gup v1.8.1

Fast parallel updater and manager for binaries installed with go install.

Install or upgrade, then see the grouped highlights below. Every artifact is
signed and ships with an SBOM and build provenance — see
Verifying release integrity.

Changelog

Features

• a056f7d: feat(release): publish Windows builds to winget from the release (#445) (@nao1215)

Documentation

• f7f3e5c: docs(changelog): prepare v1.8.1 release (#446) (@nao1215)

Full changelog: v1.8.0...v1.8.1

Features

• Windows installs are published to winget from the release. nao1215.gup already existed in the community repository, but a third-party bot submitted the manifests on its own schedule and missed v1.5.1, v1.6.0, and v1.7.0 outright; v1.8.0 arrived five days after the tag carrying v1.7.1's release notes. A tagged release now generates the manifests and opens the pull request against microsoft/winget-pkgs itself, so winget install --id nao1215.gup tracks the release page. The identifier is unchanged, so nothing changes for anyone who already installed gup that way. (#445)

v1.8.1 Latest

Latest

Compare

Choose a tag to compare

gup v1.8.0

Fast parallel updater and manager for binaries installed with go install.

Install or upgrade, then see the grouped highlights below. Every artifact is
signed and ships with an SBOM and build provenance — see
Verifying release integrity.

Changelog

Features

• 66692f7: feat(e2e): replace ShellSpec with atago-driven end-to-end specs (@nao1215)
• 314b6d9: feat(migrate): positional argument shell completion (@scop)
• 91d16ea: feat(website): add GitHub Pages documentation (#432) (@nao1215)

Bug fixes

• 5356d2a: fix(completion): complete migrate BINARY from BEFORE_PATH instead of $GOBIN (@nao1215)
• c584b8d: fix(completion): do not complete --timeout with filenames (@scop)
• c1dc38a: fix(goutil): explicitly skip Go standard library commands when scanning binaries (#413) (@nao1215)
• 4288822: fix(pin): complete only first positional arg with path binaries (@scop)
• 285983c: fix(unpin): do not complete beyond accepted number of positional arguments (@scop)
• 79c1f84: fix(website): correct license in footer (#434) (@nao1215)
• 4fabc9f: fixup! fix(pin): complete only first positional arg with path binaries (@scop)
• f49e99f: fixup! fix(unpin): do not complete beyond accepted number of positional arguments (@scop)

Documentation

• 8675e4c: docs(changelog): prepare v1.8.0 release (@nao1215)
• 54b5caf: docs(cli): add project links to help (#433) (@nao1215)
• 6dcd038: docs(readme): update repository badges (#424) (@nao1215)
• 6eb9370: docs: add aqua installation instructions to all READMEs (@nao1215)

Others

• b993dec: build(coverage): combine unit and self-hosted E2E coverage (#419) (@nao1215)

Full changelog: v1.7.1...v1.8.0

Features

• Add a documentation website at nao1215.github.io/gup, built and deployed from the repository via GitHub Pages. (#432)
• gup --help now prints the documentation and GitHub Sponsors links. (#433)
• gup migrate completes its positional arguments: directories while BEFORE_PATH and AFTER_PATH are being typed, then the binaries that actually live under the given BEFORE_PATH. (#438, #439)

Bug Fixes

• Toolchain commands such as go and gofmt are skipped by their cmd/... import path, not only by their missing main module. Installing Go through mise and similar tools places them in $GOBIN, where gup used to try to reinstall them with go install cmd/go@latest. (#206, #413)
• gup pin and gup unpin complete a binary name only where one can still be accepted: not for pin's VERSION, and not past unpin's single argument. (#438)
• --timeout no longer completes file names; a duration is not a path. (#438, #439)
• Correct the license shown in the website footer. (#434)

Documentation

• Document the aqua installation method in all translated READMEs. (#415)
• Update the repository badges. (#424)

Tests

• Replace the ShellSpec end-to-end suite with atago-driven specs that run the real CLI against a self-contained offline module proxy, and extend them with pty and snapshot scenarios. (#418, #421, #427, #428, #429, #430)
• Combine unit and end-to-end coverage into a single report and raise the acceptable threshold to 90%. (#419, #420)

Chore

• Bump actions/attest-build-provenance from 4.1.0 to 4.1.1, golangci/golangci-lint-action from 9.2.1 to 9.3.0, goreleaser/goreleaser-action from 7.2.2 to 7.2.3, actions/setup-go from 6.5.0 to 7.0.0, reviewdog/action-actionlint from 1.72.0 to 1.73.0, actions/checkout from 7.0.0 to 7.0.1, k1LoW/octocov-action from 1.5.1 to 1.5.2, actions/configure-pages from 5 to 6, actions/deploy-pages from 4 to 5, and actions/upload-pages-artifact from 3 to 5.

v1.8.0

Compare

Choose a tag to compare

gup v1.7.1

Fast parallel updater and manager for binaries installed with go install.

Install or upgrade, then see the grouped highlights below. Every artifact is
signed and ships with an SBOM and build provenance — see
Verifying release integrity.

