Nub 0.8.3

This release repairs the self-upgrade channel and carries the config, install, and runtime fixes that landed since v0.8.2.

Important

Upgrading from v0.7.5 picks up the whole 0.8.x line. The v0.8.0, v0.8.1, and v0.8.2 releases published to npm but never claimed the repository's Latest marker, which is what nub upgrade and the install scripts resolve — so the upgrade channel kept serving v0.7.5. This release fixes the pipeline and moves the channel forward; see those releases' notes for everything an upgrade from v0.7.5 includes.

Release pipeline

What changed	Commit
Promoting the stable release now claims the Latest marker, so the upgrade channel serves each release as it publishes	276db81
The release run asserts releases/latest serves the new tag after promotion, so a silent regression fails the workflow	a21ec25
The canary channel now also publishes for the release-bump commit itself, instead of trailing each release by the gap to the next code commit (#748)	21c3761

Runtime and install fixes

• Nested Node processes no longer hang or die under a shipped nub on the compat tier (Node 18.19–22.14). The preload chainer recognized nub's own preload only in the dev layout, so on released binaries it folded that preload into itself and deadlocked any node a script spawned through nub's shim — which is why nub install failed on packages whose install scripts shell out to Node, such as sqlite3. (#834, fixes #746)
• An install that could not run a dependency's build scripts retries them on the next install. Previously the tree was recorded as complete and every later install reported "Already up to date", permanently sealing a node_modules whose build scripts never ran. Also fixes an add re-resolve un-trusting the build scripts of every already-locked package. (#836, fixes #764)
• The launcher's Node-version probe cache now works under a group-writable umask. The probe directory inherited the umask, its own safety gate then refused it, and every launch silently re-ran the probe. (#839)
• A refused runtime-cache base names the actual reason — a read-only filesystem, a reparse point, and a failed ACL query no longer all report "unsafe owner or permissions". (#843)

Configuration

• A nodeExecutable field in nub.jsonc names the exact Node binary a project runs, above the pin chain, with a $(command) form that resolves the path from a command's output — "$(which node)" uses whatever Node leads your PATH, with nub's own shim excluded from the answer. (#835, closes #606)
• A config write that nothing would read back is refused. Setting an .npmrc key that a nub.jsonc install field already answers is refused with the field to set instead (#842), and settings no reader under nub consults are rejected with a working replacement named per key (#833). The same change makes preferFrozenLockfile actually honored.
• Nub finds pnpm's global config and auth.ini on Windows the way pnpm does — including on machines with no home directory set. (#831, fixes #605)

CLI

• The ci command accepts the dependency-axis flags — -P/--prod/--production and -D/--dev — matching pnpm 11's ci surface, so a Docker build stage can produce a devDependency-free tree. (#838)
• A --smol compiled executable refuses a discovered Node that cannot run its loader shim, instead of failing at startup on the 23.0–23.4 band. (#829)

Documentation

• Every Homebrew install surface now points at the core formula — brew install nub resolves without a tap. Existing tap installs keep upgrading from the tap. (#821, closes #728)

Testing and internals

• The pre-push wiki lint distinguishes cannot-run from found-violations instead of failing branches that predate it (03640b5).
• Dev-tooling: remote builders gain an ad-hoc fixture job (9f864ba), and make install-dev symlinks the target directory the build actually resolved (c7181f4).

---

What's Changed

• compile: close the shim-capability gap at both ends, and gate it on every host by @colinhacks in #829
• docs(readme): update Homebrew installation to use core formula instead of tap by @fraluc06 in #821
• launcher: pin the probe directory's mode instead of taking it from the umask by @colinhacks in #839
• runtime cache: report why a base was refused instead of naming a cause by @colinhacks in #843
• ci: accept the dependency-axis flags pnpm's ci inherits by @colinhacks in #838
• config: only write a key that something reads back by @colinhacks in #833
• spawn: stop folding nub's own preload into the preload chainer by @colinhacks in #834
• config: refuse an .npmrc write that nub.jsonc already answers by @colinhacks in #842
• fix(config): inject the Windows local-app-data root into pnpm's config-dir resolver by @colinhacks in #831
• install: retry dependency builds a previous install could not run by @colinhacks in #836
• feat(config): a nodeExecutable field with command substitution by @colinhacks in #835

New Contributors

• @fraluc06 made their first contribution in #821

Full Changelog: v0.8.2...v0.8.3