Skip to content

chore(deps): update dependency nub to v0.8.3 - #30

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nub-0.x
Closed

chore(deps): update dependency nub to v0.8.3#30
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nub-0.x

Conversation

@renovate

@renovate renovate Bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
nub (source) 0.7.5 → 0.8.3 age confidence

Release Notes

nubjs/nub (nub)

v0.8.3: Nub 0.8.3

Compare Source

This release repairs the self-upgrade channel and carries the config, install, and runtime fixes that landed since v0.8.2.

[!IMPORTANT]
Upgrading from v0.7.5 picks up the whole 0.8.x line. The v0.8.0, v0.8.1, and v0.8.2 releases published to npm but never claimed the repository's Latest marker, which is what nub upgrade and the install scripts resolve — so the upgrade channel kept serving v0.7.5. This release fixes the pipeline and moves the channel forward; see those releases' notes for everything an upgrade from v0.7.5 includes.

Release pipeline

What changed Commit
Promoting the stable release now claims the Latest marker, so the upgrade channel serves each release as it publishes 276db81
The release run asserts releases/latest serves the new tag after promotion, so a silent regression fails the workflow a21ec25
The canary channel now also publishes for the release-bump commit itself, instead of trailing each release by the gap to the next code commit (#​748) 21c3761

Runtime and install fixes

  • Nested Node processes no longer hang or die under a shipped nub on the compat tier (Node 18.19–22.14). The preload chainer recognized nub's own preload only in the dev layout, so on released binaries it folded that preload into itself and deadlocked any node a script spawned through nub's shim — which is why nub install failed on packages whose install scripts shell out to Node, such as sqlite3. (#​834, fixes #​746)
  • An install that could not run a dependency's build scripts retries them on the next install. Previously the tree was recorded as complete and every later install reported "Already up to date", permanently sealing a node_modules whose build scripts never ran. Also fixes an add re-resolve un-trusting the build scripts of every already-locked package. (#​836, fixes #​764)
  • The launcher's Node-version probe cache now works under a group-writable umask. The probe directory inherited the umask, its own safety gate then refused it, and every launch silently re-ran the probe. (#​839)
  • A refused runtime-cache base names the actual reason — a read-only filesystem, a reparse point, and a failed ACL query no longer all report "unsafe owner or permissions". (#​843)

Configuration

  • A nodeExecutable field in nub.jsonc names the exact Node binary a project runs, above the pin chain, with a $(command) form that resolves the path from a command's output — "$(which node)" uses whatever Node leads your PATH, with nub's own shim excluded from the answer. (#​835, closes #​606)
  • A config write that nothing would read back is refused. Setting an .npmrc key that a nub.jsonc install field already answers is refused with the field to set instead (#​842), and settings no reader under nub consults are rejected with a working replacement named per key (#​833). The same change makes preferFrozenLockfile actually honored.
  • Nub finds pnpm's global config and auth.ini on Windows the way pnpm does — including on machines with no home directory set. (#​831, fixes #​605)

CLI

  • The ci command accepts the dependency-axis flags — -P/--prod/--production and -D/--dev — matching pnpm 11's ci surface, so a Docker build stage can produce a devDependency-free tree. (#​838)
  • A --smol compiled executable refuses a discovered Node that cannot run its loader shim, instead of failing at startup on the 23.0–23.4 band. (#​829)

Documentation

  • Every Homebrew install surface now points at the core formula — brew install nub resolves without a tap. Existing tap installs keep upgrading from the tap. (#​821, closes #​728)

Testing and internals

  • The pre-push wiki lint distinguishes cannot-run from found-violations instead of failing branches that predate it (03640b5).
  • Dev-tooling: remote builders gain an ad-hoc fixture job (9f864ba), and make install-dev symlinks the target directory the build actually resolved (c7181f4).

What's Changed

New Contributors

Full Changelog: nubjs/nub@v0.8.2...v0.8.3

v0.8.2: Nub 0.8.2

Compare Source

Nub's TypeScript loader is now available as a standalone package for plain Node, alongside fixes across install, resolution, configuration, runtime compatibility, and nub compile.

[!IMPORTANT]
The loader ships as its own package. @nubjs/loader runs TypeScript, JSX, tsconfig paths, and data-format imports under stock node, with no Nub binary involved. Install it as a dev dependency and register it the way tsx and ts-node are registered. Source that runs under it also runs unchanged under those, so adopting it is reversible.

