chore(deps): update dependency aube to v1.9.1 (#478)

This PR contains the following updates:

| Package | Update | Change | Pending |
|---|---|---|---|
| [aube](https://redirect.github.com/endevco/aube) | minor | `v1.6.2` →
`v1.9.1` | `v1.14.1` (+10) |

---

### Release Notes

<details>
<summary>endevco/aube (aube)</summary>

###
[`v1.9.1`](https://redirect.github.com/endevco/aube/releases/tag/v1.9.1):
: Cold install overhaul, HTTP prefetch, and workspace fixes

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.9.0...v1.9.1)

A performance- and correctness-focused patch release. Cold installs get
a streaming tarball pipeline, Linux gets an `O_TMPFILE`+`linkat` CAS
fast path, and the resolver's cold path overlaps DNS, TLS, and packument
prefetch with the manifest/workspace/lockfile work that used to
serialize them. On the fix side, `aube run` once again finds `node-gyp`
for package scripts, and `aube update` / `aube outdated` stop trying to
fetch unpublished `workspace:` deps from the registry.

#### Added

- **Pre-resolver packument prefetch + shared HTTP utilities**
([#&#8203;529](https://redirect.github.com/endevco/aube/pull/529) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) — a new
`aube-util::http` module consolidates client-side primitives (`prewarm`,
`priority`, `race`, `resolve`, `ticket_cache`) so leaf crates share one
warm-pool surface with consistent killswitch semantics. On install
entry, aube now reads `package.json` and fires fire-and-forget packument
GETs for every registry-shaped direct dep before workspace yaml load,
settings resolve, lockfile parse, and resolver construction — by the
time the resolver pops its first task, the packument cache and reqwest
pool are warm. `RegistryClient::prewarm_connection` now covers the
default registry **plus** every scoped (`@org:registry=...`) and per-uri
auth registry, with parallel DNS preresolve so DNS RTT hides behind the
TLS handshake. Abbreviated packument GETs also send `Priority: u=0` (RFC
9218 Critical) so H2 schedulers prioritize resolver-blocking metadata
over pending tarball frames. New killswitches:
`AUBE_DISABLE_DNS_PRERESOLVE`, `AUBE_DISABLE_REQUEST_RACING`,
`AUBE_DISABLE_PREFETCH`, `AUBE_DISABLE_TLS_TICKET_CACHE`. Prefetch is a
no-op when offline or when any lockfile is present.

- **Cold install pipeline overhaul**
([#&#8203;522](https://redirect.github.com/endevco/aube/pull/522) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
several overlapping wins on the cold-cache path:

- **Streaming tarball pipeline** (opt-in via `AUBE_TARBALL_STREAM=1`,
killswitch `AUBE_DISABLE_TARBALL_STREAM`) — HTTP body chunks pipe
through SHA-512 + gz + tar + CAS via an mpsc bridge instead of buffering
the whole tarball; non-SHA-512 SRI falls back to buffered. Bounded by
the registry's `tarball_max_bytes` cap.
- **Linux `O_TMPFILE` + `linkat` CAS publish** with `EOPNOTSUPP`
fallback to the tempfile path, `posix_fallocate` to avoid ext4
fragmentation, and `posix_fadvise(DONTNEED)` to free page cache after
publish. Killswitch: `AUBE_DISABLE_O_TMPFILE`.
- **Materialize-stream into the lockfile fast path** — both lockfile and
no-lockfile branches now share the GVS prewarm materializer, hiding
30-200ms of GVS reflinks behind the in-flight download tail.
- **Resolver tuning** — foldhash on `graph_hash` hot maps, pre-sized
resolver caches, thread-local `node_semver::Version` parse cache,
`PARALLEL_IMPORT_THRESHOLD` lowered from 256 to 16 (median npm tarball
is 7 files), and pinned tokio `worker_threads` (`cpu.min(8)`) /
`max_blocking_threads(64)` (tunable via `AUBE_TOKIO_WORKERS` /
`AUBE_TOKIO_BLOCKING`).
- **Windows** gets `FILE_ATTRIBUTE_NOT_CONTENT_INDEXED` on the store
root; cross-volume detection (drive letters on Windows, `dev` id on
Unix) is gated per-platform.

Reported same-volume Windows cold-install ratios: 1.80x-8.75x faster
than Bun across svelte/vite/next/babylon.

- **Per-project materialize pipelined into fetch**
([#&#8203;527](https://redirect.github.com/endevco/aube/pull/527) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) — when
GVS is off, each fetched `(canonical_key, PackageIndex)` triggers
`materialize_into` against `.aube/<dep_path>/` immediately, so by the
time fetch finishes the dedicated link phase only has to create
top-level `node_modules/<name>` symlinks. The driver now uses `JoinSet`
instead of `Vec<JoinHandle>`, so on early-return all in-flight tasks
abort instead of detaching and racing install cleanup. \~10% improvement
on warm fresh installs in the local benchmark matrix.

#### Fixed

- **`aube run` / `aube test` find `node-gyp`**
([#&#8203;518](https://redirect.github.com/endevco/aube/pull/518) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — package scripts only
had `node_modules/.bin` prepended to `PATH`, so `aube test` would fail
with `node-gyp: not found` on hosts that didn't already ship it. Script
execution now reuses aube's existing node-gyp bootstrap (via a lazy shim
bin dir + `AUBE_NODE_GYP_EXE` / `AUBE_NODE_GYP_PROJECT_DIR`), matching
pnpm/npm behavior. Ports pnpm's `lifecycleScripts.ts:128` coverage into
the offline node-gyp bootstrap bats suite.

- **`workspace:` deps in `aube update` / `aube outdated`**
([#&#8203;523](https://redirect.github.com/endevco/aube/pull/523) by
[@&#8203;jdx](https://redirect.github.com/jdx), fixes
[#&#8203;520](https://redirect.github.com/endevco/aube/discussions/520))
— `aube update` now discovers workspace package `name`/`version` pairs
and passes them into resolver workspace resolution so `workspace:` deps
from `package.json#workspaces` resolve locally instead of triggering
registry packument fetches. `aube outdated` filters out direct deps with
`workspace:` specifiers and reports "no matching dependencies" rather
than attempting a packument fetch. Adds a new
`WARN_AUBE_WORKSPACE_PACKAGE_MISSING_NAME` warning code for workspace
packages without a `name` field.

- **Resolver peer-context divergence is fatal**
([#&#8203;522](https://redirect.github.com/endevco/aube/pull/522) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
`apply_peer_contexts` hitting `MAX_ITERATIONS` used to log a warning and
ship a broken graph; it now returns a fatal
`Error::PeerContextDivergence(usize)`. `state::remove_state` errors at
`--force` and GVS-transition sites also propagate instead of being
silently swallowed, so permission-denied or Windows-locked sidecars no
longer defeat the freshness check.

- **Tarball hardening**
([#&#8203;522](https://redirect.github.com/endevco/aube/pull/522) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
entries declared as 0 bytes with non-zero stream payload are now
rejected (synthetic-entry injection guard), and GNU `LongName` /
`LongLink` metadata records are correctly accepted.

- **Patches loaded once per cwd**
([#&#8203;529](https://redirect.github.com/endevco/aube/pull/529) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
`load_patches_for_linker` walked `patches/` from disk 2-3 times per
install (lockfile-prewarm, no-lockfile-prewarm, and link-phase sites).
Now cached per cwd via `OnceLock<Mutex<HashMap<PathBuf, ...>>>`.

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.9.0...v1.9.1>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

###
[`v1.9.0`](https://redirect.github.com/endevco/aube/releases/tag/v1.9.0):
: Comment-preserving workspace edits, deploy bundling, and node
--inspect

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.8.0...v1.9.0)

A focused release: `aube deploy` learns to bundle workspace siblings and
local-path deps into the deploy artifact, workspace-yaml writers stop
eating user comments, aube-owned settings move out of `.npmrc`, and
`aube run` forwards Node debugger flags.

