release: v1.1.0 by mBukator · Pull Request #123 · mBukator/merlin-commit

mBukator · 2026-10-18T21:06:37Z

🎯 Overview

Minor release v1.1.0. It brings custom themes (#122) from develop to main. Setting "theme": "custom" applies a customTheme block from the user or project .merlinrc.json, overriding only the listed messages on top of the wizard or standard base theme.

✨ Changes

Release

Version bump and changelog:

Bump version 1.0.2 -> 1.1.0
Add the 1.1.0 CHANGELOG entry

Included since 1.0.2

Added:

Custom themes via "theme": "custom" and customTheme: { extends: "wizard" | "standard", messages: {...} }. Unlisted messages fall back to the base theme, which also decides decoration (emoji columns, menu icons). The three template messages take {field}, {maxCharacters} and {fileName} placeholders, filled by plain string substitution (feat(themes): add custom theme overrides via customTheme config #122)
Validation of overrides against the built-in theme shape. C0/C1 control characters and bidi overrides are stripped, and messages are capped at 200 code points (feat(themes): add custom theme overrides via customTheme config #122)
custom option in the merlin config theme picker, and the active customTheme in merlin config --show (feat(themes): add custom theme overrides via customTheme config #122)
Custom Themes section and message key reference in docs/usage/themes.md, plus customTheme in docs/reference/config-schema.md and docs/reference/configuration.md (feat(themes): add custom theme overrides via customTheme config #122)

Changed:

DEFAULT_CONFIG now includes an empty customTheme, so the next save to ~/.merlinrc.json writes a starter { "extends": "wizard", "messages": {} } block. It has no effect unless theme is "custom". Saving from merlin config keeps a hand-written customTheme exactly as written (feat(themes): add custom theme overrides via customTheme config #122)

🔧 Technical Details

Files Added/Modified:

✅ src/utils/theme.ts - resolve, validate, compile and merge custom themes
📝 src/lib/config-loader.ts - merge custom overrides over the base theme in getMessages()
📝 src/utils/config.ts, src/utils/constants.ts, src/types/config.ts, src/types/theme.ts, src/types/index.ts - customTheme config, validation and types
📝 src/commands/config.ts - custom picker option and --show output; menu decoration follows the base theme
📝 src/lib/prompt.ts - emoji columns follow the base theme via resolveBaseTheme()
✅ tests/unit/theme.test.ts, 📝 five other test files - custom theme coverage
📝 docs/usage/themes.md, docs/reference/config-schema.md, docs/reference/configuration.md - custom theme docs
📝 package.json / package-lock.json - version 1.1.0
📝 CHANGELOG.md - 1.1.0 entry

Merge commit from main: v1.0.2 was squash-merged, so main's tree matched develop at the #120 sync point but git no longer saw a shared history. Merging origin/main reported conflicts in CHANGELOG.md, package.json and package-lock.json. All three were resolved to the release branch side, and the merge commit changes no files. The diff shown here is exactly #122 plus the version bump.

📋 Testing

How to Test:

npm ci
npm run lint && npm run type-check && npm run knip && npm test && npm run build
npx prettier --check "src/**/*.ts" "tests/**/*.ts" "docs/**/*.md"
npm audit                      # found 0 vulnerabilities
node bin/merlin.js --version   # 1.1.0
npm pack --dry-run             # merlin-commit@1.1.0, 100 files, 72.7 kB

Expected Behavior:

All gates pass. npm audit reports 0 vulnerabilities, and the packed tarball is version 1.1.0.

Test Coverage:

Test Files  21 passed (21)
     Tests  568 passed (568)

🔗 Related Issues

Relates to #122

✅ Checklist

Code follows project coding standards
Self-review completed
Tests added/updated and passing
Documentation updated (if needed)
No new warnings introduced
Commit messages follow conventional commits

📝 Notes

Dependabot #121 (dev-dependencies group) is deliberately left out and will go in the next release.

After merge: tag v1.1.0 on main. Pushing the tag runs release.yml, which publishes to npm. Then sync the release back to develop.

…#89) The Dependabot dev-dependency bump upgraded @typescript-eslint/eslint-plugin to ^8.60.0 in package.json but did not regenerate the lock file, so npm ci on CI installed a stale version that lacked the no-useless-assignment rule. Regenerated the lock file to pin the plugin at 8.60.0, then fixed the 20 errors it surfaced. Two config menu loops assigned running = false before an immediate return - simplified to while (true) with exits via return only. Eighteen redundant as-cast assertions in the commitlint-sync and constants test files were removed since TypeScript already infers the correct types.