Changelog

Bug fixes

• a727f27: fix(config): fail fast when auto-detected gup.json is a directory (#399) (@nao1215)
• fbb5cd7: fix(configstate): persist version for the effective channel in MergePackages (@nao1215)
• 1a8881b: fix(list,export,pin): don't require the go command for local-only work (@nao1215)
• 7d85c7d: fix(migrate): validate AFTER_PATH creatability during --dry-run (@nao1215)
• 306564e: fix(print): serialize Printer writes shared across parallel workers (#393) (@nao1215)
• 61443d3: fix(remove): treat a failed confirmation read as an error, not a cancel (@nao1215)
• 7722b12: fix: handle bug-report browser timeouts without false success (#405) (@nao1215)
• d9f9c95: fix: keep human-readable output consistent with --ignore-go-update (#400) (@nao1215)
• 7171d4a: fix: preserve dangling symlinks when writing completion files atomically (#403) (@nao1215)
• 97c3754: fix: preserve symlinked gup.json during atomic config writes (#404) (@nao1215)
• 7de2305: fix: reject directory paths explicitly in gup import (#406) (@nao1215)
• 1de2819: fix: reject relative XDG and ZDOTDIR paths for completion install (#401) (@nao1215)
• 8ba50a8: fix: respect umask when setting generated manpage permissions (#408) (@nao1215)
• 044ef08: fix: treat missing GOBIN directory as empty environment (#409) (@nao1215)
• 9ddf128: fix: validate auto-detected config on empty environments (#410) (@nao1215)
• 3f6464a: fix: write completion files and zshrc atomically (#402) (@nao1215)
• 10d05d5: fix: write generated manpages atomically (#407) (@nao1215)

Documentation

• 082f44c: docs(changelog): prepare v1.7.1 release (#412) (@nao1215)
• b9e8b65: docs(print): use US spelling "canceled" in Question doc comment (@nao1215)

Others

• 69d8b24: Preserve saved channels when exporting back to an alternate config file (#411) (@nao1215)
• 2128532: refactor(cmd): centralize Cobra flag-registration panics into helpers (@nao1215)
• d7ab786: refactor(cmd): extract shared empty-environment handling (@nao1215)
• 39f627d: refactor(cmd): extract shared per-result progress renderer (@nao1215)
• 46372d8: refactor(cmd): inject Printer via cobra SetOut/SetErr instead of redirecting os.Stdout (#393) (@nao1215)
• 35d5567: refactor(cmd): inject dependencies instead of mutable global seams (#393) (@nao1215)
• f8d7531: refactor(cmd): inject update/check operations via a dependencies value (@nao1215)
• aa9bb73: refactor(completion): unify per-shell file sync into one helper (@nao1215)
• ccd4df1: refactor(configstate): split monolithic file by responsibility (@nao1215)
• 7cf7c87: refactor(goutil): drop mutable goExe global in favor of goCommandContext seam (#393) (@nao1215)
• e9a6fa2: refactor(goutil): move version display out of the domain model (@nao1215)
• c1ba879: refactor(migrate): base missing-target warning on binary paths via pkgselect.MissingTargets (@nao1215)
• d6eb49c: refactor(print): introduce Printer and thread it through all commands (#393) (@nao1215)

Full changelog: v1.7.0...v1.7.1

Bug Fixes

• gup export now preserves channels saved under an alternate config file (--output) instead of dropping them when exporting back to a non-default gup.json. (#411)
• gup validates an auto-detected gup.json on otherwise empty environments so a malformed config fails fast rather than being silently ignored. (#410)
• A missing $GOBIN directory is treated as an empty environment instead of an error. (#409)
• Generated manpages now respect the process umask when their permissions are set, and are written atomically so a crash can never leave a truncated page behind. (#407, #408)
• gup import rejects directory paths explicitly instead of failing later with an opaque error. (#406)
• The gup bug-report browser launch no longer reports false success when the browser open times out. (#405)
• Atomic config writes preserve a symlinked gup.json (writing through the link rather than replacing it), and completion-file writes preserve dangling symlinks; completion files and .zshrc are written atomically. (#402, #403, #404)
• Completion install rejects relative XDG_* and ZDOTDIR paths rather than resolving them against the wrong base. (#401)
• Human-readable output stays consistent with --ignore-go-update. (#400)
• gup fails fast when an auto-detected gup.json is a directory. (#399)
• gup list, gup export, and gup pin no longer require the go command for local-only work.
• gup migrate --dry-run validates that AFTER_PATH is creatable so a dry run surfaces the same failure a real run would.
• gup remove treats a failed confirmation read as an error instead of a silent cancel.
• The shared Printer serializes writes across parallel workers so concurrent output is no longer interleaved. (#393)
• gup.json persists the version for the effective channel when merging packages.

Code Refactoring

• Thread a Printer through all commands and inject it via Cobra's SetOut/SetErr instead of redirecting os.Stdout, and inject update/check operations and other dependencies instead of mutating global seams. No user-visible behavior change. (#393)
• Internal cleanups across cmd, goutil, configstate, and completion (shared empty-environment and progress-rendering helpers, centralized Cobra flag-registration panics, version-display separation, per-shell completion sync, and a split of the monolithic configstate file). No user-visible behavior change.

Chore

• Bump sigstore/cosign-installer from 3.9.1 to 4.1.2.

v1.7.1

Compare

Choose a tag to compare

gup v1.7.0

Fast parallel updater and manager for binaries installed with go install.

Install or upgrade, then see the grouped highlights below. Every artifact is
signed and ships with an SBOM and build provenance — see
Verifying release integrity.

Changelog

Features

• 9f8446b: feat(cmd): add gup pin/unpin and pinned update/check behavior (@nao1215)
• 8a18b0e: feat(config): add pinned update channel and schema v2 (@nao1215)

Bug fixes

• bfdc79a: fix(pin): address review findings on pinned packages (@nao1215)

Documentation

• ac40298: docs(changelog): prepare v1.7.0 release (@nao1215)
• 3965144: docs(i18n): fix diagnostics comparison row and a punctuation typo (@nao1215)
• d28ca4b: docs(i18n): mirror README refresh across translated READMEs (@nao1215)
• b45ea9c: docs(i18n): mirror version pinning into all translated READMEs (@nao1215)
• 9975271: docs(readme): reword intro, relocate go-tool section, unwrap sentences (@nao1215)
• 0882e2e: docs(readme): sharpen intro, trim decoration, note Go build requirement (@nao1215)
• 394bbbb: docs(readme): split go-tool comparison and oh-my-zsh into own sections (@nao1215)
• bc6e231: docs(security): rewrite SECURITY.md to fit gup (@nao1215)
• 0a7df54: docs: document version pinning and refresh demo assets (@nao1215)
• 762ef88: docs: fold benchmark result into the feature comparison table (@nao1215)
• 6cceed7: docs: strengthen community standards (@nao1215)

