[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aube	tools	minor	2.2.15 → v2.8.5

---

Release Notes

aubepkg/aube (aube)

v2.8.5: : Maintenance release

Compare Source

This release has no user-facing changes. It only updates dependencies and CI tooling.

Full Changelog: aubepkg/aube@v2.8.4...v2.8.5

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.8.4: : npm, pnpm, Bun and Yarn lockfile rewrites match each tool's own output

Compare Source

Lockfiles that aube rewrites now pass npm ci, pnpm install --frozen-lockfile, Bun frozen installs and yarn install --immutable in many more cases. This release also fixes --lockfile-dir with workspaces, fixes how bins of link: and workspace dependencies are linked, and puts workspace root bins on PATH for member scripts.

Fixed

npm package-lock.json

• npm ci no longer fails after an unrelated aube add (#​1851, #​1863): aube no longer drops or changes entries npm already wrote. It keeps auto-installed peer entries ("peer": true), hoisted required peers such as @emnapi/*, bundleDependencies and their nested placements, workspaces and engines on existing entries, and leftover nested optional entries. Before this fix, npm ci could fail with errors like Missing: @emnapi/core@1.11.3 from lock file.
• New entries match what npm writes: hasInstallScript is now recorded, so npm ci runs the package's install scripts (#​1846). deprecated is written and kept on rewrite, and a scoped package's string bin uses the unscoped command name (#​1858). libc is written only if the lockfile already uses it or packageManager is npm@11.11.0 or later, which stops churn for teams on older npm (#​1874).
• Workspace members with no dependencies are recorded (#​1876): before this fix, aube reported "Already up to date" and npm ci failed with Missing: <member> from lock file. Member entries also now copy os/cpu from the member's package.json and omit name when it matches the folder name, as npm does.
• Local dependencies: when a local package declares its own file: dependencies, aube now writes the declared spec instead of an internal file+<hash> key, so the next clean --frozen-lockfile install no longer fails (#​1855). Absolute file: directory targets are written as root-relative keys with "link": true, which fixes an EUSAGE error from npm ci (#​1853).
• Lockfiles with entries outside node_modules can be read again (#​1878): this covers a symlinked member's real path or an extraneous deleted member. Before this fix, aube failed with ERR_AUBE_LOCKFILE_PARSE ... could not determine package name. aube still drops these entries when it rewrites the lockfile.

pnpm pnpm-lock.yaml

• pnpm metadata is kept on rewrite: aube now keeps the leading packageManagerDependencies/configDependencies document that pnpm 12 writes (#​1842). It also keeps settings entries it doesn't model, such as peersSuffixMaxLength, and local tarball version, integrity and bundledDependencies (#​1857). Bundled children of a local tarball are no longer resolved from the registry. Together these fix ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE and ERR_PNPM_LOCKFILE_CONFIG_MISMATCH errors after aube add.
• Peer keys match pnpm, so pnpm and aube stop rewriting each other's lockfiles: peer suffixes now use the registry name of aliased providers, and an optional peer that is actually provided is included even when its version is out of range (#​1849). Peer-cycle providers are written bare (#​1859). A package's own declared peers are left out of its transitivePeerDependencies (#​1860).

Bun bun.lock

• When the root and a member need different versions of a peer provider, the member keeps its own version after a clean --frozen-lockfile install. For example, a member on React 19 no longer loads the root's React 18 (#​1847).
• Hoisted local tarballs whose paths are relative to the member that declares them now resolve from that member, not from the project root (#​1844).
• Folder identifiers for absolute file: directories inside the project are written relative to the lockfile (child@file:assets/child), which Bun's frozen install accepts (#​1854).

Yarn Berry yarn.lock

• Rewritten Yarn 4 lockfiles now pass yarn install --immutable (no more YN0028 error) (#​1862). Block headers list only the descriptors that are actually requested, peerDependencies ranges are quoted only when YAML requires it, and optional dependencies keep their dependenciesMeta: optional: true flags.

Install, linking and scripts

• --lockfile-dir works with workspaces (#​1856): before this fix, a clean --frozen-lockfile install failed with lockfile already records importers from other projects, and a relocated package-lock.json or bun.lock was rejected. aube and pnpm lockfiles now record every importer relative to the lockfile directory, as pnpm does.
  • Upgrade note: the next normal install migrates relocated workspace lockfiles written by older aube versions. A --frozen-lockfile install that would need this migration fails and asks you to run aube install --no-frozen-lockfile once.
• Workspace root bins are on PATH in member scripts (#​1845): <root>/node_modules/.bin is now added after the member's own .bin, as pnpm does. This applies to aube run (including -r, --filter and --parallel), the test/start shortcuts and aube exec.
• Bin changes in link: and workspace dependencies are picked up (#​1839, @​JamBalaya56562): before this fix, aube reported "Already up to date" and kept old commands in node_modules/.bin until --force. aube now checks bin and directories for changes, and a link: target that gains a package.json is linked on the next install.
• A dependency's link: deps get their bins linked into its .bin (#​1873, @​JamBalaya56562): the dependency's lifecycle scripts can now call those commands.
• file: dependencies:
  • A peer satisfied by a file: dependency now links to the directory aube actually creates, instead of a link that points nowhere. With the global virtual store, dependents of file: packages now stay in the project's virtual store instead of the shared one (#​1850).
  • A file:-linked directory in a package-lock.json project can now require its own dependencies (#​1848).
  • Absolute file:/link: children of local tarballs now resolve when block-exotic-subdeps=false (#​1852).

Registry

• No more false "0 downloads last week" warnings (#​1881): if npm's downloads API returns a stats window that is more than 7 days old, aube treats the count as unknown. Before this fix, aube add flagged legitimate new packages as suspicious during npm's stats outage.

Full Changelog: aubepkg/aube@v2.8.3...v2.8.4

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.8.3: : Honor NPM_CONFIG_GLOBALCONFIG for registry settings

Compare Source

aube now reads the npm global config file set by NPM_CONFIG_GLOBALCONFIG, so a registry and auth configured only there are used for installs, as npm does.

Fixed

• NPM_CONFIG_GLOBALCONFIG is now read (#​1818, @​jdx): before this fix, if the internal registry was set only through NPM_CONFIG_GLOBALCONFIG, with no ~/.npmrc or NPM_CONFIG_USERCONFIG, aube ignored it and fetched packages from registry.npmjs.org. aube now reads the file that NPM_CONFIG_GLOBALCONFIG or npm_config_globalconfig points to, including registry, scoped registry and auth token settings.

  • As in npm, the global file has the lowest precedence. Project .npmrc overrides user config, and user config overrides the global file. npm_config_* environment variables override all of them.
  • If both casings are set, the upper-case variable wins. A leading ~ in the path is expanded.
  • aube reads the global file only when one of these variables is set. It does not look in npm's default $PREFIX/etc/npmrc location.

  # file pointed to by $NPM_CONFIG_GLOBALCONFIG
  registry=<your internal registry URL>
  //<your registry host>/:_authToken=...

Full Changelog: aubepkg/aube@v2.8.2...v2.8.3

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.8.2: : Smaller lockfile diffs for yarn.lock v1 and package-lock.json, plus no more 5-minute cap on slow tarball downloads

Compare Source

v2.8.2 brings aube's rewrites of Yarn Classic, npm and pnpm lockfiles closer to each tool's own output. It also stops large tarball downloads from failing after 5 minutes while data is still arriving, and fixes several install and resolution differences from pnpm.

Fixed

Lockfiles

• Yarn Classic yarn.lock (#​1802): re-resolving no longer rewrites every entry. aube now keeps resolved URLs, including the #sha1 fragment, and quotes keys only where Yarn does. Block headers list only the ranges that consumers declare, and blocks are sorted the way Yarn sorts them. As a result, bumping one dependency changes only that package's entries:

  -"accepts@1.3.8", "accepts@~1.3.8":
  +accepts@~1.3.8:
     version "1.3.8"
  +  resolved "https://registry.yarnpkg.com/accepts/-/accepts-1.3.8.tgz#0bf0be125b67014adcb0b0921e62db7bffe16b2e"

• npm package-lock.json (#​1814): aube add and other rewrites leave unchanged entries byte-identical to npm's output.
  • Keys are now sorted the way npm sorts them, so "dev": true no longer moves.
  • funding values are kept exactly as written, including type and arrays with more than one URL.
  • New entries still record funding only as {"url": …}.
• pnpm 11 peer suffixes (#​1805): when a dependency needs a peer resolved from higher in the tree, the parent package's snapshot key now includes that peer even if the parent declares its own peers, as pnpm 11 does. For example, aube now writes @ai-sdk/react@4.0.138(react@19.3.1)(zod@4.6.7). The peer is also listed under transitivePeerDependencies:. Snapshot keys for affected packages change once on the next resolve; frozen installs read existing lockfiles unchanged.
• catalog: dependencies with ranged overrides (#​1816): an override with a version range, such as "is-odd@^3": "catalog:", no longer applies to a dependency declared as catalog:. This matches pnpm. The importer keeps specifier: 'catalog:', so pnpm install --frozen-lockfile no longer fails with ERR_PNPM_OUTDATED_LOCKFILE. Catalog entries that are referenced only by an override value are no longer written to catalogs:. Lockfiles that older aube versions wrote for this setup are reported as outdated until the next aube install rewrites them.

