Skip to content

Preserve working CLI on failed upgrades and release 0.98.1 - #507

Merged
ralyodio merged 2 commits into
mainfrom
fix/install-runtime-dependencies
Sep 13, 2026
Merged

ralyodio merged 2 commits into
mainfrom
fix/install-runtime-dependencies

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Archive upgrades currently replace the working CLI before installing its runtime dependencies. Install production dependencies and verify moshcode --version in staging, then replace the package only after both succeed. Failed downloads, dependency installation, or startup leave the existing CLI in place; dependency-free releases still skip npm.

Includes the 0.98.1 patch release and executable installer regression coverage. Preserves the current protection for operator settings in ~/.moshcode.

Validation: 17 installer tests passed; full CLI suite passed (2,638 passed, 340 skipped, zero failures); POSIX shell syntax checks passed. GitHub CI will check the release commit before merge.

@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

5 finding(s) in the 4 file(s) this pull request changes.

HIGH/CRITICAL: 5

Severity Rule Location
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:258
HIGH sh-remote-script-execution install.sh:269
HIGH sh-remote-script-execution install.sh:275
88 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 3 | **MEDIUM**: 75 | **LOW**: 10

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:974
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1044
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1147
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1170
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1192
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1391
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1541

…and 68 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 80f5f05 into main Sep 13, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant