chore(deps): update dependency aube to v1.41.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aube	tools	minor	1.33.1 → 1.41.0

---

Release Notes

jdx/aube (aube)

v1.41.0: : Faster removes, safer package extensions, and catalog pruning

Compare Source

This release adds a cache path command and pnpm-style catalog pruning, makes aube remove avoid unnecessary resolution and network requests, validates packageExtensions up front, and fixes several install/linker correctness issues around hoisted workspaces and global-virtual-store links.

Added

• aube cache path command (#​1302 by @​jdx) — Prints the resolved metadata/policy cache root so CI jobs have one stable path to cache packuments, runtime metadata, and lockfile policy-verification records. It honors cacheDir/cache-dir overrides and platform defaults, and resolves the cache relative to the workspace/project root (so nested workspace packages share one root). Mirrors the command added in pnpm 11.22.

  aube cache path
  

• catalogPrune setting (#​1308 by @​jdx) — Adds pnpm 11.22's catalogPrune as the canonical setting for pruning unused workspace catalog entries after install. The previous cleanupUnusedCatalogs name is retained as a deprecated alias; when both are set, catalogPrune wins. Configurable via env, .npmrc, workspace YAML, and settings.toml.

Fixed

• Validate packageExtensions before resolution (#​1304 by @​jdx) — Malformed packageExtensions (non-object shapes, non-string dependency ranges like a null version, invalid peerDependenciesMeta) were previously dropped silently, quietly changing the effective policy. They now fail early with a stable ERR_AUBE_INVALID_PACKAGE_EXTENSION diagnostic that names the offending field path, applied consistently across install, update, remove, dedupe, and audit. aube remove validates before writing package.json so a bad policy can't leave the manifest and lockfile inconsistent.

• Repair stale nested global-virtual-store links (#​1299 by @​jdx) — Warm installs and GVS cache hits could leave nested node_modules links inside shared global-virtual-store packages pointing at an outdated dependency identity even after the lockfile graph moved on. The linker now reconciles nested links in cached GVS entries (fixing stale, missing, or wrongly-targeted links), and the warm fast path is invalidated when shared topology drifts. Fixes #​1298.

• Keep hoisted workspace installs warm (#​1295 by @​jdx) — In hoisted workspaces where a member's direct dependency is satisfied from the root node_modules, install state previously always recorded a member-local path that is intentionally empty, so every freshness check treated a valid layout as stale and reinstalled the whole tree (and re-triggered "Auto-installing" on repeated aube run). Install state now records the actual ancestor-visible placement for hoisted direct dependencies. Fixes #​1292.

• SBOM output reflects the current host (#​1309 by @​jdx) — Default aube sbom output now filters out platform-incompatible optional packages using effective supportedArchitectures and ignoredOptionalDependencies, and aligns optional-edge traversal with pnpm/Yarn Berry semantics. A new --lockfile-only flag retains the complete platform-independent lockfile graph in the CycloneDX/SPDX output.

• lowest-direct resolution is now distinct from time-based (#​1307, #​1311 by @​jdx) — resolution-mode=lowest-direct now picks the oldest satisfying version for direct dependencies (with transitives still on the newest satisfying version) without computing a publish-time cutoff or writing a time: block into the lockfile, instead of being folded into time-based mode. The public aube_resolver::ResolutionMode enum stays stable for embedders — the behavior is driven through additive builder state rather than a new enum variant.

• Embedded install memory diagnostics (#​1303 by @​jdx) — Embedded hosts such as mise now honor the same AUBE_DIAG_* env surface as the CLI, initializing and flushing diagnostics at operation boundaries. Adds OOM-safe per-event flushing (AUBE_DIAG_FLUSH=1), periodic current/peak RSS samples (AUBE_DIAG_KERNEL=1), and richer resolver/extraction metrics to help distinguish resolver retention from extraction spikes. Install behavior is unchanged. Supports #​1301.