Install and resolution

• Slow tarball downloads (#​1804): a large tarball on a slow connection no longer fails with operation timed out after fetchTimeout (default 5 minutes) while data is still arriving. For tarballs, fetchTimeout is now the longest time a download can go without receiving data; a stalled download still fails and is retried. Registry metadata requests still use fetchTimeout as a limit on the whole response.
• Colliding npm aliases in frozen installs (#​1812, @​chrismatix): aube install --frozen-lockfile could install the wrong package when an npm alias shared a name and version with an ordinary package or another alias. For example, compiler: npm:@test/compiler@1.0.0 in one workspace member and compiler: 1.0.0 in another. Each member now gets the correct package and its binaries.
• Hidden hoisting (#​1815): when a package has several versions in the graph, node_modules/.aube/node_modules now gets the version closest to an importer, as with pnpm. Ties are broken by dependency path. In the default layout, the root project's direct dependencies are no longer hidden-hoisted because Node already finds them in the root node_modules/. Previously, an undeclared import from a package could resolve to a different version than under pnpm. In one reported case, Vite+ bundled the wrong rolldown version.
• supportedArchitectures platform lists (#​1813): pnpm-workspace.yaml can now use pnpm 12.5's list form, which previously failed with invalid type: sequence:

  supportedArchitectures:
    - darwin-arm64
    - linux-x64-manylinux_2_28

  Entries can be <os>-<cpu>[-<libc>], Rust target triples or current. aube merges the OS, CPU and libc values from all entries, so it can allow a few more combinations than pnpm. For example, darwin-arm64 plus linux-x64 also allows darwin-x64.
• aube outdated / aube update warnings (#​1807): aube no longer warns "updates hidden by minimumReleaseAge" when the hidden version is a prerelease latest outside the manifest range that is older than the cutoff (for example elm-test@0.19.3-0).

Full Changelog: aubepkg/aube@v2.8.1...v2.8.2

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.8.1: : pnpm 11 lockfile parity, Yarn Berry and npm lockfile fixes

Compare Source

v2.8.1 brings aube-written pnpm-lock.yaml files closer to pnpm 11's output and fixes lockfile round-trips for npm and Yarn Berry. It also fixes minimumReleaseAge in update/dedupe, install --force, workspace detection for nested projects, and handling of an empty CI variable.

Fixed

Lockfiles

• pnpm 11 parity (#​1792, #​1793, #​1788): when a tool such as Dependabot regenerates the lockfile with pnpm, it should rewrite fewer lines that did not change.
  • Peer suffixes are now sorted by the full name@version string, e.g. (react-dom@18.2.0(react@18.2.0))(react@18.2.0).
  • With dedupePeerDependents on (the default), aube resolves an optional peer from any matching version in the graph and lists it under optionalDependencies:. Compatible variants of a package are merged across importers.
  • catalogs: no longer lists entries that an override replaces.
• npm package-lock.json:
  • aube add now keeps "optional": true (for example on @esbuild/* platform packages) and "hasInstallScript": true. Previously, dropping these made npm fail with Unsupported platform (#​1775).
  • Root file: directory dependencies now keep their link and target entries, so npm ci no longer reports Missing: … from lock file (#​1799).
• file: peers on re-resolve (#​1775): aube add no longer fails with ERR_AUBE_BLOCKED_EXOTIC_SUBDEP when a direct file: dependency satisfies another package's peer.
• Yarn Berry yarn.lock (#​1798):
  • Changes to package.json are now detected even when some dependencies are unchanged. Previously aube could print "Lockfile is up to date" and leave yarn.lock stale. This also applies to Yarn Classic.
  • Rewritten lockfiles now keep the __metadata version and cacheKey, the root workspace entry, bin: maps and builtin<compat/…> patch blocks, and use Yarn's formatting. As a result, yarn install --immutable accepts them.
  • Not yet round-tripped: conditions:, dependenciesMeta: and non-root workspace blocks.

