Upstream Audit

Checks every entry in installer/upstreams.yaml for newer stable versions, security advisories, and hash drift. Updates the manifest and verifies each change installs correctly.

Important

• Never update to pre-release, alpha, beta, rc, or canary versions. Only stable releases.
• Never update a curl entry's sha256 without downloading and verifying the script content first.
• Every version bump must be install-tested before writing to upstreams.yaml.
• Preserve all existing fields (comments, last_audited, soft_pin, scripts_policy, etc.) — only change version, sha256, and last_audited.

Instructions

Step 1: Load the Manifest

cat installer/upstreams.yaml