Changed

• Faster aube remove without unnecessary resolution (#​1306 by @​jdx) — For single-project installs with a fresh lockfile, remove now prunes the removed roots and their unreachable transitive closure directly from the existing graph and relinks in frozen/offline mode, avoiding registry metadata requests entirely. Multi-importer workspaces, patch/catalog/manifest drift, removed overrides, and surviving peer contexts still fall back to full resolution.

Full Changelog: jdx/aube@v1.40.0...v1.41.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.40.0: : Lifecycle script output for embedders

Compare Source

A small release whose only user-facing change lets embedding hosts capture lifecycle script output as tagged install events.

Added

• Report lifecycle script output as install events (#​1284 by @​jdx) — When an install runs in event output mode, lifecycle script stdout and stderr are now piped and forwarded line-by-line as tagged InstallEvent::Output events (code AUBE_LIFECYCLE_SCRIPT_OUTPUT) instead of being written directly to the shared terminal. This lets embedding hosts such as mise render lifecycle logs through their own progress UI without corrupting it. The standalone Aube CLI and non-event installs are unchanged and keep inheriting stdio.

Full Changelog: jdx/aube@v1.39.0...v1.40.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.39.0: : Configurable lockfile format & smarter store pruning

Compare Source

This release adds a configurable default lockfile format, lets store prune reclaim stale global-virtual-store entries, tightens devEngines version enforcement, and lets embedders drop the comment-preserving workspace-YAML dependency chain.

Added

• Configurable default lockfile format (#​1271 by @​jdx) — New defaultLockfileFormat setting ("aube" or "pnpm", default "aube") chooses which lockfile to create when no supported lockfile is present on disk. Existing lockfiles remain authoritative, so the setting never converts a lockfile or writes a duplicate alongside one that already exists. This makes the aube clean --lockfile → reinstall workflow reliably regenerate pnpm-lock.yaml for projects that need pnpm compatibility. Configurable via workspace config, settings.toml, .npmrc, and env, and applied consistently across install and the add/remove/update/dedupe/audit write paths. Addresses #​1264.

  # settings.toml
  defaultLockfileFormat = "pnpm"
  

• Optional workspace YAML preservation for embedders (#​1278 by @​jdx) — Comment- and format-preserving pnpm-workspace.yaml edits are now gated behind a default-on workspace-yaml-preserve feature. The standalone Aube CLI is unchanged, but embedders (e.g. mise) can disable the feature to drop the yamlpatch/yamlpath/tree-sitter dependency chain — which required Rust 1.97+ — falling back to a canonical full-document rewrite.

Fixed

• Prune unused global virtual store entries (#​1273 by @​jdx) — aube store prune previously only walked the content-addressable store, leaving hashed graph directories under <cacheDir>/virtual-store behind even after their projects were deleted. Installs that use the global virtual store now register the project (including warm/fast-path installs after upgrading), and prune uses that registry to keep entries still linked from live projects while removing unreachable ones before continuing with normal content-store cleanup. Installs and pruning coordinate via shared/exclusive locks, registry-managed entries live under a versioned virtual-store/v1/ namespace so older releases' entries are untouched, and registry failures fail closed with ERR_AUBE_GVS_PRUNE_FAILED. --dry-run covers the new phase. Addresses #​1268.

• Enforce devEngines aube version errors (#​1269 by @​jdx) — An explicit devEngines.packageManager.onFail: "error" now correctly rejects the invoking aube when its version does not satisfy the declared aube version, instead of silently re-execing to an already-installed match. The same self-version policy is now enforced for aube --version (which previously returned before self-version handling), and aube --version --workspace-root works outside a workspace. devEngines.packageManager entries naming pnpm or other package managers keep their existing compatibility behavior. Fixes #​1263.

Full Changelog: jdx/aube@v1.38.1...v1.39.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.38.1: : Sharper updates, shims, and filtered installs

Compare Source

A small patch release with three targeted fixes to aube update --no-save, POSIX shim resolution, and cold-store filtered installs.

Fixed

• Keep --no-save resolutions inside the existing range (#​1247 by @​jdx) — aube update --latest --no-save no longer treats --latest as permission to bump the manifest or catalog specifier. It now refreshes the lockfile to the newest version allowed by the retained range (for both direct and shared catalog entries) instead of recording a latest that the specifier itself excludes — which could otherwise make a subsequent frozen install reject the lockfile.
• Resolve symlinks in POSIX shims (#​1249 by @​jdx) — Generated POSIX .bin shims now follow their invocation path through absolute and relative symlink chains (up to 40 hops, guarding against cycles) before computing basedir. Launching a tool via a symlink on PATH previously pointed basedir at the external symlink directory rather than the real node_modules/.bin, breaking the shim's relative target. The shim marker is bumped to aube-bin-shim v2 so older shims are still parsed correctly on uninstall.
• Filter cold per-project materialization (#​1253 by @​jdx) — Filtered installs (--production, --filter, workspace scoping) now apply dependency-section and workspace selection before pipelined materialization. Previously a cold store streamed the full lockfile graph into node_modules/.aube, leaving unrelated package cells on disk even though the importer symlinks were correct (warm installs looked fine because cached packages aren't re-streamed). The on-disk lockfile and full-graph validation still use the unfiltered graph. Fixes #​1250.

Full Changelog: jdx/aube@v1.38.0...v1.38.1

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.38.0: : Shared workspace hoisting, embedder storage overrides, and safer store pruning

Compare Source

This release lets embedding hosts fully own installed-package storage, adds a --dry-run preview to store prune, and enriches SBOM output with real license metadata — alongside a batch of fixes for hoisted workspaces, global-virtual-store unlinking, deploy patches, and nested shim resolution.

Added

• Per-install storage overrides for embedders (#​1239 by @​jdx) — New source-compatible install_with_overrides / add_with_overrides APIs (via EmbedderInstallOverrides) let a host pin cacheDir, storeDir, and enableGlobalVirtualStore for a single invocation without mutating process env or global state. Overrides take command-line precedence and flow through install, add, frozen-lockfile verification, trust-policy metadata, and warm-path GVS detection, so hosts like mise can isolate embedded npm installs and remove their storage cleanly. Host-owned cache indices now round-trip non-UTF-8 store paths.

• aube store prune --dry-run (#​1228 by @​jdx) — Preview exactly what a prune would remove before anything is unlinked. The dry run performs the identical walk and skip decisions (index-referenced files, nlink > 1, exec-marker companions) but never deletes:

  $ aube store prune --dry-run
  Would prune 412 files (up to 18.7 MB) from the store
  

  Closes #​1218.

• Package license metadata in SBOM output (#​1208 by @​jdx) — aube sbom now reuses aube licenses' installed-package discovery to emit root and dependency licenses in CycloneDX 1.5 (as SPDX identifiers, expressions, or named licenses) and to populate SPDX 2.3 licenseDeclared for valid expressions. Works across isolated, hoisted, linked, and custom virtual-store layouts, with a fingerprinted sidecar and live-manifest fallbacks for older installs. Closes #​1204.