Others

• 3481069: refactor(cmd): consolidate flag parsing into parseUpdateFlags/parseCheckFlags (@nao1215)
• e607ea8: refactor(goutil): reuse internal/parallel.Run in collectPackageInformation (@nao1215)
• e90da00: refactor(goutil): split goutil.go monolith into concern-focused files (@nao1215)

Full changelog: v1.6.0...v1.7.0

Features

• Add version pinning. gup pin <tool> <version> (also gup pin <tool>@<version>) records a tool in gup.json under a new pinned channel with a concrete version, and gup unpin <tool> clears it. gup update installs a pinned tool at its exact version with go install <import_path>@<version> (never @latest), keeps it there, and reinstalls it only when the installed version differs or the Go toolchain changed (suppressible with --ignore-go-update), while unpinned tools still update in parallel. gup check reports pinned/pin-mismatch without querying @latest, and --json gains a pinned_version field and the pinned/pin-mismatch statuses. Pinned state is preserved across export/import. (#384)

Bug Fixes

• gup.json now uses schema_version 2 only when a package is pinned and otherwise stays at 1, so older gup releases keep reading pin-free configs; channels are parsed strictly so an unknown channel, a pinned entry without a concrete version, or channel: "pinned" under schema_version: 1 fails fast instead of being silently downgraded to @latest. (#384)

Code Refactoring

• Split the internal/goutil monolith into concern-focused files and reuse internal/parallel.Run for package-information collection. No user-visible behavior change. (#380)
• Consolidate the update/check flag parsing into parseUpdateFlags/parseCheckFlags so a flag error is handled in one place. No user-visible behavior change. (#381)

Docs

• Refresh the README introduction and structure, rewrite SECURITY.md to fit gup, split the go tool comparison into its own section, fold the benchmark result into the feature-comparison table, and mirror the version-pinning documentation across all translated READMEs. (#383, #384)

CI

• Pin GitHub Actions to commit SHAs, disable persisted checkout credentials, and cache the release smoke build. (#383)

v1.7.0

Compare

Choose a tag to compare

gup v1.6.0

Fast parallel updater and manager for binaries installed with go install.

Install or upgrade, then see the grouped highlights below. Every artifact is
signed and ships with an SBOM and build provenance — see
Verifying release integrity.

Changelog

Features

• 994f645: feat(cmd): add failure diagnostics / next-step hints on update failures (@nao1215)
• 80ef535: feat(diagnose): cover go.mod replace directives (close last go-global-update gap) (@nao1215)

Bug fixes

• 9166df1: fix(diagnose): address CodeRabbit review (@nao1215)
• f02bb1d: fix(diagnose): base hints on verified go output, add v2-move case and e2e (@nao1215)
• 321e359: fix(pkgselect): base "not found" on binary paths, dedupe missing notices (@nao1215)

Documentation

• c71b30a: docs(changelog): prepare v1.6.0 release (@nao1215)

Others

• a10f583: refactor(cmd): extract package selection into internal/pkgselect (@nao1215)
• 84b6fa6: refactor(cmd): extract version cache into internal/vercache (@nao1215)
• 44b1487: refactor(cmd): extract worker pool into generic internal/parallel (@nao1215)
• 127539b: refactor(goutil): drop archived github.com/pkg/errors (@nao1215)

Full changelog: v1.5.1...v1.6.0

Features

• gup update and gup check now turn the Go toolchain's failure output into a short, actionable next-step hint printed on STDERR right after the error (and exposed as a per-package hint field in --json output). Hints cover module renames/major-version moves, relocated commands, go.mod replace directives, binaries not installed via go install, missing branch/tag for the selected channel, unresolvable/private/deleted repositories, SSH/auth and network/proxy errors, and an out-of-date Go toolchain. gup stays silent when it has nothing reliable to add (e.g. a timeout, whose message already names the remedy). (#378)

Bug Fixes

• gup update and gup check no longer mislabel a binary that exists in $GOBIN but whose build info cannot be read (or that was not installed by go install) as "not found": such a binary is reported as unreadable, not missing. The "not found" notice is now derived from the installed binary paths rather than the resolved packages. (#378)
• gup update no longer prints two "not found" notices for the same name when it is supplied both as a positional target and in --main/--master/--latest; the duplicate channel-flag notice is suppressed once the name has already been reported. (#378)

Code Refactoring

• Extract package selection, online-version caching, and the parallel worker pool out of the cmd/ layer into new reusable internal/pkgselect, internal/vercache, and internal/parallel packages, keeping cmd/ a thin wiring/output shell. No user-visible behavior change. (#377)
• Replace the archived github.com/pkg/errors dependency with the standard library errors/fmt. No user-visible behavior change. (#376)

CI

• Tighten the golangci-lint configuration and modernize the codebase for Go 1.25. (#376)

v1.6.0

Compare

Choose a tag to compare

gup v1.5.1

Fast parallel updater and manager for binaries installed with go install.

Install or upgrade, then see the grouped highlights below. Every artifact is
signed and ships with an SBOM and build provenance — see
Verifying release integrity.

