From 32f37af81a02a4b91c107b768f1365848e5bf005 Mon Sep 17 00:00:00 2001 From: Julius Brussee Date: Fri, 12 Jun 2026 14:57:52 +0200 Subject: [PATCH] chore(release): pin remote fetches to v1.9.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit First tag shipping src/hooks/checksums.sha256 — with PINNED_REF now pointing at it, curl|bash / detached installs fetch hook files from the immutable v1.9.0 ref and SHA-256 enforcement activates fully (#261, #262). Manifest verified current against src/hooks/ before the bump. Co-Authored-By: Claude Opus 4.8 (1M context) --- bin/install.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/install.js b/bin/install.js index 40ab702..75223dc 100755 --- a/bin/install.js +++ b/bin/install.js @@ -33,7 +33,7 @@ const REPO = 'JuliusBrussee/caveman'; // the new tag on every release (CI release step) AFTER regenerating // src/hooks/checksums.sha256 so the integrity manifest matches the ref. // Overridable via CAVEMAN_REF for testing against a branch. -const PINNED_REF = process.env.CAVEMAN_REF || 'v1.8.2'; +const PINNED_REF = process.env.CAVEMAN_REF || 'v1.9.0'; const RAW_BASE = `https://raw.githubusercontent.com/${REPO}/${PINNED_REF}`; const HOOKS_REMOTE = `${RAW_BASE}/src/hooks`; const INIT_SCRIPT_URL = `${RAW_BASE}/src/tools/caveman-init.js`;