This release makes Nub a single self-contained binary, hardens self-provisioning and the embedded runtime, and quiets the install output.
Important
Nub now ships as a single self-contained binary. The runtime is embedded in the executable and extracted into the cache automatically on first run — there is no separate runtime to download or discover. The first invocation after upgrading does this one-time extraction; every run after is unaffected. If the extracted runtime is ever removed or fails its integrity check, Nub re-extracts it, and degrades to un-augmented plain Node rather than failing if it still can't.
Install and runtime
- Single self-contained binary — the runtime is embedded and extracted on first run. (#175)
- A verify-on-load integrity check and safe-extraction hardening for the embedded runtime. (#182)
- Nub degrades to un-augmented when self-heal leaves no live runtime directory. (#193)
Install output
The install command now respects pnpm's output flags, so its progress can be quieted or made machine-readable.
| Area | What changed |
|---|---|
| Progress | A single-line in-place TTY progress bar with a clean summary handoff (#184) |
| Flags | --reporter, --silent, and --loglevel forward to the install engine, and are honored before the verb (nub --silent install) (#183, #191) |
| Notices | The unactionable global-virtual-store auto-fallback notice is silenced (#187) |
Security
Hardening of the self-provisioning and registry-bin paths:
- Registry bin paths that escape the package directory are rejected. (#180)
- Self-provisioning is hardened to engine-parity security across five related findings. (#190)
- The Windows drive-letter store-path escape in provisioning is closed. (#194)
The full release notes list every change in this release.
Get started
Or paste this "Get Started" prompt into an agent. It will install Nub and explain how it can be used in your project. (It won't make any changes without permission.)