[renatoathaydes]

What changed

devpod upgrade:

• Compares versions. A version is three or more numbers, optionally followed by a suffix (0.8.0-alpha.1, 1.2.3alpha, 1.2.3-beta-1, 1.2.3.4) and build metadata (+abc, ignored when comparing). The automatic upgrade only considers non-draft, non-pre-release releases tagged plain X.Y.Z, and only installs one strictly newer than the running binary. At equal numbers a suffixed version counts as older (so v0.8.0-alpha.1 is offered v0.8.0); extra numbers count (1.2.3.4 > 1.2.3). Before, it installed the latest release whenever it merely differed from the current one, which could downgrade a newer build.
• Checks permissions before downloading, without touching the binary: that it can create and remove files next to the binary, and what else could stop the swap, by looking only: the sticky rule (the user must own the file or the directory), immutable and append-only flags on the binary, the link and their directories (chflags uchg/schg/uappnd/sappnd, SIP and sunlnk on macOS; chattr +i/+a on Linux, via statx or FS_IOC_GETFLAGS), and on Windows opening the binary and the link with DELETE access, which fails on an ACL that denies it or another process holding the file without sharing delete, plus a read-only link. Directory flags are checked before the create probe, so an append-only directory doesn't keep the probe file. For an upgrade through a symlink, it also probes creating a symlink (Windows needs a privilege or Developer Mode). Probe files and the temporary link get random names, so concurrent upgrades or dry runs and leftovers don't collide.
• Keeps the binary's mode and owner, instead of always 0755. If the user may not keep the owner or group (it keeps the group if it can), it warns what changed and which chown command fixes it, since the mode is kept.
• Cleans up after interrupted downloads: Ctrl-C/SIGTERM cancels the download, which removes its temp file; temp files (downloads, probes, temporary links) that a killed upgrade left more than an hour ago are removed on the next one, in every directory it writes to (the binary's, the link's and the link target's).
• Symlinked CLIs: when the CLI was started through a symlink, it downloads the release next to the link's target as devpod-<tag>, repoints the link (keeping it relative if it was), and logs that the previous binary was left alone. If a file named devpod-<tag> already exists there, it warns that it is replaced (in the dry run too). Both the link's and the target's directories are permission-checked first. A link to another link is refused. The link is found from os.Args[0] (via PATH if needed), checked to be the running binary, because os.Executable resolves links on Linux.
• --version looks the tag up directly (with or without the leading v), so any release works, and doesn't need the current version to be parseable.
• New --dry-run reports whether a newer version is available (or what --version would install), what would be replaced or linked, and fails (non-zero exit) if the upgrade would fail. Nothing is downloaded.
• Removes the unused PrintNewerVersionWarning, NewerVersionAvailable and CheckForNewerVersion.

Dependencies

The download and swap are now done in pkg/upgrade (temp file in the target directory, size check, then rename; on Windows the running exe is moved aside first, to a uniquely named hidden .old file that is removed once it no longer runs). This drops rhysd/go-github-selfupdate and with it inconshreveable/go-update (unmaintained since 2016), google/go-github/v30, google/go-querystring, tcnksm/go-gitconfig and ulikunitz/xz (~53k vendored lines). The licenses page drops them too (the go-licenses workflow would regenerate it anyway). GitHub release JSON uses pkg/download's GithubRelease types, extended with the fields needed. Requests use http.DefaultClient, not pkg/http's client, which skips TLS verification.

Notes for reviewers

• GitHub intermittently answers GET /releases?per_page=100 with [] (seen 3 times in 6 identical anonymous requests while testing). When the list has no usable release, /releases/latest is tried before giving up.
• GITHUB_TOKEN is used if set, for GitHub's rate limit.
• The symlink is found from os.Args[0], because os.Executable resolves links on Linux. That's unit-tested (invokedBinary) and was run for real on macOS and on Linux (Docker).
• Windows code paths (replace_windows.go, symlink privilege, the DELETE-access check) are vetted and linted but not run here; windows-tests.yaml runs this package's unit tests, including one for a file held open without FILE_SHARE_DELETE.
• macOS ACLs that deny delete on the binary itself aren't checked (a denied delete on the directory is, through the create-and-remove probe).

Testing

• pkg/upgrade unit tests, including end-to-end Upgrade runs against an httptest fake of the GitHub API: in-place replace, nothing newer (several current versions), dry run, permission failure before any download, --version (with an unparseable current version, missing tag, same version), symlinks (absolute and relative, read-only link or target dir, link to link, target already named like the release), an empty release list, an immutable binary (macOS chflags uchg, Linux chattr +i) in a real run and a dry run, keeping the mode, and a stalled download cancelled once it has started (temp file removed, stale ones cleaned, also in a link's directories). Unit tests for the sticky rule, append-only files and directories, concurrent permission checks (binary and link stay in place throughout), unique temporary link names, keeping the group and the owner warning. Run with -race, and on Linux in Docker as a non-root user and as root with CAP_LINUX_IMMUTABLE (for the chattr tests, on tmpfs and overlayfs). The sticky check was also run against real root-owned files in sticky directories in Docker.
• go vet and golangci-lint v1.60.1 for darwin, linux and windows on the changed packages.
• Real runs against GitHub on macOS: dry run through a PATH symlink, link to link, read-only target dir, a real upgrade through a relative symlink (v0.8.0-alpha.1 → v0.8.0, previous binary untouched), and a real in-place upgrade.

🤖 Generated with Claude Code