A patch release focused on lockfile compatibility — most notably reading legacy npm lockfiles — plus a Homebrew install-path fix.
Legacy npm lockfiles
Nub now reads the legacy npm lockfile formats it previously refused: package-lock.json with lockfileVersion: 1 (npm 5 and 6), and pre-2017 npm-shrinkwrap.json (a nested dependencies tree with no lockfileVersion field). The legacy nested tree is lifted into the same install-path scheme Nub uses for v2 and v3, so registry dependencies resolve and install; the first mutating operation — nub add, nub remove — rewrites the lock as v3, the same in-place upgrade npm 7+ performs. Two edges remain out of scope: git and file: deps a v1 lock encodes in version rather than resolved, and fully-hoisted pre-npm-5 shrinkwraps with no requires edges — Nub installs what it can and warns about the rest. (#212)
Three smaller compatibility fixes ship alongside it:
| Area | What changed |
|---|---|
| Bun lockfile | The Bun reader accepts lockfileVersion: 2, forward-compat for the unreleased Bun 1.4; released Bun still writes v1 (#210) |
| Lockfile ambiguity | The multiple-lockfiles ambiguity guard no longer trips on global-scope read commands (#199) |
| Config migration | The nub pm use nub config-migration precedence is now pnpm-major-aware (#211) |
Distribution
The Homebrew formula installs nub and nubx from the stripped working directory instead of a bin/ subpath. (#209, closes #208)
The full release notes list every change in this release.
Get started
Or paste this "Get Started" prompt into an agent. It will install Nub and explain how it can be used in your project. (It won't make any changes without permission.)