Skip to content

v0.2.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Jun 23:16
v0.2.4
b52d5d9

This release makes nub a single self-contained binary, hardens self-provisioning and the embedded runtime, and quiets the install output.

Important

nub now ships as a single self-contained binary. The runtime is embedded in the executable and extracted into the cache automatically on first run — there is no separate runtime to download or discover. The first invocation after upgrading does this one-time extraction; every run after is unaffected. If the extracted runtime is ever removed or fails its integrity check, nub re-extracts it, and degrades to un-augmented (plain Node) rather than failing if it still can't.

Install & runtime

Area What changed Commit
Binary Single self-contained binary — runtime embedded and JIT-extracted on first run (#175) b8e22d9
Embedded runtime Verify-on-load integrity check and safe-extraction hardening (#182) 42d843e
Self-heal Degrade to un-augmented when self-heal leaves no live runtime directory (#193) c602eac

Install output

The install command now respects the pnpm output flags, so its progress can be quieted or made machine-readable.

Area What changed Commit
Progress Single-line in-place TTY progress bar with a clean summary handoff (#184, #179) 605bdc9
Flags Forward --reporter / --silent / --loglevel to the install engine (#183, #179) e778265
Flags Honor those flags when they appear before the verb (nub --silent install) (#191) e96a7d6
Flags Add --loglevel / --reporter to the value-flag set so they no longer misroute to add (#195) e4cdc79
Notices Silence the unactionable GVS-incompatible auto-fallback notice (#187) 36a4f84

Package manager

Area What changed Commit
Lockfile ambiguity Scope the multiple-lockfile hard error to the mutating install family — nubx / dlx / create no longer error on a transient fetch-and-run (#197) eccaec2
Shim Do not refuse a global install on a cross-PM project pin (#189) a6482fd
Transpile cache Fold the filename into the transpile-cache key so a cache hit reports the correct sourceURL (#181, #171) bbb6d5e
Engine Sync vendored aube to upstream 1.25.1 (#177) 46f34c0

Security

Hardening of the self-provisioning and registry-bin paths.

Area What changed Commit
Path traversal Reject registry bin paths that escape the package directory (#180, #172) aaf331c
Self-provisioning Harden self-provisioning to aube-parity security (five #172-class findings) (#190) de9511b
Windows Close the Windows drive-letter store-path escape in PM provisioning (#194) 11d588d

Build & packaging

Area What changed Commit
Nix From-source flake with an embedded runtime, dropping the prebuilt tarball (#186) f08d591
musl Use as _ for the TIOCSCTTY ioctl request cast so the musl target compiles (#192) e5ecdb9

Commits in this release

  • fix(pm): reject registry bin paths that escape the package dir (#172) (#180, aaf331c)
  • fix(cache): fold filename into transpile cache key (#171) (#181, bbb6d5e)
  • feat(install): forward pnpm reporter/silent/loglevel flags to quiet the install (#183, e778265)
  • Single self-contained binary (embed runtime, JIT-extract on first run) (#175, b8e22d9)
  • vendor/aube: sync upstream 1.25.1 (#177, 46f34c0)
  • feat(embed): verify-on-load integrity + safe-extraction hardening (R1+R2) (#182, 42d843e)
  • fix(install): silence the unactionable GVS-incompatible auto-fallback notice (#187, 36a4f84)
  • fix(shim): don't refuse a global install on a cross-PM project pin (#189, a6482fd)
  • docs(agents): add the audit-thread profile (0cd21cf)
  • fix(spawn): use as _ for the TIOCSCTTY ioctl request cast (musl compile) (#192, e5ecdb9)
  • Harden self-provisioning to aube-parity security (5 #172-class findings) (#190, de9511b)
  • fix(install): honor --silent/--reporter/--loglevel before the verb too (#191, e96a7d6)
  • build(nix): from-source flake with embed-runtime (drop prebuilt tarball) (#186, f08d591)
  • fix(pm): close the Windows drive-letter store-path escape in PM provisioning (F0c) (#194, 11d588d)
  • site: add GitHub star pill to nav; nudge annotation off for now (a71be16)
  • fix(install): add --loglevel/--reporter to VALUE_FLAGS in install_to_add_args (#195, e4cdc79)
  • ci-watch skill: document orchestrator-owned background merge-on-green + self-contained landing-agent watch pattern (9030865)
  • fix(embed): degrade to un-augmented when self-heal leaves no live runtime dir (#193, c602eac)
  • fray vocab sweep: migrate skills/guide prose to canonical statuses (60b2e6b)
  • fix(pm): scope lockfile-ambiguity guard to the mutating install family (#197, eccaec2)
  • skills: add impact-analysis reviewer lens; make it a mandatory self-review leg (18102c1)
  • feat(install): single-line in-place TTY progress bar with clean summary handoff (#184, 605bdc9)

Full Changelog: v0.2.3...v0.2.4

Assets 18
Loading