#### Added

- **Aube settings move out of `.npmrc`**
([#&#8203;517](https://redirect.github.com/endevco/aube/pull/517) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — known aube-owned
settings now live in `~/.config/aube/config.toml` (XDG-aware), while
registry, auth, and unknown keys keep using `.npmrc`. `aube config
get/set/list/delete` reads and writes the right file automatically, and
migrating a known setting cleans up the stale `.npmrc` entry. `.npmrc`
writes are also atomic against the **symlink target** now, so dotfile
setups that symlink `~/.npmrc` into a managed config repo stop having
the symlink replaced by a regular file.

- **`aube run --inspect` / `--inspect-brk`**
([#&#8203;515](https://redirect.github.com/endevco/aube/pull/515) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — both flags accept an
optional `[host:]port` (e.g. `--inspect=9229`,
`--inspect-brk=0.0.0.0:9230`) and are forwarded as explicit Node argv
when aube can identify a Node-backed target — direct `node ...` scripts
in `package.json` and local `node_modules/.bin` fallbacks resolved
through shims/symlinks. The flags are passed as argv rather than via
`NODE_OPTIONS`, so the debugger doesn't attach to nested Node processes
spawned by the script.

- **`aube deploy --no-prod`**
([#&#8203;507](https://redirect.github.com/endevco/aube/pull/507) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — opt out of the default
`--prod` filter for deploys that need devDependencies at runtime
(test-harness staging, build-step artifacts). Mutually exclusive with
`--prod` / `--dev`; combine with `--no-optional` to keep prod + dev but
drop optionals.

- **Comment-preserving workspace yaml writes**
([#&#8203;511](https://redirect.github.com/endevco/aube/pull/511) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — every workspace-yaml
writer (`approve-builds`, `patch-commit`, `patch-remove`, the daily
`cleanupUnusedCatalogs` install pass, and `aube config set --location
workspace`) now routes through `yamlpatch` instead of round-tripping the
file through a serializer. Keys, comments, and whitespace the edit
didn't touch land back on disk byte-identical, so user annotations on
adjacent entries survive. Empty/missing files still go through the
regular serializer since there are no comments to preserve.

#### Fixed

- **`aube deploy` bundles local dependencies**
([#&#8203;507](https://redirect.github.com/endevco/aube/pull/507) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fixes two real bugs
reported in
[#&#8203;345](https://redirect.github.com/endevco/aube/discussions/345):

- **`workspace:*` siblings tried to fetch from the registry.** Deploy
used to rewrite `workspace:*` to a concrete version and ask install to
resolve it — fine for published siblings, broken for the (very common)
unpublished case. Reachable workspace siblings are now copied into
`<target>/.aube-deploy-injected/<id>/` and the manifest spec becomes a
relative `file:` pointer. Recursion handles sibling chains where a
sibling's own deps are workspace siblings.
- **`file:` deps resolved relative to the deploy output dir.** A
`file:../local-vendor` spec used to ride along unchanged in the deployed
manifest, pointing at `<target>/../local-vendor` instead of the source
workspace's `local-vendor`. Local-path deps now go through the same
staging pipeline.

When bundling occurs the lockfile-subset path is skipped, since the
rewritten `file:` pointers don't appear in the source lockfile and would
otherwise trip a frozen install.

- **`aube remove` preserves dependency order**
([#&#8203;511](https://redirect.github.com/endevco/aube/pull/511) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — dropping one dep used
to alphabetize the remaining entries in the affected `package.json`
section as a side effect. Surviving entries now stay in their original
on-disk order, matching pnpm/npm. (`aube add` is unaffected — sorted
inserts there are intentional.)

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.8.0...v1.9.0>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

###
[`v1.8.0`](https://redirect.github.com/endevco/aube/releases/tag/v1.8.0):
: Stable error codes, smarter run/dlx, and a new install progress UI

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.7.0...v1.8.0)

A polish-and-plumbing release: install progress gets a from-scratch
redesign, errors and warnings now carry stable identifiers (with bespoke
exit codes and dep-chain context), `aube run` / `aube dlx` prefer
locally-installed binaries, and a handful of workspace-from-subpackage
and `aube add` ergonomics get fixed.

