
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
gh-propagate
Advanced tools
[](https://badge.fury.io/js/gh-propagate)
A command-line tool for propagating changes through a chain of pull requests with automatic integration branch detection and PR management features.
gh-propagate
automatically merges changes through sequential pull requests while providing powerful PR management features. It automatically detects integration branches, supports PR title numbering, and can update integration PR descriptions with chain information. This is particularly useful when working with stacked pull requests where changes need to be propagated from base branches to target branches.
The tool discovers the chain of pull requests by traversing from your target branch back to the base branch using GitHub CLI (gh
), then merges changes in reverse order to ensure proper propagation. Integration branches are automatically detected and merged PRs are included in all operations.
Example scenario:
dev
dev ← feature-1 ← feature-2
When you run gh-propagate feature-2
, the tool will:
dev → feature-1 → feature-2
dev
→ feature-1
→ feature-2
--no-ff
gh
) must be installed and authenticated# Using bun
bun install -g gh-propagate
# Using npm
npm install -g gh-propagate
For Fish shell users, you can enable tab completion by copying the completion file:
# Copy fish completion to your fish completions directory
cp completions/gp.fish ~/.config/fish/completions/
# Or if installed globally via npm/bun, find the installation path
# and copy from there
The completion provides:
--integration
option--edit
option (title, desc)gp [options] <target-branch>
Examples:
# Basic propagation with auto base branch detection
gp feature-branch
# Preview what would be executed
gp feature-branch --dry-run
# Enable debug logging
gp feature-branch --debug
# Edit PR titles and descriptions in integration mode
gp feature-branch --integration integration-branch --edit title desc
--dry-run
, -d
: Preview what commands would be executed without making any changes--edit <operations>
, -e <operations>
: Apply edit operations to PRs (requires --integration
). Available operations:
title
: Add sequential numbering to PR titles in [n/total]
formatdesc
: Update integration PR description with PR list--integration <branch>
, -i <branch>
: Specify integration branch for edit operations--debug
: Enable debug logging for troubleshooting--version
, -v
: Show version informationgh pr view --json number,headRefName,baseRefName,url,title,body --head <branch>
git switch <source-branch>
git pull
git switch <target-branch>
git pull
git merge --no-ff <source-branch>
git push
[n/total]
# Simple propagation
gh-propagate main feature-branch
# Preview changes without executing
gh-propagate --dry-run main feature-branch
# List PRs in the chain
gh-propagate --list main feature-branch
# Add sequential numbering to PR titles
gh-propagate --edit title main feature-branch
# Update integration PR description with PR list
gh-propagate --edit integration main feature-branch
# Apply both operations
gh-propagate --edit title,integration main feature-branch
# Use with dry run to preview changes
gh-propagate --edit title --dry-run main feature-branch
List output:
- [1/3] ✅ #123: [Add authentication system](https://github.com/user/repo/pull/123)
- [2/3] 🔄 #124: [Add user management](https://github.com/user/repo/pull/124)
- [3/3] 🔄 #125: [Add admin dashboard](https://github.com/user/repo/pull/125)
Title numbering output:
🔄 Updating PR titles with sequential numbering...
✅ PR #123: "[1/3] Add authentication system"
✅ PR #124: "[2/3] Add user management"
✅ PR #125: "[3/3] Add admin dashboard"
✅ Updated 3/3 PR titles successfully
# Build the project
bun run build
# Run tests
bun test
# Version bump
bun run version
Apache License 2.0
FAQs
[](https://badge.fury.io/js/gh-propagate)
The npm package gh-propagate receives a total of 0 weekly downloads. As such, gh-propagate popularity was classified as not popular.
We found that gh-propagate demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.