Changelog

Bug fixes

• ff752c1: fix(completion): honor XDG paths and ZDOTDIR in completion --install (#372) (@nao1215)
• 7e9a03d: fix(completion): self-heal zsh .zshrc fpath block on re-install (#373) (@nao1215)
• 1775917: fix(config): fail fast on invalid/ambiguous gup.json and reject directory destinations (#370) (@nao1215)
• 5c43264: fix(configstate): keep package when rename does not change import_path (@nao1215)
• f5b9e06: fix(json): stabilize --json output ordering for parallel commands (#371) (@nao1215)

Documentation

• 44a89bb: docs(changelog): cut v1.5.1 release notes (#375) (@nao1215)

Others

• ddeab0d: refactor(cmd): centralize config/state logic in internal/configstate (@nao1215)

Full changelog: v1.5.0...v1.5.1

Bug Fixes

• gup check, gup update, and gup list --json now fail fast when the resolved gup.json is malformed or has an unsupported schema_version, instead of silently falling back to @latest, and reject a directory passed where a gup.json file is expected instead of clobbering it. (#370)
• --json output for the parallel commands (check/update/import/migrate) is now emitted in the original input order, making machine-readable output deterministic across runs without changing exit codes, status values, or error semantics. (#371)
• gup completion --install now honors XDG_DATA_HOME (bash), XDG_CONFIG_HOME (fish), and ZDOTDIR (zsh) when choosing where to write completion files and the .zshrc snippet. (#372)
• gup completion --install now repairs a deleted, stale, or hand-broken zsh .zshrc fpath block on re-install instead of leaving zsh completion broken; an already-correct block is left byte-for-byte unchanged. (#373)
• Fix a config data-loss case in gup update: persisting gup.json after a binary rename that kept the same import_path could drop the package from the saved config entirely. (#374)

Code Refactoring

• Centralize the config/state logic that was spread across the cmd/ commands into a new internal/configstate package (config-path resolution, update-channel resolution/merge, and persistence) and unify binary-name matching in internal/binname, so update/check/list/export interpret the same gup.json entry through one consistent package-identity model. No user-visible behavior change. (#374)

CI

• Generate sigstore bundles during release signing. (#363)

v1.5.1

Compare

Choose a tag to compare

gup v1.5.0

Fast parallel updater and manager for binaries installed with go install.

Install or upgrade, then see the grouped highlights below. Every artifact is
signed and ships with an SBOM and build provenance — see
Verifying release integrity.

Changelog

Features

• cc827cc: feat(cli): treat an empty environment as a friendly first-run, not an error (@nao1215)

Bug fixes

• 3988c1f: fix(bug-report): drop placeholder title, add OS, align issue template (@nao1215)
• e8523fd: fix(cli): harden completion --install and man for env edge cases (@nao1215)
• b0550d5: fix(completion): propagate Close error via named return (CodeRabbit) (@nao1215)
• 5837b07: fix(config): harden gup.json channel resolution across check/update/export (@nao1215)
• 4379f90: fix(goutil): address CodeRabbit review (@nao1215)
• dd0be6a: fix(update): honor explicit --file as channel write destination (#358) (@nao1215)

Documentation

• c594e84: docs(changelog): cut v1.5.0 release notes (#360) (@nao1215)
• fed405c: docs(i18n): sync translated READMEs and add regression tests (#359) (@nao1215)
• 2ba74b8: docs: fix README install/comparison and sync translated READMEs (@nao1215)

Full changelog: v1.4.0...v1.5.0

Features

• Add a --file/-f flag to check and update to select which gup.json to read saved update channels from (and write back to, for update), consistent with import/export. (#342)

Changes

• Treat an empty global environment (no binaries installed by go install yet) as a normal first-run condition rather than an error: list, check, export, and update now exit 0. list/check/update print an informational note (or emit a valid empty [] in --json mode), and export writes an empty gup.json. Naming a non-existent binary or excluding everything is still treated as a usage error (exit 1). (#350)

Bug Fixes

• gup update --main and check now fall back from @main to @master only when the main branch does not exist. Build, network, proxy, authentication, timeout, and cancellation failures on @main are surfaced as-is instead of silently installing @master. (#340)
• gup export now preserves each package's saved update channel (latest/main/master) regardless of --file/--output. Channels are always resolved from the canonical user-level gup.json, matched by import_path first (with Windows .exe name differences normalized), so exporting to a new destination no longer resets channels to latest. (#341)
• gup check and gup update now fail fast when both the user-level gup.json and ./gup.json exist and --file is omitted, instead of silently picking one — matching the existing gup import behavior. (#342)
• gup completion --install now exits non-zero when a completion file cannot be written (previously it could print an error but still exit 0), and fails fast with a clear message when HOME is unset instead of writing completion files into relative paths under the current directory. (#343)
• gup man now creates the target man1 directory when it does not exist (e.g. for a valid custom MANPATH) instead of failing, and reports a clear error for unwritable targets. (#344)
• gup bug-report no longer pre-fills a generic placeholder issue title (so reports are less likely to be filed with an empty/placeholder title), now includes the OS alongside the gup version in the generated body, and its help text no longer claims to include broader system information than is actually present. The bug-report issue template is aligned with the command. (#345)
• gup update --file <path> now persists update channels and rename bookkeeping to the explicitly named file even when it does not exist yet, instead of silently writing them to the user-level gup.json. The export-side saved-channel matching also normalizes the .exe/.EXE suffix case-insensitively so hand-edited or upper-cased config entries keep their channel. (#358)

Documentation

• Fix the Homebrew install command in the README to the correct tap form brew install nao1215/tap/gup, and rewrite the feature-comparison table so the force-reinstall row is command-scoped (update never reinstalls up-to-date binaries; migrate --force reinstalls when the target already exists), removing the previously misleading row. (#349)
• Sync the newer feature sections into all translated READMEs (doc/{ja,ru,zh-cn,ko,es,fr}): Quiet output (--quiet/-q), machine-readable JSON output (--json), disable-colorized output (NO_COLOR/--no-color), and the feature-comparison table; remove the stale v1.0.0 breaking-change note. doc_sync_test.go now guards these sections so future drift fails CI. (#339)
• Finish syncing the translated READMEs with the English source: the config-resolution rules (import/check/update fail-fast on an ambiguous gup.json, and export always resolving saved channels from the canonical user-level config), the empty-environment behavior, man honoring MANPATH, and completion --install requiring HOME. (#359)

Tests

• Add an offline end-to-end test suite (ShellSpec) under e2e/ that exercises the real gup binary in an isolated temp HOME/XDG_CONFIG_HOME/GOBIN, with no network access. It covers list, export --output, import --file, migrate, and non-TTY remove. Run it with make e2e; it also runs in CI (.github/workflows/e2e.yml). (#346)
• Extend the offline E2E suite to cover real check and update flows through the actual go toolchain against a self-contained local module proxy (e2e/testproxy): up-to-date vs. update-available, installing a newer version, --main success, @main→@master fallback only on branch-not-found, and no fallback when @main exists but fails to build. (#347)
• Strengthen the README-sync test to assert the MANPATH and HOME payloads verbatim across every translation, and extend the E2E suite to cover update --file persisting the channel to a not-yet-existing destination and the multiple-gup.json ambiguity fail-fast. (#359)

CI

• Smoke-test the GoReleaser artifacts before publishing a release: the release workflow now builds a snapshot and runs scripts/smoke_artifacts.sh (extracted archive runs gup --version, every archive ships the completion files, and the Linux .deb installs and runs) before the real goreleaser release, so a packaging regression blocks publication. A Release Smoke workflow runs the same check on every PR. (#348)

v1.5.0

Compare

Choose a tag to compare

gup v1.4.0

Fast parallel updater and manager for binaries installed with go install.

Install or upgrade, then see the grouped highlights below. Every artifact is
signed and ships with an SBOM and build provenance — see
Verifying release integrity.

Changelog

Features

• 4248f24: feat(cmd): add --quiet output mode to check and update (@nao1215)
• eab466b: feat(cmd): add top-level --version/-V flag while keeping the version subcommand (@nao1215)
• d880900: feat(cmd): fail fast on gup remove confirmation in non-interactive mode (@nao1215)
• 1232ed8: feat(cmd): respect NO_COLOR and add a --no-color flag (@nao1215)
• bd4b137: feat(cmd): show concise actionable guidance when required args are missing (@nao1215)

Bug fixes

• b2c5c5c: fix(config): normalize "unknown" version to latest before persisting (@nao1215)
• f9f3ea0: fix(goutil): classify binaries by main module, not a dotless-path heuristic (@nao1215)

Documentation

• 36896ff: docs(cmd): add practical examples to root and major subcommand help (@nao1215)
• 09c93e7: docs(cmd): document why summarizeResults switch is exhaustive for check/update (@nao1215)
• a551dac: docs: add feature comparison table (@LucasM4r)
• cc2957a: docs: credit external feature-request reporters (ideas) (@nao1215)
• da5c198: docs: credit remaining external problem reporters (#233, #76, #16) (@nao1215)
• 55990a9: docs: expand feature comparison table (@LucasM4r)
• 8d63819: docs: move benchmark/comparison before contributing, slim the table, add contributors (@nao1215)
• 1f25192: docs: sync Benchmark, release-integrity, and Migrate sections into all translated READMEs (@nao1215)

Others

• 1362608: Merge remote-tracking branch 'origin/main' into feat/issue-301-305-goutil-testability (@nao1215)
• b789648: Merge remote-tracking branch 'origin/main' into feat/issue-301-305-goutil-testability (@nao1215)
• c9e8ca4: Merge remote-tracking branch 'origin/main' into feat/issue-303-323-remove-hardening (@nao1215)
• accfe3e: Merge remote-tracking branch 'origin/main' into feat/issue-304-parallel-invariants (@nao1215)
• c204f61: Merge remote-tracking branch 'origin/main' into feat/issue-306-readme-sync (@nao1215)

Full changelog: v1.3.1...v1.4.0

Features

• Add a top-level --version/-V flag in addition to the existing gup version subcommand. (#326)
• Add a --quiet/-q output mode to check and update that hides the up-to-date lines and prints only changed/updatable binaries, failures, and a one-line summary. Errors still go to STDERR. (#290)
• Respect the NO_COLOR environment variable and add a --no-color flag to disable colorized output. (#309)
• Show concise, actionable guidance (the correct usage line) when a required argument is missing, instead of dumping the full help. (#324)

Bug Fixes

• gup remove now fails fast with a clear message in non-interactive execution (when stdin is not a TTY, e.g. CI or a pipe) instead of blocking on stdin or surfacing a raw EOF. --force still skips confirmation. (#323)
• Normalize an unknown/(devel)/empty binary version to latest before persisting it to gup.json, so later gup update runs resolve the package correctly. (#300)
• Classify binaries by their main module path instead of a dotless-import-path heuristic, fixing the misclassification of tools whose host has no dot (e.g. internal registries). (#299)

Documentation

• Sync the Benchmark, release-integrity, and Migrate sections into all five translated READMEs, and add a test that fails when a translation is missing one of these sections. (#306)
• Document the top-level --version flag, the non-TTY remove behavior, and the --json/--quiet precedence in the README.

Tests

• Add a helper-process test seam for goExe-based subprocess calls, plus property-based tests for version comparison, name normalization, and config round-trip. (#301, #305)
• Cover parallel-execution invariants: result count, timeout isolation, and CPU clamping. (#304)
• Make config_file rename injectable and cover the backup-swap restore-failure worst case. (#302)
• Add a property-based test for the path-traversal guard in gup remove. (#303)

Others

• Tidy help-text consistency (flag-description casing, Short punctuation, example indentation) and give the non-interactive remove error a labeled STDERR message.

v1.4.0

Compare

Choose a tag to compare

gup v1.3.1

Fast parallel updater and manager for binaries installed with go install.

Install or upgrade, then see the grouped highlights below. Every artifact is
signed and ships with an SBOM and build provenance — see
Verifying release integrity.