The three-layer architecture with barrel re-exports in types/index.ts makes orphaned exports and unused dependencies easy to accumulate unnoticed, since nothing in the build fails when an export loses its last importer. Add knip to trace the real import graph from src and flag unreachable files, exports, and dependencies. Wire it into the CI pipeline and the pre-push hook so issues are caught before they reach the remote, and configure it to ignore the husky binary and the config-only packages (@commitlint/cli, lint-staged) that are never imported in source. Document the script in the contributing guide and add it to the pre-PR quality check chain.

…95) Adding the knip row to the development scripts table widened its "When to use" column, but the surrounding rows merged without being re-padded, so the committed table failed prettier --check. Re-pad every row to the new column width. This is a whitespace-only change with no edits to the table's text content.

The CI format check and the format script only covered src, so Prettier violations in docs and tests were never caught. A contributing-guide edit had already merged with a misaligned table because of this gap, and the script and check used different globs, so running format locally could not always fix what CI verified. Reformat the existing offenders (five docs files, .prettierrc, and eslint.config.mjs) so the wider check passes, then extend both the format script and the CI check to the same scope: src, tests, and docs markdown. Keeping the two globs identical means npm run format fixes exactly what CI checks. Root-level markdown is left out to avoid matching untracked files.

The MIT license named "Avilo Labs" as the copyright holder, which is not the actual author of the project. Update the copyright line to Maksym Bukator.

npm audit and Dependabot flagged three advisories in transitive development dependencies: a high and moderate in vite (server.fs.deny bypass and launch-editor NTLM disclosure), a high in flatted (prototype pollution), and a moderate in js-yaml (quadratic-complexity DoS). Update the lock file to pull patched versions: vite 8.1.3, flatted 3.4.2, and js-yaml 4.3.0.

Dependabot had no target-branch configured, so it opened every update PR against the default branch (main), conflicting with the develop-first workflow and pushing dependency changes onto main ahead of develop. Set target-branch: develop on both the npm and github-actions update blocks so future PRs open against develop and follow the normal flow.

Back-merge the v1.0.1 release commit from main, bringing the version bump and changelog entry into develop so the branches stay reconciled.

The weekly dev-dependencies group PR was permanently failing npm ci. Dependabot bundles every dev dependency into unsatisfiable bump blocked 13 unrelated safe updates. The group bumped typescript to ^7.0.2, which no stable typescript-eslint release supports - @typescript-eslint/eslint-plugin@8.67.0, the current latest, still declares a peer range of typescript ">=4.8.4 <6.1.0". Only 8.67.1-alpha.* prereleases exist beyond that, so the bump cannot resolve until upstream ships TypeScript 7 support. Scope the ignore rule to version-update:semv patch and minor typescript updates keep flowing. The rationale and the removal condition are documented inline in the config. Closing #107 alone would not have helped - Dependabot would recreate the identical failing PR on the next weekly run. Relates to #107

Update chalk 5 to 6, execa 9 to 10, @inquirer/prompts to 8.6.0 and ora to 9.4.1. Both majors raise their Node floor to 22, so correct the declared engines range alongside them. The >=18 claim was already inaccurate: commander@15 requires Node >=22.12.0, so v1.0.1 could not install or run on Node 18 or 20 despite advertising support. This corrects a false declaration rather than removing working functionality; Node 18 and 20 are both end-of-life. Three safeguards hid the drift: npm ci only warns on EBADENGINE, CI pinned a single Node 20 job below the real floor, and execa is mocked throughout the test suite. Move CI and release workflows to Node 22 so the supported floor is actually exercised. No source changes were needed. Only chalk colour helpers are used, and every execa call site uses the execa(file, argsArray) form - neither the removed execaCommand() nor the relocated ChildProcess methods are touched. @inquirer/prompts 8.5.2 hardens external-editor temp files, which back the editor flow in lib/editor-wrapper.ts. Verified against real git with execa 10 rather than the test mocks: isGitRepo, getRepoRoot and getStagingCandidates all behave correctly, and the CLI renders help and version. CI run 32578611999 confirms Node v22.23.2 with zero EBADENGINE warnings across the run. Relates to #110

Replace the static logo at the top of the README with an animated SVG banner: Merlin on a turning summoning circle, pulsing eye beams, a blink, twinkling hat stars and a sheen across the wordmark. Pure SVG and CSS, so it animates inside GitHub's image sandbox where scripts and external fonts are blocked. It shows a still frame when prefers-reduced-motion is set. Remove merlin-logo-large.svg: the banner replaces it and nothing else in the repo references it.

