v1.33.0: Script completions, embeddable Node wrappers, and pnpm 11.16+ compatibility

This release brings package.json script completions and a polished aube run picker, extends the library-embedding work so hosts can wrap the Node runtime, adds FreeBSD support, and tracks pnpm 11.16/11.17 compatibility across settings, version, and login hardening.

Added

• Shell completion for package.json scripts (#1108 by @jdx) — aube run <TAB> now completes the scripts declared in the nearest package.json, showing each script's command as the description. This works through a hand-written usage spec fragment merged onto the generated completions, so no reinstall is needed — aube completion <shell> re-derives the spec at TAB time and runs the completer per project. Note: -C/--dir on the line being completed is not forwarded to the completer (a usage limitation).
• Embedders can wrap the Node runtime, not just select one (#1086 by @jdx) — Extends the embedder Node hook from #1079 so a host can describe a full Node invocation rather than just a bin dir. A new EmbedderRuntime builder offers two constructors: selector(bin_dir) (the version-manager case, identical to #1079) and wrapper(node_program) for instrumenting runtimes, transpiling loaders, and sandboxes — keeping a shim on PATH and at $NODE while pointing npm_node_execpath at the real binary so node-gyp still resolves correctly. Wrappers can contribute lifecycle-script env via env_append/env_set (with NODE_OPTIONS appending by default). Registration is process-wide via set_embedder_runtime (first-write-wins), with per-install and per-call overrides, and new in-process entry points embed::{run, exec, dlx, node} that anchor on an explicit project_dir. Every field is optional; unset reproduces standalone aube byte-for-byte. See the new "Node runtime" and "Run scripts, binaries, and Node" sections in docs/embedding/rust.md.
• Canonical pnpm 11.16+ update and audit settings (#1104 by @jdx) — Adds support for pnpm's update.ignoreDeps, audit.level, and audit.ignore workspace settings. The deprecated updateConfig.ignoreDependencies, auditConfig, and top-level auditLevel spellings are retained as fallbacks, with the canonical keys taking precedence. update.ignoreDeps applies to both aube update and aube outdated, and aube audit now resolves its severity from config instead of hard-defaulting to low (CLI --audit-level still wins). Projects using pnpm's new configuration behave the same under aube without rewriting.
• aube version from-git (#1102 by @jdx) — Accepts from-git as a version target, resolving the latest semver-like Git tag via git describe and normalizing a leading v. Matches pnpm version from-git added in pnpm 11.17.
• FreeBSD support (#1084 by @jdx) — Platform::current() now detects FreeBSD as a host platform, unblocking Node runtime resolution via PATH, installed-Node scans, and mise (previously it hard-errored). Scoped to source compatibility: there are no published FreeBSD release binaries, so aube self-update returns a clear message pointing to pkg/mise instead.

Fixed

• aube run script picker no longer scrambles the output (#1109 by @jdx) — Long script commands that wrapped past the terminal width used to stack duplicate frames on every keypress. The picker now shows the script name as the label with the command aligned in a secondary column, truncated to the real terminal width, and starts in filtering mode so typing searches script names immediately. Bundles demand 2.0.4 for correct redraws on resize.
• Vite and VitePress keep the global virtual store fast path (#1106 by @jdx) — aube now writes pnpm-compatible node_modules/.modules.yaml metadata exposing its virtual-store path, so Vite 8.1+ works with GVS natively without manual server.fs.allow configuration. Older Vite releases receive an equivalent project-local compatibility copy while unrelated dependencies stay shared. GVS is no longer disabled by default for Vite/VitePress.
• Registry-name patches now apply to npm-aliased installs (#1085 by @jdx) — A patch declared against a package's registry name (e.g. is-odd@3.0.1) was not applied when the package was installed under an npm alias (odd-alias: npm:is-odd@3.0.1), even though the lockfile recorded the patched identity. Patch lookups now fall back to the registry name, matching pnpm's behavior.

Security

• Web-login token responses are capped at 64 KiB (#1103 by @jdx) — A malicious or compromised registry could previously return an unbounded successful token response and force aube to buffer it. Successful responses are now streamed with a 64 KiB limit (enforced for both declared and chunked bodies), failing with ERR_AUBE_WEB_LOGIN_RESPONSE_TOO_LARGE without persisting a token. Mirrors the hardening in pnpm 11.17.

Full Changelog: v1.32.0...v1.33.0

💚 Sponsor aube

aube is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.