Changelog

Features

• 4649ae4: feat(cmd): add machine-readable JSON output to list, check, and update (@nao1215)
• 4fef9e2: feat(release): curated release notes plus signing, SBOM, and provenance (@nao1215)

Bug fixes

• 48ed9ad: fix(check): respect saved update channels in gup check (@nao1215)
• 4d3ee1b: fix(cmd): disable per-package timeout by default and name the command on timeout (@nao1215)
• 3a69aad: fix(release): address review feedback on changelog filters, cosign identity, and config tests (@nao1215)
• 78c9654: fix(release): migrate .goreleaser.yml to v2 schema (version, archives.formats, snapshot.version_template) (@nao1215)
• f94989c: fix(update): derive skip/update decision from the resolved channel (@nao1215)
• f131f0a: fix(update): keep --json stdout pure JSON when excluding packages (@nao1215)
• 2060f5d: fix: guarantee dry-run temp-dir cleanup and make it panic-safe (@nao1215)
• bd34132: fix: skip Go-version comparison when 'go version' detection fails (@nao1215)
• 4930c2f: fix: surface a cause when a killed go subprocess has empty stderr (@nao1215)

Documentation

• 1a50cea: docs: add example output to gup check --json jq example (@nao1215)
• 2d37e75: docs: keep translated READMEs in sync with the English source of truth (@nao1215)
• 0d9a998: docs: prepare v1.3.1 release (changelog) (@nao1215)
• 9816026: docs: show gup check --json output directly instead of a jq pipeline (@nao1215)
• baa7fa9: docs: shrink JSON output section in README (@nao1215)
• 6f0c071: docs: unify language switcher across all translated READMEs (@nao1215)

Full changelog: v1.3.0...v1.3.1

Bug Fixes

• The per-package --timeout added in v1.3.0 is now opt-in and disabled by default (default 0), so a slow but healthy go install is no longer killed as a timeout; this restores the pre-v1.3.0 behavior. Pass --timeout 5m (or any duration) to re-enable a bound. (#318)
• When a --timeout bound is hit, the error now names the exact command to rerun (go install <path>@<version> or go list -m <module>@<ref>) and hints at --timeout, so a slow build is easy to diagnose. (#318)
• gup update now decides whether to skip a package using its resolved update channel, so binaries tracked on @main/@master are no longer skipped or updated based on @latest. (#292)
• gup update --json keeps STDOUT valid JSON when --exclude is used, instead of leaking a human-readable "Exclude ..." line that broke machine-readable output. (#291)
• When the installed Go version cannot be detected, gup disables the Go-version comparison for that run (and warns once) instead of treating every binary as outdated and reinstalling all of them. (#296)
• Dry-run mode now always removes its temporary directory, even when restoring GOBIN/GOPATH fails, and runs cleanup via defer so it is panic-safe. (#297)
• A killed go install/go list subprocess that writes nothing to stderr now reports a cause (e.g. signal: killed) instead of an empty error message. (#298)

v1.3.1

Compare

Choose a tag to compare

Changelog

• 8cf97fc Merge pull request #263 from nao1215/dependabot/github_actions/actions/checkout-7
• 330690f Merge pull request #272 from nao1215/fix/issue-264-lazy-asset-deploy
• eb0f9a3 Merge pull request #273 from nao1215/fix/issue-266-import-ambiguous-config
• 82ae659 Merge pull request #274 from nao1215/fix/issue-269-lint-baseline
• 92634be Merge pull request #275 from nao1215/fix/issue-265-completion-install-windows
• 29ed199 Merge pull request #276 from nao1215/fix/issue-267-go-subprocess-timeout
• 6939af2 Merge pull request #277 from nao1215/fix/issue-268-coverage-platform-paths
• 03ad305 Merge pull request #278 from nao1215/refactor/issue-270-shared-operation-engine
• 24c8e1e Merge pull request #279 from nao1215/perf/issue-271-benchmark-and-optimize
• 5783bd0 Merge pull request #280 from nao1215/release/v1.3.0
• 87ddac3 build(deps): bump actions/checkout from 6 to 7
• 6ca11de ci(octocov): stop excluding now-tested platform-dependent files
• cecaef5 ci: enforce golangci-lint as a hard gate instead of warnings
• 71a9c54 docs(cmd): fix grammar and accuracy in subcommand descriptions
• 9d7c7c7 docs(perf): record measured rejection of go list -m batching (no crossover)
• 4432fe0 docs(perf): reduce bold emphasis in performance.md
• d6d63ea feat(cmd): add per-package timeout for go subprocess operations
• 2d7ecde fix(bench): make timing portable (GNU date/gdate) and fail fast on errors
• c126227 fix(cmd): deploy notification icons lazily to avoid startup filesystem writes
• 6d8ae76 fix(cmd): reject negative --timeout values
• 545d113 fix(completion): return explicit error for --install on Windows
• 64b8285 fix(import): fail explicitly when multiple gup.json candidates exist
• 209ddf7 fix: resolve govet inline and stale nolintlint findings
• 4c45632 perf(goutil): skip go-version subprocess for commands that don't need it
• df4641a perf(harness): fail fast on command errors; record measured go list -m batching win
• d6c10ab perf(update): add reproducible real-install harness and record measured findings
• faae4cb refactor(cmd): extract shared package-operation engine
• 897acfb refactor(test): replace repeated string literals with constants for goconst
• 92be424 style: use US spelling 'canceled' for misspell (US locale)
• 19fec11 test(cmd): use shared constants for shell and command names to satisfy goconst
• 219d0ed test(completion): cover make/append error branches to raise coverage
• 79ea909 test(import): use t.Chdir to fix Windows temp dir cleanup race

Features

• Add a per-package --timeout to update, check, import, and migrate so a stuck go subprocess fails instead of hanging forever (default 5m; --timeout 0 disables). Signal-based cancellation still aborts in-flight work, and timeouts are reported distinctly from cancellations.

Bug Fixes

• gup import now fails with a clear error when both the user-level gup.json and ./gup.json exist and --file is omitted, instead of silently picking one.
• Read-only commands (gup version, gup help, gup completion <shell>) no longer create notification asset files under the user profile at startup; icons are deployed lazily only when a desktop notification is actually sent.
• gup completion --install now returns a clear error on Windows (where it was a silent no-op) and points users to gup completion powershell for stdout generation.