Standalone loader

npm install --save-dev @nubjs/loader
node --import @nubjs/loader app.ts

The package arms the shared resolve and transpile hooks and nothing else. Every preload form Node accepts works:

node --import @nubjs/loader app.ts        # ESM hooks + CommonJS require() augmentation
node --require @nubjs/loader app.ts       # CommonJS delivery (Node 20.19+)
node --import @nubjs/loader/esm app.ts    # ESM hooks only

It also works anywhere a preload can be set rather than passed, such as NODE_OPTIONS="--import @nubjs/loader" vitest.

The native transform rides eight @nubjs/loader-<platform> packages as optionalDependencies, covering macOS, Linux (glibc and musl), and Windows on x64 and arm64. Documentation is at nubjs.com/docs/loader. (#​810)

Install and update

Area What changed PR
Resolver A version refused by trustPolicy=no-downgrade now backtracks to an older version in the same range that still carries its trust evidence, instead of aborting the install. This matches how the age gate already resolved the same situation. #​819
outdated, update Neither command reports or offers a version below the one already installed. A blocked latest tag widened the scan downward, so an older release could be advertised as the upgrade target while the exit code stayed at 1 with nothing installable. #​823
config Engine settings that Nub never reads are no longer listed by config list --all or written by config set. Setting one previously added a key to your .npmrc that changed nothing. #​811

Runtime

--experimental-webstorage is passed on the command line instead of through NODE_OPTIONS. That variable is inherited by every descendant process, and the flag does not exist before Node 22.4, so any child running an older Node aborted at startup with exit 9. This was reachable in practice: a host on the Node 22.4–24 band running Electron 34 or earlier, which embeds Node 20.18.1, hit it. (#​812)

Compile

nub compile finds the strip tool on Windows. The probe tested for a bare filename, so it never matched llvm-strip.exe and every compile on a Windows host silently took the unstripped path — a note: on stderr and an artifact roughly 4 MB larger than it should be. The probe is now PATHEXT-aware. (#​827)

Testing and internals

Cross-runtime compatibility results now run node:test files under bun test, matching how Deno is already measured, and the published numbers are updated accordingly (#​820). The age-gate warning for registries that publish no dates gained end-to-end coverage (#​813). Host build tooling gained a compile-slot cap (#​808) and a self-pruning target directory collector (a247a22). None of these changes affect the released binary.

What's Changed

Full Changelog: nubjs/nub@v0.8.1...v0.8.2

v0.8.1: Nub 0.8.1

Compare Source

Nub 0.8.1 is a patch release: a lockfile fix for pnpm 12, a round of Node-version and loader compatibility fixes in the runtime, and global-install repairs in the package manager.

[!NOTE]
pnpm 12 rejects a lockfile written by Nub 0.8.0 or earlier when a peer is declared optional: false (vitest declares vite that way). Nub wrote the entry as an empty mapping under peerDependenciesMeta; pnpm 12's reader fails on it with ERR_PNPM_BROKEN_LOCKFILE, where pnpm 10 accepted it. Nub now omits those entries, as pnpm does. (#​814)

Package manager

Area What changed PR
Lockfiles peerDependenciesMeta records only optional: true entries, matching pnpm; pnpm 12 reads the result under --frozen-lockfile. #​814
Lockfiles A lockfile read resolves against the declared package manager, not filename precedence. In a project declaring npm, a stray bun.lock no longer outranks package-lock.json and gets serialized back out as it. #​781
Global installs nub install -g <pkg> produces a runnable command, and nub remove -g unlinks the bins it created instead of leaving dangling entries in the global bin directory. Fixes #​642. #​773
nub outdated The minimumReleaseAge window is applied without remark, as install and update apply it; the per-cell marker and the footer naming the held version are gone. #​779

Runtime

Area What changed PR
Node versions Node 23.0–23.4 route to the compat tier: module.registerHooks reached the 23.x line at 23.5.0, and those releases threw at startup under the fast tier. nub compile refuses an external-shim build targeting that band for the same reason. #​802
Node versions --enable-source-maps is withheld on every Node 26.x below 26.8, the band affected by nodejs/node#63169. #​784
Builtins CommonJS require("node:test"), node:sqlite, node:sea and node:test/reporters work again on Node 22.15.0–22.17.1, 23.5.0–23.11.1 and 24.0.0–24.3.0, where a registered resolve hook dropped the node: scheme (fixed upstream in 22.18, 24.4 and 25+). #​803
Loaders A non-file: URL passes through the load hook untouched, so a custom-protocol ESM loader behaves as it does on plain Node. #​788
Environment files --env-file values are no longer $VAR-expanded, matching Node. A value holding a literal $ arrives intact. #​789
Environment files .env.schema discovery walks from the project root up to the workspace root, so a schema at an enclosing package or at a directory without a manifest is found. #​809
Test runner Node's default test-file coverage exclusion stays in effect when Nub adds its own exclusion for the preloaded runtime. #​798, #​815
Debugging A transpiled TypeScript file reports a file: URL as its sourceURL, so editor and DevTools breakpoints match the same script identity as under node. #​800
REPL A module-resolution error in the REPL keeps its named stack frames. #​797
Blob URLs URL.revokeObjectURL() with no argument throws ERR_MISSING_ARGS, as Node does. #​799

Documentation and site

  • The environment-file docs describe the current --env-file and .env.schema behavior; the Varlock page's monorepo callout is updated. (#​809)
  • The FAQ lists only the WinterTC gap global the preload defines. (abe3a6a)
  • The Node-compat corpus is refreshed to Node 26.7.0 and scored under named lenses; the compat benchmark on the site carries the remeasured figures. (#​785, c93d676)
  • The docs pages prerender again; ?section= share links route to an on-demand variant. (dbb4ae1)
  • The 0.8.0 blog post's eject callout describes the collective fallback tree. (985d122)

Testing & internals

  • The repository root is a nub-identity project on nub.lock, and CI bootstraps with nub. (#​807)
  • A worktree that edits only runtime/ builds into an isolated target directory. (#​801)
  • The public wiki drops research docs written as internal investigations and gains a public-content lint. (d50b1c2)
  • The download-stats pipeline reads the daily snapshot ledger. (5992582, ec69670)
  • A failing nubjs.com production deploy is tracked like a red trunk. (374c253)

What's Changed

Full Changelog: nubjs/nub@v0.8.0...v0.8.1

v0.8.0: Nub 0.8.0

Compare Source

Nub 0.8.0 reworks environment-file configuration, ships a round of package-manager correctness fixes, and adds garbage collection for the package store.

[!IMPORTANT]
Two changes are worth knowing before upgrading:

  • File paths in envFile now go in an array — "envFile": [".env"]. A bare string path is an error that names the fix. (#​735)
  • The first install after upgrading relinks each warm tree once, because hidden-hoist link ordering changed. (#​775)

Breaking changes

File paths in envFile go in an array. "envFile": ".env" is now an error naming [".env"]; a string value is reserved for mode names, and "varlock" is the only one. This makes envFile consistent with the other list-valued config fields. (#​735)

A declared envFile now displaces a .env.schema hand-over, at every scope. A .env.schema file decides the environment only when no envFile is declared. Previously the two together were a hard error, and envFile: false in a schema project loaded the schema anyway. Now declared intent wins: envFile: false (or --no-env-file) loads nothing, an envFile list loads those files, and envFile: "varlock" keeps the hand-over explicitly. This applies to a global-scope envFile too, so a machine-wide envFile: false empties a schema project unless the project declares "varlock". (#​735, #​774)

An unreadable tsconfig.json now refuses the run. A project tsconfig whose extends target is missing previously ran under options its author never wrote — extends is where strict, target, and path aliases usually live. Nub now stops with the read error, as tsc does (TS5083). Fix the config, or run with --node. A dependency's own unreadable tsconfig is still salvaged rather than fatal. (#​778, #​768)

Another package manager's config no longer directs the node_modules layout. The layout is configured in nub.jsonc (install.linker, install.publicHoist) under every project identity. The last two branded exceptions are gone: pnpm 11's pnpm-workspace.yaml layout keys are no longer read, and npm's install-strategy=nested no longer aborts the install. (#​698)

Version-gated feature flags moved out of NODE_OPTIONS. NODE_OPTIONS is inherited by the whole process subtree, and flags matched to the host Node aborted any descendant on an older Node — Electron apps exited at startup. Feature flags now ride argv instead. Cost: a tool that spawns Node by absolute path (bypassing the shim) loses the version-gated features, though it keeps the preload and source-map remapping. (#​777)

