
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
github-backport
Advanced tools
github-backport backports a pull request using the GitHub REST API.
See Backport to backport a pull request by simply commenting it.
import { backportPullRequest } from "github-backport";
const example = async () => {
const backportedPullRequestNumber = await backportPullRequest({
// The branch upon which the backported pull request should be based.
base: "master",
// The description to give to the backported pull request.
// Defaults to: "Backport #{pullRequestNumber}."
body: givenBody,
// The name to give to the head branch of the backported pull request.
// Defaults to: "backport-{pullRequestNumber}-to-{base}"
head: givenHead,
// An already authenticated instance of https://www.npmjs.com/package/@octokit/rest.
octokit,
// The username of the repository owner.
owner,
// The number of the pull request to backport.
pullRequestNumber: 1337,
// The name of the repository.
repo,
// The title to give to the backported pull request.
// Defaults to: "[Backport to {base}] {original pull request title}"
title: givenTitle,
});
};
github-backport can run on Node.js and in recent browsers.
github-backport uses debug to log helpful information at different steps of the backport process. To enable these logs, set the DEBUG environment variable to github-backport.
Backporting a pull request consists in cherry-picking all its commits to another branch.
The GitHub REST API doesn't provide direct endpoints to backport a pull request or even to cherry-pick commits.
github-backport thus relies on github-cherry-pick to perform all the relevant cherry-pick operations needed to perform a backport.
Let's say we have this Git state:
* 0d40af8 (feature) D
* 8a846f6 C
* b3c3b70 (dev) B
* 55356b7 (HEAD -> master) A
and a pull request numbered #1337 where dev is the base branch and feature the head branch. GitHub would say: "The user wants to merge 2 commits into dev from feature".
To backport #1337 to master, github-backport would then take the following steps:
#1337 is composed of 8a846f6 and 0d40af8 with GET /repos/:owner/:repo/pulls/:number/commits.backport-1337-to-master branch from master with POST /repos/:owner/:repo/git/refs.
* 0d40af8 (feature) D
* 8a846f6 C
* b3c3b70 (dev) B
* 55356b7 (HEAD -> backport-1337-to-master, master) A
8a846f6 and 0d40af8 on backport-1337-to-master with github-cherry-pick.
* 1ec51e5 (HEAD -> backport-1337-to-master) D
* e99200a C
| * 0d40af8 (feature) D
| * 8a846f6 C
| * b3c3b70 (dev) B
|/
* 55356b7 (master) A
master is the base branch and backport-1337-to-master the head branch with POST /repos/:owner/:repo/pulls.github-backport is atomic.
It will either successfully cherry-pick all the commits and create the backported pull request or delete the head branch created at the beginning of the backport process.
There are tests for it.
FAQs
Backport a pull request using the GitHub REST API
We found that github-backport demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.