#### Added

- **Redesigned install progress UI**
([#&#8203;501](https://redirect.github.com/endevco/aube/pull/501) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fixed 15-char bar on
the left, stats on the right, phase-aware label (`resolving` /
`fetching` / `linking`), ETA, transfer rate, and an estimated install
size derived from the resolve stream:

  ```
  aube 1.8.0 by en.dev
  █████░░░░░░░░░░ 23/142 pkgs · 4.2 MB / ~13.8 MB · 1.4 MB/s · ETA 5s
  ███████████████ 1230/1230 pkgs · linking
  ✓ resolved 1230 · reused 98 · downloaded 1132 (54.6 MB) in 6.8s
  ```

Installs that finish before the first 2s heartbeat now print a single
self-identifying summary line (`✓ installed 5 packages in 423ms`)
instead of a partial bar. Also fixes two real bookkeeping bugs (a `2/1
packages` overflow on platform-mismatched non-optional deps, and the
"stuck at 90%" undercount caused by `filter_graph` dropping packages
after the denominator was inflated).

- **Local bins for `aube run` and `aube dlx`**
([#&#8203;502](https://redirect.github.com/endevco/aube/pull/502) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `aube run <name>`
falls back to `node_modules/.bin/<name>` when no `package.json` script
matches, and `aube dlx` / `aubx` will execute an already-installed local
binary instead of doing a throwaway install. Pass `-p` / `--package` (or
a versioned spec) to force the install path.

- **Stable error and warning codes**
([#&#8203;492](https://redirect.github.com/endevco/aube/pull/492) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — every error and
warning aube emits now carries an `ERR_AUBE_*` or `WARN_AUBE_*`
identifier in a structured field, so CI scripts and ndjson consumers can
branch on the code instead of substring-matching English messages. A
curated subset maps to bespoke Unix exit codes (10–99 in 10-wide ranges
by category) so shells can react to specific failures without parsing
stderr — e.g. `aube install --frozen-lockfile` in an empty dir exits
with `10` (`ERR_AUBE_NO_LOCKFILE`). Post-resolver errors that mention a
specific package now also include the dependency chain back to the
importer (`chain: a@1 > b@2 > leaf@3`) so a tarball-integrity or fetch
failure tells you *why* your install pulled that transitive dep. The
full code list lives at `docs/error-codes.md`.

#### Fixed

- **`aube why` / `list` / `query` from a workspace subpackage**
([#&#8203;504](https://redirect.github.com/endevco/aube/pull/504) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — these commands
resolved cwd via the nearest `package.json`, so running them inside
`packages/foo/` errored with `No lockfile found. Run aube install
first.` even though the workspace lockfile sat one level up. They now
walk up to the workspace root when one is present.

- **Workspace lifecycle scripts and pnpm-lock npm aliases**
([#&#8203;500](https://redirect.github.com/endevco/aube/pull/500) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — recursive workspace
installs now run `preinstall`/`install`/`postinstall`/`prepare` for each
linked workspace importer in dependency order (not just the root), and
the build-script policy merges `pnpm.allowBuilds` /
`onlyBuiltDependencies` / `neverBuiltDependencies` across all
participating manifests so a member can approve its own dep's builds.
`pnpm-lock.yaml` now writes npm aliases in pnpm's native
`<real>@&#8203;<version>` encoding instead of leaking aube's internal
`aliasOf` field.

- **`aube add` auto-detects local paths**
([#&#8203;499](https://redirect.github.com/endevco/aube/pull/499) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `aube add
/path/to/lib`, `./lib`, `~/lib`, `file:./lib`, and `link:./lib` no
longer fall through to the registry path with a confusing `HTTP 405
Method Not Allowed`. Bare paths default to `link:` for directories and
`file:` for tarballs (pnpm parity); explicit prefixes are preserved.
Tarball-suffix paths emit a clear "not yet supported in `aube add`" hint
instead of a 405.

