[styfle]

You asked how this repo publishes releases, and whether a patch could go out right now. The short answer to the second question is no, and this PR is the first part of fixing that.

How releases work today

RELEASE.md writes it down, since it was not recorded anywhere in the repo:

• master feeds releases.hyper.is, canary feeds releases-canary.hyper.is. app/updater.ts polls https://<feed>/update/<platform>/<version> 10s after launch and every 30 minutes after that. Both feeds mirror the GitHub Releases of this repo, and the stable one filters out pre-releases.
• A release is a commit bumping version in both package.json and app/package.json (message is the bare version), a vX.Y.Z tag on it, and a GitHub Release carrying the installers.
• release turns the commits since the previous tag into a draft release; release.js in the repo root is the hook that prompts for the one-line summary.
• The push to master/canary runs Node CI, which builds on macOS, Windows and Ubuntu plus two cross-built Linux ARM jobs. electron-builder runs with no --publish flag, so a branch push resolves the policy to onTagOrDraft: it uploads into the draft release matching v<version> and does nothing at all if that draft is missing. Publishing the draft is what ships the update.

Why a patch cannot go out right now

1. Actions is disabled on this repo. GET /repos/vercel/hyper/actions/permissions returns {"enabled": false}, and merging fix: validate ssh:// URLs before building the ssh command #8217 earlier today produced no Node CI run. Nothing builds until that is turned back on, and only someone with repo settings access can do it.
2. Node CI fails before its first step. Every job in the last runs (May 2026) died on This request has been automatically failed because it uses a deprecated version of 'actions/upload-artifact: v3'. That is what this PR fixes: the three uploads move to @v4 with per-job names, and the pr_num artifact goes away because its only consumer, .github/workflows/e2e_comment.yml, was deleted in Delete .github/workflows/e2e_comment.yml #8207.
3. The build-linux-arm jobs fail separately, on their own exit codes rather than the artifact action, so they need a look once the rest is green.
4. Signing is unverified. The macOS and Windows certificates in the repository secrets were last exercised in July 2023 and code-signing certificates expire. Worth confirming before cutting a tag rather than after.

The source tree itself is healthy — lint, the 19 unit tests, pnpm run build and an unsigned Linux electron-builder run all pass locally on this branch.

What shipping the ssh:// fix would take

#8217 landed on canary, which is 4.0.0-canary.5 plus 708 commits. Stable users are on 3.4.1 from January 2023.

• A 4.0.0-canary.6 pre-release off canary is the cheap path, but it only reaches people who opted into the canary channel.
• A 3.4.2 off master reaches everyone else, and that is not mechanical: cherry-picking 890a332 onto master conflicts in app/index.ts, lib/actions/ui.ts and typings/common.d.ts. master also still carries the unreleased "Security fixes" commit from December 2023, whose lib/actions/ui.ts guard validates the host but not the user component.

Notes

• The CI change is untested, because Actions is disabled and I cannot run the workflow to prove it.
• bin/notarize.js reads APPLE_PASSWORD, but the workflow exports that secret as APPLE_APP_SPECIFIC_PASSWORD, so the afterSign hook returns early every time. electron-builder's built-in notarization reads the name the workflow does set, so this is probably harmless, but the dead hook is confusing and worth deleting separately.
• actions/checkout, actions/setup-node and actions/cache are all on v4 and only emit deprecation warnings, so I left them for Dependabot.

Generated via styfle's devbox

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​actions/​upload-artifact@​ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 ⏵ ea165f8d65b6e75b540449e92b4886f43607fa02	-13				+11

View full report

[styfle]

Confirming the first blocker from the description: this PR itself triggered no Node CI run — GET /repos/vercel/hyper/actions/runs?branch=investigate-hyper-release-publishing-process returns total_count: 0, and the only checks on it are Socket Security and the Vercel security review. So the workflow fix here cannot be exercised until Actions is re-enabled on the repo.