Install and resolution

• minimumReleaseAge on npmjs.org (#​1791): aube update and aube dedupe could install versions that minimumReleaseAge should have blocked, including with minimumReleaseAgeStrict: true. Both commands now fetch the publish times they need to apply the cutoff.
• npm's --min-release-age (#​1770): when aube receives npm-style install arguments, it now converts --min-release-age <days> and --min-release-age=<days> to aube's minimumReleaseAge, which is set in minutes. Arguments after -- are left as they are.
• aube install --force (#​1789): now rebuilds every linked package. Files deleted from node_modules are restored instead of the command printing "Already up to date". With the global virtual store, each shared entry is rebuilt in a staging directory and swapped into place.
• Nested non-member projects (#​1787): running aube install in a subdirectory that is not a workspace member now installs that subdirectory alone. This applies, for example, below an aube-workspace.yaml or pnpm-workspace.yaml that contains only settings. Previously aube installed the ancestor root. --ignore-workspace now works too and is listed in the CLI help.
• Empty CI variable (#​1786): CI= no longer turns on CI mode (frozen lockfile by default, global virtual store disabled). CI=0 and CI=false still count as CI.
• TLS root certificates (#​1797): updated rustls-webpki and webpki-root-certs to versions that drop the compromised eMudhra intermediate CA certificates.

Changed

• Homebrew tap (#​1771, #​1772): releases now go to the Aube-maintained tap, installed with brew install aubepkg/tap/aube. brew install aube installs the Homebrew core formula. The legacy jdx/tap/aube formula remains available during the transition.

Lockfile changes on upgrade

After upgrading, the next resolve rewrites some lines in existing aube-written pnpm-lock.yaml files: peer suffixes are reordered and newly resolved optional peers are added. Lockfiles are read as they are, so --frozen-lockfile installs of older lockfiles keep working.

Full Changelog: aubepkg/aube@v2.8.0...v2.8.1

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.8.0: : Trusted dependency controls and shim fixes

Compare Source

v2.8.0 lets projects opt out of aube’s built-in trusted dependency list, fixes shell bin execution and long lockfile snapshot keys, and avoids leaking the default shim directory into child-process PATH.

Added

• Trusted-dependency opt-out (#​1767): use useDefaultTrustedDependencies to opt out of the built-in trust list.

Fixed

• Shell bins without shebangs (#​1766): run them with sh.
• Long lockfile snapshot keys (#​1765): keep keys over 1024 characters in explicit form.
• Shim directory in PATH (#​1761): strip the default shim directory when AUBE_SHIM_DIR is unset.

Full Changelog: aubepkg/aube@v2.7.2...v2.8.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.7.2: : Root project filters and TLS error handling

Compare Source

v2.7.2 makes --filter select the root project by name and turns an unloadable TLS root into an error instead of a panic.

Fixed

• Root-project filters (#​1754): allow --filter to select the root project by name.
• TLS root failures (#​1758): report an unloadable TLS root as an error instead of panicking.

Full Changelog: aubepkg/aube@v2.7.1...v2.7.2

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.7.0: : Local and workspace dependency linking fixes

Compare Source

v2.7.0 improves local and workspace dependency linking, fixes file: package handling across dlx and moved lockfiles, and improves Windows virtual-store behavior.

Fixed

• Local and workspace dependencies: preserve links, bins, peers, patch hashes, and relative link: dependencies across installs and lockfile rewrites (#​1648, #​1679, #​1680, #​1684, #​1685, #​1688).
• file: packages in dlx: resolve relative specs from the invoking directory and accept Windows paths (#​1642, #​1708).
• Windows virtual store: rewrite moved junctions and replace a real directory left at a global-store entry (#​1646).
• First dependency after an empty lockfile (#​1707): detect the new dependency during install.

Added

• Interactive update context (#​1702): show the project name in the picker title.

Full Changelog: aubepkg/aube@v2.6.1...v2.7.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.6.1: : Recover installs after deleting the lockfile and store

Compare Source

v2.6.1 fixes installs after deleting the lockfile and store, stabilizes dense peer-context resolution, and reduces duplicate store verification work.

Fixed

• Recover linked installs (#​1671): reuse linked trees when the lockfile and store have been deleted.
• Dense peer graphs (#​1669): converge the peer-context pass on dense hashed peer webs.
• Packaging (#​1657): publish one executable in each npm platform package.

Changed

• Less duplicate verification (#​1659): verify each store entry once across dep paths.
• Smaller release binaries (#​1656): strip symbols from release builds.

