chore(release): prepare v1.2.3

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.3] - 2026-11-02
+
+A wrapper-only release. The Go binary is unchanged from v1.2.2 — this
+version republishes the npm wrapper with the dependency fix and the
+documentation below.
+
 ### Fixed
 - The npm wrapper's `tar` dependency was pinned to `6.2.1`, which npm
   itself flags as deprecated ("Old versions of tar are not supported,
@@ -1045,7 +1051,8 @@ without weakening the body-length guard for hand-authored commits.
 ### Added
 - Project blueprint — internal design doc covering language choice, scope, detection engine, version resolution, package migration, architecture, CLI design, edge cases, git workflow, conventional commits, versioning, CI/CD, and distribution. (Superseded by `README.md`; the standalone doc was removed in the Unreleased section.)
 
-[Unreleased]: https://github.com/dipto0321/nodeup/compare/v1.2.2...HEAD
+[Unreleased]: https://github.com/dipto0321/nodeup/compare/v1.2.3...HEAD
+[1.2.3]: https://github.com/dipto0321/nodeup/compare/v1.2.2...v1.2.3
 [1.2.2]: https://github.com/dipto0321/nodeup/compare/v1.2.1...v1.2.2
 [1.2.1]: https://github.com/dipto0321/nodeup/compare/v1.2.0...v1.2.1
 [1.2.0]: https://github.com/dipto0321/nodeup/compare/v1.1.0...v1.2.0

CLAUDE.md

@@ -136,7 +136,7 @@ orchestrator.
 | 5 — Config subsystem | Done | merged |
 | 6 — Cross-platform polish | Done | merged (interrupted-upgrade sentinel, `QuotePath`, system-node classifier) |
 | 7 — Distribution packaging | Done | GoReleaser, brew/scoop/npm wrappers all shipped (#17, #18); manual v1.0.0 npm publish (#35) bootstrapped the OIDC trust |
-| 8 — v1.0.0 → v1.2.2 releases | Done | `nodeupx@1.2.2` live on npm (matching the Go binary); trusted-publisher OIDC flow active for every tag (`#109`) |
+| 8 — v1.0.0 → v1.2.3 releases | Done | `nodeupx@1.2.3` live on npm (matching the Go binary); trusted-publisher OIDC flow active for every tag (`#109`) |
 
 ## On-disk data layout
 

README.md

@@ -274,9 +274,9 @@ See [`docs/configuration.md`](./docs/configuration.md) for the full schema.
 
 ## Project status
 
-Current release: **v1.2.2** (`nodeupx@1.2.2` on npm — the wrapper
+Current release: **v1.2.3** (`nodeupx@1.2.3` on npm — the wrapper
 publishes automatically alongside the tag). See `CHANGELOG.md` for the
-v1.1.0 → v1.2.2 history.
+v1.1.0 → v1.2.3 history.
 
 | Phase | Status | What shipped |
 |---|---|---|
@@ -287,7 +287,7 @@ v1.1.0 → v1.2.2 history.
 | 5 — Config subsystem | ✅ | YAML config at `~/.nodeup/config.yaml` + `config {show,get,set,init}` + env vars |
 | 6 — Cross-platform polish | ✅ | `QuotePath`, interrupted-upgrade replay, system-node classifier, lock file |
 | 7 — Distribution packaging | ✅ | GoReleaser + brew tap + Scoop bucket + npm wrapper (`nodeupx` via OIDC Trusted Publishing) |
-| 8 — Tagged releases | ✅ | `v1.0.0` shipped (PR #35); `v1.1.0` shipped with the `internal/ui` rollout (`#117`/`#118`/`#119`); `v1.2.0` adds Vite+ support (`#124`); `v1.2.1` repairs the npm install path (`#126`); `v1.2.2` stops the snapshot leak (`#130`) |
+| 8 — Tagged releases | ✅ | `v1.0.0` shipped (PR #35); `v1.1.0` shipped with the `internal/ui` rollout (`#117`/`#118`/`#119`); `v1.2.0` adds Vite+ support (`#124`); `v1.2.1` repairs the npm install path (`#126`); `v1.2.2` stops the snapshot leak (`#130`); `v1.2.3` fixes the wrapper's `tar` advisory (`#136`) |
 
 **Release train:** every `v*.*.*` tag triggers GoReleaser → brew cask
 push → Scoop manifest push → `nodeupx` publish via OIDC. To ship a

SPEC.md

@@ -1,10 +1,11 @@
 # SPEC — nodeup
 
 Distilled from code (README, CLAUDE.md, CONTRIBUTING.md, docs/*, and
-`internal/*` source). Last refresh: 2026-11-01 (post v1.2.2 release;
+`internal/*` source). Last refresh: 2026-11-02 (post v1.2.3 release;
 §C/§I/§V/§T updated to match current state — snapshot cleanup complete
 via #130, Vite+ support complete via #124, `internal/ui` rollout
-complete via #117/#118/#119, #120/#121 are commitlint relaxations).
+complete via #117/#118/#119, wrapper `tar` advisory fix via #136,
+#120/#121 are commitlint relaxations).
 Caveman encoding per FORMAT.md convention (not present at repo root —
 using shapes from the caveman skill).
 

docs/managers.md

@@ -1,6 +1,6 @@
 # Supported Version Managers
 
-All 9 managers listed below are fully detected by `nodeup` as of v1.2.2
+All 9 managers listed below are fully detected by `nodeup` as of v1.2.3
 (macOS, Linux, and Windows where applicable). The matrix is the source of
 truth — keep it in sync with `internal/detector/registry_*.go` and the
 per-manager files (`fnm.go`, `nvm.go`, `volta.go`, `asdf.go`, `mise.go`,
@@ -78,7 +78,7 @@ bin dir (e.g., `fnm env --use-on-cd | source`, or add
 points at a binary inside the manager's data dir, nodeup's next
 run will classify it as `manager` and proceed without warning.
 
-> _Status: Phase 7 complete. Post-upgrade cleanup prompt, per-manager native mutation commands, and full distribution packaging (GoReleaser, brew/scoop taps, npm wrapper at `nodeupx@1.2.2` via OIDC Trusted Publishing) have all shipped — see `CHANGELOG.md` for the v1.1.0 → v1.2.2 history._
+> _Status: Phase 7 complete. Post-upgrade cleanup prompt, per-manager native mutation commands, and full distribution packaging (GoReleaser, brew/scoop taps, npm wrapper at `nodeupx@1.2.3` via OIDC Trusted Publishing) have all shipped — see `CHANGELOG.md` for the v1.1.0 → v1.2.3 history._
 
 ## Post-upgrade cleanup
 

nodeup-npm/README.md

@@ -38,7 +38,7 @@ on your `$PATH`, and the install log says:
 
 ```
 npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
-npm warn install-scripts   nodeupx@1.2.2 (preinstall: node scripts/check.js; postinstall: node scripts/install.js)
+npm warn install-scripts   nodeupx@1.2.3 (preinstall: node scripts/check.js; postinstall: node scripts/install.js)
 ```
 
 Approve the script and re-run the install:

nodeup-npm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodeupx",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "Automated Node.js version upgrade + global package migration CLI. Static Go binary wrapped for npm distribution.",
   "license": "MIT",
   "author": "Dipto Karmakar <dipto@local>",
@@ -42,5 +42,5 @@
     "README.md",
     "LICENSE"
   ],
-  "binaryVersion": "1.2.2"
+  "binaryVersion": "1.2.3"
 }