Fixed

• Share hoisted deps across workspace importers (#​1243 by @​jdx) — The hoisted linker now plans all workspace importers as one tree rooted at the workspace node_modules, so with hoistingLimits=none compatible dependencies hoist to a single physical package at the workspace root, while hoistingLimits=workspaces correctly keeps deps within workspace boundaries (previously it behaved like none). Installs record the exact placement map in hoisted-placements.json so rebuild and licenses reflect the real layout. Fixes #​1242.
• Keep GVS-backed deps out of bare aube unlink (#​1230 by @​jdx) — With the global virtual store on (the default outside CI), bare aube unlink deleted every ordinary dependency symlink from node_modules/ and reported each as "Unlinked". The internal/external classification is now lex-normalized first (mirroring unlink_bins) so .aube/... targets stay internal without following GVS symlinks into the shared store.
• Unlink global bins under the shared virtual store (#​1232 by @​jdx) — aube remove -g <pkg> left the package's bin behind as a dangling symlink in the global bin dir when GVS was enabled. Bin ownership is now checked against the lexically normalized target link_bins actually wrote, with canonicalization retained as a fallback. Reported in #​1219.
• Fail closed on incomplete store index scans (#​1237 by @​jdx) — A malformed or unreadable cached package index could previously make store prune build an incomplete "referenced" hash set and delete live CAS files. Prune, --dry-run, and store status now abort with the new ERR_AUBE_STORE_INDEX_SCAN_FAILED (with path-specific diagnostics) instead of silently skipping. Discussion #​1234.
• Canonicalize isolated dependency build paths on Windows (#​1238 by @​jdx) — On Windows with GVS + isolated linking, native build tools such as node-gyp could resolve dependency files (e.g. node-addon-api/node_api.gyp) as missing because lifecycle scripts ran in the logical .aube/<dep> cwd while paths pointed at the hashed store. Lifecycle working directories are now canonicalized to the physical package path for install and rebuild. Addresses #​1235.
• Route deprecation warnings through embedder output (#​1236 by @​jdx) — Install-time deprecation warnings now flow through InstallControl as structured events (WARN_AUBE_DEPRECATED_PACKAGE / WARN_AUBE_DEPRECATED_PACKAGE_SUMMARY) instead of writing directly to stderr, so embedded hosts no longer race their own progress renderer (fixing corrupted terminal rows in mise on Windows). The aube deprecations hint now only shows for standalone aube, not an invalid host-branded command.
• Preserve workspace dependency patches through deploy (#​1213 by @​jdx) — aube deploy previously dropped workspace-root patchedDependencies, so dependencies were silently materialized without their patches. Deploy now filters patches to each importer's lockfile closure, stages them into a content-addressed metadata directory, and writes matching manifest entries so the target install applies and retains them. Fixes #​1212.
• Preserve workspace bins through nested shims (#​1207 by @​jdx) — Recursive aube exec now falls back to the workspace-root node_modules/.bin (matching pnpm's extraBinPaths), and activated pnpm/npm/yarn shims stay reachable after aube node resolves the real Node binary, so Node tools like Rspack can spawn their package manager.

Changed

• Correct the --global link registry docs (#​1205 by @​jdalton) — The -g/--global help for aube link / aube unlink now correctly documents the global link registry location as the XDG cache directory ($XDG_CACHE_HOME/aube/global-links, $HOME/.cache/aube/global-links, or %LOCALAPPDATA%\aube\global-links) rather than $AUBE_HOME/global-links.

New Contributors

• @​jdalton made their first contribution in #​1205

Full Changelog: jdx/aube@v1.37.0...v1.38.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.37.0: : Sharper release-age reporting and embedder PATH control

Compare Source

This release makes minimumReleaseAge visible in outdated/update reports instead of silently hiding upgrades, gives embedding hosts precise control over how runtime binaries sit on PATH, and fixes several rough edges in add, patch, licenses, and shim resolution.

Added

• Built-in pnpm trusted-dependency list for lifecycle scripts (#​1199 by @​jdx) — Built-in lifecycle-script approvals now come from a pinned, validated snapshot of pnpm's maintained trusted-dependencies list (e.g. esbuild, sharp), embedded at build time so installs stay offline and reproducible. Project and workspace allowBuilds settings are merged, and explicit denials always win over built-in or configured approvals.
• Leave PATH unchanged for embedder runtimes (#​1189 by @​jdx) — A new EmbedderRuntime::without_path() builder lets embedding hosts supply the Node program and npm exec path (NODE, npm_node_execpath) without deriving or prepending a PATH entry, so bare node commands resolve as inherited. path_dir(...) and without_path() follow last-call-wins builder semantics.

Fixed

• Surface upgrades hidden by minimumReleaseAge (#​1193, #​1192 by @​jdx) — aube outdated, aube update, and the interactive picker now apply the same release-age policy as install resolution, so they no longer offer versions that selecting wouldn't install. When newer releases are still quarantined, a single aggregated WARN_AUBE_MINIMUM_RELEASE_AGE_BLOCKED_UPDATE explains what's hidden and why (e.g. updates hidden by minimumReleaseAge: is-odd@3.0.1). aube up --latest now selects the newest mature version instead of admitting a quarantined dist-tag, aliased dependencies are handled correctly, and full timestamped packuments are fetched when abbreviated metadata lacks publish times. Fixes the behavior reported in #​1191.
• Trust exact popular package names in aube add (#​1198 by @​jdx) — The similar-name supply-chain gate now stops once a requested name exactly matches the top-100k popularity corpus, so aube add esbuild and aube add @types/node no longer require --allow-low-downloads just because lower-ranked lookalikes (msbuild, @types/code) exist. Typo detection for names not in the corpus is unchanged.
• Preserve existing patches and refresh their hashes (#​1196 by @​jdx) — patch-commit now reuses a dependency's existing patchedDependencies path and appends new hunks so the result still applies to pristine package contents, instead of orphaning the original patch behind a freshly generated file. Lockfile freshness checks now SHA-256 declared patch files against the hashes recorded in pnpm-lock.yaml, re-resolving on normal installs and failing frozen installs with ERR_AUBE_LOCKFILE_CONFIG_MISMATCH. Addresses discussions #​1195 and #​1197.
• Resolve licenses from hoisted installs (#​1183 by @​jdx) — aube licenses no longer assumes an isolated virtual store. It now prefers the recorded install layout, reconstructs hoisted placements from the lockfile graph, and reads each package.json from its on-disk hoisted path, fixing hoisted installs (including --node-linker=hoisted) where every dependency reported UNKNOWN. Fixes #​1182.
• Keep wrapper node first on PATH (#​1188 by @​jdx) — Wrapper embedder runtimes were being silently bypassed when a dependency or project exposed a node_modules/.bin/node, defeating host-supplied instrumentation, transpilation, or sandboxing. Wrapper shims are now prepended ahead of project-local bins, while selector runtimes keep the existing .bin-first precedence, with the same ordering applied across lifecycle scripts, run, and shell-mode exec/dlx. Addresses Discussion #​1083.
• Keep activated shims available in scripts (#​1187 by @​jdx) — After aube activate, package scripts run via aube run can again resolve pnpm, npm, and yarn through the activated shim directory, which was previously stripped by aube's own startup PATH sanitization. aube's process PATH stays sanitized so internal runtime probes don't recurse through shims. Fixes discussion #​1186.

Full Changelog: jdx/aube@v1.36.0...v1.37.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.36.0: : pnpm 11.18 parity and safer terminal output

Compare Source

This release brings aube in line with several pnpm 11.18 features — publishConfig.name and the pnpm:devPreinstall hook — while stabilizing recursive workspace updates, tightening outdated reporting, and hardening terminal output against Unicode spoofing.

Added

• publishConfig.name support (#​1176 by @​jdx) — Matching pnpm 11.18, a workspace package can now publish under a different registry name via publishConfig.name without renaming the project. The published name drives registry existence checks, the PUT URL, tarball filename, and embedded manifest, while the on-disk name stays the workspace/lockfile identity. Single-package publishes now run pre-publish hooks first, then re-resolve the target so hooks that change the name or version are honored.

  {
    "name": "my-workspace-pkg",
    "publishConfig": { "name": "@scope/published-name" }
  }

• pnpm:devPreinstall hook (#​1177 by @​jdx) — The root package's pnpm:devPreinstall script now runs once from the workspace/lockfile root before ordinary preinstall, letting a workspace prepare files that resolution or linking expects. It also runs on chained add/update installs, and is skipped on warm no-op installs, --ignore-scripts, --lockfile-only, and dry runs.

• Preserve existing package.json indentation (#​1171 by @​howmanysmall) — When aube rewrites manifests, tabs and nonstandard space widths now survive workspace edits, deploy rewrites, patch removal, and shared manifest writes. Read failures other than a missing file now abort the write, so an invalid UTF-8 package.json is never clobbered while aube detects its indentation.

