Repository navigation
fix(deps): bump the npm wrapper's tar to v7 and document npm 12's allowScripts gate - #136
Merged
Merged
Conversation
…owScripts gate
Two problems surfaced while verifying the v1.2.2 npm channel.
**1. `tar` was pinned to a version with published advisories.**
`nodeup-npm` pinned `tar@6.2.1`. npm itself flags it:
npm warn deprecated tar@6.2.1: Old versions of tar are not
supported, and contain widely publicized security vulnerabilities
`npm audit` against the published wrapper reports **1 critical and 1
high** vulnerability, every one of them in `tar` — the hardlink path
traversal, symlink poisoning, and PAX file-smuggling advisories. All
of them sit on the archive-extraction path the wrapper uses to unpack
the release tarball, which is the one place the wrapper touches
untrusted bytes.
Bumped to `tar@7.5.22`, past the advisory range (`<=7.5.20`).
`npm audit` is now clean: **0 vulnerabilities**.
The bump raises the wrapper's Node floor from 14 to 18, because
`tar@7` declares `engines: { node: ">=18" }`. The wrapper's own code
is unchanged and still runs on Node 14 — the floor comes from the
dependency, so `engines` and the docs are updated to match.
Verified end-to-end: the wrapper's real `extractTarGz()` (with its
zip-slip `filter` guard) extracts the actual v1.2.2 release archive
under `tar@7`, producing the binary at the expected 8423058 bytes.
**2. npm 12 blocks the wrapper's install script.**
npm 12 added `allowScripts`, which blocks install scripts for packages
that aren't on an allowlist. `nodeupx` needs its `postinstall` to
download the binary, so on npm 12+ a fresh `npm install -g nodeupx`
finishes with the wrapper in place but **no binary** — `nodeup` never
appears on `$PATH`, and the install log's warning scrolls past.
The fix is `npm install-scripts approve nodeupx`. The wrapper README,
the main README, and `docs/installation.md` now spell it out, with the
permanent `~/.npmrc` form for anyone who wants it.
|
✔️ 01070e0 - Conventional commits check succeeded. |
This was referenced Nov 2, 2026
Closed
dipto0321
added a commit
that referenced
this pull request
Nov 2, 2026
Release prep for v1.2.3 — a wrapper-only release. The Go binary is unchanged from v1.2.2; this republishes the npm wrapper with the dependency fix and the documentation that landed in #136. - CHANGELOG.md — new [1.2.3] section covering the tar@7.5.22 bump and the npm 12 allowScripts documentation. - nodeup-npm/package.json — version and binaryVersion both to 1.2.3. binaryVersion pins which Go binary the wrapper downloads, so it must match the tag or every install 404s on the archive. - README.md / CLAUDE.md / SPEC.md / docs/managers.md / nodeup-npm/README.md — refresh the release references. Refs #135 Co-authored-by: dipto0321 <dipto@local>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two problems found while verifying the v1.2.2 npm channel.
1.
tarwas pinned to a version with published advisoriesnodeup-npmpinnedtar@6.2.1, which npm itself flags:npm auditagainst the published wrapper reported 1 critical and 1high vulnerability, every one of them in
tar— the hardlink pathtraversal, symlink poisoning, and PAX file-smuggling advisories. All
of them sit on the archive-extraction path, which is the one place
the wrapper touches untrusted bytes.
Bumped to
tar@7.5.22, past the advisory range (<= 7.5.20).npm auditis now clean: 0 vulnerabilities.The bump raises the wrapper's Node floor from 14 to 18, because
tar@7declaresengines: { node: ">=18" }. The wrapper's own codeis unchanged and still runs on Node 14 — the floor comes from the
dependency, so
enginesand the docs are updated to match.2. npm 12 blocks the wrapper's install script
npm 12 added
allowScripts, which blocks install scripts forpackages that aren't on an allowlist.
nodeupxneeds itspostinstallto download the binary, so on npm 12+ a freshnpm install -g nodeupxfinishes with the wrapper in place but nobinary —
nodeupnever appears on$PATH, and the install log'swarning scrolls past:
The fix is
npm install-scripts approve nodeupx. The wrapper README,the main README, and
docs/installation.mdnow spell it out, with thepermanent
~/.npmrcform for anyone who wants it.Verification
npm auditinnodeup-npm/→ 0 vulnerabilities (was 1 critical + 1 high)extractTarGz()(with its zip-slipfilterguard) extracts the actual v1.2.2 release archive under
tar@7→nodeupat 8423058 bytes, mode 755npm install nodeupx@1.2.2with the script approveddownloads the binary → no quarantine attribute, runs 3/3,
nodeup versionreports 1.2.2node nodeup-npm/scripts/install_test.js→ 25 tests, 0 issuesgo build ./...,go vet ./...,gofmt -l .(clean),golangci-lint run ./...→ 0 issues🤖 Generated with puku-cli
Closes #135