Full Changelog: aubepkg/aube@v2.6.0...v2.6.1

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.6.0: : Lockfile selection and Bun 1.4 support

Compare Source

v2.6.0 adds selectable lockfile read/write behavior, supports Bun 1.4 scoped overrides, and improves Bun lockfile imports. It also makes fresh resolution faster and allows why-is-node-running 3.2.2 without provenance.

Changed

• Selectable lockfile format (#​1649): choose which supported lockfile aube reads and writes.
• Bun 1.4 compatibility (#​1638, #​1639): import Bun 1.4 lockfiles, link their peers, and honor scoped overrides.
• Faster fresh resolution (#​1652): index cached packuments.

Fixed

• Trust compatibility (#​1653): allow why-is-node-running 3.2.2 when it has no provenance.

Full Changelog: aubepkg/aube@v2.5.1...v2.6.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.5.1: : Faster repeated fresh installs and faster startup on Linux

Compare Source

Repeated fresh installs skip redundant OSV lookups, and the Linux release binaries start a little faster.

Changed

• Faster repeated fresh installs (#​1631 by @​jdx): When the OSV Bloom filter flags a package that turns out to have no malicious advisory, aube used to confirm it with a live OSV query on every install. That added about 220–250 ms each time. aube now caches a clean result for 30 seconds. A cached result is reused only when both the exact package/version pairs and the validated Bloom filter match. On a warmed Svelte fixture, installing with node_modules and aube-lock.yaml removed went from a 346 ms median to 107 ms.
  • Failed OSV queries, failed Bloom filter refreshes and confirmed malicious hits are never cached.
  • Explicit add/update/dlx checks, advisoryCheck = required and advisoryCheckEveryInstall = true still query OSV live every time.
  • Tradeoff: if a malicious-package advisory is published for a version that was just cleared, a repeated ordinary install may take up to 30 seconds to catch it.
• About 0.6 ms faster startup on Linux (#​1625 by @​jdx): The Linux GNU release binaries (x86_64 and aarch64) for aube, aubr and aubx are now linked as non-PIE. The loader no longer has to patch about 56k pointers at each launch, so aube --version drops from about 2.2 ms to 1.6 ms.
  • Tradeoff: ASLR no longer randomizes aube's own code and data. The heap, stack and shared libraries are still randomized.
  • musl, macOS and Windows builds are unchanged, as are cargo install, source builds and the PPA/COPR packages.

Full Changelog: aubepkg/aube@...v2.5.1

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.5.0: : Choose range or latest per package in aube update --interactive

Compare Source

aube update --interactive now lets you pick, for each package, whether to keep the current version, move to the newest version its range allows, or jump to latest. Repeated frozen installs and fresh installs without a lockfile are also faster, and a reinstall that failed after you deleted the cache and lockfile now works.

Added

• Per-package version choice in aube update --interactive (#​1612 by @​jdx): The picker used to be one checkbox per dependency, with the target set by flags. It is now a table, like Yarn Berry's upgrade-interactive. Each row shows the current version, the newest version the range allows, and the registry's latest. Use ↑/↓ to move between rows and ←/→ to choose a version. Rows left on Current are skipped, and / filters by name. Closes #​1611.

  $ aube update -i
  Choose which dependencies to update
                Current     Range      Latest
   > chalk      [•] ^4.1.2             [ ] ^6.0.0
     is-number  [•] ^6.0.0             [ ] ^7.0.0
     ms         [ ] 2.0.0   [•] 2.1.3
     semver     [ ] 7.5.0   [•] 7.8.5
  ↑/↓/k/j up/down • ←/→/h/l choose • / filter • enter confirm
  

  • Rows start on Range, or on Latest with --latest. Pressing Enter right away does the same thing as the non-interactive command.
  • Updates keep the manifest's range operator. Exact pins are now listed: each one is offered the newest release its caret range would allow, and it stays an exact pin after the update. -E still forces exact pins.
  • --no-save hides Latest and pin bumps, because both would rewrite package.json.
  • Latest is offered only when it is newer than the installed version, so the picker never offers a downgrade.
  • With update -r -i, the version you choose for a shared catalog entry is used for later workspace packages without asking again.
  • Rows no longer show the dependency section (dependencies / devDependencies).