Fixed

• Stabilize recursive workspace updates (#​1180 by @​jdx) — Recursive update no longer runs a full per-importer install that could wipe unrelated catalog entries from a shared lockfile. Catalog maps are now merged entry-by-entry, the chained install runs once at the workspace root after every importer is updated, interactive catalog decisions are remembered across importers so shared deps are prompted only once, and cancellation now stops the sweep instead of continuing. Closes #​1174.
• Exclude auto-installed peers from outdated (#​1178 by @​jdx) — outdated now only checks dependencies declared directly in each importer's package.json, so auto-installed peers (e.g. esbuild pulled in for vite) no longer show up as outdated. Applies to both single-project and recursive reports. Closes #​1173.

Security

• Strip Unicode formatting from terminal output (#​1181 by @​jdx) — Bidi overrides, isolates, and other Unicode formatting characters (the Cf set) plus control bytes are now stripped from registry- and manifest-derived text at display boundaries in list, outdated, interactive update, human-readable view, and install progress/warnings. This prevents untrusted metadata from visually reordering terminal output. Raw identifiers are preserved internally, and JSON/machine-readable output is unchanged.

New Contributors

• @​howmanysmall made their first contribution in #​1171

Full Changelog: jdx/aube@v1.35.0...v1.36.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.35.0: : Supply-chain name gates, relocatable virtual store, and richer embedding

Compare Source

This release hardens aube add against typosquats and freshly-registered hallucinated package names, lets you relocate the global virtual store without dragging every other tool's cache along, adds a trust check command for inspecting a version before installing, and expands the aube::embed surface so hosts like mise can own workspace discovery and confirmation prompts.

Highlights

• Supply-chain reputation gates on aube add — new packages are quarantined for 30 days and requested names are challenged against a top-100,000 npm corpus for close lookalikes, with interactive "did you mean?" prompts and fail-closed behavior in CI (#​1157).
• Move just the virtual store — a new globalVirtualStoreDir setting plus fixes to the long-broken cacheDir let you relocate the global virtual store onto a fast volume without moving all your metadata caches (#​1146).
• Deeper embedding for hosts — workspace discovery, manifest types, and confirmation prompts are now routed through the stable aube::embed facade so embedders can supply their own UI and repo-scoped boundaries (#​1154, #​1168, #​1169).

Added

• Block new and lookalike package names on add (#​1157 by @​jdx) — Two supply-chain reputation gates now run on public npmjs names, alongside the existing OSV and low-download checks. A minimumPackageAge setting (default 30 days) quarantines newly registered names by checking npm time.created, raising the cost of registering a plausible AI-hallucinated name right before use. A second gate compares the requested name against an embedded, download-ranked top-100,000 npm corpus using bounded Damerau–Levenshtein distance, with scope-aware rules (basenames compared within a scope, full names across scopes). Interactive sessions get "did you mean?" / new-name confirmations; non-interactive contexts fail closed with ERR_AUBE_SIMILAR_PACKAGE_NAME, ERR_AUBE_NEW_PACKAGE_NAME, or ERR_AUBE_PACKAGE_AGE_CHECK_FAILED. --allow-low-downloads now bypasses all three reputation gates and allowedUnpopularPackages exempts a name from the similar-name, age, and download checks.

  # disable the age quarantine for a run
  AUBE_MINIMUM_PACKAGE_AGE=0 aube add some-fresh-package

• aube trust check <package>@<version> (#​1144 by @​jdx) — Inspect a specific package version's publishing trust status without installing it, with human-readable and JSON reports. --ignore-default-excludes enforces the underlying no-downgrade policy directly. The built-in Hono exception is now scoped to @hono/node-server@1.19.15 (trusted publishing resumed in 1.19.17) so it no longer disables protection for future versions.

• Relocate the global virtual store independently (#​1146 by @​jdx) — A new globalVirtualStoreDir setting moves only the virtual store tree (the part that must sit on the storeDir volume for hardlinks), leaving packument/metadata caches where they are. It's available via env, .npmrc, and aube-workspace.yaml, and wins over cacheDir when both are set. aube doctor gained a global-virtual-store line, its store line now honors storeDir, and cross-volume fallbacks carry a WARN_AUBE_GVS_CROSS_VOLUME code.

