release: v2.5.0 — Sign of Life

[brucearctor]

Checklist

Pre-release

• Merge dependabot security PRs (Bump send and express in /products/userale #70, Bump serialize-javascript from 6.0.0 to 6.0.2 in /products/userale/example/webpackUserAleExample #72, Bump cookie and express in /products/userale #73, Bump body-parser and express in /products/userale #75, Bump serve-static and express in /products/userale #76, Bump http-proxy-middleware from 2.0.6 to 2.0.9 in /products/userale/example/react-app-example #110)
• Review + merge PR feat(auth): add support for api keys #124 (API key auth) — or defer to v2.6.0
• Merge toolchain PRs (chore: add nix dev shell, lefthook, and direnv #127, chore/modernize-toolchain)
• Merge proto schema PR (feat/proto-schema)
• Tighten files field in package.json (exclude examples, source from npm tarball)
• Bump version to 2.5.0 in package.json files
• Write CHANGELOG.md
• Run full test suite: pnpm test
• Build and verify npm tarball: pnpm pack

Apache Release Process

• Create signed release tarball (apache-flagon-userale-2.5.0-src.tar.gz)
• Upload RC to dist/dev/flagon/
• Call vote on dev@flagon.apache.org (72-hour minimum)
• Record vote result
• Move tarball to dist/release/flagon/
• Publish to npm: npm publish
• Tag v2.5.0 on master
• Create GitHub release with changelog

Post-release

• Announce on dev@flagon.apache.org
• Close this milestone

Context

First release since v2.4.0 (May 2024). Includes the TypeScript migration, security fixes, toolchain modernization, and proto schema definition. 38+ commits unreleased.