Repository navigation
Release v1.2.3 — publish the wrapper with the tar@7 fix and the npm 12 allowScripts docs #137
Description
Problem
The tar@6.2.1 advisory fix (PR #136, issue #135) is merged, but it
only reaches npm users when a new wrapper version is published — and the
wrapper's postinstall downloads the Go binary matching its
binaryVersion field, which only moves when a v*.*.* tag exists.
Right now npm view nodeupx version still reports 1.2.2, so every
npm install -g nodeupx still pulls the vulnerable tar@6.2.1 and
still hits npm 12's allowScripts gate with no in-repo explanation.
Fix
Ship v1.2.3:
nodeup-npm/package.json—versionandbinaryVersionto1.2.3.CHANGELOG.md— a[1.2.3]section for the wrapper-only release.- Doc references refreshed (
README.md,CLAUDE.md,SPEC.md,
docs/managers.md,nodeup-npm/README.md). - Tag
v1.2.3so GoReleaser publishes the Go artifacts and the OIDC
publish-npmjob publishesnodeupx@1.2.3.
Acceptance criteria
-
nodeup-npm/package.jsonpinsbinaryVersionto1.2.3 -
npm pack --dry-runshows exactly 5 files -
make cigreen - Tag
v1.2.3pushed -
npm view nodeupx versionreports1.2.3 -
npm install -g nodeupx@1.2.3yields a runnable, unquarantined
nodeupbinary - Tap cask and Scoop manifest both point at
1.2.3
Refs #135
Activity
dipto0321 commentedon Nov 2, 2026
Shipped — v1.2.3 is live
Tag
v1.2.3pushed; the Release workflow'sGoReleaserandPublish nodeupx to npm (OIDC)jobs both went green.Channels verified
checksums.txtpublishedCasks/nodeup.rbat1.2.3; sha256s match the release's ownchecksums.txt; thepostflight_stepsquarantine hook is intact;brew reinstall --cask→ binary atCaskroom/nodeup/1.2.3, quarantine(none), 3/3 runsnodeup.jsonat1.2.3, windows hash matcheschecksums.txtnpm view nodeupx version→1.2.3;dependencies.tar = 7.5.22;engines.node >= 18;npm audit→ 0 vulnerabilities (was 1 critical + 1 high)curl→ sha256 matcheschecksums.txt; quarantine(none);nodeup version→ 1.2.3npm 12
allowScriptsgate confirmedA fresh
npm install nodeupx@1.2.3on npm 12 reproduces thedocumented symptom exactly — the wrapper lands but no binary is
downloaded, and npm prints the
install-scriptswarning. Afternpm install-scripts approve nodeupxthepostinstallruns, thebinary lands in
node_modules/nodeupx/bin/nodeupwith quarantine(none), and it runs 3/3 times.Closes the remaining acceptance criteria.