aube

Run your project. Dependencies take care of themselves.

A Node.js package manager written in Rust. Installs automatically before running scripts, shares packages across projects, and updates your existing lockfile in place.

Get started · Documentation · Commands · Benchmarks

Get started

Install with mise, then run a script in your project:

mise use -g aube
aube --version
cd your-project
aubr build

Use a script defined in your package.json. aubr is shorthand for aube run: when dependencies are missing or stale, it installs them before starting the script. Repeat runs skip the install when nothing has changed.

Prefer another installer? See Homebrew, npm, Cargo, Linux packages, and source builds. To pin aube for a project with mise, run mise use aube inside that project.

Why aube

Fast installs. Warm installs are about 8x faster than pnpm and about 3x faster than Bun in the current benchmarks. Repeat test commands run up to 24x faster than pnpm and up to 2x faster than Bun.

Those results describe the recorded fixtures and cache conditions. See the methodology and all scenarios for the comparison.

• Keep your lockfile. Reads and writes pnpm, npm, Yarn, and Bun text lockfiles in place. New projects default to aube-lock.yaml.
• Install as part of the work. aubr build, aube test, and aube exec vitest check dependency freshness before running. aubx runs one-off tools.
• Share package files. A content-addressable store deduplicates files; the global virtual store also reuses package directory trees across local projects.
• Review dependency code. Dependency build scripts need an allow rule or built-in trust. Explicit denies take precedence. Optional build jails restrict approved scripts; release-age and publishing-trust checks run during resolution.

Everyday commands

Task	Command
Run a project script	aubr build
Run the test script	aube test
Run a local binary	aube exec vitest
Run a one-off tool	aubx cowsay hi
Add a dependency	aube add react
Add a development dependency	aube add -D vitest
Remove a dependency	aube remove react
Update within manifest ranges	aube update
Install without running a project script	aube install
Clean install from a committed lockfile	aube ci

aubr <name> prefers a package script, then a local binary. aubx <name> prefers a local binary, then installs the tool in a throwaway project. Use aubx --package <package> <binary> to request a separate tool installation. See scripts and binaries for flags, argument forwarding, and workspace runs.

Try it in an existing project

Existing lockfile	Supported format
pnpm-lock.yaml	Lockfile v9, written by pnpm 9–11
package-lock.json	v2 and v3
npm-shrinkwrap.json	npm shrinkwrap
yarn.lock	Classic v1 and Berry v2+
bun.lock	Text format v1

Run aube install, inspect the diff, and run your tests. You do not need to import or delete a supported lockfile. Upgrade older pnpm lockfiles with pnpm first; convert bun.lockb with Bun. Yarn PnP projects need a node_modules linker. Keeping the lockfile format does not guarantee identical behavior: aube uses isolated dependencies, its own stores, and its own security defaults.

Migration guides: pnpm · npm · Yarn · Bun.

Dependency builds and security

Root lifecycle scripts run during install unless --ignore-scripts is set. Dependency scripts run only when allowed by project policy or aube's built-in trusted-dependencies list. Review skipped builds with:

aube ignored-builds
aube approve-builds
aube rebuild

Commit the resulting allowBuilds policy so teammates and CI use the same approvals. To restrict approved dependency builds, set jailBuilds: true in aube-workspace.yaml or an existing pnpm-workspace.yaml.

The jail's filesystem and network enforcement depends on the OS; filesystem reads are currently unrestricted. See security defaults and jailed builds for the exact boundaries and the optional paranoid bundle.

Workspaces and Node.js

aube -r run test
aube --filter @acme/api add zod
aube runtime set node 24 --save-exact

aube reads an existing pnpm-workspace.yaml in place. New workspaces can use aube-workspace.yaml. Both support workspace packages, filters, and catalogs.

Commands run through aube use the project's Node pin from devEngines.runtime, .node-version, or .nvmrc. Optional shell activation also routes ordinary node, npm, pnpm, and yarn commands through aube. See workspaces and Node runtime switching.

Find your next step

• CI and containers: frozen installs, production dependencies, and cache choices.
• Configuration: project and user settings, registries, and policy.
• Troubleshooting: diagnose installs, scripts, and tool compatibility.
• Embedding: use aube from Rust, Node-API, or a C ABI host.
• Contributing: build, test, and improve aube.

Questions and bug reports belong in GitHub Discussions. Report vulnerabilities through the security policy.

aube means dawn in French, pronounced /ob/ ("ohb"). Built by jdx.

Sponsors

Sponsored by

   

View all sponsors

Star History

Contributors

Built by jdx.

License

MIT