Install aube

About aube

aube is a package manager for Node.js projects. It uses pnpm-style isolated node_modules for fast, disk-efficient installs. Existing projects keep their lockfile format. aube reads and writes pnpm-lock.yaml, package-lock.json, npm-shrinkwrap.json, yarn.lock, and bun.lock in place. New projects without a supported lockfile get aube-lock.yaml. Why Try It - Fast installs. Warm installs are about 8x faster than pnpm and about 5x faster than Bun in the current benchmarks. Repeat test commands run up to 35x faster than p...

What's new in 1.18.1

A small patch release focused on install robustness: lockfiles with Git merge conflict markers now recover gracefully, aube update --global works from anywhere, and lockfile tarball URLs are verified against the registry before download. Fixed - (install) Regenerate conflicted lockfiles (#843 by @jdx) — When aube-lock.yaml still contains Git conflict markers (<<<<<<<, =======, >>>>>>>), install now treats it as a recoverable prefer-frozen parse failure rather than aborting. It emits the new WARN_AUBE_LOCKFILE_CONFLICT_MARKERS warning and regenerates the lockfile from package.json, so a plain aube install after a messy merge just works. - (update) Support global updates (#840 by @jdx) — aube update --global (and aube update -g <pkg>) now routes through the global install directory instead of requiring a project package.json, so it works from any directory — including outside a repo. Each global install runs the normal update pipeline with --latest and exact manifest pins, then bin shims are relinked and stale executables removed. Named packages resolve by alias; unknown names fail with not globally installed. When combined with a workspace --filter, --global takes precedence and leaves workspace manifests untouched. Fixes #839. aube update -g # update every globally installed tool aube update -g prettier # update a single global tool Security - (install) Verify lockfile tarball URLs (#842 by @jdx) — When the lockfile pins an explicit registry tarball URL (e.g. lockfile-include-tarball-url=true or npm-alias entries), install now fetches per-version registry metadata and compa...

Read release notes

Version history