[dipto0321]

Summary

Fixes the npm install path, which has been broken for every user
since v1.1.0.

nodeup-npm/scripts/install.js validates the redirect that GitHub
serves for release-asset downloads against a host allowlist. GitHub
now serves release assets from release-assets.githubusercontent.com,
but the allowlist only listed objects.githubusercontent.com — so the
wrapper refused the redirect and the install aborted:

nodeup: refusing to follow redirect from
https://github.com/dipto0321/nodeup/releases/download/v1.2.0/checksums.txt
to https://release-assets.githubusercontent.com/...: host
release-assets.githubusercontent.com is not in the allowlist

npm install -g nodeupx therefore cannot install the binary. The
Homebrew tap, the Scoop bucket, and direct binary downloads are
unaffected — they don't go through this redirect-validation path.

The allowlist was introduced in #91 (cb425a9, 2026-07-04), when
GitHub was still redirecting to objects.githubusercontent.com. The CDN
host changed out from under the wrapper, and nothing failed loudly
until the next install.

Changes

• nodeup-npm/scripts/install.js — add
  release-assets.githubusercontent.com to ALLOWED_REDIRECT_HOSTS.
  Both hosts are GitHub-controlled, so allowing both preserves the
  security property fix(deps): verify npm-wrapper binary download against release checksums #91 was after (an attacker cannot redirect the
  download to a host they control) while surviving the CDN migration.
• nodeup-npm/scripts/install_test.js — mirror the allowlist change
  and add a followHops_allowsGitHubToReleaseAssetsCdnRedirect
  regression test that exercises the new host.

Verification

• node --test scripts/ — 21 tests pass, including the new
  regression test
• Live end-to-end against the published v1.2.0 release: the
  wrapper's postinstall downloads the archive, verifies its SHA256
  against the published checksums.txt (exact match), extracts it,
  and the resulting binary reports nodeup version 1.2.0
• The off-CDN rejection test still passes — an attacker-controlled
  redirect target is still refused

Release plan

This ships as v1.2.1 — a patch release. The Go binary is
unchanged from v1.2.0; only the npm wrapper's install.js changed.

Tagging v1.2.1 triggers the standard release workflow, which
rebuilds the identical Go binaries and republishes nodeupx with the
fixed wrapper. The wrapper's binaryVersion stays pinned at 1.2.0
so it keeps fetching the v1.2.0 binary — no need for users to
re-download a new Go binary, and the Go and npm versions continue to
move independently as the wrapper is designed to.

Closes #126

🤖 Generated with puku-cli

[cocogitto-bot]

✔️ 114f66c - Conventional commits check succeeded.