Performance

• list, export, and migrate no longer run the go version subprocess they never used, cutting their package scan by up to ~97% on small $GOBIN sets.
• Added a measurement-driven performance investigation in doc/performance.md, including a reproducible harness and optimizations that were measured and explicitly rejected (e.g. batching go list -m, which was slower than the existing parallel resolution).

Code Refactoring

• Extracted a shared package-operation engine (cancellation, worker-pool execution, per-package result reporting) used by update, check, import, and migrate, shrinking the command files without changing behavior.

Docs

• Added a benchmark table comparing gup with go-global-update and a sequential go install loop, and replaced the v1.0.0 breaking-change note with it.
• Replaced the static gup update example and gup list screenshot with VHS-recorded GIFs.

Others

• Restored a clean golangci-lint baseline (goconst/nolintlint/govet) and made golangci-lint an enforced CI gate; aligned the module with its declared go1.25 policy by dropping a go1.26-constrained dependency.
• Added focused tests for the platform-dependent internal/completion, internal/assets, and internal/notify packages.

v1.3.0

Compare

Choose a tag to compare

Features

• Add gup migrate BEFORE_PATH AFTER_PATH [BINARY...] subcommand to reinstall go install binaries from one $GOBIN directory into another
  • Reinstalls using the exact import path@version recorded in each binary's build info (no implicit upgrade to @latest)
  • Add-only semantics: never deletes files in AFTER_PATH, skips binaries that already exist there unless --force is given
  • Refuses to run when BEFORE_PATH and AFTER_PATH resolve to the same directory, and never mutates the filesystem on a validation failure
  • Skips binaries with no resolvable import path, command-line-arguments builds, and devel/(devel) versions instead of upgrading them
  • Follows module-path renames, warns about missing targets, and supports --dry-run, --notify, --jobs, and --force (parallelized like import/update)
  • Useful when a Go version manager such as mise changes the real path of $GOBIN per Go version

Docs

• Replace the static README screenshot with a gup update GIF recorded via VHS and document the gup migrate use case (including mise)

Build

• Bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0
• Bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15
• Bump gitleaks/gitleaks-action from 2 to 3

Tests

• Add table-driven tests for migrate covering path validation, add-only/force semantics, binary filtering, skip conditions, module-path-mismatch retry, dry-run, and --jobs boundaries

Build

• Bump minimum Go version from 1.24 to 1.25
• Add Go 1.26 to CI test matrix
• Bump github.com/fatih/color from 1.18.0 to 1.19.0

Fixes

• Harden browser launch behavior in bug-report with command timeout/wait handling
• Make interactive confirmation flow iterative and robust against repeated invalid input
• Strengthen remove target validation and normalization (including Windows-specific suffix handling)
• Improve man generation success logging and config swap error reporting in failure recovery paths
• Fix Windows remove regression test expectation and resolve -race failure in bug-report fallback output test

Build

• Bump goreleaser/goreleaser-action from v6 to v7

Docs

• Highlight installation availability via winget, mise, and nix

Tests

• Add and expand regression tests for browser launcher behavior, remove target edge cases, and fallback output handling
• Keep overall statement coverage from dropping while adding the new hardening changes

Fixes

• Treat equal custom Go toolchain versions (e.g. go1.26.0-X:nodwarf5) as up-to-date in check and update
• Normalize custom Go version separators for comparison and apply Go-aware comparison to version colorization

Tests

• Add regression tests for custom Go toolchain tags across internal/goutil, check, and update, including output color behavior

Fixes

• Make config writes atomic and harden replacement flow to avoid data loss on failed updates
• Fix Windows rename/update edge cases when GOEXE is unset
• Fix Windows target matching for update with case-insensitive name handling
• Fix remove behavior on Windows when GOEXE is empty and handle .exe suffix checks robustly
• Propagate cancellation to running go install / go list subprocesses
• Unify signal-based cancellation behavior across update/import/check flows

Performance

• Speed up completion generation script by building once and reusing the binary

Refactoring

• Centralize Go command availability checks and jobs clamping
• Simplify update internals toward context-aware operation paths

Docs

• Consolidate contributor guidance and align README/CONTRIBUTING workflow instructions

Tests

• Add and expand regression tests for atomic config writes, completion comparison, Windows suffix handling, and cancellation behavior

Features

• Add PowerShell completion generation via gup completion powershell
• Generate completions/gup.ps1 in scripts/completions.sh

Docs

• Clarify that completion --install targets bash/fish/zsh only
• Add PowerShell completion usage examples to README (en/es/fr/ja/ko/ru/zh-cn)

Tests

• Strengthen completion output tests by capturing os.Stdout and verifying PowerShell header output

⚠ BREAKING CHANGES

• Config format changed from plain-text gup.conf (<name> = <import-path>) to JSON gup.json with versioned schema
• gup import now installs the exact version recorded in gup.json
• gup import flag changed from --input to --file
• gup export flag changed from --output to --file

Features

• Store update channels (latest / main / master) in gup.json
• Auto-adapt to module path changes (detect and follow import path renames)
• Add config path resolution ($XDG_CONFIG_HOME/gup/gup.json first, then ./gup.json)
• Add --file option to both import and export
• Always include version in bug-report template

Fixes

• Persist dry-run temp path for proper cleanup and cancel workers on interrupt signals
• Validate binary names in removeOldBinaryIfRenamed to prevent path traversal
• Block path traversal in remove targets
• Warn instead of failing when gup.json is corrupt during update
• Surface gup.json parse errors during update
• Normalize binary names in --main/--master/--latest flag resolution for Windows
• Remove stale config entries when binary is renamed during update
• Return original importPath when prefix does not match in replaceImportPathPrefix
• Trim whitespace in --exclude package names
• Require explicit --install for completion file writes
• Validate go command availability in import
• Exit with status 1 when command execution fails
• Version coloring: yellow=outdated, green=up-to-date
• Reject malformed gup.conf lines early (legacy format migration)
• Normalize devel version to latest during import