Package manager

Area What changed PR
Optional dependencies A build failure in an optionalDependencies entry skips the package with a warning instead of failing the install, matching npm and pnpm. #​737
Store maintenance nub store prune now garbage-collects the global virtual store and extracted-tree tiers, not just the content store. Installs register the project with the store; a project whose last install predates 0.8.0 registers on its next install. #​720
nub outdated minimumReleaseAge now applies to both reported columns, so the report no longer offers upgrades nub update would decline. A held version is marked with the time it becomes installable, and a project whose only pending upgrade is held exits 0. #​743
Release-age policy A frozen install revalidates the release policy only when the age gate actually moved. #​710
Relocated stores A store-dir override now moves every store tier together, so phantom-dependency protection keeps working and the machine's default store stays untouched. #​644
.bin wrappers A package whose bin shares its interpreter's name (for example the node npm package) no longer produces a wrapper that resolves to itself — nub install node used to hang. #​741
Workspaces Workspace aliases and relative-path workspace specs resolve. #​717
Workspaces A member-scoped nub update resolves in the workspace-root frame. #​754
Workspaces The disk-materialize eject applies in workspace projects too. #​736
Workspaces nub config init writes nub.jsonc at the workspace root. #​714
Lockfiles An empty importer reads as drift, not as a specifier-less lockfile format. #​763
Linker Hidden-hoist names are claimed shallowest-first, matching pnpm's depth ordering — 1.0.0 no longer beats 2.0.0 on lexicographic accident. #​775
Resolution Peer-context convergence is sized by graph. #​716
Registry A stalled packument fetch is bounded and surfaced instead of hanging the install. #​723
Configuration NUB_CACHE_DIR moves the engine cache, and nub config get/list report values set through the environment. #​740
Configuration A settings default with a namespace resolves against the active embedder. #​780
Fresh installs The shim directories honor XDG_DATA_HOME on a fresh install; an existing ~/.nub install keeps its path. #​752
Source builds A source build (Homebrew and friends) now fails loudly when a build prerequisite is missing instead of shipping a quietly degraded binary. #​761

Runtime

Area What changed PR
import defer Deferred module evaluation is enabled on Node 26.4+, where Node wires the defer phase through. #​770
Loaders A user loader delivered through NODE_OPTIONS is seen by the CommonJS-sync guard. #​742
fetch cache Cache-evict builtins load synchronously, closing a startup race. #​707
Types @nubjs/types covers the six polyfilled proposals an es2024 lib can't reach. #​734
Windows nub.exe reserves an 8 MB main-thread stack, matching node.exe. #​701

CLI

  • A help flag after the verb works in the pm and node command groups. (#​739)
  • Ctrl-C signals every concurrent child of nub run, and --color takes effect. (#​744)

What's Changed

New Contributors

Full Changelog: nubjs/nub@v0.7.5...v0.8.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/nub-0.x branch 2 times, most recently from 56a77d8 to 463e86f Compare August 29, 2026 22:05
@renovate renovate Bot changed the title chore(deps): update dependency nub to v0.8.0 chore(deps): update dependency nub to v0.8.1 Aug 29, 2026
@renovate
renovate Bot force-pushed the renovate/nub-0.x branch 2 times, most recently from be39e7a to bbffcf4 Compare September 1, 2026 12:38
@renovate renovate Bot changed the title chore(deps): update dependency nub to v0.8.1 chore(deps): update dependency nub to v0.8.2 Sep 1, 2026
@renovate
renovate Bot force-pushed the renovate/nub-0.x branch 2 times, most recently from c83e605 to ca73ecd Compare September 2, 2026 18:21
@renovate
renovate Bot force-pushed the renovate/nub-0.x branch from ca73ecd to a0cdeb0 Compare September 3, 2026 05:09
@renovate renovate Bot changed the title chore(deps): update dependency nub to v0.8.2 chore(deps): update dependency nub to v0.8.3 Sep 3, 2026
@lzm0x219

lzm0x219 commented Sep 3, 2026

Copy link
Copy Markdown
Member

Closing: blocked by upstream nubjs/nub#804 (tsconfig extends wildcard subpaths like astro/tsconfigs/strict never resolve in nub 0.8.x, still open in 0.8.2/canary). Keep nub 0.7.5 until upstream fix lands.

@lzm0x219 lzm0x219 closed this Sep 3, 2026
@renovate

renovate Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (0.8.3). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate
renovate Bot deleted the renovate/nub-0.x branch September 3, 2026 09:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@lzm0x219 lzm0x219

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lzm0x219