Changed

• Faster repeated frozen installs (#​1615 by @​jdx): Standalone projects can now reuse the installed state when nothing has changed. This applies to projects with registry dependencies and no declared patches, installed with an explicit --frozen-lockfile and lifecycle scripts disabled (for example aube install --frozen-lockfile --offline --ignore-scripts). On the benchmark fixture, a no-op install went from about 82 ms to about 7 ms. The freshness check hashes the lockfile and manifest contents, so a change is caught even when file size and modification time stay the same. A missing dependency link also counts as a change. Workspaces, patches, local sources, enabled scripts, custom lockfile locations and active per-install advisory policies still go through full validation.
• Faster advisory checks on fresh installs (#​1616 by @​jdx): A fresh install without a lockfile used to query OSV for every resolved public-npm package. Under the default advisoryCheck: on, graphs with more than 10 distinct package/version pairs are now screened with the advisory Bloom filter first, and only probable hits are checked against the live API. On the benchmark fixtures this cut fresh install time by 36–67%.
  • Full live checks are still used for smaller graphs, for explicit aube add / aube update, for transient aube dlx installs, and with advisoryCheck: required or advisoryCheckEveryInstall: true.
  • If the filter can't be refreshed or validated, every package is checked live.
  • The filter cache refreshes every 15 minutes, so a newly published advisory may take up to that long to be caught.

Fixed

• "missing package index" after deleting the cache and lockfile (#​1613 by @​jdx): A reinstall could fail with this error if you had deleted aube's cache/store and the root lockfile but kept node_modules. Now an existing package directory is reused only when its dependency subtree matches the previous install and the directory still exists. Anything else is looked up in the store again, or downloaded again, before linking.

Full Changelog: aubepkg/aube@...v2.5.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.4.0: : Reuse node_modules/.aube-lock.yaml when the lockfile is missing

Compare Source

aube install can now rebuild a deleted lockfile from a hidden copy kept in node_modules, so it doesn't re-resolve from the registry. This release also makes cold installs on Linux faster and lighter on memory, and fixes lifecycle scripts on Windows and a workspace aube update that could drop members from the lockfile.

Added

• Hidden lockfile in node_modules (#​1594 by @​jdx): Every install now writes a copy of the resolved graph to node_modules/.aube-lock.yaml. If the project has no lockfile of any supported kind, aube install starts from that copy, as pnpm does with its current lockfile. If the manifests haven't changed, the graph is reused with no resolve. If they have changed, only the specs that changed are resolved again, and the other packages keep their locked versions. aube-lock.yaml is then written again.

  $ aube install      # writes aube-lock.yaml + node_modules/.aube-lock.yaml
  $ rm aube-lock.yaml
  $ aube install      # seeds from node_modules/.aube-lock.yaml, no registry resolve

  • --frozen-lockfile and aube ci still fail when there is no lockfile.
  • --no-frozen-lockfile ignores the hidden copy.
  • In auto-CI mode (CI=true with no explicit flags), an install that seeds from the hidden copy is treated as prefer-frozen.
  • If the hidden copy is broken, aube shows WARN_AUBE_HIDDEN_LOCKFILE_BROKEN and resolves normally.
  • The hidden copy is not used with lockfile=false, which also deletes any existing copy, or with sharedWorkspaceLockfile=false. It is also skipped for reuse installs from npm, yarn or bun lockfiles.

Changed

• Faster, lighter cold installs on Linux (#​1598, #​1603, #​1604, #​1605 by @​jdx):
  • On Linux, the blocking thread pool now defaults to 8 threads instead of 128. On the benchmark fixture this cut peak memory from about 1.5 GB to about 400 MB and reduced kernel CPU time. AUBE_TOKIO_BLOCKING still overrides the default, and macOS and Windows keep 128.
  • Small tarballs (up to 1 MiB) are downloaded in full before their store import begins, so an import no longer ties up a thread while it waits on the network. Memory for these buffered downloads is capped at 64 MiB in total.
  • Installs with the global virtual store no longer read back dependency links they just wrote.

Fixed

• Windows lifecycle scripts failing with EISDIR: illegal operation on a directory, lstat 'C:' (#​1591 by @​jdx): This affected scripts that start node through a .bin shim (for example node-gyp-build) during aube add, remove, update, dedupe and ci, and during installs from embedding hosts such as mise's npm: backend. The install root and the Node-API embedding's project directory no longer carry the \\?\ verbatim prefix. Fixes #​1590.
• aube update at a workspace root dropping workspace members from aube-lock.yaml (#​1579 by @​jdx): With a shared lockfile, running aube update or aube update -w at the root could delete every workspace member's entry in aube-lock.yaml. Member entries, their packages, patch hashes and catalog snapshots are now kept, and only the root's direct dependencies are updated. aube install also treats a workspace member that declares dependencies but has no entry in the lockfile as stale, so installing again repairs lockfiles already damaged by this bug.

Full Changelog: aubepkg/aube@v2.3.0...v2.4.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.3.0: : Host-bound Node launchers for embedders, plus hoisted .bin, lockfile patch-hash, and terminal-cleanup fixes

Compare Source

Embedding hosts such as mise can now bind installed Node CLIs to a specific Node executable, and a batch of fixes covers hoisted-install bin linking, aube-lock.yaml patch hashes, ignoreScripts resolution, signal delivery in dlx --shell-mode, and terminal state after failed or interrupted installs.

Added

• Bind installed CLIs to a host-managed Node runtime (#​1576 by @​jdx) — Installed Node CLIs previously found their interpreter through the caller's PATH, so a tool manager could not give an application its own runtime without also changing which Node its project subprocesses see. EmbedderRuntime::bind_bins_to generates launchers that invoke the supplied absolute Node executable directly while leaving the inherited PATH unchanged; it works with both embedded install and add:

  let mut options = aube::embed::InstallOptions::new("/tools/my-cli");
  options.runtime = Some(
      aube::embed::EmbedderRuntime::selector("/runtimes/node/25/bin")
          .bind_bins_to("/runtimes/node/25/bin/node"),
  );
  aube::embed::install(options).await?;

  The path is kept as written (symlinks are not canonicalized), so a moving major-version path like mise's installs/node/25/bin/node works; a missing runtime fails rather than falling back to ambient Node. Changing or removing the binding regenerates launchers on the next install, including frozen ones. Bound installs always materialize locally and disable the global virtual store so runtime-specific launchers stay out of shared trees. Simple Node shebang flags are preserved; quoted shebang arguments and environment assignments are rejected. Standalone aube's runtime selection is unchanged — this is the launcher support a host needs to implement its own policy (see jdx/mise#13477).

Fixed

• Hoisted installs link transitive dependency bins (#​1548 by @​jdx) — With --node-linker=hoisted, only importers' direct dependencies were linked into node_modules/.bin, so packages whose lifecycle scripts call a binary from their own dependencies failed with errors like sh: node-pre-gyp: command not found (bcrypt, prebuild-install, napi-postinstall; see discussion #​1543). Hoisted installs now follow npm's rule: each package's bins are linked into the .bin/ of the node_modules/ it sits in, and a dependency's lifecycle script sees its own nested .bin first so a version conflict no longer silently runs the hoisted winner. An importer's own bin and its direct dependencies always take precedence over transitive packages on a name collision. Isolated installs are unaffected.
• aube rebuild relinks the full bin surface (#​1550 by @​jdx) — rebuild only relinked per-dependency shims, so a command added or retargeted in package.json#bin after install stayed missing or stale until the next aube install. rebuild now uses the same bin-linking entry point as install (importer bins, workspace member bins, then dependency bins). If a workspace member manifest is unreadable, it warns and reconciles the root importer instead of aborting. aube rebuild --filter <member> is not covered by this change.
• ignoreScripts is honored from env, .npmrc, and aube-workspace.yaml (#​1552 by @​jdx, fixes #​1551) — Only the --ignore-scripts flag reached the installer; AUBE_IGNORE_SCRIPTS, npm_config_ignore_scripts, ignore-scripts=true in .npmrc, and ignoreScripts: true in the workspace yaml were parsed and then discarded, so aube config get ignore-scripts printed true while the next install ran scripts anyway. All sources now apply across install, ci, add, remove, update (including its pnpm:devPreinstall hook), dlx, deploy, and the auto-install aube run performs on a stale tree — which previously had no way to skip scripts at all. An explicit flag still wins over a lower-precedence false. pack, publish, and version keep their own --ignore-scripts flags.
• aube-lock.yaml keeps patch hashes on re-resolve (#​1577 by @​jdx) — In a project with patchedDependencies, running aube add dropped the (patch_hash=…) suffix from patched entries in aube-lock.yaml, producing a spurious lockfile diff on every add and a node_modules/.aube/ directory name that varied by how the lockfile was produced (reported in jdx/mise#13456). aube-lock.yaml now records patch identities the same way pnpm-lock.yaml does — a top-level patchedDependencies: map and (patch_hash=…) in entry names — consistently after install, add, and import, and a plain aube install now detects edited, added, or removed patches. Upgrade note: existing hashless aube-lock.yaml files still pass --frozen-lockfile unchanged; the next non-frozen install or add records the hashes as a one-time diff. Projects without patches are unaffected.
• Lifecycle scripts get a working npm_execpath when aube is embedded (#​1565 by @​jdx) — Embedded aube set npm_execpath to the host's binary, so a package running ${npm_execpath} run verify-build (e.g. install-artifact-from-github, used by re2) invoked the host's own CLI and failed, causing a needless source build or a failed install (jdx/mise#13451). Embedded aube now exports a shim that re-enters aube's CLI through the host via a private __aube-cli argv token (embed::CLI_TRAMPOLINE_ARG); hosts dispatch it the same way as the existing node-gyp trampoline, and docs/embedding/rust.md now documents both. If the shim cannot be written, npm_execpath is left unset rather than naming the host. AUBE_CLI_EXE is new in the lifecycle environment, and an inherited outer npm_execpath is now cleared before stamping. Standalone aube is unchanged.
• aube dlx --shell-mode delivers termination signals to the tool (#​1562 by @​jdx) — Signaling an aube dlx --shell-mode (or aubx -c) process stopped at the intermediate sh -c, leaving the tool running and aube hung waiting on it. A shell-mode line that is a single plain command now runs without a shell (using the same strict allowlist as aube run), so the tool is aube's direct child, receives the forwarded signal, and its exit code propagates. Pipelines, redirects, expansions, quoting, and shell builtins still run under sh with unchanged behavior, and the --shell-mode help text now describes this contract.
• Terminal state is restored when an install fails, is interrupted, or panics (#​1559, #​1560 by @​jdx) — A failing install (trust-policy rejection, unresolvable dependency, network error) exited without retiring the progress renderer, leaving the cursor hidden and the OSC 9;4 taskbar indicator lit in iTerm2, Ghostty, and VS Code (discussions #​1557 and #​1558). Every error path now restores both before the diagnostic prints, and while the progress bar is active aube also handles SIGINT/SIGTERM/SIGHUP/SIGQUIT and panics to restore the terminal before re-raising — Ctrl-C still exits 130. Signals already ignored or handled (e.g. under nohup, or by an embedding host) are left alone. Windows gets the panic restore but not the signal handling.

Full Changelog: aubepkg/aube@v2.2.17...v2.3.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.2.17: : Maintenance release

Compare Source

This release only refreshes Cargo.lock dependencies and contains no user-facing changes.

Full Changelog: aubepkg/aube@v2.2.16...v2.2.17

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.2.16: : aube add installs local tarballs by their manifest name

Compare Source

aube add ./package.tgz now records the package under the name declared in the tarball's package.json, and local file: / link: / portal: dependencies now install their optionalDependencies.

Fixed

• Local tarballs are added by manifest name, not filename (#​1532 by @​jdx) — Downloaded npm artifacts are commonly named package.tgz, and aube add previously derived the dependency key from that filename, producing a bogus "package": "file:./package.tgz" entry alongside any existing dependency on the real package. For an unaliased local tarball or directory, aube add now reads package.json#name and uses it as the key, so the add replaces an existing dependency on the same package instead of adding a second one. Explicit aliases (aube add alias@file:./package.tgz) remain authoritative, and a local package whose manifest has no name is now rejected with an error. This fixes Bun checksum installs through mise (jdx/mise#13125), which download the verified artifact as package.tgz.
• Local packages install their optionalDependencies (#​1532 by @​jdx) — file:, link:, and portal: directory and tarball dependencies previously only resolved dependencies, so optional platform packages declared by a local package (such as Bun's per-platform binaries) were silently dropped. They are now resolved and linked under the local package, honoring ignoredOptionalDependencies and blockExoticSubdeps, and skipping any optional dependency already listed under dependencies so it is not installed twice.

Full Changelog: aubepkg/aube@v2.2.15...v2.2.16

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: mise.lock

�[2mmise�[0m lock            aube@2.8.5 windows-x64
�[2mmise�[0m lock            aube@2.8.5 linux-arm64-musl
�[2mmise�[0m lock            aube@2.8.5 linux-x64-musl
�[2mmise�[0m lock            aube@2.8.5 macos-arm64
�[2mmise�[0m lock            aube@2.8.5 linux-x64
�[2mmise�[0m lock            aube@2.8.5 macos-x64
�[2mmise�[0m lock            aube@2.8.5 linux-arm64
�[31mmise�[0m �[31mERROR�[0m lockfile generation would change the recorded signer; previous files were preserved
�[31mmise�[0m �[31mERROR�[0m Version: 2026.10.24 linux-x64 (2026-10-30)
�[31mmise�[0m �[31mERROR�[0m �[2mRun with --verbose or MISE_VERBOSE=1 for more information�[0m