chore: upgrade changesets to v3

[dannyhw]

Summary

Upgrades the release tooling to Changesets v3. This removes the @changesets/cli route to sprintf-js (no patched release exists), which came through @manypkg/get-packages@1 → read-yaml-file → js-yaml@3 → argparse@1. v3 uses @manypkg/get-packages@3, which drops that chain.

The sprintf-js Dependabot alert will stay open: jest still reaches it through babel-plugin-istanbul → @istanbuljs/load-nyc-config → js-yaml@3. That chain is the same in the latest jest (30.5.2), so there is no update path yet.

Changes

• @changesets/cli ^2.31.1 → ^3.0.3, @changesets/changelog-github ^0.7.0 → ^1.0.1
• changesets/action v1.9.0 → v2.1.2 (pinned SHA). Required: CLI v3 no longer prints the New tag: lines that action v1 parses to find published packages and create GitHub releases. Action v2 reads them from the CHANGESETS_OUTPUT file instead, and it validates that the CLI is v3.
  • Inputs renamed to v2's kebab-case names (version-script, publish-script, commit-message, pr-title, create-github-releases).
  • The token goes through github-token; v2 no longer reads GITHUB_TOKEN from the env for itself. The env var is kept on the step because @changesets/changelog-github reads it to build PR links.
• .changeset/config.json $schema → @changesets/config@4.0.1

Compatibility checks against v3 breaking changes

• Node ^22.11 || ^24 and pnpm >=10: the release workflow uses Node 24.18.0 and pnpm 10.34.
• changeset tag → git-tag rename: not used.
• prettier config → format: not used. CHANGELOGs are still formatted by pnpm lint (Biome) after changeset version.
• Private packages are no longer versioned by default: all our private apps/tests are ignored or have no changesets. The output below is the same either way.
• ___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH.onlyUpdatePeerDependentsWhenOutOfRange is still supported in config v4.
• .npmrc/NPM_TOKEN handling was removed from action v2. Not used here; we publish with OIDC id-token.

Test plan

• Ran changeset version on the 3 pending changesets with v2.31.1 and with v3.0.3, then diffed the results. Versions, changelog entries, PR/commit links and dependency bumps are identical. The only differences: v3 writes "No changes in this release." for packages in the fixed group with no changesets of their own, and leaves out one trailing blank line in the repack CHANGELOG.
• changeset version --snapshot canary produces 5.4.3-canary-<timestamp> as before
• changeset publish --tag canary --no-git-tag still parses as tag: canary, gitTag: false (checked against v3's argument parser)
• changeset status and changeset add work with the existing config
• pnpm lint:ci
• The release workflow itself (changesets/action v2) can only be exercised on main. Watch the next "chore: changeset version" PR and publish run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
repack-website	Ready	Preview	Oct 12, 2026 10:55am UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: e0f4dbc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR