chore(deps): update dependency aube to latest

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aube	tools	minor	2.2.15 → v2.7.0

---

Release Notes

aubepkg/aube (aube)

v2.7.0: : Maintenance release

Compare Source

This release has no user-facing changes in its commit range.

Full Changelog: aubepkg/aube@d36fec0...v2.7.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.6.1: : Maintenance release

Compare Source

The commit range for this release has no user-facing changes.

Full Changelog: aubepkg/aube@bd94e42...v2.6.1

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.6.0: : Maintenance release

Compare Source

There are no user-facing changes in the commit range for this release.

Full Changelog: aubepkg/aube@f43833c...v2.6.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.5.1: : Faster repeated fresh installs and faster startup on Linux

Compare Source

Repeated fresh installs skip redundant OSV lookups, and the Linux release binaries start a little faster.

Changed

• Faster repeated fresh installs (#​1631 by @​jdx): When the OSV Bloom filter flags a package that turns out to have no malicious advisory, aube used to confirm it with a live OSV query on every install. That added about 220–250 ms each time. aube now caches a clean result for 30 seconds. A cached result is reused only when both the exact package/version pairs and the validated Bloom filter match. On a warmed Svelte fixture, installing with node_modules and aube-lock.yaml removed went from a 346 ms median to 107 ms.
  • Failed OSV queries, failed Bloom filter refreshes and confirmed malicious hits are never cached.
  • Explicit add/update/dlx checks, advisoryCheck = required and advisoryCheckEveryInstall = true still query OSV live every time.
  • Tradeoff: if a malicious-package advisory is published for a version that was just cleared, a repeated ordinary install may take up to 30 seconds to catch it.
• About 0.6 ms faster startup on Linux (#​1625 by @​jdx): The Linux GNU release binaries (x86_64 and aarch64) for aube, aubr and aubx are now linked as non-PIE. The loader no longer has to patch about 56k pointers at each launch, so aube --version drops from about 2.2 ms to 1.6 ms.
  • Tradeoff: ASLR no longer randomizes aube's own code and data. The heap, stack and shared libraries are still randomized.
  • musl, macOS and Windows builds are unchanged, as are cargo install, source builds and the PPA/COPR packages.

Full Changelog: aubepkg/aube@98be8d1...v2.5.1

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.5.0: : Choose range or latest per package in aube update --interactive

Compare Source

aube update --interactive now lets you pick, for each package, whether to keep the current version, move to the newest version its range allows, or jump to latest. Repeated frozen installs and fresh installs without a lockfile are also faster, and a reinstall that failed after you deleted the cache and lockfile now works.

Added

• Per-package version choice in aube update --interactive (#​1612 by @​jdx): The picker used to be one checkbox per dependency, with the target set by flags. It is now a table, like Yarn Berry's upgrade-interactive. Each row shows the current version, the newest version the range allows, and the registry's latest. Use ↑/↓ to move between rows and ←/→ to choose a version. Rows left on Current are skipped, and / filters by name. Closes #​1611.

  $ aube update -i
  Choose which dependencies to update
                Current     Range      Latest
   > chalk      [•] ^4.1.2             [ ] ^6.0.0
     is-number  [•] ^6.0.0             [ ] ^7.0.0
     ms         [ ] 2.0.0   [•] 2.1.3
     semver     [ ] 7.5.0   [•] 7.8.5
  ↑/↓/k/j up/down • ←/→/h/l choose • / filter • enter confirm
  

  • Rows start on Range, or on Latest with --latest. Pressing Enter right away does the same thing as the non-interactive command.
  • Updates keep the manifest's range operator. Exact pins are now listed: each one is offered the newest release its caret range would allow, and it stays an exact pin after the update. -E still forces exact pins.
  • --no-save hides Latest and pin bumps, because both would rewrite package.json.
  • Latest is offered only when it is newer than the installed version, so the picker never offers a downgrade.
  • With update -r -i, the version you choose for a shared catalog entry is used for later workspace packages without asking again.
  • Rows no longer show the dependency section (dependencies / devDependencies).

Changed

• Faster repeated frozen installs (#​1615 by @​jdx): Standalone projects can now reuse the installed state when nothing has changed. This applies to projects with registry dependencies and no declared patches, installed with an explicit --frozen-lockfile and lifecycle scripts disabled (for example aube install --frozen-lockfile --offline --ignore-scripts). On the benchmark fixture, a no-op install went from about 82 ms to about 7 ms. The freshness check hashes the lockfile and manifest contents, so a change is caught even when file size and modification time stay the same. A missing dependency link also counts as a change. Workspaces, patches, local sources, enabled scripts, custom lockfile locations and active per-install advisory policies still go through full validation.
• Faster advisory checks on fresh installs (#​1616 by @​jdx): A fresh install without a lockfile used to query OSV for every resolved public-npm package. Under the default advisoryCheck: on, graphs with more than 10 distinct package/version pairs are now screened with the advisory Bloom filter first, and only probable hits are checked against the live API. On the benchmark fixtures this cut fresh install time by 36–67%.
  • Full live checks are still used for smaller graphs, for explicit aube add / aube update, for transient aube dlx installs, and with advisoryCheck: required or advisoryCheckEveryInstall: true.
  • If the filter can't be refreshed or validated, every package is checked live.
  • The filter cache refreshes every 15 minutes, so a newly published advisory may take up to that long to be caught.

Fixed

• "missing package index" after deleting the cache and lockfile (#​1613 by @​jdx): A reinstall could fail with this error if you had deleted aube's cache/store and the root lockfile but kept node_modules. Now an existing package directory is reused only when its dependency subtree matches the previous install and the directory still exists. Anything else is looked up in the store again, or downloaded again, before linking.

Full Changelog: aubepkg/aube@d79acaa...v2.5.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.4.0: : Reuse node_modules/.aube-lock.yaml when the lockfile is missing

Compare Source

aube install can now rebuild a deleted lockfile from a hidden copy kept in node_modules, so it doesn't re-resolve from the registry. This release also makes cold installs on Linux faster and lighter on memory, and fixes lifecycle scripts on Windows and a workspace aube update that could drop members from the lockfile.

Added

• Hidden lockfile in node_modules (#​1594 by @​jdx): Every install now writes a copy of the resolved graph to node_modules/.aube-lock.yaml. If the project has no lockfile of any supported kind, aube install starts from that copy, as pnpm does with its current lockfile. If the manifests haven't changed, the graph is reused with no resolve. If they have changed, only the specs that changed are resolved again, and the other packages keep their locked versions. aube-lock.yaml is then written again.

  $ aube install      # writes aube-lock.yaml + node_modules/.aube-lock.yaml
  $ rm aube-lock.yaml
  $ aube install      # seeds from node_modules/.aube-lock.yaml, no registry resolve

  • --frozen-lockfile and aube ci still fail when there is no lockfile.
  • --no-frozen-lockfile ignores the hidden copy.
  • In auto-CI mode (CI=true with no explicit flags), an install that seeds from the hidden copy is treated as prefer-frozen.
  • If the hidden copy is broken, aube shows WARN_AUBE_HIDDEN_LOCKFILE_BROKEN and resolves normally.
  • The hidden copy is not used with lockfile=false, which also deletes any existing copy, or with sharedWorkspaceLockfile=false. It is also skipped for reuse installs from npm, yarn or bun lockfiles.

Changed

• Faster, lighter cold installs on Linux (#​1598, #​1603, #​1604, #​1605 by @​jdx):
  • On Linux, the blocking thread pool now defaults to 8 threads instead of 128. On the benchmark fixture this cut peak memory from about 1.5 GB to about 400 MB and reduced kernel CPU time. AUBE_TOKIO_BLOCKING still overrides the default, and macOS and Windows keep 128.
  • Small tarballs (up to 1 MiB) are downloaded in full before their store import begins, so an import no longer ties up a thread while it waits on the network. Memory for these buffered downloads is capped at 64 MiB in total.
  • Installs with the global virtual store no longer read back dependency links they just wrote.

Fixed

• Windows lifecycle scripts failing with EISDIR: illegal operation on a directory, lstat 'C:' (#​1591 by @​jdx): This affected scripts that start node through a .bin shim (for example node-gyp-build) during aube add, remove, update, dedupe and ci, and during installs from embedding hosts such as mise's npm: backend. The install root and the Node-API embedding's project directory no longer carry the \\?\ verbatim prefix. Fixes #​1590.
• aube update at a workspace root dropping workspace members from aube-lock.yaml (#​1579 by @​jdx): With a shared lockfile, running aube update or aube update -w at the root could delete every workspace member's entry in aube-lock.yaml. Member entries, their packages, patch hashes and catalog snapshots are now kept, and only the root's direct dependencies are updated. aube install also treats a workspace member that declares dependencies but has no entry in the lockfile as stale, so installing again repairs lockfiles already damaged by this bug.

Full Changelog: aubepkg/aube@v2.3.0...v2.4.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.3.0: : Host-bound Node launchers for embedders, plus hoisted .bin, lockfile patch-hash, and terminal-cleanup fixes

Compare Source

Embedding hosts such as mise can now bind installed Node CLIs to a specific Node executable, and a batch of fixes covers hoisted-install bin linking, aube-lock.yaml patch hashes, ignoreScripts resolution, signal delivery in dlx --shell-mode, and terminal state after failed or interrupted installs.

Added

• Bind installed CLIs to a host-managed Node runtime (#​1576 by @​jdx) — Installed Node CLIs previously found their interpreter through the caller's PATH, so a tool manager could not give an application its own runtime without also changing which Node its project subprocesses see. EmbedderRuntime::bind_bins_to generates launchers that invoke the supplied absolute Node executable directly while leaving the inherited PATH unchanged; it works with both embedded install and add:

  let mut options = aube::embed::InstallOptions::new("/tools/my-cli");
  options.runtime = Some(
      aube::embed::EmbedderRuntime::selector("/runtimes/node/25/bin")
          .bind_bins_to("/runtimes/node/25/bin/node"),
  );
  aube::embed::install(options).await?;

  The path is kept as written (symlinks are not canonicalized), so a moving major-version path like mise's installs/node/25/bin/node works; a missing runtime fails rather than falling back to ambient Node. Changing or removing the binding regenerates launchers on the next install, including frozen ones. Bound installs always materialize locally and disable the global virtual store so runtime-specific launchers stay out of shared trees. Simple Node shebang flags are preserved; quoted shebang arguments and environment assignments are rejected. Standalone aube's runtime selection is unchanged — this is the launcher support a host needs to implement its own policy (see jdx/mise#13477).

Fixed

• Hoisted installs link transitive dependency bins (#​1548 by @​jdx) — With --node-linker=hoisted, only importers' direct dependencies were linked into node_modules/.bin, so packages whose lifecycle scripts call a binary from their own dependencies failed with errors like sh: node-pre-gyp: command not found (bcrypt, prebuild-install, napi-postinstall; see discussion #​1543). Hoisted installs now follow npm's rule: each package's bins are linked into the .bin/ of the node_modules/ it sits in, and a dependency's lifecycle script sees its own nested .bin first so a version conflict no longer silently runs the hoisted winner. An importer's own bin and its direct dependencies always take precedence over transitive packages on a name collision. Isolated installs are unaffected.
• aube rebuild relinks the full bin surface (#​1550 by @​jdx) — rebuild only relinked per-dependency shims, so a command added or retargeted in package.json#bin after install stayed missing or stale until the next aube install. rebuild now uses the same bin-linking entry point as install (importer bins, workspace member bins, then dependency bins). If a workspace member manifest is unreadable, it warns and reconciles the root importer instead of aborting. aube rebuild --filter <member> is not covered by this change.
• ignoreScripts is honored from env, .npmrc, and aube-workspace.yaml (#​1552 by @​jdx, fixes #​1551) — Only the --ignore-scripts flag reached the installer; AUBE_IGNORE_SCRIPTS, npm_config_ignore_scripts, ignore-scripts=true in .npmrc, and ignoreScripts: true in the workspace yaml were parsed and then discarded, so aube config get ignore-scripts printed true while the next install ran scripts anyway. All sources now apply across install, ci, add, remove, update (including its pnpm:devPreinstall hook), dlx, deploy, and the auto-install aube run performs on a stale tree — which previously had no way to skip scripts at all. An explicit flag still wins over a lower-precedence false. pack, publish, and version keep their own --ignore-scripts flags.
• aube-lock.yaml keeps patch hashes on re-resolve (#​1577 by @​jdx) — In a project with patchedDependencies, running aube add dropped the (patch_hash=…) suffix from patched entries in aube-lock.yaml, producing a spurious lockfile diff on every add and a node_modules/.aube/ directory name that varied by how the lockfile was produced (reported in jdx/mise#13456). aube-lock.yaml now records patch identities the same way pnpm-lock.yaml does — a top-level patchedDependencies: map and (patch_hash=…) in entry names — consistently after install, add, and import, and a plain aube install now detects edited, added, or removed patches. Upgrade note: existing hashless aube-lock.yaml files still pass --frozen-lockfile unchanged; the next non-frozen install or add records the hashes as a one-time diff. Projects without patches are unaffected.
• Lifecycle scripts get a working npm_execpath when aube is embedded (#​1565 by @​jdx) — Embedded aube set npm_execpath to the host's binary, so a package running ${npm_execpath} run verify-build (e.g. install-artifact-from-github, used by re2) invoked the host's own CLI and failed, causing a needless source build or a failed install (jdx/mise#13451). Embedded aube now exports a shim that re-enters aube's CLI through the host via a private __aube-cli argv token (embed::CLI_TRAMPOLINE_ARG); hosts dispatch it the same way as the existing node-gyp trampoline, and docs/embedding/rust.md now documents both. If the shim cannot be written, npm_execpath is left unset rather than naming the host. AUBE_CLI_EXE is new in the lifecycle environment, and an inherited outer npm_execpath is now cleared before stamping. Standalone aube is unchanged.
• aube dlx --shell-mode delivers termination signals to the tool (#​1562 by @​jdx) — Signaling an aube dlx --shell-mode (or aubx -c) process stopped at the intermediate sh -c, leaving the tool running and aube hung waiting on it. A shell-mode line that is a single plain command now runs without a shell (using the same strict allowlist as aube run), so the tool is aube's direct child, receives the forwarded signal, and its exit code propagates. Pipelines, redirects, expansions, quoting, and shell builtins still run under sh with unchanged behavior, and the --shell-mode help text now describes this contract.
• Terminal state is restored when an install fails, is interrupted, or panics (#​1559, #​1560 by @​jdx) — A failing install (trust-policy rejection, unresolvable dependency, network error) exited without retiring the progress renderer, leaving the cursor hidden and the OSC 9;4 taskbar indicator lit in iTerm2, Ghostty, and VS Code (discussions #​1557 and #​1558). Every error path now restores both before the diagnostic prints, and while the progress bar is active aube also handles SIGINT/SIGTERM/SIGHUP/SIGQUIT and panics to restore the terminal before re-raising — Ctrl-C still exits 130. Signals already ignored or handled (e.g. under nohup, or by an embedding host) are left alone. Windows gets the panic restore but not the signal handling.

Full Changelog: aubepkg/aube@v2.2.17...v2.3.0

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.2.17: : Maintenance release

Compare Source

This release only refreshes Cargo.lock dependencies and contains no user-facing changes.

Full Changelog: aubepkg/aube@v2.2.16...v2.2.17

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.2.16: : aube add installs local tarballs by their manifest name

Compare Source

aube add ./package.tgz now records the package under the name declared in the tarball's package.json, and local file: / link: / portal: dependencies now install their optionalDependencies.

Fixed

• Local tarballs are added by manifest name, not filename (#​1532 by @​jdx) — Downloaded npm artifacts are commonly named package.tgz, and aube add previously derived the dependency key from that filename, producing a bogus "package": "file:./package.tgz" entry alongside any existing dependency on the real package. For an unaliased local tarball or directory, aube add now reads package.json#name and uses it as the key, so the add replaces an existing dependency on the same package instead of adding a second one. Explicit aliases (aube add alias@file:./package.tgz) remain authoritative, and a local package whose manifest has no name is now rejected with an error. This fixes Bun checksum installs through mise (jdx/mise#13125), which download the verified artifact as package.tgz.
• Local packages install their optionalDependencies (#​1532 by @​jdx) — file:, link:, and portal: directory and tarball dependencies previously only resolved dependencies, so optional platform packages declared by a local package (such as Bun's per-platform binaries) were silently dropped. They are now resolved and linked under the local package, honoring ignoredOptionalDependencies and blockExoticSubdeps, and skipping any optional dependency already listed under dependencies so it is not installed twice.

Full Changelog: aubepkg/aube@v2.2.15...v2.2.16

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.