  # move only the virtual store, keep metadata on the system disk
  export AUBE_GLOBAL_VIRTUAL_STORE_DIR=/Volumes/Fast/aube-virtual-store
  export AUBE_STORE_DIR=/Volumes/Fast/stores/aube

• Route embedded confirmations through host handlers (#​1154 by @​jdx) — Embedding hosts can attach a structured, async InstallPromptHandler so aube confirmations (such as low-download warnings) render through the host's own UI instead of reading process stdin. Prompt waits honor the existing install cancellation token, and a missing handler fails closed. Standalone aube keeps its interactive terminal prompts.

• Configurable workspace discovery for embedders (#​1169 by @​jdx) — aube::embed now exposes is_workspace_project_root and discover_workspace_packages, plus an opt-in ConfinedToRoot boundary that rejects parent-relative/absolute globs and out-of-root symlinks for repository-scoped hosts. Discovery now expands brace alternates (e.g. {apps,packages}/*) in positive and negative patterns and treats an on-disk workspace YAML as authoritative even when its package list is empty. The default remains pnpm-compatible, still allowing ../**.

• Expose package manifest types from aube::embed (#​1168 by @​jdx) — PackageJson, Workspaces, and ManifestError are re-exported from the stable embedding facade so hosts get aube's tolerant real-world manifest parsing without depending on aube-manifest directly or duplicating schemas.

Fixed

• Launch native package bins directly (#​1141 by @​benjaminwestern) — Package bins that point at compiled executables were being handed to Node through generated wrappers and failing. Non-shell aube exec, the local-bin fallback of aube run, and non-shell aube dlx now decode aube-generated POSIX/cmd wrappers, resolve the real target, and launch recognized native binaries (ELF, Mach-O, FAT/FAT64, validated PE, and Windows command suffixes) directly while preserving the wrapper environment, NODE_PATH, arguments, and Unix argv[0]. JavaScript and interpreter-backed bins are unchanged.
• Upgrade catalog-backed dependencies with update --latest (#​1166 by @​jdx) — Selecting a catalog: dependency in the interactive upgrade picker previously did nothing: resolution reused the unchanged catalog range and reported it as already latest. Catalog entries are now resolved through the registry latest tag and written back to the highest-precedence source (aube-workspace.yaml, pnpm-workspace.yaml, or package.json catalogs), preserving member catalog: references, range prefixes, and YAML comments. --no-save leaves on-disk ranges untouched while still refreshing lockfile resolutions.
• Preserve third-party caches during clean (#​1163 by @​jdx) — aube clean / purge no longer wipes the whole node_modules/ tree. It now removes only install-managed content (top-level packages plus aube/pnpm-owned hidden entries like .bin, .aube, .pnpm) and leaves unrecognized dotdirs such as Vite's .vite/ and .vite-temp/ in place, matching pnpm. Symlinked/junctioned module directories are still removed wholesale without walking the target.
• Keep foreign-platform optionals in portable lockfiles (#​1156 by @​jdx) — With supportedArchitectures configured, any command that re-resolved the graph could strip optional packages for other platforms out of pnpm-lock.yaml, aube-lock.yaml, bun.lock, or npm lockfiles, silently making a committed lockfile unusable elsewhere. Portable lockfiles now always resolve every platform variant, while fetch/link still honor the configured architectures so foreign packages stay out of node_modules.
• Accept --lockfile-only on aube list (#​1161 by @​jdx) — pnpm added list --lockfile-only in v10.23.0 and CI scripts use it, but clap rejected the flag before the command could run. It's now accepted (including the la/ll aliases) as a compatibility no-op, since list already reads exclusively from the canonical lockfile and needs no node_modules.
• Ignore unsupported allowBuilds .npmrc values (#​1159 by @​jdx) — allowBuilds was incorrectly advertised as an .npmrc source, so a user-level .npmrc allowlist appeared in config get/config list/config explain while install (which reads it only from workspace YAML and the manifest) safely ignored it. Config inspection now filters .npmrc rows to settings that actually declare that source; free-form unknown keys still round-trip.
• Trust locked packages without embedded prompts (#​1143 by @​jdx) — Packages already present in an active lockfile are now exempt from the low-download popularity gate, so re-adding or bumping a locked dependency doesn't re-trigger the prompt. OSV malicious-package checks stay active, and embedded add_to_project never reads aube's stdin for confirmation.