#### Changed

- **Per-command `--help` is bucketed**
([#&#8203;505](https://redirect.github.com/endevco/aube/pull/505) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `--frozen-lockfile` /
`--prefer-frozen-lockfile`, `--registry` + `--fetch-*`, and
`--disable/--enable-global-virtual-store` moved off the global flag set
into per-command groups under `Lockfile` / `Network` / `Virtual store`
headings, and now appear only on commands that consume them. Seven
pnpm-compat no-op flags (`--workspace-packages`, `--ignore-workspace`,
`--include-workspace-root`, `--aggregate-output`, `--stream`,
`--use-stderr`, `--yes`) are still parsed but hidden from `--help`.
Pre-subcommand placement still works (`aube --frozen-lockfile install`,
`aube --registry=URL install`) via an argv pre-pass.

One caveat: implicit-script invocations like `aube --frozen-lockfile
dev` (where `dev` is a `package.json` script) no longer apply the flag —
write `aube run --frozen-lockfile dev` instead.

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.7.0...v1.8.0>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

###
[`v1.7.0`](https://redirect.github.com/endevco/aube/releases/tag/v1.7.0):
: Local & git specs in aube add, faster cold installs

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.6.2...v1.7.0)

A feature-heavy release: `aube add` learns git and local-path specs,
workspace commands gain support for yaml-only "coordinator" monorepos,
`aube update` and `aube rebuild` get pnpm-parity polish, and a deep
performance pass speeds up cold installs by up to \~1.9×.

#### Highlights

- **`aube add` is now a one-stop shop** for git, GitHub-shorthand, and
`link:` / `file:` local-path dependencies — not just registry packages.
- **Performance pass on the install hot path**
([#&#8203;469](https://redirect.github.com/endevco/aube/pull/469)) lands
streaming SHA-512, parallel CAS imports, TLS prewarm, fetch reordering,
and a long tail of cold-path cleanups, with measured cold-install
speedups up to \~1.9× vs v1.6.2.
- **Workspace and pnpm parity polish** across `update`, `rebuild`,
yaml-only roots, unversioned members, and nested `link:` / `file:`
resolution.

#### Added

- **`aube add file:./pkg` / `link:../sibling`**
([#&#8203;487](https://redirect.github.com/endevco/aube/pull/487) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — local-path specs are
routed through a non-registry branch, with the manifest key derived from
the path basename (with `.tgz` / `.tar.gz` stripped) or from an explicit
alias. `aube add my-bundle@file:./bundle.tgz` works too.

- **`aube add` supports git specs**
([#&#8203;483](https://redirect.github.com/endevco/aube/pull/483) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — bare GitHub shorthand,
`github:` / `gitlab:` / `bitbucket:` prefixes, full `git+ssh` /
`git+https` URLs, and aliases. The verbatim spec is written to
`package.json` and the resolver handles the rest:

  ```bash
  aube add kevva/is-negative
  aube add github:kevva/is-positive
  aube add my-alias@git+https://github.com/kevva/is-negative.git
  ```

- **Yaml-only workspace roots**
([#&#8203;486](https://redirect.github.com/endevco/aube/pull/486) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `install`, `list`,
`run -r`, `query`, and `why` now work in pure-coordinator monorepos that
have `pnpm-workspace.yaml` / `aube-workspace.yaml` at the root but no
root `package.json` (Turborepo-style layouts). Single-project commands
like `add` / `remove` still hard-error without a manifest.

- **`aube update <pkg>` rewrites manifest ranges by default**
([#&#8203;479](https://redirect.github.com/endevco/aube/pull/479) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — caret/tilde ranges
(`^1.2.0`, `~1.2.0`) are rewritten to track the resolved in-range max,
matching pnpm. Other shapes (`>=`, exact pins, dist-tags, git,
`workspace:`) stay frozen. Set `update-rewrites-specifier=false` to keep
the previous behavior.

- **`aube rebuild <pkg>...`**
([#&#8203;477](https://redirect.github.com/endevco/aube/pull/477) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — runs lifecycle scripts
only for the named deps, bypasses the `allowBuilds` /
`onlyBuiltDependencies` policy, and skips root hooks. Composes with
`--filter`. Bare `aube rebuild` continues to do a full policy-respecting
rebuild.

