chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
aube		minor	1.25.0 → 1.35.0
docker/login-action	action	minor	v4.1.0 → v4.6.0
oxfmt (source)	devDependencies	minor	^0.56.0 → ^0.61.0

---

Release Notes

jdx/aube (aube)

v1.35.0: : Supply-chain name gates, relocatable virtual store, and richer embedding

Compare Source

This release hardens aube add against typosquats and freshly-registered hallucinated package names, lets you relocate the global virtual store without dragging every other tool's cache along, adds a trust check command for inspecting a version before installing, and expands the aube::embed surface so hosts like mise can own workspace discovery and confirmation prompts.

Highlights

• Supply-chain reputation gates on aube add — new packages are quarantined for 30 days and requested names are challenged against a top-100,000 npm corpus for close lookalikes, with interactive "did you mean?" prompts and fail-closed behavior in CI (#​1157).
• Move just the virtual store — a new globalVirtualStoreDir setting plus fixes to the long-broken cacheDir let you relocate the global virtual store onto a fast volume without moving all your metadata caches (#​1146).
• Deeper embedding for hosts — workspace discovery, manifest types, and confirmation prompts are now routed through the stable aube::embed facade so embedders can supply their own UI and repo-scoped boundaries (#​1154, #​1168, #​1169).

Added

• Block new and lookalike package names on add (#​1157 by @​jdx) — Two supply-chain reputation gates now run on public npmjs names, alongside the existing OSV and low-download checks. A minimumPackageAge setting (default 30 days) quarantines newly registered names by checking npm time.created, raising the cost of registering a plausible AI-hallucinated name right before use. A second gate compares the requested name against an embedded, download-ranked top-100,000 npm corpus using bounded Damerau–Levenshtein distance, with scope-aware rules (basenames compared within a scope, full names across scopes). Interactive sessions get "did you mean?" / new-name confirmations; non-interactive contexts fail closed with ERR_AUBE_SIMILAR_PACKAGE_NAME, ERR_AUBE_NEW_PACKAGE_NAME, or ERR_AUBE_PACKAGE_AGE_CHECK_FAILED. --allow-low-downloads now bypasses all three reputation gates and allowedUnpopularPackages exempts a name from the similar-name, age, and download checks.

  # disable the age quarantine for a run
  AUBE_MINIMUM_PACKAGE_AGE=0 aube add some-fresh-package

• aube trust check <package>@&#8203;<version> (#​1144 by @​jdx) — Inspect a specific package version's publishing trust status without installing it, with human-readable and JSON reports. --ignore-default-excludes enforces the underlying no-downgrade policy directly. The built-in Hono exception is now scoped to @hono/node-server@1.19.15 (trusted publishing resumed in 1.19.17) so it no longer disables protection for future versions.

• Relocate the global virtual store independently (#​1146 by @​jdx) — A new globalVirtualStoreDir setting moves only the virtual store tree (the part that must sit on the storeDir volume for hardlinks), leaving packument/metadata caches where they are. It's available via env, .npmrc, and aube-workspace.yaml, and wins over cacheDir when both are set. aube doctor gained a global-virtual-store line, its store line now honors storeDir, and cross-volume fallbacks carry a WARN_AUBE_GVS_CROSS_VOLUME code.

  # move only the virtual store, keep metadata on the system disk
  export AUBE_GLOBAL_VIRTUAL_STORE_DIR=/Volumes/Fast/aube-virtual-store
  export AUBE_STORE_DIR=/Volumes/Fast/stores/aube

• Route embedded confirmations through host handlers (#​1154 by @​jdx) — Embedding hosts can attach a structured, async InstallPromptHandler so aube confirmations (such as low-download warnings) render through the host's own UI instead of reading process stdin. Prompt waits honor the existing install cancellation token, and a missing handler fails closed. Standalone aube keeps its interactive terminal prompts.

• Configurable workspace discovery for embedders (#​1169 by @​jdx) — aube::embed now exposes is_workspace_project_root and discover_workspace_packages, plus an opt-in ConfinedToRoot boundary that rejects parent-relative/absolute globs and out-of-root symlinks for repository-scoped hosts. Discovery now expands brace alternates (e.g. {apps,packages}/*) in positive and negative patterns and treats an on-disk workspace YAML as authoritative even when its package list is empty. The default remains pnpm-compatible, still allowing ../**.

• Expose package manifest types from aube::embed (#​1168 by @​jdx) — PackageJson, Workspaces, and ManifestError are re-exported from the stable embedding facade so hosts get aube's tolerant real-world manifest parsing without depending on aube-manifest directly or duplicating schemas.