…y with 3 updates (#116) Bumps the production-dependencies group with 3 updates in the / directory: [@inquirer/prompts](https://github.com/SBoudrias/Inquirer.js), [chalk](https://github.com/chalk/chalk) and [execa](https://github.com/sindresorhus/execa). Updates `@inquirer/prompts` from 8.6.0 to 8.7.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/SBoudrias/Inquirer.js/releases">@inquirer/prompts's releases</a>.</em></p> <blockquote> <h2><code>@inquirer/prompts</code><a href="https://github.com/8"><code>@8</code></a>.7.3</h2> <h3>What's new</h3> <ul> <li><code>search()</code> no longer submits a stale choice when Enter is pressed while an async search is still loading — the prompt waits for the fresh results, the query is preserved, and repeated Enter presses during validation no longer run the async validator more than once (<code>@inquirer/search</code>, <a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2291">#2291</a>, closes <a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2290">#2290</a>).</li> <li><code>confirm()</code> now always accepts the single keystrokes <code>y</code>/<code>n</code> even with localized keywords, and unrecognized input no longer silently falls back on the default answer (<code>@inquirer/confirm</code>, <a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2281">#2281</a>, closes <a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2279">#2279</a>).</li> <li><code>expand()</code> and <code>rawlist()</code> now ignore surrounding whitespace in answers (<code>@inquirer/expand</code>, <code>@inquirer/rawlist</code>, <a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2280">#2280</a>).</li> <li>All package READMEs now document the Deno install command (<code>deno add npm:@inquirer/prompts</code>) alongside the npm/yarn/pnpm/bun ones (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2269">#2269</a>).</li> </ul> <h3>Included</h3> <ul> <li><code>@inquirer/checkbox@^5.2.6</code></li> <li><code>@inquirer/confirm@^6.3.3</code></li> <li><code>@inquirer/editor@^5.3.4</code></li> <li><code>@inquirer/expand@^5.1.6</code></li> <li><code>@inquirer/input@^5.1.7</code></li> <li><code>@inquirer/number@^4.2.4</code></li> <li><code>@inquirer/password@^5.2.3</code></li> <li><code>@inquirer/rawlist@^5.3.6</code></li> <li><code>@inquirer/search@^4.3.4</code></li> <li><code>@inquirer/select@^5.2.6</code></li> </ul> <h2><code>@inquirer/prompts</code><a href="https://github.com/8"><code>@8</code></a>.7.2</h2> <h3>What's new</h3> <ul> <li>Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach keypress handlers after the prompt was done, cancelled, or aborted (<code>@inquirer/core</code>, <a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2255">#2255</a>, closes <a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/1816">#1816</a>).</li> <li><code>confirm()</code> now trims surrounding whitespace from answers before matching yes/no keywords (<code>@inquirer/confirm</code>, <a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2254">#2254</a>).</li> </ul> <h3>Included</h3> <ul> <li><code>@inquirer/checkbox@^5.2.5</code></li> <li><code>@inquirer/confirm@^6.3.2</code></li> <li><code>@inquirer/editor@^5.3.3</code></li> <li><code>@inquirer/expand@^5.1.5</code></li> <li><code>@inquirer/input@^5.1.6</code></li> <li><code>@inquirer/number@^4.2.3</code></li> <li><code>@inquirer/password@^5.2.2</code></li> <li><code>@inquirer/rawlist@^5.3.5</code></li> <li><code>@inquirer/search@^4.3.3</code></li> <li><code>@inquirer/select@^5.2.5</code></li> </ul> <h2><code>@inquirer/prompts</code><a href="https://github.com/8"><code>@8</code></a>.7.1</h2> <h3>What's new</h3> <ul> <li>All bundled prompts now pin <code>@inquirer/type</code> to an exact version in their published manifests. Since these type definitions leak into consumers' <code>tsc</code> runs, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2247">#2247</a>, fixes <a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2244">#2244</a>).