semantic-release generates incorrect release notes

[jdbruijn]

🐛 Bug report

Steps to reproduce

I've run into this issue before, see e.g. vidavidorra/create-project@5c66dc8, and did not have an explicit idea of the impact. From the reproduction I have made now, and am creating this ticket to clearly document it here for future reference, the release notes are impacted by this too. Given that the issue is semantic-release/release-notes-generator#655, or duplicate semantic-release/release-notes-generator#657, that does make some sense in hindsight. As indicated the workaround, also shown below, is forcing conventional-changelog-conventionalcommits to version 8 or above.

The proper fix for this is to have dependency conventional-changelog-conventionalcommits updated to v8 or above in @commitlint/config-conventional, a package in conventional-changelog/commitlint. See e.g. conventional-changelog/commitlint#406, conventional-changelog/commitlint#4417 and conventional-changelog/commitlint#4069 for the failed and ongoing (stale) attempts of doing so.

Workaround

The following override in the package.json forces the conventional-changelog-conventionalcommits dependency of the @commitlint/config-conventional package to a newer version.

"overrides": {
  "@commitlint/config-conventional": {
    "conventional-changelog-conventionalcommits": ">=9.0.0"
  }
}

Expected behaviour

semantic-release generates the following release notes from the commits listed in the details below. To generate this from the same output as below, the override was added to the package.json. During this test, on 18 December 2025, that resolved in v9.1.0 of the dependency being installed.

Note

This is generated locally by removing the @semantic-release/npm, @semantic-release/git and @semantic-release/github plugins from the config and running npx semantic-release --dry-run=false --debug.

## 1.0.2 (2025-12-18)

### Bug Fixes

    * temporary override conventional-changelog-conventionalcommits to `>=v9.0.0` ([333bc49](https://github.com/vidavidorra/semantic-release-config/commit/333bc4904ef0246f415f0f7843a51856910fc6b6)), closes [semantic-release/release-notes-generator#657](https://github.com/semantic-release/release-notes-generator/issues/657)

Analysed commits

Output of the semantic-release:get-commits step, with the irrelevant parts removed for simplicity.

[
  {
    subject:
      "Merge remote-tracking branch 'origin/main' into fix/changelog-override",
    body: '',
    hash: 'aa001f7ce05ecd9bca5547df60724fb1f6a1188b',
    committerDate: '2025-12-18T19:38:46.000Z',
    message:
      "Merge remote-tracking branch 'origin/main' into fix/changelog-override",
    gitTags: '(HEAD -> fix/changelog-override, origin/fix/changelog-override)',
  },
  {
    subject: 'chore: add lockfile',
    body: '',
    hash: 'cb18ab8ef3eb7d913a3d0e083dcf547da1bc0465',
    committerDate: '2025-12-18T19:38:33.000Z',
    message: 'chore: add lockfile',
    gitTags: '',
  },
  {
    subject:
      'fix: temporary override conventional-changelog-conventionalcommits to `>=v9.0.0`',
    body: 'This fixes semantic-release/release-notes-generator#657 until @commitlint/config-conventional is updated, see conventional-changelog/commitlint#4063.\n',
    hash: '333bc4904ef0246f415f0f7843a51856910fc6b6',
    committerDate: '2025-12-18T19:35:15.000Z',
    message:
      'fix: temporary override conventional-changelog-conventionalcommits to `>=v9.0.0`\n' +
      '\n' +
      'This fixes semantic-release/release-notes-generator#657 until @commitlint/config-conventional is updated, see conventional-changelog/commitlint#4063.',
    gitTags: '',
  },
  {
    subject: 'chore(deps): update vidavidorra/.github action to v8.0.10',
    body: '',
    hash: '37d8a246b90bc8706d31184665286b843ce4c882',
    committerDate: '2025-12-18T06:59:18.000Z',
    message: 'chore(deps): update vidavidorra/.github action to v8.0.10',
    gitTags: '(origin/main, origin/HEAD)',
  },
]

Actual behaviour

semantic-release generates the following release notes from the same commits as listed in the expected behaviour.

## <small>1.0.2 (2025-12-18)</small>

    * Merge remote-tracking branch 'origin/main' into fix/changelog-override ([aa001f7](https://github.com/vidavidorra/semantic-release-config/commit/aa001f7))
    * chore: add lockfile ([cb18ab8](https://github.com/vidavidorra/semantic-release-config/commit/cb18ab8))
    * chore(deps): update vidavidorra/.github action to v8.0.10 ([37d8a24](https://github.com/vidavidorra/semantic-release-config/commit/37d8a24))
    * fix: temporary override conventional-changelog-conventionalcommits to `>=v9.0.0` ([333bc49](https://github.com/vidavidorra/semantic-release-config/commit/333bc49)), closes [semantic-release/release-notes-generator#657](https://github.com/semantic-release/release-notes-generator/issues/657)

Environment

Version: 1.0.1 (tree)

Environment information.

$ npx envinfo --system --binaries
...

[vidavidorra-release]

🎉 This issue has been resolved in version 1.0.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