Fixed

• Launch native package bins directly (#​1141 by @​benjaminwestern) — Package bins that point at compiled executables were being handed to Node through generated wrappers and failing. Non-shell aube exec, the local-bin fallback of aube run, and non-shell aube dlx now decode aube-generated POSIX/cmd wrappers, resolve the real target, and launch recognized native binaries (ELF, Mach-O, FAT/FAT64, validated PE, and Windows command suffixes) directly while preserving the wrapper environment, NODE_PATH, arguments, and Unix argv[0]. JavaScript and interpreter-backed bins are unchanged.
• Upgrade catalog-backed dependencies with update --latest (#​1166 by @​jdx) — Selecting a catalog: dependency in the interactive upgrade picker previously did nothing: resolution reused the unchanged catalog range and reported it as already latest. Catalog entries are now resolved through the registry latest tag and written back to the highest-precedence source (aube-workspace.yaml, pnpm-workspace.yaml, or package.json catalogs), preserving member catalog: references, range prefixes, and YAML comments. --no-save leaves on-disk ranges untouched while still refreshing lockfile resolutions.
• Preserve third-party caches during clean (#​1163 by @​jdx) — aube clean / purge no longer wipes the whole node_modules/ tree. It now removes only install-managed content (top-level packages plus aube/pnpm-owned hidden entries like .bin, .aube, .pnpm) and leaves unrecognized dotdirs such as Vite's .vite/ and .vite-temp/ in place, matching pnpm. Symlinked/junctioned module directories are still removed wholesale without walking the target.
• Keep foreign-platform optionals in portable lockfiles (#​1156 by @​jdx) — With supportedArchitectures configured, any command that re-resolved the graph could strip optional packages for other platforms out of pnpm-lock.yaml, aube-lock.yaml, bun.lock, or npm lockfiles, silently making a committed lockfile unusable elsewhere. Portable lockfiles now always resolve every platform variant, while fetch/link still honor the configured architectures so foreign packages stay out of node_modules.
• Accept --lockfile-only on aube list (#​1161 by @​jdx) — pnpm added list --lockfile-only in v10.23.0 and CI scripts use it, but clap rejected the flag before the command could run. It's now accepted (including the la/ll aliases) as a compatibility no-op, since list already reads exclusively from the canonical lockfile and needs no node_modules.
• Ignore unsupported allowBuilds .npmrc values (#​1159 by @​jdx) — allowBuilds was incorrectly advertised as an .npmrc source, so a user-level .npmrc allowlist appeared in config get/config list/config explain while install (which reads it only from workspace YAML and the manifest) safely ignored it. Config inspection now filters .npmrc rows to settings that actually declare that source; free-form unknown keys still round-trip.
• Trust locked packages without embedded prompts (#​1143 by @​jdx) — Packages already present in an active lockfile are now exempt from the low-download popularity gate, so re-adding or bumping a locked dependency doesn't re-trigger the prompt. OSV malicious-package checks stay active, and embedded add_to_project never reads aube's stdin for confirmation.

New Contributors

• @​benjaminwestern made their first contribution in #​1141

Full Changelog: jdx/aube@v1.34.0...v1.35.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.34.0: : Smarter completions and resolver safety

Compare Source

This release rounds out shell completion — aubx now completes, and TAB now offers registry packages, project bins, workspace packages, settings, and more — teaches the resolver to never mistake a deprecated republish for an upgrade, and makes activated shims survive aube upgrades.

Added

• Rich, mise-style completions plus aubx support (#​1130 by @​jdx) — Completions are now generated for the aubx multicall surface alongside aube and aubr, and a set of dynamic completers fills in real values as you type: registry packages (queried against your configured npm registry with scoped-registry auth, a ~1.2s timeout, and a 2 MiB response cap), local dependencies, workspace packages, project bins from node_modules/.bin, settings/aliases, patch keys, and filesystem paths. Typed text is safely quoted before evaluation, and the aubx spec stops at the fetched command so downstream arguments aren't parsed as aube flags.
• effect= metadata for every command (#​1122 by @​jdx) — All 114 aube commands now declare whether they only inspect state (read), change it (write), or destroy something (destructive), via usage 4's effect=. Registry commands like publish, deprecate, dist-tag, and access are never read and carry blast-radius comments (they affect every consumer of a package), while code-running commands (run, exec, dlx, node, create, …) are deliberately left unclassified since their effect is whatever the executed code does. This lets tooling reason about what a command will do before running it. Requires a usage CLI of 4.0 or newer to consume the generated spec.

