diff --git a/.github/workflows/bindings.nodejs.yml b/.github/workflows/bindings.nodejs.yml
index e81abc56..d2060a55 100644
--- a/.github/workflows/bindings.nodejs.yml
+++ b/.github/workflows/bindings.nodejs.yml
@@ -111,6 +111,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     permissions:
+      contents: write
       id-token: write
     environment:
       name: npmjs.com
diff --git a/.github/workflows/bindings.python.yml b/.github/workflows/bindings.python.yml
index cc375f12..1b658117 100644
--- a/.github/workflows/bindings.python.yml
+++ b/.github/workflows/bindings.python.yml
@@ -150,4 +150,5 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           skip-existing: true
+          verify-metadata: false
           packages-dir: bindings/python/artifacts
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8ec8c45a..6dc247c1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -139,6 +139,11 @@ jobs:
           curl -sSfLo /tmp/nfpm.tar.gz https://github.com/goreleaser/nfpm/releases/download/v2.28.0/nfpm_2.28.0_Linux_x86_64.tar.gz
           tar -xzf /tmp/nfpm.tar.gz -C /tmp
           sudo mv /tmp/nfpm /usr/local/bin/nfpm
+      - name: Setup yq
+        shell: bash
+        run: |
+          curl -sSfLo /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+          chmod +x /usr/local/bin/yq
       - name: Download
         shell: bash
         env:
@@ -150,9 +155,9 @@ jobs:
       - name: Package
         shell: bash
         run: |
-          arch=${{ matrix.arch }}
-          version=${{ github.ref_name }}
-          nfpm package --packager ${{ matrix.packager }} --target dist/pkg/ -f <(envsubst '${arch} ${version}' < nfpm.yaml)
+          yq -i '.arch = "${{ matrix.arch }}"' nfpm.yaml
+          yq -i '.version = "${{ github.ref_name }}"' nfpm.yaml
+          nfpm package --packager ${{ matrix.packager }} --target dist/pkg/
       - name: Publish
         shell: bash
         env:
diff --git a/bindings/nodejs/package.json b/bindings/nodejs/package.json
index 7731aaf7..ed19d979 100644
--- a/bindings/nodejs/package.json
+++ b/bindings/nodejs/package.json
@@ -6,14 +6,16 @@
   "main": "index.js",
   "types": "index.d.ts",
   "description": "Databend Driver Node.js Binding",
-  "repository": "https://github.com/databendlabs/bendsql.git",
+  "repository": {
+    "url": "git+https://github.com/databendlabs/bendsql.git"
+  },
   "napi": {
     "name": "databend-driver",
     "package": {
       "name": "@databend-driver/lib"
     },
     "triples": {
-      "defaults": true,
+      "defaults": false,
       "additional": [
         "x86_64-unknown-linux-gnu",
         "aarch64-unknown-linux-gnu",
diff --git a/deny.toml b/deny.toml
index 32af5b8c..2adbfba2 100644
--- a/deny.toml
+++ b/deny.toml
@@ -3,7 +3,6 @@ version = 2
 db-path = "~/.cargo/advisory-db"
 db-urls = ["https://github.com/rustsec/advisory-db"]
 ignore = [
-    "RUSTSEC-2024-0332",
     "RUSTSEC-2024-0370",
     "RUSTSEC-2024-0379",
     "RUSTSEC-2024-0384"
@@ -21,7 +20,6 @@ allow = [
     "MIT",
     "MPL-2.0",
     "OpenSSL",
-    "Unicode-DFS-2016",
     "Unicode-3.0"
 ]
 
diff --git a/nfpm.yaml b/nfpm.yaml
index bbabc4d0..41718aec 100644
--- a/nfpm.yaml
+++ b/nfpm.yaml
@@ -1,7 +1,7 @@
 name: "bendsql"
-arch: "${arch}"
+arch: ""
 platform: "linux"
-version: "${version}"
+version: ""
 section: "database"
 priority: "extra"
 maintainer: "Databend Authors <opensource@databend.com>"