "Codecov",
   "license": "MIT",

packages/remix-vite-plugin/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @codecov/remix-vite-plugin
 
+## 2.0.0
+
+### Major Changes
+
+- 1950efe: Version 2.0.0 addresses critical security issues and dependency updates. It also drops support for Node 18
+
+  Bump `@actions/core` to ^3.0.0 and `@actions/github` to ^9.0.0, and set `engines.node` to `>=20.0.0` to match upstream. **Semver major** because supported Node.js drops below 20 (breaking for anyone still on Node 18).
+
+  **@actions/core** ([actions/toolkit `packages/core/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md))
+
+  - **v3.0.0**: ESM-only release; apps that `require("@actions/core")` directly must use dynamic `import()`. **`@codecov/bundler-plugin-core` bundles `@actions/core` and `@actions/github` into `dist/index.cjs`**, so `require("@codecov/bundler-plugin-core")` (e.g. Rollup/Webpack CJS configs) keeps working.
+  - **v2.x** (between 1.x and 3.x): Node 24 support and `@actions/http-client` upgrades (including 3.x in the 2.x line).
+
+  **@actions/github** ([actions/toolkit `packages/github/RELEASES.md`](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md))
+
+  - **v9.0.0**: ESM-only (same consideration as `@actions/core` for this package). Release notes also note improved TypeScript behavior with ESM and `@octokit/core/types`.
+  - **v8.0.0**: **Minimum Node.js is now 20** (previously 18); Octokit dependencies move to current major lines (`@octokit/core`, REST plugins, request stack).
+  - **v8.0.1**: Dependency updates (`undici`, `@actions/http-client`).
+
+  **Impact here**
+
+  - Runtime behavior we rely on is unchanged: `context` for GitHub Actions metadata and `getIDToken()` for OIDC uploads are still the supported APIs.
+  - **Build**: unbuild inlines `@actions/*` (and their transitive deps) like `@sentry/core`; `failOnWarn: false` suppresses expected “inlined implicit external” noise. Published `dist` is larger (~9 MB CJS) but avoids `ERR_PACKAGE_PATH_NOT_EXPORTED` for CJS consumers.
+  - **Node 18** is no longer a supported runtime for this package; use **Node 20+** (aligned with `@actions/github` 8+ and this repo’s Volta pin on Node 20).
+
+### Patch Changes
+
+- 866e31a: update GitHub Actions workflow permissions
+- Updated dependencies [1950efe]
+- Updated dependencies [866e31a]
+  - @codecov/bundler-plugin-core@2.0.0
+  - @codecov/vite-plugin@2.0.0
+
 ## 1.9.1
 
 ### Patch Changes

packages/remix-vite-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codecov/remix-vite-plugin",
-  "version": "1.9.1",
+  "version": "2.0.0",
   "description": "Official Codecov Remix plugin",
   "author": "Codecov",
   "license": "MIT",