Fixed

• Never prefer a deprecated version inside a range (#​1136 by @​jdx) — A deprecated, mis-tagged republish that sorts above genuine releases (e.g. codemirror@6.65.7, an accidental republish of 5.65.7) could make aube outdated offer a downgrade-in-disguise as an upgrade and cause installs to land on the withdrawn version. Version selection now mirrors pnpm: dist-tags.latest wins when it's in range, otherwise the highest satisfying non-deprecated version, otherwise (as a tiebreak, not a filter) the highest satisfying version so ranges that only reach deprecated versions still resolve. The rule is shared across install/add/update, the vulnerable-version re-pick, and the Wanted column of outdated/update, keeping them in agreement.
• Keep activated shims stable across upgrades (#​1129 by @​jdx) — On Unix, aube activate previously symlinked each tool shim to the exact executable that created it, so removing a version-managed aube left every activated shim dangling. Activation now writes small dispatcher scripts that resolve the current aube from PATH and route through an internal marker, matching mise's stable-indirection model. Windows behavior is unchanged.
• Replace activated shims atomically (#​1131 by @​jdx) — Follow-up to #​1129: shim updates on Unix now build the replacement in a sibling temp file, apply 0755, and rename it over the live path, closing the window where a concurrent command could see a missing or half-written shim.
• Clear the progress row for no-op installs (#​1132 by @​jdx) — On a no-op install, the transient TTY progress bar left a durable row alongside Already up to date, producing two completion lines for one result. The progress row is now cleared for no-op installs, while real installs and --lockfile-only runs still keep the finished bar (or CI summary) visible.
• Complete package scripts through aubr (#​1128 by @​jdx) — aube completion now registers a dedicated aubr surface, so both aube run <TAB> and aubr <TAB> complete the scripts declared in the nearest package.json (with their commands as descriptions). Previously aubr <TAB> was treated as an unknown top-level invocation and offered nothing.

Changed

• Prioritize opencode-ai in the native-build critical path (#​1127 by @​jdx) — opencode-ai is added to the curated build-heavy allowlist so its tarball is fetched earlier and its build step can overlap with remaining package downloads.

Full Changelog: jdx/aube@v1.33.1...v1.34.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.33.1: : Progress bar and node-gyp fixes

Compare Source

A small patch release with two install-path fixes: interactive terminals get their animated progress bar back, and embedders can build native packages again.

Fixed

• Restore the animated progress bar in interactive terminals (#​1117 by @​jdx) — An AUBE_TTY_PROGRESS gate introduced back in v1.10.0 had quietly routed every interactive terminal to the CI-oriented append-only heartbeat, so installs appeared to jump in ~2s chunks (0% → 83% → 100%) instead of animating. That gate is removed: stderr TTYs now get the smooth in-place bar again, while pipes and CI runners still use the line-oriented heartbeat. --reporter=append-only remains available to force line output on demand.
• Bootstrap node-gyp in-process instead of re-execing aube (#​1114 by @​jdx) — When aube is embedded as a library (e.g. mise's npm backend), the node-gyp bootstrap shelled out to current_exe, which named the host binary and failed with error: unexpected argument '--ignore-scripts' found. This broke installs of any npm package whose build scripts reach node-gyp (gemini-cli, vercel, wrangler, orval, and others) on a cold cache. The bootstrap now runs in-process under the existing project lock, so native builds work for embedders. Standalone aube behavior is unchanged.

Full Changelog: jdx/aube@v1.33.0...v1.33.1

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.33.0: : Script completions, embeddable Node wrappers, and pnpm 11.16+ compatibility

Compare Source

This release brings package.json script completions and a polished aube run picker, extends the library-embedding work so hosts can wrap the Node runtime, adds FreeBSD support, and tracks pnpm 11.16/11.17 compatibility across settings, version, and login hardening.