</li> </ul> <h3>Included</h3>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/a9436bd94d55a439df308f50e77a7cd0b2078e98"><code>a9436bd</code></a> chore(release): bump <code>@inquirer/type</code> range to ^4.2.0</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/61be5dfa976ff5c28ebde6c8cfdad5cd3738a152"><code>61be5df</code></a> chore: Publish new release</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/7dc77e281228214e19ccacbb52cbfcf58481d3cc"><code>7dc77e2</code></a> fix(search): prevent submissions while the prompt is loading</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/73b5eab2b8fafa9501724a2708135862a0f3e126"><code>73b5eab</code></a> docs: document Deno installation (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2269">#2269</a>)</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/79a092acb411703d70d1a463e1b1dd3b885ab43f"><code>79a092a</code></a> ci: add Deno compatibility test suite (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2271">#2271</a>)</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/148a96acb7f8e840e840e4a7de771a598d92d6db"><code>148a96a</code></a> chore: enable vitest fsModuleCache to persist transforms across runs</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/e928543051dbef7750cb271335d236ad5790031b"><code>e928543</code></a> chore: bump yarn to 4.18.1 via corepack</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/2348c7ba4bbbd1c2a848b9785b19bdf30e4daa36"><code>2348c7b</code></a> fix(external-editor): use BSD/GNU-compatible truncate flag in test</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/3c1fdb3242bd31bcb025555eb1731ac742ead18f"><code>3c1fdb3</code></a> fix(confirm): always accept y/n and reject unrecognized input (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2281">#2281</a>)</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/eae8b3e2622b4f3c790968a2694ccddcabac2872"><code>eae8b3e</code></a> fix(expand, rawlist): ignore surrounding whitespace in answers (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2280">#2280</a>)</li> <li>Additional commits viewable in <a href="https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/prompts@8.6.0...@inquirer/prompts@8.7.3">compare view</a></li> </ul> </details> <br /> Updates `chalk` from 6.0.0 to 6.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/chalk/chalk/releases">chalk's releases</a>.</em></p> <blockquote> <h2>v6.0.1</h2> <ul> <li>Fix inconsistent coercion of two arguments 9c93a04</li> </ul> <hr /> <p><a href="https://github.com/chalk/chalk/compare/v6.0.0...v6.0.1">https://github.com/chalk/chalk/compare/v6.0.0...v6.0.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/chalk/chalk/commit/47fc05abd46171b235e24174cd2dba83d25bf037"><code>47fc05a</code></a> 6.0.1</li> <li><a href="https://github.com/chalk/chalk/commit/9c93a04eae27fb1801764fbd60eb0811e2068b83"><code>9c93a04</code></a> Fix inconsistent coercion of two arguments</li> <li><a href="https://github.com/chalk/chalk/commit/8960ada92ca0f9220c8863495bae78dcc0c323ee"><code>8960ada</code></a> Meta tweaks</li> <li>See full diff in <a href="https://github.com/chalk/chalk/compare/v6.0.0...v6.0.1">compare view</a></li> </ul> </details> <br /> Updates `execa` from 10.0.1 to 10.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sindresorhus/execa/releases">execa's releases</a>.</em></p> <blockquote> <h2>v10.1.0</h2> <h3>Behavior changes</h3> <p>These are bug fixes, but they might affect code that relied on the previous incorrect behavior.</p> <ul> <li><a href="https://github.com/sindresorhus/execa/blob/HEAD/docs/api.md#optionsextendenv"><code>extendEnv: false</code></a> without the <a href="https://github.com/sindresorhus/execa/blob/HEAD/docs/api.md#optionsenv"><code>env</code></a> option no longer inherits <code>process.env</code>, per docs 67acf60</li> <li>Windows: Arguments of <code>.cmd</code> and <code>.bat</code> files are now escaped like Rust does, which fixes batch files reading <code>%~1</code> (<a href="https://redirect.github.com/sindresorhus/execa/issues/1261">#1261</a>) 93bddc4</li> <li>Invalid <a href="https://github.com/sindresorhus/execa/blob/HEAD/docs/api.md#optionsstdio"><code>stdio</code></a> values, such as negative file descriptors, now throw c6bd387</li> <li>Using the same file as input and output now throws, even when the paths are