No description
Find a file
renovate[bot] 43db152e9b
Some checks are pending
Check dist/ / Check dist/ (push) Waiting to run
Continuous Integration / TypeScript Tests (push) Waiting to run
CodeQL / Analyze (push) Waiting to run
release-plz / release-plz (push) Waiting to run
Test Redacted Environment Variables / test-redacted-env (push) Waiting to run
build-test / build (push) Waiting to run
build-test / alpine (push) Waiting to run
build-test / macos (push) Waiting to run
build-test / ubuntu (push) Waiting to run
build-test / windows (push) Waiting to run
build-test / specific_version (push) Waiting to run
build-test / checksum_failure (push) Waiting to run
build-test / custom_cache_key (push) Waiting to run
build-test / fetch_from_github (push) Waiting to run
build-test / final (push) Blocked by required conditions
chore(deps): update dependency aube to v1.9.1 (#478)
This PR contains the following updates:

| Package | Update | Change | Pending |
|---|---|---|---|
| [aube](https://redirect.github.com/endevco/aube) | minor | `v1.6.2` →
`v1.9.1` | `v1.14.1` (+10) |

---

### Release Notes

<details>
<summary>endevco/aube (aube)</summary>

###
[`v1.9.1`](https://redirect.github.com/endevco/aube/releases/tag/v1.9.1):
: Cold install overhaul, HTTP prefetch, and workspace fixes

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.9.0...v1.9.1)

A performance- and correctness-focused patch release. Cold installs get
a streaming tarball pipeline, Linux gets an `O_TMPFILE`+`linkat` CAS
fast path, and the resolver's cold path overlaps DNS, TLS, and packument
prefetch with the manifest/workspace/lockfile work that used to
serialize them. On the fix side, `aube run` once again finds `node-gyp`
for package scripts, and `aube update` / `aube outdated` stop trying to
fetch unpublished `workspace:` deps from the registry.

#### Added

- **Pre-resolver packument prefetch + shared HTTP utilities**
([#&#8203;529](https://redirect.github.com/endevco/aube/pull/529) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) — a new
`aube-util::http` module consolidates client-side primitives (`prewarm`,
`priority`, `race`, `resolve`, `ticket_cache`) so leaf crates share one
warm-pool surface with consistent killswitch semantics. On install
entry, aube now reads `package.json` and fires fire-and-forget packument
GETs for every registry-shaped direct dep before workspace yaml load,
settings resolve, lockfile parse, and resolver construction — by the
time the resolver pops its first task, the packument cache and reqwest
pool are warm. `RegistryClient::prewarm_connection` now covers the
default registry **plus** every scoped (`@org:registry=...`) and per-uri
auth registry, with parallel DNS preresolve so DNS RTT hides behind the
TLS handshake. Abbreviated packument GETs also send `Priority: u=0` (RFC
9218 Critical) so H2 schedulers prioritize resolver-blocking metadata
over pending tarball frames. New killswitches:
`AUBE_DISABLE_DNS_PRERESOLVE`, `AUBE_DISABLE_REQUEST_RACING`,
`AUBE_DISABLE_PREFETCH`, `AUBE_DISABLE_TLS_TICKET_CACHE`. Prefetch is a
no-op when offline or when any lockfile is present.

- **Cold install pipeline overhaul**
([#&#8203;522](https://redirect.github.com/endevco/aube/pull/522) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
several overlapping wins on the cold-cache path:

- **Streaming tarball pipeline** (opt-in via `AUBE_TARBALL_STREAM=1`,
killswitch `AUBE_DISABLE_TARBALL_STREAM`) — HTTP body chunks pipe
through SHA-512 + gz + tar + CAS via an mpsc bridge instead of buffering
the whole tarball; non-SHA-512 SRI falls back to buffered. Bounded by
the registry's `tarball_max_bytes` cap.
- **Linux `O_TMPFILE` + `linkat` CAS publish** with `EOPNOTSUPP`
fallback to the tempfile path, `posix_fallocate` to avoid ext4
fragmentation, and `posix_fadvise(DONTNEED)` to free page cache after
publish. Killswitch: `AUBE_DISABLE_O_TMPFILE`.
- **Materialize-stream into the lockfile fast path** — both lockfile and
no-lockfile branches now share the GVS prewarm materializer, hiding
30-200ms of GVS reflinks behind the in-flight download tail.
- **Resolver tuning** — foldhash on `graph_hash` hot maps, pre-sized
resolver caches, thread-local `node_semver::Version` parse cache,
`PARALLEL_IMPORT_THRESHOLD` lowered from 256 to 16 (median npm tarball
is 7 files), and pinned tokio `worker_threads` (`cpu.min(8)`) /
`max_blocking_threads(64)` (tunable via `AUBE_TOKIO_WORKERS` /
`AUBE_TOKIO_BLOCKING`).
- **Windows** gets `FILE_ATTRIBUTE_NOT_CONTENT_INDEXED` on the store
root; cross-volume detection (drive letters on Windows, `dev` id on
Unix) is gated per-platform.

Reported same-volume Windows cold-install ratios: 1.80x-8.75x faster
than Bun across svelte/vite/next/babylon.

- **Per-project materialize pipelined into fetch**
([#&#8203;527](https://redirect.github.com/endevco/aube/pull/527) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) — when
GVS is off, each fetched `(canonical_key, PackageIndex)` triggers
`materialize_into` against `.aube/<dep_path>/` immediately, so by the
time fetch finishes the dedicated link phase only has to create
top-level `node_modules/<name>` symlinks. The driver now uses `JoinSet`
instead of `Vec<JoinHandle>`, so on early-return all in-flight tasks
abort instead of detaching and racing install cleanup. \~10% improvement
on warm fresh installs in the local benchmark matrix.

#### Fixed

- **`aube run` / `aube test` find `node-gyp`**
([#&#8203;518](https://redirect.github.com/endevco/aube/pull/518) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — package scripts only
had `node_modules/.bin` prepended to `PATH`, so `aube test` would fail
with `node-gyp: not found` on hosts that didn't already ship it. Script
execution now reuses aube's existing node-gyp bootstrap (via a lazy shim
bin dir + `AUBE_NODE_GYP_EXE` / `AUBE_NODE_GYP_PROJECT_DIR`), matching
pnpm/npm behavior. Ports pnpm's `lifecycleScripts.ts:128` coverage into
the offline node-gyp bootstrap bats suite.

- **`workspace:` deps in `aube update` / `aube outdated`**
([#&#8203;523](https://redirect.github.com/endevco/aube/pull/523) by
[@&#8203;jdx](https://redirect.github.com/jdx), fixes
[#&#8203;520](https://redirect.github.com/endevco/aube/discussions/520))
— `aube update` now discovers workspace package `name`/`version` pairs
and passes them into resolver workspace resolution so `workspace:` deps
from `package.json#workspaces` resolve locally instead of triggering
registry packument fetches. `aube outdated` filters out direct deps with
`workspace:` specifiers and reports "no matching dependencies" rather
than attempting a packument fetch. Adds a new
`WARN_AUBE_WORKSPACE_PACKAGE_MISSING_NAME` warning code for workspace
packages without a `name` field.

- **Resolver peer-context divergence is fatal**
([#&#8203;522](https://redirect.github.com/endevco/aube/pull/522) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
`apply_peer_contexts` hitting `MAX_ITERATIONS` used to log a warning and
ship a broken graph; it now returns a fatal
`Error::PeerContextDivergence(usize)`. `state::remove_state` errors at
`--force` and GVS-transition sites also propagate instead of being
silently swallowed, so permission-denied or Windows-locked sidecars no
longer defeat the freshness check.

- **Tarball hardening**
([#&#8203;522](https://redirect.github.com/endevco/aube/pull/522) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
entries declared as 0 bytes with non-zero stream payload are now
rejected (synthetic-entry injection guard), and GNU `LongName` /
`LongLink` metadata records are correctly accepted.

- **Patches loaded once per cwd**
([#&#8203;529](https://redirect.github.com/endevco/aube/pull/529) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) —
`load_patches_for_linker` walked `patches/` from disk 2-3 times per
install (lockfile-prewarm, no-lockfile-prewarm, and link-phase sites).
Now cached per cwd via `OnceLock<Mutex<HashMap<PathBuf, ...>>>`.

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.9.0...v1.9.1>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

###
[`v1.9.0`](https://redirect.github.com/endevco/aube/releases/tag/v1.9.0):
: Comment-preserving workspace edits, deploy bundling, and node
--inspect

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.8.0...v1.9.0)

A focused release: `aube deploy` learns to bundle workspace siblings and
local-path deps into the deploy artifact, workspace-yaml writers stop
eating user comments, aube-owned settings move out of `.npmrc`, and
`aube run` forwards Node debugger flags.

#### Added

- **Aube settings move out of `.npmrc`**
([#&#8203;517](https://redirect.github.com/endevco/aube/pull/517) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — known aube-owned
settings now live in `~/.config/aube/config.toml` (XDG-aware), while
registry, auth, and unknown keys keep using `.npmrc`. `aube config
get/set/list/delete` reads and writes the right file automatically, and
migrating a known setting cleans up the stale `.npmrc` entry. `.npmrc`
writes are also atomic against the **symlink target** now, so dotfile
setups that symlink `~/.npmrc` into a managed config repo stop having
the symlink replaced by a regular file.

- **`aube run --inspect` / `--inspect-brk`**
([#&#8203;515](https://redirect.github.com/endevco/aube/pull/515) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — both flags accept an
optional `[host:]port` (e.g. `--inspect=9229`,
`--inspect-brk=0.0.0.0:9230`) and are forwarded as explicit Node argv
when aube can identify a Node-backed target — direct `node ...` scripts
in `package.json` and local `node_modules/.bin` fallbacks resolved
through shims/symlinks. The flags are passed as argv rather than via
`NODE_OPTIONS`, so the debugger doesn't attach to nested Node processes
spawned by the script.

- **`aube deploy --no-prod`**
([#&#8203;507](https://redirect.github.com/endevco/aube/pull/507) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — opt out of the default
`--prod` filter for deploys that need devDependencies at runtime
(test-harness staging, build-step artifacts). Mutually exclusive with
`--prod` / `--dev`; combine with `--no-optional` to keep prod + dev but
drop optionals.

- **Comment-preserving workspace yaml writes**
([#&#8203;511](https://redirect.github.com/endevco/aube/pull/511) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — every workspace-yaml
writer (`approve-builds`, `patch-commit`, `patch-remove`, the daily
`cleanupUnusedCatalogs` install pass, and `aube config set --location
workspace`) now routes through `yamlpatch` instead of round-tripping the
file through a serializer. Keys, comments, and whitespace the edit
didn't touch land back on disk byte-identical, so user annotations on
adjacent entries survive. Empty/missing files still go through the
regular serializer since there are no comments to preserve.

#### Fixed

- **`aube deploy` bundles local dependencies**
([#&#8203;507](https://redirect.github.com/endevco/aube/pull/507) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fixes two real bugs
reported in
[#&#8203;345](https://redirect.github.com/endevco/aube/discussions/345):

- **`workspace:*` siblings tried to fetch from the registry.** Deploy
used to rewrite `workspace:*` to a concrete version and ask install to
resolve it — fine for published siblings, broken for the (very common)
unpublished case. Reachable workspace siblings are now copied into
`<target>/.aube-deploy-injected/<id>/` and the manifest spec becomes a
relative `file:` pointer. Recursion handles sibling chains where a
sibling's own deps are workspace siblings.
- **`file:` deps resolved relative to the deploy output dir.** A
`file:../local-vendor` spec used to ride along unchanged in the deployed
manifest, pointing at `<target>/../local-vendor` instead of the source
workspace's `local-vendor`. Local-path deps now go through the same
staging pipeline.

When bundling occurs the lockfile-subset path is skipped, since the
rewritten `file:` pointers don't appear in the source lockfile and would
otherwise trip a frozen install.

- **`aube remove` preserves dependency order**
([#&#8203;511](https://redirect.github.com/endevco/aube/pull/511) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — dropping one dep used
to alphabetize the remaining entries in the affected `package.json`
section as a side effect. Surviving entries now stay in their original
on-disk order, matching pnpm/npm. (`aube add` is unaffected — sorted
inserts there are intentional.)

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.8.0...v1.9.0>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

###
[`v1.8.0`](https://redirect.github.com/endevco/aube/releases/tag/v1.8.0):
: Stable error codes, smarter run/dlx, and a new install progress UI

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.7.0...v1.8.0)

A polish-and-plumbing release: install progress gets a from-scratch
redesign, errors and warnings now carry stable identifiers (with bespoke
exit codes and dep-chain context), `aube run` / `aube dlx` prefer
locally-installed binaries, and a handful of workspace-from-subpackage
and `aube add` ergonomics get fixed.

#### Added

- **Redesigned install progress UI**
([#&#8203;501](https://redirect.github.com/endevco/aube/pull/501) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fixed 15-char bar on
the left, stats on the right, phase-aware label (`resolving` /
`fetching` / `linking`), ETA, transfer rate, and an estimated install
size derived from the resolve stream:

  ```
  aube 1.8.0 by en.dev
  █████░░░░░░░░░░ 23/142 pkgs · 4.2 MB / ~13.8 MB · 1.4 MB/s · ETA 5s
  ███████████████ 1230/1230 pkgs · linking
  ✓ resolved 1230 · reused 98 · downloaded 1132 (54.6 MB) in 6.8s
  ```

Installs that finish before the first 2s heartbeat now print a single
self-identifying summary line (`✓ installed 5 packages in 423ms`)
instead of a partial bar. Also fixes two real bookkeeping bugs (a `2/1
packages` overflow on platform-mismatched non-optional deps, and the
"stuck at 90%" undercount caused by `filter_graph` dropping packages
after the denominator was inflated).

- **Local bins for `aube run` and `aube dlx`**
([#&#8203;502](https://redirect.github.com/endevco/aube/pull/502) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `aube run <name>`
falls back to `node_modules/.bin/<name>` when no `package.json` script
matches, and `aube dlx` / `aubx` will execute an already-installed local
binary instead of doing a throwaway install. Pass `-p` / `--package` (or
a versioned spec) to force the install path.

- **Stable error and warning codes**
([#&#8203;492](https://redirect.github.com/endevco/aube/pull/492) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — every error and
warning aube emits now carries an `ERR_AUBE_*` or `WARN_AUBE_*`
identifier in a structured field, so CI scripts and ndjson consumers can
branch on the code instead of substring-matching English messages. A
curated subset maps to bespoke Unix exit codes (10–99 in 10-wide ranges
by category) so shells can react to specific failures without parsing
stderr — e.g. `aube install --frozen-lockfile` in an empty dir exits
with `10` (`ERR_AUBE_NO_LOCKFILE`). Post-resolver errors that mention a
specific package now also include the dependency chain back to the
importer (`chain: a@1 > b@2 > leaf@3`) so a tarball-integrity or fetch
failure tells you *why* your install pulled that transitive dep. The
full code list lives at `docs/error-codes.md`.

#### Fixed

- **`aube why` / `list` / `query` from a workspace subpackage**
([#&#8203;504](https://redirect.github.com/endevco/aube/pull/504) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — these commands
resolved cwd via the nearest `package.json`, so running them inside
`packages/foo/` errored with `No lockfile found. Run aube install
first.` even though the workspace lockfile sat one level up. They now
walk up to the workspace root when one is present.

- **Workspace lifecycle scripts and pnpm-lock npm aliases**
([#&#8203;500](https://redirect.github.com/endevco/aube/pull/500) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — recursive workspace
installs now run `preinstall`/`install`/`postinstall`/`prepare` for each
linked workspace importer in dependency order (not just the root), and
the build-script policy merges `pnpm.allowBuilds` /
`onlyBuiltDependencies` / `neverBuiltDependencies` across all
participating manifests so a member can approve its own dep's builds.
`pnpm-lock.yaml` now writes npm aliases in pnpm's native
`<real>@&#8203;<version>` encoding instead of leaking aube's internal
`aliasOf` field.

- **`aube add` auto-detects local paths**
([#&#8203;499](https://redirect.github.com/endevco/aube/pull/499) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `aube add
/path/to/lib`, `./lib`, `~/lib`, `file:./lib`, and `link:./lib` no
longer fall through to the registry path with a confusing `HTTP 405
Method Not Allowed`. Bare paths default to `link:` for directories and
`file:` for tarballs (pnpm parity); explicit prefixes are preserved.
Tarball-suffix paths emit a clear "not yet supported in `aube add`" hint
instead of a 405.

#### Changed

- **Per-command `--help` is bucketed**
([#&#8203;505](https://redirect.github.com/endevco/aube/pull/505) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `--frozen-lockfile` /
`--prefer-frozen-lockfile`, `--registry` + `--fetch-*`, and
`--disable/--enable-global-virtual-store` moved off the global flag set
into per-command groups under `Lockfile` / `Network` / `Virtual store`
headings, and now appear only on commands that consume them. Seven
pnpm-compat no-op flags (`--workspace-packages`, `--ignore-workspace`,
`--include-workspace-root`, `--aggregate-output`, `--stream`,
`--use-stderr`, `--yes`) are still parsed but hidden from `--help`.
Pre-subcommand placement still works (`aube --frozen-lockfile install`,
`aube --registry=URL install`) via an argv pre-pass.

One caveat: implicit-script invocations like `aube --frozen-lockfile
dev` (where `dev` is a `package.json` script) no longer apply the flag —
write `aube run --frozen-lockfile dev` instead.

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.7.0...v1.8.0>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

###
[`v1.7.0`](https://redirect.github.com/endevco/aube/releases/tag/v1.7.0):
: Local & git specs in aube add, faster cold installs

[Compare
Source](https://redirect.github.com/endevco/aube/compare/v1.6.2...v1.7.0)

A feature-heavy release: `aube add` learns git and local-path specs,
workspace commands gain support for yaml-only "coordinator" monorepos,
`aube update` and `aube rebuild` get pnpm-parity polish, and a deep
performance pass speeds up cold installs by up to \~1.9×.

#### Highlights

- **`aube add` is now a one-stop shop** for git, GitHub-shorthand, and
`link:` / `file:` local-path dependencies — not just registry packages.
- **Performance pass on the install hot path**
([#&#8203;469](https://redirect.github.com/endevco/aube/pull/469)) lands
streaming SHA-512, parallel CAS imports, TLS prewarm, fetch reordering,
and a long tail of cold-path cleanups, with measured cold-install
speedups up to \~1.9× vs v1.6.2.
- **Workspace and pnpm parity polish** across `update`, `rebuild`,
yaml-only roots, unversioned members, and nested `link:` / `file:`
resolution.

#### Added

- **`aube add file:./pkg` / `link:../sibling`**
([#&#8203;487](https://redirect.github.com/endevco/aube/pull/487) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — local-path specs are
routed through a non-registry branch, with the manifest key derived from
the path basename (with `.tgz` / `.tar.gz` stripped) or from an explicit
alias. `aube add my-bundle@file:./bundle.tgz` works too.

- **`aube add` supports git specs**
([#&#8203;483](https://redirect.github.com/endevco/aube/pull/483) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — bare GitHub shorthand,
`github:` / `gitlab:` / `bitbucket:` prefixes, full `git+ssh` /
`git+https` URLs, and aliases. The verbatim spec is written to
`package.json` and the resolver handles the rest:

  ```bash
  aube add kevva/is-negative
  aube add github:kevva/is-positive
  aube add my-alias@git+https://github.com/kevva/is-negative.git
  ```

- **Yaml-only workspace roots**
([#&#8203;486](https://redirect.github.com/endevco/aube/pull/486) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — `install`, `list`,
`run -r`, `query`, and `why` now work in pure-coordinator monorepos that
have `pnpm-workspace.yaml` / `aube-workspace.yaml` at the root but no
root `package.json` (Turborepo-style layouts). Single-project commands
like `add` / `remove` still hard-error without a manifest.

- **`aube update <pkg>` rewrites manifest ranges by default**
([#&#8203;479](https://redirect.github.com/endevco/aube/pull/479) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — caret/tilde ranges
(`^1.2.0`, `~1.2.0`) are rewritten to track the resolved in-range max,
matching pnpm. Other shapes (`>=`, exact pins, dist-tags, git,
`workspace:`) stay frozen. Set `update-rewrites-specifier=false` to keep
the previous behavior.

- **`aube rebuild <pkg>...`**
([#&#8203;477](https://redirect.github.com/endevco/aube/pull/477) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — runs lifecycle scripts
only for the named deps, bypasses the `allowBuilds` /
`onlyBuiltDependencies` policy, and skips root hooks. Composes with
`--filter`. Bare `aube rebuild` continues to do a full policy-respecting
rebuild.

- **Persistent unreviewed-builds warning**
([#&#8203;476](https://redirect.github.com/endevco/aube/pull/476) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — repeat warm-path
installs no longer swallow the "ignored build scripts for N package(s)"
nudge; the spec keys are persisted in `.aube-state` and re-emitted on
every install.

- **`aube update --depth` no longer silently ignored**
([#&#8203;473](https://redirect.github.com/endevco/aube/pull/473) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — emits a one-line
warning pointing at `rm aube-lock.yaml && aube install` for the only
useful semantic case.

#### Fixed

- **Faster cold installs**
([#&#8203;469](https://redirect.github.com/endevco/aube/pull/469) by
[@&#8203;imjustprism](https://redirect.github.com/imjustprism)) — a wide
hot-path pass with measurable wins on real registries:

  | Project           |    v1.6.2 |  v1.7.0 | Speedup |
  | ----------------- | --------: | ------: | ------: |
  | svelte (56 pkg)   |   1393 ms | 1386 ms |   1.01× |
  | vue (117 pkg)     |   1590 ms | 1360 ms |   1.17× |
  | next.js (336 pkg) |  14071 ms | 9160 ms |   1.54× |
  | babylon (21 pkg)  | \~6000 ms | 3186 ms |  \~1.9× |

Highlights: streaming SHA-512 over the wire (no second buffered hash
pass), two-phase parallel CAS tar import, speculative TLS/HTTP/2 prewarm
behind manifest parse, native-build packages floated to the front of the
fetch queue, `Accept-Encoding: gzip, br, zstd` on packuments, in-process
DNS cache via `hickory-dns`, mmap+rayon BLAKE3 over 4 MiB, network
concurrency default raised 64 → 128, and zero-copy packument parsing.
Every change ships with an `AUBE_DISABLE_*` killswitch
(`AUBE_DISABLE_STREAMING_SHA512`, `AUBE_DISABLE_SPECULATIVE_TLS`,
`AUBE_DISABLE_CRITICAL_PATH`, `AUBE_DISABLE_PARALLEL_IMPORT`,
`AUBE_DISABLE_MMAP_BLAKE3`, `AUBE_DISABLE_SNAPSHOTS`) plus an
`AUBE_CONCURRENCY=N` clamp.
- **Nested `link:` / `file:` resolution**
([#&#8203;470](https://redirect.github.com/endevco/aube/pull/470) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fixes the `transitive
local specifier link:./libs/foo cannot be resolved without the parent
package source root` install error in two cases: a `file:` / `link:`
parent declaring a transitive `link:`, and a root `pnpm.overrides`
rewriting a registry dep to a local path. Override paths now anchor at
the project root like pnpm does.
- **Workspace members without `version`**
([#&#8203;480](https://redirect.github.com/endevco/aube/pull/480) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — fall back to `0.0.0`
instead of hard-erroring. `workspace:*` / `^` / `~` siblings still link
locally; specific ranges like `workspace:^2.0.0` still correctly fail to
satisfy. Unblocks repos like
[tuist/tuist#10584](https://redirect.github.com/tuist/tuist/pull/10584).
- **Bare `user/repo` parsed as GitHub shorthand**
([#&#8203;472](https://redirect.github.com/endevco/aube/pull/472) by
[@&#8203;jdx](https://redirect.github.com/jdx)) in lockfile/spec
parsing, with `update --latest` now skipping git-spec deps so they can't
be silently rewritten into registry pins.
- **CLI short help wraps cleanly**
([#&#8203;478](https://redirect.github.com/endevco/aube/pull/478) by
[@&#8203;jdx](https://redirect.github.com/jdx)) — many flags across
`add`, `install`, `publish`, `update`, `view`, etc. had multi-line doc
comments that clap merged into 120+ char paragraphs for `-h`. Now each
flag has a one-line summary followed by the longer prose, restoring
readable short help on standard terminals.

**Full Changelog**:
<https://github.com/endevco/aube/compare/v1.6.2...v1.7.0>

#### 💚 Sponsor aube

aube is part of [**en.dev**](https://en.dev) — an independent
developer-tooling studio run by
[@&#8203;jdx](https://redirect.github.com/jdx), also behind
[mise](https://mise.jdx.dev/). Work on aube is funded entirely by
sponsors.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

If aube is saving your team install time or CI minutes, please consider
[sponsoring at en.dev](https://en.dev). Individual and company
sponsorships are what keep the project fast, free, and independent.

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/Chicago)

- Branch creation
  - Only on Friday (`* * * * 5`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/jdx/mise-action).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzkuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE3OS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-15 05:32:30 +00:00
.github fix: install mise-shim.exe on Windows (#476) 2026-05-14 14:38:13 -05:00
.husky fix: run npm install in pre-commit hook before build (#410) 2026-03-22 10:54:05 -05:00
dist fix: install mise-shim.exe on Windows (#476) 2026-05-14 14:38:13 -05:00
scripts fix(ci): add gh auth setup-git to release-plz.sh (#473) 2026-05-12 15:20:22 -05:00
src fix: install mise-shim.exe on Windows (#476) 2026-05-14 14:38:13 -05:00
.eslintrc.yml feat: support windows (#122) 2024-09-25 21:27:52 +00:00
.gitattributes updated action template base from actions/typescript-action (#170) 2023-10-16 19:18:57 -05:00
.gitignore chore: migrate package manager from npm/pnpm/bun to aube (#455) 2026-04-29 09:13:34 -05:00
.npmrc chore: migrate package manager from npm/pnpm/bun to aube (#455) 2026-04-29 09:13:34 -05:00
.prettierignore updated action template base from actions/typescript-action (#170) 2023-10-16 19:18:57 -05:00
.prettierrc.json updated action template base from actions/typescript-action (#170) 2023-10-16 19:18:57 -05:00
action.yml feat: add wings_enabled input (mise-wings cache integration) (#454) 2026-04-29 09:36:39 -05:00
CHANGELOG.md chore: release v4.0.1 (#406) 2026-03-22 16:06:38 +00:00
CLAUDE.md chore: migrate package manager from npm/pnpm/bun to aube (#455) 2026-04-29 09:13:34 -05:00
cliff.toml docs: hide release entries in CHANGELOG 2025-08-18 11:50:35 -05:00
CODEOWNERS jdxcode -> jdx 2023-08-27 12:12:44 -05:00
eslint.config.mjs chore: updated deps 2024-11-27 18:10:51 -06:00
LICENSE Initial commit 2023-01-14 08:11:40 -06:00
mise.lock chore(deps): update dependency aube to v1.6.2 (#466) 2026-05-09 01:39:13 +00:00
mise.toml chore(deps): update dependency aube to v1.9.1 (#478) 2026-05-15 05:32:30 +00:00
package-lock.json chore(deps): lock file maintenance (#468) 2026-05-11 05:40:15 +00:00
package.json chore(deps): update dependency aube to v1.5.1 (#463) 2026-05-08 05:30:45 +00:00
README.md fix: include runner image in cache key to prevent cross-provider collisions (#456) 2026-04-30 09:15:04 -05:00
rollup.config.mjs chore: migrate package manager from npm/pnpm/bun to aube (#455) 2026-04-29 09:13:34 -05:00
tsconfig.json chore: migrate from ncc (CJS) to rollup (ESM) (#436) 2026-04-11 12:55:09 -05:00

Example Workflow

name: test
on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: jdx/mise-action@v4
        with:
          version: 2026.3.10 # [default: latest] mise version to install
          install: true # [default: true] run `mise install`
          install_args: "bun" # [default: ""] additional arguments to `mise install`
          cache: true # [default: true] cache mise using GitHub's cache
          experimental: true # [default: false] enable experimental features
          log_level: debug # [default: info] log level
          # automatically write this .tool-versions file
          tool_versions: |
            shellcheck 0.11.0
          # or, if you prefer .mise.toml format:
          mise_toml: |
            [tools]
            shellcheck = "0.11.0"
          working_directory: app # [default: .] directory to run mise in
          reshim: false # [default: false] run `mise reshim -f`
          github_token: ${{ secrets.GITHUB_TOKEN }} # [default: ${{ github.token }}] GitHub token for API authentication
      - run: shellcheck scripts/*.sh
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: jdx/mise-action@v4
      # .tool-versions will be read from repo root
      - run: node ./my_app.js

Cache Configuration

You can customize the cache key used by the action:

- uses: jdx/mise-action@v4
  with:
    cache_key: "my-custom-cache-key"  # Override the entire cache key
    cache_key_prefix: "mise-v1"       # Or just change the prefix (default: "mise-v0")

Template Variables in Cache Keys

When using cache_key, you can use template variables to reference internal values:

- uses: jdx/mise-action@v4
  with:
    cache_key: "mise-{{platform}}-{{version}}-{{file_hash}}"
    version: "2026.3.10"
    install_args: "node python"

Available template variables:

  • {{version}} - The mise version (from the version input)
  • {{cache_key_prefix}} - The cache key prefix (from cache_key_prefix input or default)
  • {{platform}} - The target platform, including the runner image (e.g., "linux-x64-ubuntu24", "macos-arm64-macos15", "linux-x64-self-hosted"). The trailing segment is process.env.ImageOS on github-hosted runners and falls back to "self-hosted" elsewhere — preventing cache collisions when the same repo runs on different runner providers (github-hosted, namespace.so, self-hosted).
  • {{file_hash}} - Hash of all mise configuration files
  • {{mise_env}} - The MISE_ENV environment variable value
  • {{install_args_hash}} - SHA256 hash of the sorted tools from install args
  • {{default}} - The processed default cache key (useful for extending)

Conditional logic is also supported using Handlebars syntax like {{#if version}}...{{/if}}.

Example using multiple variables:

- uses: jdx/mise-action@v4
  with:
    cache_key: "mise-v1-{{platform}}-{{install_args_hash}}-{{file_hash}}"
    install_args: "node@24 python@3.14"

You can also extend the default cache key:

- uses: jdx/mise-action@v4
  with:
    cache_key: "{{default}}-custom-suffix"
    install_args: "node@24 python@3.14"

This gives you full control over cache invalidation based on the specific aspects that matter to your workflow.

GitHub API Rate Limits

When installing tools hosted on GitHub (like gh, node, bun, etc.), mise needs to make API calls to GitHub's releases API. Without authentication, these calls are subject to GitHub's rate limit of 60 requests per hour, which can cause installation failures.

- uses: jdx/mise-action@v4
  with:
    github_token: ${{ secrets.GITHUB_TOKEN }}
    # your other configuration

Note: The action automatically uses ${{ github.token }} as the default, so in most cases you don't need to explicitly provide it. However, if you encounter rate limit errors, make sure the token is being passed correctly.

Alternative Installation

Alternatively, mise is easy to use in GitHub Actions even without this:

jobs:
  build:
    steps:
    - run: |
        curl https://mise.run | sh
        echo "$HOME/.local/share/mise/bin" >> $GITHUB_PATH
        echo "$HOME/.local/share/mise/shims" >> $GITHUB_PATH