Added

• Shell completion for package.json scripts (#​1108 by @​jdx) — aube run <TAB> now completes the scripts declared in the nearest package.json, showing each script's command as the description. This works through a hand-written usage spec fragment merged onto the generated completions, so no reinstall is needed — aube completion <shell> re-derives the spec at TAB time and runs the completer per project. Note: -C/--dir on the line being completed is not forwarded to the completer (a usage limitation).
• Embedders can wrap the Node runtime, not just select one (#​1086 by @​jdx) — Extends the embedder Node hook from #​1079 so a host can describe a full Node invocation rather than just a bin dir. A new EmbedderRuntime builder offers two constructors: selector(bin_dir) (the version-manager case, identical to #​1079) and wrapper(node_program) for instrumenting runtimes, transpiling loaders, and sandboxes — keeping a shim on PATH and at $NODE while pointing npm_node_execpath at the real binary so node-gyp still resolves correctly. Wrappers can contribute lifecycle-script env via env_append/env_set (with NODE_OPTIONS appending by default). Registration is process-wide via set_embedder_runtime (first-write-wins), with per-install and per-call overrides, and new in-process entry points embed::{run, exec, dlx, node} that anchor on an explicit project_dir. Every field is optional; unset reproduces standalone aube byte-for-byte. See the new "Node runtime" and "Run scripts, binaries, and Node" sections in docs/embedding/rust.md.
• Canonical pnpm 11.16+ update and audit settings (#​1104 by @​jdx) — Adds support for pnpm's update.ignoreDeps, audit.level, and audit.ignore workspace settings. The deprecated updateConfig.ignoreDependencies, auditConfig, and top-level auditLevel spellings are retained as fallbacks, with the canonical keys taking precedence. update.ignoreDeps applies to both aube update and aube outdated, and aube audit now resolves its severity from config instead of hard-defaulting to low (CLI --audit-level still wins). Projects using pnpm's new configuration behave the same under aube without rewriting.
• aube version from-git (#​1102 by @​jdx) — Accepts from-git as a version target, resolving the latest semver-like Git tag via git describe and normalizing a leading v. Matches pnpm version from-git added in pnpm 11.17.
• FreeBSD support (#​1084 by @​jdx) — Platform::current() now detects FreeBSD as a host platform, unblocking Node runtime resolution via PATH, installed-Node scans, and mise (previously it hard-errored). Scoped to source compatibility: there are no published FreeBSD release binaries, so aube self-update returns a clear message pointing to pkg/mise instead.

Fixed

• aube run script picker no longer scrambles the output (#​1109 by @​jdx) — Long script commands that wrapped past the terminal width used to stack duplicate frames on every keypress. The picker now shows the script name as the label with the command aligned in a secondary column, truncated to the real terminal width, and starts in filtering mode so typing searches script names immediately. Bundles demand 2.0.4 for correct redraws on resize.
• Vite and VitePress keep the global virtual store fast path (#​1106 by @​jdx) — aube now writes pnpm-compatible node_modules/.modules.yaml metadata exposing its virtual-store path, so Vite 8.1+ works with GVS natively without manual server.fs.allow configuration. Older Vite releases receive an equivalent project-local compatibility copy while unrelated dependencies stay shared. GVS is no longer disabled by default for Vite/VitePress.
• Registry-name patches now apply to npm-aliased installs (#​1085 by @​jdx) — A patch declared against a package's registry name (e.g. is-odd@3.0.1) was not applied when the package was installed under an npm alias (odd-alias: npm:is-odd@3.0.1), even though the lockfile recorded the patched identity. Patch lookups now fall back to the registry name, matching pnpm's behavior.

Security

• Web-login token responses are capped at 64 KiB (#​1103 by @​jdx) — A malicious or compromised registry could previously return an unbounded successful token response and force aube to buffer it. Successful responses are now streamed with a 64 KiB limit (enforced for both declared and chunked bodies), failing with ERR_AUBE_WEB_LOGIN_RESPONSE_TOO_LARGE without persisting a token. Mirrors the hardening in pnpm 11.17.

Full Changelog: jdx/aube@v1.32.0...v1.33.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.32.0: : Host-supplied node for embedded lifecycle scripts

Compare Source

A small release that continues the library-embedding work from v1.30.0/v1.31.0, letting hosts embedding aube::embed::add tell aube which node to run dependency lifecycle scripts on. Standalone aube behavior is unchanged.

Added

• Embedders can supply the node runtime for lifecycle scripts (#​1079 by @​jdx) — Hosts like mise that manage node as a dependency rather than on the process PATH can now point aube at the right binary. embed::InstallOptions and AddToProjectOptions gain a node_bin_dir: Option<PathBuf>; when set, aube seeds its per-install runtime slot with the host's node (prepending that dir to the script PATH and probing --version so engine checks match) instead of resolving its own runtime or falling back to an ambient node PATH lookup. This restores the behavior the old aube add --global subprocess path had for in-process embedders such as mise's npm: tool support. The runtime slot is a per-install tokio::task_local, so concurrent installs are safe, and leaving node_bin_dir unset (the default for all CLI, CI, deploy, and FFI paths) preserves normal runtime switching.

Full Changelog: jdx/aube@v1.31.0...v1.32.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.31.0: : Embeddable without the publish & DNS stack

Compare Source

A small release that continues the library-embedding work from v1.30.0, letting install-only hosts like mise depend on the aube crate without pulling in the sigstore publishing stack or a forced DNS resolver. Standalone aube behavior is unchanged.

Added

• The aube crate is now embeddable without the publish/DNS stack (#​1069 by @​jdx) — Follow-up to #​1068, unblocking mise's use of the install path (aube::embed::add) as a library instead of shelling out to the aube binary. Two dependencies an install-only embedder never needs are now opt-out:
  • A new publish feature (on by default) gates the sigstore provenance/signing supply chain (sigstore-*, ambient-id, x509-cert, etc.), which is only used by aube publish. The Publish CLI variant and its command modules are compiled out when the feature is off.
  • hickory-dns is dropped from aube-registry's defaults (now default = ["rustls"]), so embedders pulling it in transitively no longer have reqwest's DNS resolver silently flipped for the whole binary via feature unification. The aube binary re-enables it through the aube crate's defaults, so standalone builds are unchanged.
  • The aube crate gains rustls and hickory-dns features that forward to reqwest / aube-registry / aube-util, so it can be depended on with default-features = false, features = ["rustls"] — producing a build tree with zero sigstore, hickory, ratatui, or mimalloc nodes.

Full Changelog: jdx/aube@v1.30.0...v1.31.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.30.0: : Clean process teardown for dlx and exec

Compare Source

This release fixes a long-standing issue where aube dlx and aube exec could leave the tool they launched running after aube itself was terminated, and lays the groundwork for embedding aube's library crates in other tools like mise.

Fixed

• aube dlx no longer orphans the tool it launches (#​1065 by @​jdx) — Previously, terminating aube left the spawned tool running, reparented to init (ppid=1), surviving even a catchable SIGTERM — leaking long-running stdio servers and memory on every host teardown (discussion #​1059). dlx and exec spawns now route through a process guard that ties the child's lifetime to aube: on any Unix, catchable signals (SIGTERM/SIGINT/SIGHUP/SIGQUIT) are forwarded to the child (so pkill -x aube stops the tool), and on Linux PR_SET_PDEATHSIG additionally reaps the child even on an uncatchable SIGKILL. This matches the teardown behavior of npx, pnpm dlx, and bunx. (macOS SIGKILL-of-aube remains a documented gap.)

Changed

• Standalone aube exec <bin> and aube dlx <local-bin> now replace aube's process image (#​1067 by @​jdx) — On the standalone Unix binary, these single-tool paths now execvp into the tool instead of spawning it as a supervised child. The tool inherits aube's pid, so any signal — including an uncatchable SIGKILL — reaches it directly with no supervisor process to outlive, closing the macOS SIGKILL gap for these paths. This matches how aube node and mise x already behave. Embedded hosts (aube-ffi/aube-node), Windows, the dlx install path, and recursive aube exec -r continue to use the supervised spawn.

  Worth noting: on the standalone binary, aube exec <bin> / aube dlx <local-bin> no longer appears as a parent process — the tool takes over aube's pid.

Added

• Library crates are now embeddable at MSRV 1.91 with backend-agnostic features (#​1068 by @​jdx) — Groundwork for embedding aube's library crates (starting with aube-registry) into other tools like mise. The workspace MSRV is lowered from 1.93 to 1.91, and TLS/DNS/zlib backend selection (rustls, hickory-dns, zlib-ng) moves from the workspace to leaf crates so embedders no longer inherit those global build side effects. Standalone aube behavior is unchanged via defaults; embedders opt in with default-features = false, features = ["rustls"].

Full Changelog: jdx/aube@v1.29.1...v1.30.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.29.1: : minimumReleaseAge now covers add pins

Compare Source

A small but security-relevant patch release that closes a minimumReleaseAge bypass in aube add.

Fixed

• aube add now honors minimumReleaseAge when pinning manifest versions (#​1056 by @​jdx) — Previously the version written into package.json came straight from the packument with no release-age cutoff, so dist-tag adds (including the default aube add pkg) and --save-exact could pin a freshly published version that full resolution would have gated — exactly the version most likely to be a compromised latest in a supply-chain attack. The manifest step now routes through the resolver's pick_version, so gated latest tags are steered to the newest version clearing the cutoff, deliberate exact pins and non-latest tags are still honored (or refused under minimumReleaseAgeStrict=true with ERR_AUBE_NO_MATURE_MATCHING_VERSION), and minimumReleaseAgeExclude exemptions apply consistently. Offline adds skip the gate as before.

  Note that this activates the default 24h gate for add picks, which was silently inert for dist-tag and exact adds until now:

  $ aube add caniuse-lite        # latest published 15h ago
  + caniuse-lite@1.0.30001805    # newest version ≥24h old; before: 1.0.30001806
  

Full Changelog: jdx/aube@v1.29.0...v1.29.1

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.29.0: : Benchmark Refresh

Compare Source

A small maintenance release with no user-facing code changes. The only update refreshes the published benchmark numbers so the README's install-speed claims match the latest measurements.

Changed

• Refreshed benchmarks for v1.28.0 (#​1050 by @​jdx) — Re-ran the hermetic benchmark matrix against aube 1.28.0 (and deno 2.9.3) and regenerated benchmarks/results.json plus the README BENCH_RATIOS block. Warm-install claims now read ~5× faster than pnpm and ~2× faster than Bun, with the repeat install && test scenario at ~39× vs pnpm.

Full Changelog: jdx/aube@v1.28.0...v1.29.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.28.0: : Embeddable aube

Compare Source

This release makes aube embeddable in other applications, landing a stable in-process embedding API for both Rust and Node.js/Bun/Electron hosts, and fixes a warm-path bug where changed local file:/portal: directory dependencies weren't reinstalled.

Highlights

• Embed aube in your own apps — Three stacked pieces come together to let you drive installs programmatically: invocation-scoped install controls with structured events and cancellation (#​1036), a stable aube::embed Rust facade (#​1042), and a production @jdxcode/aube-node Node-API addon (#​1025) — all by @​jdx.

Added

• @jdxcode/aube-node Node-API addon (#​1025 by @​jdx) — Run aube installs in-process from Node.js, Bun, Electron, and compiled Bun executables. The addon exposes install/add, dev-dependency saves, structured progress/output events, cooperative cancellation via AbortSignal, offline mode, structured errors (AubeError with stable code and diagnostic), and result statistics. It creates package.json when absent, saves requested versions exactly, honors supported lockfile formats and project registry/auth config, skips lifecycle scripts, and uses aube's install-state fast path. Independent projects install concurrently; operations on the same workspace serialize through its project lock, and cancellation during add restores manifest and lockfile snapshots. Ships the root package plus eight optional platform packages (macOS, Windows, glibc and musl Linux), with signed macOS addons, attested tarballs, and npm trusted publishing.

  import { install } from "@​jdxcode/aube-node"
  
  const result = await install(projectDirectory, {
    add: [
      { name: "react", version: "19.1.0" },
      { name: "typescript", version: "5.9.3", dev: true },
    ],
    offline: false,
    signal,
    onEvent(event) {
      // event.kind: "phase" | "progress" | "output"
    },
  })

• Stable aube::embed Rust API (#​1042 by @​jdx) — Native Rust hosts get a supported public contract (initialize, install, add, error_code) without depending on internal aube-util, aube-settings, or CLI command structs. add_to_project holds the workspace project lock across manifest mutation and install, supports offline/network modes, and rolls back package.json and the lockfile on cancellation. Includes docs covering embedding, concurrency, lifecycle policy, and errors.

• Install control hooks (#​1036 by @​jdx) — New invocation-scoped InstallControl with human (CLI default), structured-event, and silent output modes. A non-blocking InstallReporter delivers phase, progress, and output events, and cooperative cancellation returns the stable ERR_AUBE_INSTALL_CANCELLED diagnostic at safe install boundaries. Concurrent installs stay isolated via Tokio task-local state; standalone aube install behavior is unchanged.

Fixed

• Refresh changed local directory dependencies (#​1034 by @​jdx) — Editing the contents of a file: directory or portal: dependency could previously hit the Already up to date fast path and leave stale installed output, even when the file size was unchanged. Install freshness now records per-source content and metadata fingerprints (BLAKE3), and the linker re-materializes mutable local entries during the ensuing full install.

Full Changelog: jdx/aube@ba5f3c5...v1.28.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.27.0: : access, git-repo build approvals, concurrent installs

Compare Source

A feature release that adds an npm-style aube access command and Git-repository-scoped allowBuilds keys, tightens credential redaction on publish, fixes stale pnpm patch handling after re-resolve, and lays the groundwork for parallel embedded installs by making the explicit-install path fully reentrant.

Added

• aube access (#​1012 by @​jdx) — Manage registry package permissions from the CLI, modeled on npm and compatible with pnpm's forms. Subcommands cover get status, list packages / list collaborators, ls packages [entity] (pnpm-compatible), set status=public|private, set mfa=none|publish|automation, grant <permission> <team> <package>, and revoke <team> <package>. Requests use scoped-registry auth, honor --otp for MFA-protected mutations, cap response bodies, and produce distinct errors (ERR_AUBE_ACCESS_ENTITY_NOT_FOUND vs. plain 404). Supports --json for scripting alongside the human-readable default.

• Git-repository build approvals (#​1010 by @​jdx) — allowBuilds rules can now be keyed by a package plus a normalized Git repository URL (for example, native-addon@git+<https repo url>). The commit is intentionally omitted from the key so audited repositories can advance to new SHAs without re-approving each one. Exact per-source approvals and name-only registry approvals still work as before, and deny rules continue to win over allows. Repository rules are applied consistently across lifecycle execution, script jailing, ignored-build reporting, and install graph hashes.

• aube add --dangerously-allow-all-builds (#​1016 by @​risu729) — The broad build-approval flag was previously only accepted on install, so aube add --global <pkg> --dangerously-allow-all-builds (as used by mise) was rejected at parse time. The flag now works on add, is forwarded through local, filtered, and global add paths into the shared install pipeline, and conflicts explicitly with --deny-build=<pkg>. The override is invocation-scoped — it does not persist dangerouslyAllowAllBuilds=true to project config.

Fixed

• Redact inline registry credentials in publish output (#​1009 by @​jdx) — When a registry URL embeds credentials in the user:secret@host form, publish no longer echoes them raw. The "already published" error, the OIDC token-exchange failure wrapper, and the --dry-run "would PUT to …" line now pass URLs through aube_util::url::redact_url. Dry-run output is centralized in dry_run_outcome_line, with test coverage confirming scoped package targets redact inline auth while preserving the encoded path.

• Ignore stale pnpm patch entries after re-resolve (#​1022 by @​jdx, fixes #​1019) — On a non-frozen install that had to re-resolve, overlay_metadata_from was copying patchedDependencies from the previous pnpm-lock.yaml, so removed or wrong-version patches were still being applied and written back. Fresh-resolve now replaces graph.patched_dependencies with the workspace's current read_patched_dependencies, and the pnpm 11 hash-only scalar form is no longer misread as a file path. Bats coverage was added for both the pnpm 10 object form and the pnpm 11 hash-only form.

Changed

• Reentrant explicit-directory installs (#​1026 by @​jdx) — Removes the process-wide project-lock reentrancy flag that could let an install for project B skip its filesystem lock just because project A was already installing in the same process. Commands that chain into install (add, remove, update, filtered add, ci, dedupe) now hold an explicit ProjectLock guard and call install::run_with_project_lock. Dependency-chain diagnostics move from a global mutex to Tokio task-local state and propagate into spawned fetch and lifecycle tasks, so parallel installs no longer clobber each other's transitive error chains. configure_script_settings also only mutates global script config when scripts aren't disabled.

• Per-install runtime and script-settings isolation (#​1027 by @​jdx) — Building on #​1026, Node runtime selection and lifecycle-script settings are now scoped to each explicit install via nested task-local scopes (runtime, aube_scripts) instead of process-wide snapshots. Spawned fetch and dependency-lifecycle tasks inherit the owning install's context via scope_current. The install entry uses run_scoped and Box::pins run_inner to avoid Tokio worker stack overflow when scopes stack, and aube runtime set now re-reads package.json and the lockfile-pinned runtime for its status line rather than trusting a possibly stale process cache. Non-install CLI commands continue to use the process-wide fallbacks. Together with #​1026, this is prerequisite groundwork for concurrent embedded installs to drop their addon-wide serialization mutex.

• Refreshed benchmarks for v1.26.0 (#​1002 by @​jdx) — benchmarks/results.json and the README BENCH_RATIOS block regenerated on the hermetic Verdaccio registry against aube 1.26.0 and pnpm 11.10.0. Public ratios shift to ~3× Bun / ~6× pnpm on warm installs and ~3× Bun / ~28× pnpm on the repeat install && test case.

New Contributors

• @​risu729 made their first contribution in #​1016

Full Changelog: jdx/aube@v1.26.0...v1.27.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.26.0: : bugs, prefix, and pnpm-parity polish

Compare Source

A feature release that adds two pnpm-compatible commands (aube bugs and aube prefix), fills a workspace-flag gap in aube bin, propagates proxy configuration into lifecycle scripts, and fixes two install-time failure modes around old lockfiles and malformed JSR specs.

Added

• aube bugs (alias issues) (#​992 by @​jdx) — Resolves the package's bug tracker URL and opens it in the default browser, modeled on pnpm. With no arguments it reads the current project's package.json; with name or name@version it fetches the registry packument (honoring shared NetworkArgs / --registry). URLs come from bugs (string or bugs.url), falling back to repository with normalization for GitHub/GitLab/Bitbucket shorthands, git@ URLs, and an /issues suffix when needed. Only http(s) URLs are opened; set AUBE_NO_OPEN=1 to print without spawning a browser.
• aube prefix / aube prefix -g (#​991 by @​jdx) — Prints the nearest package root (or cwd), aligned with pnpm. -g prints the global prefix directory, resolved from AUBE_HOME / PNPM_HOME / platform defaults; this stays separate from globalBinDir, so a custom global bin path does not change what prefix -g reports. The command respects -C and is exempt from the package-manager guard like other path-only helpers.
• aube bin -w / --workspace-root (#​993 by @​jdx) — The long form already worked because the global --workspace-root flag chdirs before dispatch, but bin never registered the pnpm-style -w short. From a workspace sub-package, aube bin -w now walks up via find_workspace_root and prints the root node_modules/.bin. Conflicts with -g/--global at parse time; a no-op (falls through to plain bin) outside a workspace so it's safe in shell aliases.
• Proxy env for lifecycle scripts (#​996 by @​jdx, closes #​983) — Scripts now inherit the same outbound proxy aube uses for registry traffic via standard HTTP_PROXY / HTTPS_PROXY / NO_PROXY, plus NODE_USE_ENV_PROXY=1 so Node 24+ honors the same proxy for built-in fetch/http (which ignore npm_config_proxy). httpProxy falls back to httpsProxy per npm/pnpm behavior. The block is set only when a proxy URL is actually configured — noProxy alone won't stamp env — so direct-connection users don't see Node's experimental proxy warnings.

Fixed

• Recover from lockfiles missing tarball integrity (#​995 by @​jdx) — Follows up #​994: older lockfiles that still contain a resolution.tarball without an accompanying integrity field were failing during parse even though strictStoreIntegrity defaults to false. A new ParseOptions (strict_store_integrity) is threaded through the install path — pre-parse, frozen/dry-run selection, lockfile-only, metadata overlay, --lockfile-dir remapping, and ensure_for_cwd — so non-strict installs read those entries and re-resolve instead of aborting. Library callers and parse_for_import remain strict by default.
• Reject malformed jsr: specs (#​990 by @​jdx) — jsr_to_npm_name now validates each scope and name component with valid_jsr_name_part: empty parts, ., .., uppercase, spaces, encoded slashes, and anything outside [a-z0-9._-] are rejected before being translated to @jsr/…. aube add jsr:@​std/../collections and similar now fail as invalid jsr: spec at parse time; legitimate scoped names like @std/collections are unchanged.

Changed

• Refreshed benchmarks for v1.25.2 (#​975 by @​jdx) — Regenerated on the hermetic Verdaccio registry (500 Mbit / 50 ms) against aube 1.25.2 and deno 2.9.1. Warm fresh install drops 437ms → 319ms; public README ratios update to ~5× Bun and ~8× pnpm on warm installs, and ~7× Bun / ~39× pnpm on the npm install && npm run test repeat case.
• Sponsor references (#​978 by @​jdx) — README, aube sponsors, generated CLI docs, and the release-workflow sponsor blurb now list entire.io as title sponsor and point at jdx.dev as the canonical sponsors hub. The docs-site sponsors feed switches to title / premier / partner tier naming.

Full Changelog: jdx/aube@v1.25.2...v1.26.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.25.2: : Cold-install lockfile write overlap

Compare Source

A small performance release: cold installs now write aube-lock.yaml concurrently with the link phase instead of blocking on it, plus refreshed public benchmark numbers against v1.25.1.

Changed

• Overlap the cold-install lockfile write with the link tail (#​961 by @​jdalton) — On a fresh resolve, the lockfile serialize + pnpm-parity reformat + atomic write previously ran as a serial blocking span before filter_graph and run_link_phase, leaving the linker idle. It now runs on a `tokio::task:

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 12pm on Sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}