written differently 587045a</li> <li>Synchronous methods now enforce per-file-descriptor <a href="https://github.com/sindresorhus/execa/blob/HEAD/docs/api.md#optionsmaxbuffer"><code>maxBuffer</code></a> values 9547e51</li> <li>Synchronous methods now throw on the <code>signal</code> option, like asynchronous methods 59de065</li> <li>Synchronous methods now write the raw output bytes to files, like asynchronous methods af6264a</li> </ul> <h3>Fixes</h3> <ul> <li>Fix <code>subprocess.kill()</code> signaling the current process group when the subprocess failed to spawn 5464d43</li> <li>Fix crashes when spawning fails with <code>EMFILE</code>/<code>ENFILE</code> (<a href="https://redirect.github.com/sindresorhus/execa/issues/1262">#1262</a>), or when a file target cannot be opened 15c46cd 1cee524</li> <li>Fix <code>error.stdout</code> and <code>error.stderr</code> being <code>undefined</code> when synchronous methods fail to spawn (<a href="https://redirect.github.com/sindresorhus/execa/issues/1263">#1263</a>) bfe4633</li> <li>Fix the subprocess promise hanging until an output stream is read 004f3b3</li> <li>Fix <code>subprocess.pipe()</code> with the <code>stdio</code> option, and destination subprocesses left running 8d3f0a9 ecda56b</li> <li>Fix <code>result.all</code> when only some file descriptors are buffered or split into lines 758768f</li> <li>Fix the <code>encoding</code> option and line splitting in transforms 6adb3c3</li> <li>Fix input and output transforms with synchronous methods 516a5e2 e0b5dbc</li> <li>Fix template strings with emojis and line continuations b67f199</li> <li>Fix <code>killDescendants</code> signaling unrelated processes on Windows 9c5c71c</li> <li>Fix IPC with <code>serialization: 'json'</code>, <code>strict: true</code> and the <code>verbose</code> option 9842f1a 698a1b8 b548d8b</li> <li>Fix the subprocess error being hidden when the current directory was deleted 91d9ded</li> <li>Fix shebang scripts on Windows when the file is small 7c1a631</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/execa/compare/v10.0.1...v10.1.0">https://github.com/sindresorhus/execa/compare/v10.0.1...v10.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sindresorhus/execa/commit/63ddae6aeb6934da06fdb3754647791e58cd87c3"><code>63ddae6</code></a> 10.1.0</li> <li><a href="https://github.com/sindresorhus/execa/commit/cfac59fc3f026d60b56dcc67df69a67ae4f5b4a9"><code>cfac59f</code></a> Fix CI</li> <li><a href="https://github.com/sindresorhus/execa/commit/1cee524b9cbd726becb17c665a4e2e0ff0129623"><code>1cee524</code></a> Fix an uncaught error when a file target cannot be opened and the subprocess ...</li> <li><a href="https://github.com/sindresorhus/execa/commit/15c46cd4c2b6ea529f063a47934543186c56aa27"><code>15c46cd</code></a> Fix <code>execa()</code> crashing when spawning fails with <code>EMFILE</code> or <code>ENFILE</code></li> <li><a href="https://github.com/sindresorhus/execa/commit/54d7404b479fed61b0371655e7afe011b2d34f74"><code>54d7404</code></a> Tweaks</li> <li><a href="https://github.com/sindresorhus/execa/commit/bfe4633a3a5d1197f7830cc41056bee11084bff7"><code>bfe4633</code></a> Fix <code>execaSync()</code> returning <code>undefined</code> output when the subprocess fails to s...</li> <li><a href="https://github.com/sindresorhus/execa/commit/93bddc4155190b35902a06314f0779399b819dea"><code>93bddc4</code></a> Fix arguments of Windows batch files that read them with <code>%~1</code></li> <li><a href="https://github.com/sindresorhus/execa/commit/af6264a995ef9070d8009e205f913276455cbd92"><code>af6264a</code></a> Fix <code>execaSync()</code> writing decoded text instead of the output's bytes to files</li> <li><a href="https://github.com/sindresorhus/execa/commit/ecda56b7c36f7aa9a76e36a1dc75fdaad42904f4"><code>ecda56b</code></a> Report <code>null</code> pipe options as a rejection</li> <li><a href="https://github.com/sindresorhus/execa/commit/698a1b845eefa38cd7b390a96a00756d856c779f"><code>698a1b8</code></a> Tweaks</li> <li>Additional commits viewable in <a href="https://github.com/sindresorhus/execa/compare/v10.0.1...v10.1.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

