QSTH-937: Upgrade the dependencies and pin versions

.github/workflows/release.yml

@@ -5,6 +5,9 @@ on:
     types:
       - published
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release
@@ -17,9 +20,9 @@ jobs:
         run: echo "VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.11"
 
       - name: Set package version
         run: echo $(jq --arg v "${{ env.VERSION }}" '(.version) = $v' package.json) > package.json
@@ -30,15 +33,25 @@ jobs:
       - name: Build
         run: bun run build
 
-      - name: Set NPM_TOKEN
-        run: npm set "//registry.npmjs.org/:_authToken" ${{ secrets.NPM_TOKEN }}
+      - name: Verify build output
+        run: |
+          if [ ! -s install.js ]; then
+            echo "Error: install.js is empty or missing. Aborting publish." >&2
+            exit 1
+          fi
 
       - name: Publish
         if: "!github.event.release.prerelease"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
+          npm config set "//registry.npmjs.org/:_authToken" "${NODE_AUTH_TOKEN}"
           npm publish --access public
 
       - name: Publish release candidate
         if: "github.event.release.prerelease"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
+          npm config set "//registry.npmjs.org/:_authToken" "${NODE_AUTH_TOKEN}"
           npm publish --access public --tag=canary

.gitignore

@@ -1 +1,2 @@
-node_modules
+node_modules
+install.js

install.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import * as path from 'path';
 import * as os from 'os';
-import tar from "tar";
-import fetch from "node-fetch";
+import { Readable } from 'stream';
+import * as tar from "tar";
 import * as unzipper from 'unzipper';
 import PJ from "./package.json";
 
@@ -53,14 +53,14 @@ class BinaryDownloader {
           if (!res.body) {
             return reject(new Error("No body to pipe"));
           }
-          resolve(res.body);
+          resolve(Readable.fromWeb(res.body as any));
         }).catch(reject);
     });
   }
 
   public async extract(stream: NodeJS.ReadableStream): Promise<void> {
     return new Promise((resolve, reject) => {
-        const bin = path.resolve("./bin");
+        const bin = path.join(__dirname, 'bin');
         switch (this.config.extension) {
             case ".tar.gz":
               const untar = tar.extract({ cwd: bin });

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upstash/qstash-cli",
-  "version": "2.20.9",
+  "version": "0.0.0",
   "description": "Offical CLI tool for QStash",
   "main": "index.js",
   "scripts": {
@@ -21,13 +21,10 @@
   "license": "ISC",
   "devDependencies": {
     "@types/node": "^22.10.2",
-    "@types/node-fetch": "^2.6.12",
-    "@types/tar": "^6.1.1",
-    "@types/unzipper": "^0.10.10"
+    "@types/unzipper": "0.10.11"
   },
   "dependencies": {
-    "node-fetch": "2.6.2",
-    "tar": "^6.1.1",
-    "unzipper": "^0.12.3"
+    "tar": "7.5.13",
+    "unzipper": "0.12.3"
   }
 }