Performance

• Use a fixed worker-pool implementation for package processing
• Deduplicate GetLatestVer calls and parallelize binary info collection
• Filter binary completions by typed prefix

Refactoring

• Replace golang.org/x/exp/slices with standard slices package
• Share config file writing logic across commands
• Remove unused update wrapper function and unused first argument from shouldPersistChannels

Tests

• Add tests to increase coverage from 79.6% to 88.7%
• Stub update operations in root command tests

• Fix bug fixes and CI improvements #230 (nao1215)
• Fix address review findings across codebase #229 (nao1215)
• Fix issue #206 #228 (nao1215)
• Remove gorky package #227 (nao1215)
• Bump pointer v1.4.0 #226 (nao1215)

• docs: add mise alternate installation instructions (en/fr) and fix shell quoting in README #222 (jylenhof)
• Refactor bug report URL construction to fix the bug-report command #221 (shogo82148)
• docs: add shogo82148 to all-contributors #220 (nao1215)
• docs: fix typo in README #219 (shogo82148)
• Bump golang.org/x/sync from 0.18.0 to 0.19.0 #217 (dependabot[bot])
• Bump github.com/hashicorp/go-version from 1.7.0 to 1.8.0 #214 (dependabot[bot])
• Bump actions/checkout from 5 to 6 #213 (dependabot[bot])

• Use MANPATH when installing man pages and fix lints #211 (nao1215)
• docs: update contributors #210 (nao1215)
• Return the original error when latest version lookup fails #205 (peczenyj)
• Bump golang.org/x/sync from 0.17.0 to 0.18.0 #207 (dependabot[bot])

• Add --ignore-go-update flag and refine updater error handling #201 (iTrooz)
• Refactor tests to isolate environments and add helpers #203 (iTrooz)
• Bump golang.org/x/sync from 0.16.0 to 0.17.0 #200 (dependabot[bot])
• Bump actions/setup-go from 5 to 6 #199 (dependabot[bot])

• docs: add README translations (es, fr, ko, ru, zh-cn) #195 (nao1215)
• Trim potential GOEXPERIMENT flag in build info #197 (mcha-forks)
• Update contributors #198 (nao1215)
• Support Go 1.24 or later #188 (nao1215)
• Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 #196 (dependabot[bot])
• Bump actions/checkout from 4 to 5 #194 (dependabot[bot])
• Bump github.com/gen2brain/beeep #192 (dependabot[bot])
• Bump golang.org/x/sync from 0.15.0 to 0.16.0 #193 (dependabot[bot])
• Bump golang.org/x/sync from 0.14.0 to 0.15.0 #190 (dependabot[bot])
• Bump golang.org/x/sync from 0.13.0 to 0.14.0 #189 (dependabot[bot])

• Bump golang.org/x/sync from 0.11.0 to 0.12.0 #185 (dependabot[bot])

• Add Go 1.24 to CI and fix unit tests #182 (nao1215)
• Bump github.com/google/go-cmp from 0.6.0 to 0.7.0 #184 (dependabot[bot])
• Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 #183 (dependabot[bot])
• Bump golang.org/x/sync from 0.10.0 to 0.11.0 #181 (dependabot[bot])

• Bump github.com/mattn/go-colorable from 0.1.13 to 0.1.14 #180 (dependabot[bot])
• Bump golang.org/x/sync from 0.9.0 to 0.10.0 #179 (dependabot[bot])
• Bump golang.org/x/sync from 0.8.0 to 0.9.0 #178 (dependabot[bot])
• Bump github.com/adrg/xdg from 0.5.2 to 0.5.3 #177 (dependabot[bot])
• Bump github.com/adrg/xdg from 0.5.1 to 0.5.2 #176 (dependabot[bot])
• Bump github.com/fatih/color from 1.17.0 to 1.18.0 #175 (dependabot[bot])
• Bump github.com/adrg/xdg from 0.5.0 to 0.5.1 #174 (dependabot[bot])

• Fix: check sub command prints incorrect path #172 (nao1215)
• Add go 1.23 #170 (nao1215)

• Feat: Integrate completions into Homebrew formula (Issue #168) #169 (nao1215)
• Bump golang.org/x/sync from 0.7.0 to 0.8.0 #167 (dependabot[bot])
• Specify Language for Fenced Code Blocks #166 (nao1215)
• Bump github.com/adrg/xdg from 0.4.0 to 0.5.0 #165 (dependabot[bot])

• Output current rather than latest version in up-to-date messages #164 (scop)

• Update: change version compare logic #162 (nao1215)
• Update README output wrt added Go versions #161 (scop)

• Remove deprecated option #158 (nao1215)

• Output and consider Go toolchain version, too #156 (scop)
• Bump github.com/spf13/cobra from 1.8.0 to 1.8.1 #155 (dependabot[bot])
• Bump goreleaser/goreleaser-action from 5 to 6 #153 (dependabot[bot])

• Fix goreleaser quoting #151 (nao1215)
• Update GitHub Actions #150 (nao1215)

• Update project rules #149 (nao1215)
• Bump github.com/fatih/color from 1.16.0 to 1.17.0 #148 (dependabot[bot])

• Fix issue148: Confirmation with [Y/n] should default to "yes" #147 (nao1215)

• Auto generate homebrew tap #145 (nao1215)

• Argument validation and completion improvements #144 (scop)
• docs: add scop as a contributor for code #143 (allcontributors[bot])

• Generate cobra's v2 bash completions #141 (scop)
• Various completion improvements #140 (scop)
• Update bash completion path #139 (scop)
• Add ability to output completions to stdout #138 (scop)
• Bump golang.org/x/sync from 0.6.0 to 0.7.0 #137 (dependabot[bot])

• Polishing #136 (rkscv)