- Refresh the lockfile with npm audit fix to patch transitive dev dependencies: fast-uri 3.1.8, js-yaml 4.3.2, postcss 8.5.30, smol-toml 1.9.1, brace-expansion 5.0.12, @humanfs/node 0.16.8 and source-map-js 1.2.2 - Raise vitest and @vitest/coverage-v8 to ^4.1.11 together, since coverage-v8 pins an exact vitest peer and blocks npm audit fix Resolves all 15 open Dependabot alerts (11 high, 4 moderate) plus two newer advisories without alerts yet (GHSA-r4xh-jqrq-34v2, GHSA-68fv-2mgg-jv7q). The alerts close once this reaches main. All advisories affect development tooling only. npm audit --omit=dev was already clean, so users of the published package were never exposed. Production dependency resolution is unchanged.

Back-merge the v1.0.2 release metadata into develop so it matches main: - Bump version to 1.0.2 - Tighten engines.node to >=22.13.0 - Add the 1.0.2 CHANGELOG entry - Update the Node.js prerequisite in the docs No functional changes. After this merge, develop's tree is identical to main at the v1.0.2 tag.

Merlin shipped two hardcoded message sets, so changing any prompt text meant forking the package, and teams had no way to give every contributor the same voice in the commit wizard. Setting theme to "custom" now applies a customTheme block from user or project config. The block extends wizard or standard and lists only the messages it changes - mergeThemeMessages() layers them over the base, so any message added in a later release falls back to the base text instead of breaking the theme. resolveBaseTheme() drives decoration too, so a custom theme on wizard keeps its emoji columns in the type picker and its icons in the config menu. The three template messages (projectFieldAction, tooLong and overwrite) are written as strings with {field}, {maxCharacters} and {fileName} placeholders. compileMessageTemplate() turns them into functions using plain string substitution - nothing is evaluated. A missing argument drops the parentheses wrapping its placeholder, so "Overwrite? ({fileName})" reads cleanly without a file name, and an unknown placeholder stays visible so typos are easy to spot. A committed project config is untrusted input for every contributor who clones the repo. validateThemeOverrides() walks the built-in theme shape, dropping unknown keys and non-string values without an allow-list, strips C0 and C1 control characters and bidi overrides, and caps each message at 200 code points. Saving from merlin config preserves the raw customTheme block, so a typo in a hand-written theme is left for the user to fix rather than silently deleted. The theme picker gains a custom option and config --show includes the active customTheme. DEFAULT_CONFIG now carries an empty customTheme, so the next save to ~/.merlinrc.json writes an empty starter block.

- Bump version 1.0.2 -> 1.1.0 - Add the 1.1.0 CHANGELOG entry for custom themes

# Conflicts: # CHANGELOG.md # package-lock.json # package.json

mBukator and others added 18 commits June 6, 2026 13:19

chore(license): correct copyright holder to Maksym Bukator (#97)

f905007

The MIT license named "Avilo Labs" as the copyright holder, which is not the actual author of the project. Update the copyright line to Maksym Bukator.

chore: sync release v1.0.1 to develop (#106)

75dbd1c

Back-merge the v1.0.1 release commit from main, bringing the version bump and changelog entry into develop so the branches stay reconciled.

chore(release): bump version to 1.1.0

4f066f2

- Bump version 1.0.2 -> 1.1.0 - Add the 1.1.0 CHANGELOG entry for custom themes

chore(release): merge main into release/v1.1.0

137d87a

# Conflicts: # CHANGELOG.md # package-lock.json # package.json

mBukator merged commit 3a3faec into main Oct 19, 2026
3 checks passed

mBukator deleted the release/v1.1.0 branch October 19, 2026 15:10

mBukator mentioned this pull request Oct 19, 2026

chore: sync release v1.1.0 to develop #125

Merged

6 tasks done

Navigation Menu

Repository navigation

release: v1.1.0 - #123

release: v1.1.0#123
mBukator merged 18 commits into
mainfrom
release/v1.1.0

mBukator commented Oct 18, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

mBukator commented Oct 18, 2026

🎯 Overview

✨ Changes

Release

Included since 1.0.2

🔧 Technical Details

📋 Testing

🔗 Related Issues

✅ Checklist

📝 Notes

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant