chore(deps): update dependency aube to v1.14.1#489
Merged
Conversation
|
PR author is in the excluded authors list. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.9.1→v1.14.1v1.15.0Release Notes
endevco/aube (aube)
v1.14.1: : Install module splitCompare Source
A maintenance release with no user-facing behavior changes. The install command's growing
commands/install/mod.rswas split into focused submodules to keep the install pipeline easier to navigate. Install behavior, flags, and output are unchanged from v1.14.0.Changed
commands/install/fetch.rsmodule (#704 by @jdx).materialize.rs,critical_path.rs, andworkspace.rsmodules (#702 by @jdx).--lockfile-dirimporter remapping, human install summary output,.aubecache invalidation/orphan cleanup, and skipped-build warning replay — intolockfile_dir.rs,summary.rs,sweep.rs, andunreviewed_builds.rs(#698 by @jdx).Full Changelog: endevco/aube@v1.14.0...v1.14.1
💚 Sponsor aube
aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
v1.14.0: : Bloom-filtered OSV checks and lifecycle-script content sniffingCompare Source
Two new opt-in supply-chain layers on top of the v1.13 gates: a ~380 KB bloom-filter prefilter that lets plain reinstalls cheaply probe the OSV
MAL-*set without pulling the 200 MB mirror, and a regex-based content sniff that flags dangerous shapes in dependencypreinstall/install/postinstallscripts before you click throughaube approve-builds.Added
(install) OSV bloom-filter prefilter for lockfile installs (#680 by @jdx) — New
advisoryBloomChecksetting (on/required/off, defaultoff) adds a fourth route to the post-resolve OSV decision table. Plain reinstalls probe the resolved transitive graph against a ~380 KB bloom filter fetched fromendevco/osv-bloom— regenerated upstream every 10 minutes from OSV'sMAL-*archive — and only escalate bloom hits to the live/querybatchAPI for exact(name, version)confirmation. Bloom FPR is ~0.1%, so a typical 1000-package lockfile triggers zero or one extra live-API round trip per install. When both are configured, the bloom branch wins over the 200 MBall.zipmirror — under 1 MB on the wire, same live-API oracle, sameERR_AUBE_MALICIOUS_PACKAGEon a confirmed hit. Cached under$XDG_CACHE_HOME/aube/osv-bloom/and short-circuits the download when upstream'sset_digest_sha256is unchanged. New warningWARN_AUBE_OSV_BLOOM_REFRESH_FAILED: underoninstall continues against the previously cached filter; underrequiredit fails closed withERR_AUBE_ADVISORY_CHECK_FAILED.(install) Content-sniff dependency lifecycle scripts before approve-builds (#685 by @jdx) — aube's existing supply-chain gates (OSV
MAL-*, downloads floor, bun-compat scanner,BuildPolicyallowlist) are all name-based; none inspects whatpostinstallactually does, which leaves an OSV-ingest-lag window of 12–48h that the 2024–2026 wave of unobfuscatedcurl … | shpostinstalls walked right through. New regex matcher fires advisory warnings for known-dangerous shapes in lifecycle script bodies:ShellPipecurl … | sh,wget … | bash,… | nodeEvalDecodeeval(atob(…)),Function(atob(…)),eval(Buffer.from(…))CredentialFileRead~/.ssh,~/.aws,~/.npmrc,~/.config/ghreadsSecretEnvReadprocess.env.*(TOKEN|SECRET|API_KEY|PASSWORD|ACCESS_KEY|PRIVATE_KEY|AUTH)ExfilEndpointoast.pro,interactsh,webhook.site,pipedream.net,ngrok.io, …)BareIpHttpSniff is advisory —
allowBuildsstill gates execution — and shows up in three places: end-of-install emits oneWARN_AUBE_SUSPICIOUS_LIFECYCLE_SCRIPTper flagged package alongside the existingWARN_AUBE_IGNORED_BUILD_SCRIPTS;aube approve-buildsannotates picker rows with⚠ suspicious: <category>and prints a pre-picker summary of the matched hook+description;aube ignored-buildsindents⚠ <hook> — <description>lines under eachname@version. Findings are re-derived per install rather than persisted, so the regex set can evolve without a state-file migration. Works offline, doesn't degrade to advisory in headless CI.Changed
benchmarks/results.jsonagainst v1.13.1 and Bun 1.3.14 (#687) — public ratios update to warm installs 3× Bun / 6× pnpm, repeat test 6× Bun / 45× pnpm.Full Changelog: endevco/aube@v1.13.1...v1.14.0
💚 Sponsor aube
aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
v1.13.1: : Version-aware transitive MAL-* gateCompare Source
A targeted fix for the transitive supply-chain gate added in v1.13.0: the post-resolve OSV check is now version-aware, so name-level
MAL-*advisories stop blocking installs that resolve to clean versions of the same package.Fixed
MAL-*check (#682 by @jdx) — The post-resolve gate was reusing the pre-resolve name-only OSV query, so any name-level advisory hit every install that transitively pulled in any version of that package. Concretely,aube add cowsay@1.6.0refused withERR_AUBE_MALICIOUS_PACKAGEbecause cowsay's tree includesansi-regex@3.0.1, andansi-regexcarries the Sep 2025 shai-hulud advisoryMAL-2025-46966against6.2.1— a version published years after3.0.1. The live-API and OSV-mirror lookups now send(name, version)pairs, refusal messages surfacename@version (MAL-…), and the local mirror index bumps toformat = 2(storing per-advisory affected versions; v1 indexes rebuild on next refresh, and advisories with no enumerated versions still fail closed). The pre-resolveaube addname-gate keeps its versionless query — typosquats are malicious in every version.Full Changelog: endevco/aube@v1.13.0...v1.13.1
💚 Sponsor aube
aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
v1.13.0: : Supply-chain gates foraube addCompare Source
Added
securityScannerpackage that follows the Bun Security Scanner API (oven-sh template,@socketsecurity/bun-security-scanner, etc.) and aube runs it post-resolve against the full graph via anodebridge (#657)aube add: OSVMAL-*advisory hard-block plus a weekly-downloads floor with TTY prompt /--allow-low-downloadsbypass. NewadvisoryCheckandlowDownloadThresholdsettings, both folded intoparanoid: true(#656)(name, version)picks; opt-inadvisoryCheckOnInstallcovers plain reinstalls,advisoryCheckEveryInstallforces live API every time (#678)registry.npmjs.orgregistry, plus a newallowedUnpopularPackagesglob allowlist to silence the downloads gate on known-internal names (#673)Changed
package.json/ workspace yaml to seedallowBuilds: { <pkg>: "set this to true or false" }placeholders for unreviewed build scripts (#662)--allow-build=<pkg>now flips an existing deny instead of erroring, help renders correctly as--allow-build=<PKG>, and the no-op--ignore-scriptsis hidden onadd/import/update(#660)Fixed
aube add --global … --allow-build=<dep>no longer emit a duplicated install-root path segment when.aube/<dep>/sits behind a directory junction (#659)aube remove --globalon Windows no longer fails withAccess is denied (os error 5)on the hash pointer when it's an NTFS directory junction (#658)💚 Sponsor aube
aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
v1.12.0: : Tidier config, smarter installs from bun.lockCompare Source
A round of fixes driven by user reports —
bun.lockimports now keep peer-only packages, the store layout is reorganized so one cache mount covers everything, andaube config setstops scribbling unknown keys into.npmrc.Added
aube config set/deleterouting (#634 by @jdx) — Writes only land in.npmrcfor the npm-shared surface (per-host auth/cert templates, scoped registries, and a curated allowlist of npm-standard scalars likeregistry,proxy,fetch-retries, …). Aube-only and pnpm-only keys (autoInstallPeers,dangerouslyAllowAllBuilds,pnpmfilePath, …) plus unknown free-form keys now go to~/.config/aube/config.toml. Dotted writes for aube map settings —aube config set --local allowBuilds.@​mongodb-js/zstd true,aube config set --local overrides.lodash 4.17.21— edit a single entry ofpnpm-workspace.yaml(orpackage.json#<pnpm|aube>.<map>) in place.aube config deletesweeps both files so legacy writes from older versions are still cleaned up. New error codeERR_AUBE_CONFIG_NESTED_AUBE_KEYcovers invalid nested writes.donephase onfinish()/stop()so the last frame matches the✓summary line. The displayed~XX MBtotal is now a dynamic blend of the staticunpackedSize × 0.20fallback and a linear extrapolation from observed bytes-per-package — converging to the real total instead of overshooting by ~48%.resolvingswitched yellow → cyan, thepkgscounter is bold/uncolored mid-install, andWARN_AUBE_SLOW_METADATAdrops redundant fields.Fixed
bun.lockno longer silently dropped (#639 by @jdx) —filter_graph's GC walk ran beforehoist_auto_installed_peers, so peer-installed deps like@mui/materialthat weren't directly listed in workspacedependencies:got pruned as unreachable before the hoist could promote them. The pipeline now hoists first, then walks. On the linked repro,aube installgoes from 6 packages (with broken@mui/material/@emotion/*) to 44 with everything resolved.bun.lockimports now run the peer-context pass (#619 by @jdx) —LockfileKind::Bunwas missing from theapply_peer_contextsbranch, so peer-dependent packages landed at.aube/<pkg>@​<ver>/without sibling peer links and walked up to whatever hoisted copy they found. Now they get peer-qualifieddep_paths(e.g.@cloudflare+vite-plugin@1.17.1_vite@8.0.10_…) with correct sibling symlinks, matching the npm-lockfile import behavior.$XDG_CACHE_HOME/aube/index/into the store at<store>/v1/index/, next tov1/files/. The install fast path swappedload_indexforload_index_verified, so an index whose CAS shards have drifted out from under it is dropped at fetch classification and the tarball re-fetched cleanly — instead of the materializer dying mid-link withERR_AUBE_MISSING_STORE_FILE. Fixes a BuildKit cache-mount footgun where only one of the two cache dirs would be persisted.engines.pnpmno longer triggers spurious version warnings (#633 by @jdx) — A project pinningengines.pnpm: ">=10.11.1"producedwarn: wanted pnpm >=10.11.1, got 1.xon every install (or a hard failure underengine-strict). Aube and pnpm live in different version namespaces, so honoring this field was net-negative.engines.pnpmis now skipped entirely;engines.aubeis still honored for projects that want to gate on the running tool, andengines.nodeis unchanged.update -ino longer reports phantom upgrade rows for catalog deps (#636 by @jdx) — When acatalog:dep resolved to a newer version while the same name was pulled in transitively at an older one (e.g.jose@6.2.3direct +jose@5.10.0via@upstash/qstash),lookup_pkg's name-scan picked the transitive snapshot as "current" and offered a downgrade row the rewrite path then ignored. Lookup now goes through the importer'sDirectDep.dep_path. The companion fix extends the--latestprerelease guard to the locked version, so"^1.0.0-rc.1"isn't silently rewritten to whatever the registry'slatestdist-tag points at.update/add/dedupe/remove/auditpreserve cross-platform optionals andtime:entries (#637 by @jdx) — These commands now route through install'sconfigure_resolver, inheriting the full settings pipeline (supportedArchitectures,resolutionMode,minimumReleaseAge, overrides, …). They opt out of the full-packument disk cache so an immediately-following re-resolve picks up registrydist-tagchanges, and the resolver carries forward the prior lockfile'stime:entry when a fresh corgi packument lacks publish time for a resolved version — so direct deps don't lose theirtime:line on update.aube add --global --allow-build=<pkg>actually pre-approves builds (#620 by @jdx) — The synthetic innerAddArgswas being built withallow_build: Vec::new(), silently dropping the outer flag and erroring with "must be reviewed before install" understrictDepBuilds=true. The flag is now plumbed throughrun_global/run_global_innerand approvals are written to the throwaway install dir'spackage.json#aube.allowBuildsbefore lifecycle scripts run.Changed
aube store pathnow returns thev1/directory (#635) — One level above the previousv1/files/output, so a single Docker BuildKit cache mount or backup captures both the CAS and the new co-located index dir. Scripts consumingaube store pathwill now mount one level higher (the intended behavior). A lazy in-place migration from the legacy$XDG_CACHE_HOME/aube/index/location runs on the first store open after upgrade (rename fast path, recursive-copy fallback for cross-FS).💚 Sponsor aube
aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
v1.11.0: : Workspace-root flags, scoped config, and a 2× macOS CAS fast pathCompare Source
Added
-w/--workspace-rootto retarget cwd at the workspace root from a sub-package (#614)<cwd>/.config/aube/config.tomlsupport (#608)--offlineand--prefer-offline, forwarded into the deploy install (#606)Fixed
NODE_PATHat the hidden modules dir, and the isolated linker defaultspreferSymlinkedExecutablesto shims soextendNodePathactually works (#613)dependencies/devDependencies,outdated -rincludes the workspace root, semver-diff color inWanted/Latest, smarterupdate -ipicker, andupdateConfig.ignoreDependenciesis loaded from the workspace root (#610)reusedon a downwardset_totalrebase so summaries stop reportingreused > resolved(#609)~/.config/aube/config.tomlon write (#605)💚 Sponsor aube
aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
v1.10.4: : Streaming tarball retries + 32-bit Linux build fixCompare Source
Two targeted fixes: cold installs now retry transient registry failures on the streaming tarball path, and
aube-storebuilds cleanly on 32-bit Linux again.Fixed
start_tarball_stream(the default install hot path for sha512-pinned lockfile entries) used to skip retry entirely to avoid unwinding partial CAS writes mid-stream. That reasoning is sound for mid-stream errors, but it also leaked into pre-response failures: a 503, 429, connection refused, or connection reset before any chunk had flowed would propagate straight back to the caller with no recovery, while the buffered path retried the same failures up tofetchRetriestimes. The initialsend().awaitnow retries onis_retriable_status(5xx + 429, honoringRetry-After) and on transport errors (bounded byTIMEOUT_RETRY_CAP), emitting the existingWARN_AUBE_HTTP_RETRY_TRANSIENT/_TRANSPORTlogs. Once headers passerror_for_statusand chunks start flowing, behavior is unchanged. Caught on a macOS PGO dry-run where Verdaccio / the throttle-proxy hiccupped and the install bailed without a single retry log line.aube-storebuilds on 32-bit Linux (#587 by @jdx) — Theposix_fallocatewrapper hard-codedlen: i64, which matcheslibc::off_ton every 64-bit target but breaks armhf, where the default (non-LFS)off_t = i32. The wrapper now takeslibc::off_tdirectly and the single call site castsbytes.len() as libc::off_t, unblocking Launchpad's Ubuntu Resolute armhf build of aube and any downstreamarmv7-unknown-linux-gnueabihfconsumer.💚 Sponsor aube
aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
v1.10.3Compare Source
Fixed
aarch64-unknown-linux-gnuPGO matrix row and bump macOS arm64 PGO tomacos-arm64-largeto work around the v1.10.1 instrumented-binary segfault (#582)npm:@​yarnpkg/cli-dist@latest— theyarnnpm package only publishes 1.x and 2.x (#583)--frozen-lockfileto vlt install scenarios so vlt is measured on the same path as every other tool in the matrix (#581)Binaries
This release ships without prebuilt archives. Install via
cargo install aube,mise use aube, ornpm i -g aube.💚 Sponsor aube
aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
v1.10.2Compare Source
Changed
linux-amd64-large(32 GB) to fix OOM during the instrumented link step (#577)Binaries
This release has a partial archive set. For a complete set of prebuilts, use a later release — or install via
cargo install aube,mise use aube, ornpm i -g aube.💚 Sponsor aube
aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
v1.10.1Compare Source
Added
Fixed
aube deployresolvescatalog:references and accepts packages without an explicitversionfield (#574)npm publishskips already-published versions so re-running the publish workflow is idempotent (#565)Changed
crossfor the glibc baseline; macOS arm64 builds natively (#572)Performance
simd-jsonforsonic-rson the packument hot path (#569)fsyncfrom packument cache writes (#568)Binaries
This release has a partial archive set. For a complete set of prebuilts, use a later release — or install via
cargo install aube,mise use aube, ornpm i -g aube.💚 Sponsor aube
aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
v1.10.0: : Recursive runs grow up, install gets a diagnostics microscopeCompare Source
Added
--sort/--no-sort,--reverse,--resume-from,--workspace-concurrency,--reporter-hide-prefix) and add a per-package output multiplexer for parallel runs (#545)aube diag analyze/aube diag comparesubcommands behind a new--diag <summary|trace|live|full>flag (#547)--lockfile-onlyflag to refreshaube-lock.yamlwithout touchingnode_modules(#560)linkWorkspacePackagesandsaveWorkspaceProtocolsettings plus--save-workspace-protocol/--no-save-workspace-protocolflags (#539)Fixed
removeskips projects that don't declare the dep, and parent-relative../**globs inpnpm-workspace.yamlare honored (#564)--workspace-rootandincludeWorkspaceRoot: true(#556)sharedWorkspaceLockfile=trueinstead of leaving per-packageaube-lock.yamlfiles behind (#558)--interactiverenders a multiselect picker, fails fast on non-TTY, and--latestpreservescatalog:/catalog:<name>specifiers (#552)readPackagehook returns a non-object (#562)package.jsonhas noversion(#549)pnpm.allowBuildsapprovals into the nested install used for git-depprepare(#546)verifyDepsBeforeRunchecks whennpm_lifecycle_eventis set, fixing both theerror-mode hard-fail and theinstall-mode lock deadlock from nestedaube runinside lifecycle scripts (#538)aube approve-buildsrequires at least one selection and the TTY guard checks both stdin and stderr (#537)Changed
aube_util::adaptivelimiter (slow-start, AIMD, CUSUM-gated shrink) wired at every previously magic-numbered concurrency site, with a separate http1-only reqwest client for tarball downloads (#548)💚 Sponsor aube
aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.
Configuration
📅 Schedule: (in timezone America/Chicago)
* * * * 5)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.