- **Persistent unreviewed-builds warning**
([#&#8203;476](https://redirect.github.com/endevco/aube/pull/476) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — repeat warm-path
installs no longer swallow the "ignored build scripts for N package(s)"
nudge; the spec keys are persisted in `.aube-state` and re-emitted on
every install.

- **`aube update --depth` no longer silently ignored**
([#&#8203;473](https://redirect.github.com/endevco/aube/pull/473) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — emits a one-line
warning pointing at `rm aube-lock.yaml && aube install` for the only
useful semantic case.

#### Fixed

- **Faster cold installs**
([#&#8203;469](https://redirect.github.com/endevco/aube/pull/469) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) — a wide
hot-path pass with measurable wins on real registries:

  | Project           |    v1.6.2 |  v1.7.0 | Speedup |
  | ----------------- | --------: | ------: | ------: |
  | svelte (56 pkg)   |   1393 ms | 1386 ms |   1.01× |
  | vue (117 pkg)     |   1590 ms | 1360 ms |   1.17× |
  | next.js (336 pkg) |  14071 ms | 9160 ms |   1.54× |
  | babylon (21 pkg)  | \~6000 ms | 3186 ms |  \~1.9× |

Highlights: streaming SHA-512 over the wire (no second buffered hash
pass), two-phase parallel CAS tar import, speculative TLS/HTTP/2 prewarm
behind manifest parse, native-build packages floated to the front of the
fetch queue, `Accept-Encoding: gzip, br, zstd` on packuments, in-process
DNS cache via `hickory-dns`, mmap+rayon BLAKE3 over 4 MiB, network
concurrency default raised 64 → 128, and zero-copy packument parsing.
Every change ships with an `AUBE_DISABLE_*` killswitch
(`AUBE_DISABLE_STREAMING_SHA512`, `AUBE_DISABLE_SPECULATIVE_TLS`,
`AUBE_DISABLE_CRITICAL_PATH`, `AUBE_DISABLE_PARALLEL_IMPORT`,
`AUBE_DISABLE_MMAP_BLAKE3`, `AUBE_DISABLE_SNAPSHOTS`) plus an
`AUBE_CONCURRENCY=N` clamp.
- **Nested `link:` / `file:` resolution**
([#&#8203;470](https://redirect.github.com/endevco/aube/pull/470) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fixes the `transitive
local specifier link:./libs/foo cannot be resolved without the parent
package source root` install error in two cases: a `file:` / `link:`
parent declaring a transitive `link:`, and a root `pnpm.overrides`
rewriting a registry dep to a local path. Override paths now anchor at
the project root like pnpm does.
- **Workspace members without `version`**
([#&#8203;480](https://redirect.github.com/endevco/aube/pull/480) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fall back to `0.0.0`
instead of hard-erroring. `workspace:*` / `^` / `~` siblings still link
locally; specific ranges like `workspace:^2.0.0` still correctly fail to
satisfy. Unblocks repos like
[tuist/tuist#10584](https://redirect.github.com/tuist/tuist/pull/10584).
- **Bare `user/repo` parsed as GitHub shorthand**
([#&#8203;472](https://redirect.github.com/endevco/aube/pull/472) by
[@&#8203;jdx](https://redirect.github.com/jdx)) in lockfile/spec
parsing, with `update --latest` now skipping git-spec deps so they can't
be silently rewritten into registry pins.
- **CLI short help wraps cleanly**
([#&#8203;478](https://redirect.github.com/endevco/aube/pull/478) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — many flags across
`add`, `install`, `publish`, `update`, `view`, etc. had multi-line doc
comments that clap merged into 120+ char paragraphs for `-h`. Now each
flag has a one-line summary followed by the longer prose, restoring
readable short help on standard terminals.

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.6.2...v1.7.0>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/Chicago)

- Branch creation
  - Only on Friday (`* * * * 5`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/jdx/mise-action).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzkuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE3OS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

mise.toml

@@ -8,7 +8,7 @@ tasks.release-plz = "./scripts/release-plz.sh"
 
 [tools]
 node = '24'
-aube = 'v1.6.2'
+aube = 'v1.9.1'
 git-cliff = 'latest'
 gh = 'latest'
 communique = 'latest'