@endevco/aube-linux-x64-musl 1.2.1 → 1.4.0

package/README.md

@@ -21,7 +21,7 @@
 ## Why Try It
 
 <!-- BENCH_RATIOS:START -->
-**[Fast installs](https://aube.en.dev/benchmarks).** Warm installs are about 10x faster than pnpm and ~1.9x faster than Bun in the current benchmarks. Repeat test commands run up to 102x faster than pnpm and up to 4x faster than Bun.
+**[Fast installs](https://aube.en.dev/benchmarks).** Warm installs are about 9x faster than pnpm and about 3x faster than Bun in the current benchmarks. Repeat test commands run up to 101x faster than pnpm and up to 4x faster than Bun.
 <!-- BENCH_RATIOS:END -->
 
 **[Existing lockfiles](https://aube.en.dev/package-manager/lockfiles).** Reads and writes `pnpm-lock.yaml`, `package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`, and `bun.lock` in place.
@@ -30,7 +30,7 @@
 
 **[Less disk use](https://aube.en.dev/package-manager/node-modules).** A global content-addressable store lets projects share package files instead of keeping a full copy of the same dependencies in every checkout.
 
-**[Secure defaults](https://aube.en.dev/package-manager/configuration).** aube defaults to safer installs: new releases wait out a minimum age, exotic transitive dependencies are blocked, and dependency lifecycle scripts require approval.
+**[Secure defaults](https://aube.en.dev/security).** Out of the box, exotic transitive deps are blocked, lifecycle scripts wait for approval, trust downgrades fail at resolve, and brand-new releases sit in a 24h cooling window. One `paranoid: true` line adds the build jail and turns the soft gates into hard fails.
 
 ## Install
 
@@ -40,6 +40,15 @@ The recommended path is mise:
 mise use -g aube
 ```
 
+mise can also manage the [Node.js versions](https://mise.jdx.dev/lang/node.html)
+your projects need. If your projects already pin Node through `package.json`
+(`devEngines.runtime`), `.nvmrc`, or `.node-version`, enable mise's
+idiomatic version-file support for Node:
+
+```sh
+mise settings add idiomatic_version_file_enable_tools node
+```
+
 Check that it is on your `PATH`:
 
 ```sh
@@ -55,9 +64,15 @@ mise use aube
 aube is also published on npm:
 
 ```sh
-npm install -g @endevco/aube
+npm install -g --ignore-scripts=false @endevco/aube
+npx --ignore-scripts=false @endevco/aube --version
 ```
 
+The npm package uses an install script to fetch native binaries for
+performance. The npm commands above include the flag that keeps that
+working even if your npm config disables scripts. We still recommend mise
+for the smoothest install and runtime management path.
+
 Homebrew installs come from the Endev tap:
 
 ```sh
@@ -201,6 +216,8 @@ You can inspect packages whose scripts were skipped:
 aube ignored-builds
 ```
 
+For approved packages, `jailBuilds: true` runs lifecycle scripts with a scrubbed env and temporary `HOME`. It defaults to `false` today and is planned to default to `true` in the next major version. Use package globs in `jailBuildPermissions` or `jailBuildExclusions` for packages that need specific env vars, paths, network, or a full opt-out.
+
 ## Package Layout
 
 aube uses an isolated `node_modules` layout. Packages are linked through `node_modules/.aube/`, and package files are stored once in `$XDG_DATA_HOME/aube/store/` (defaulting to `~/.local/share/aube/store/`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@endevco/aube-linux-x64-musl",
-  "version": "1.2.1",
+  "version": "1.4.0",
   "description": "Platform binaries for aube — do not install directly, see @endevco/aube.",
   "homepage": "https://aube.en.dev",
   "repository": {