New Contributors

• @​benjaminwestern made their first contribution in #​1141

Full Changelog: jdx/aube@v1.34.0...v1.35.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

v1.34.0: : Smarter completions and resolver safety

Compare Source

This release rounds out shell completion — aubx now completes, and TAB now offers registry packages, project bins, workspace packages, settings, and more — teaches the resolver to never mistake a deprecated republish for an upgrade, and makes activated shims survive aube upgrades.

Added

• Rich, mise-style completions plus aubx support (#​1130 by @​jdx) — Completions are now generated for the aubx multicall surface alongside aube and aubr, and a set of dynamic completers fills in real values as you type: registry packages (queried against your configured npm registry with scoped-registry auth, a ~1.2s timeout, and a 2 MiB response cap), local dependencies, workspace packages, project bins from node_modules/.bin, settings/aliases, patch keys, and filesystem paths. Typed text is safely quoted before evaluation, and the aubx spec stops at the fetched command so downstream arguments aren't parsed as aube flags.
• effect= metadata for every command (#​1122 by @​jdx) — All 114 aube commands now declare whether they only inspect state (read), change it (write), or destroy something (destructive), via usage 4's effect=. Registry commands like publish, deprecate, dist-tag, and access are never read and carry blast-radius comments (they affect every consumer of a package), while code-running commands (run, exec, dlx, node, create, …) are deliberately left unclassified since their effect is whatever the executed code does. This lets tooling reason about what a command will do before running it. Requires a usage CLI of 4.0 or newer to consume the generated spec.

Fixed

• Never prefer a deprecated version inside a range (#​1136 by @​jdx) — A deprecated, mis-tagged republish that sorts above genuine releases (e.g. codemirror@6.65.7, an accidental republish of 5.65.7) could make aube outdated offer a downgrade-in-disguise as an upgrade and cause installs to land on the withdrawn version. Version selection now mirrors pnpm: dist-tags.latest wins when it's in range, otherwise the highest satisfying non-deprecated version, otherwise (as a tiebreak, not a filter) the highest satisfying version so ranges that only reach deprecated versions still resolve. The rule is shared across install/add/update, the vulnerable-version re-pick, and the Wanted column of outdated/update, keeping them in agreement.
• Keep activated shims stable across upgrades (#​1129 by @​jdx) — On Unix, aube activate previously symlinked each tool shim to the exact executable that created it, so removing a version-managed aube left every activated shim dangling. Activation now writes small dispatcher scripts that resolve the current aube from PATH and route through an internal marker, matching mise's stable-indirection model. Windows behavior is unchanged.
• Replace activated shims atomically (#​1131 by @​jdx) — Follow-up to #​1129: shim updates on Unix now build the replacement in a sibling temp file, apply 0755, and rename it over the live path, closing the window where a concurrent command could see a missing or half-written shim.
• Clear the progress row for no-op installs (#​1132 by @​jdx) — On a no-op install, the transient TTY progress bar left a durable row alongside Already up to date, producing two completion lines for one result. The progress row is now cleared for no-op installs, while real installs and --lockfile-only runs still keep the finished bar (or CI summary) visible.
• Complete package scripts through aubr (#​1128 by @​jdx) — aube completion now registers a dedicated aubr surface, so both aube run <TAB> and aubr <TAB> complete the scripts declared in the nearest package.json (with their commands as descriptions). Previously aubr <TAB> was treated as an unknown top-level invocation and offered nothing.

Changed

• Prioritize opencode-ai in the native-build critical path (#​1127 by @​jdx) — opencode-ai is added to the curated build-heavy allowlist so its tarball is fetched earlier and its build step can overlap with remaining package downloads.

Full Changelog: jdx/aube@v1.33.1...v1.34.0

💚 Sponsor aube

aube is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.