Nub 0.7.2 is a patch release about what happens when the safe answer and the newest answer are not the same version.

Running a tool the cooling window blocked

Nub holds a freshly published version at arm's length for 24 hours by default. That window is what keeps a compromised publish out of your tree during the hours between it going up and being caught, and it applies to a one-off tool run the same way it applies to an install.

Running a tool without naming a version asks for whatever the publisher tags latest, and until now that request narrowed to exactly that one version. When the window covered it there was nothing left to choose from, so the command failed rather than reaching for the release below it:

$ nubx some-tool
ERR_NUB_NO_MATURE_MATCHING_VERSION            # ❌ latest is four hours old

A blocked latest now resolves to the newest release that clears the window, and says which one it took:

$ nubx some-tool
+ some-tool@2.3.0  latest 2.4.0

warn: the latest some-tool release (2.4.0) is younger than minimumReleaseAge; using 2.3.0 instead
help: to take the newest release anyway: `--minimum-release-age=0`, or `--minimum-release-age-exclude=some-tool`

That notice matters more here than on an install. A remote tool run happens in a scratch project that is deleted the moment the tool exits, so there is no manifest and no lockfile left to inspect afterward — the line above is the only record of which version actually ran.

The fallback is deliberately conservative about where it stops. A dist-tag is a pointer the publisher can move backwards: ship 3.0.0, find it broken, tag a fresh 2.9.1 as latest. Nub never falls back past whatever they currently tag, so the release they retracted is not a candidate, and a latest pointing at a prerelease is refused outright rather than answered with a stable release from a line they have already moved off.

Installing for a machine that is not this one

Optional dependencies are selected by the host's platform, which is the wrong answer when you are building an image or a bundle for somewhere else. Three flags now override that per invocation:

$ nub install --os linux --cpu arm64 --libc musl

The selection applies to that command only, so nothing about the project's configuration changes.

Workspace members named by directory

Bun records a workspace member's resolution as a directory rather than a version, and Nub read that tail as a semver range. It satisfied nothing, so the dependency fell through to the registry and the install died claiming no version matched. A tail that does not parse as a range is now treated as what it is — a locator naming the member — and binds to it directly.

Patch failures also say more than they did. A hunk that will not apply now reports its number and line, counted from one as every other tool counts them, along with what was searched for and the fact that the patch needs regenerating against the current version.

The full release notes list every change in this release.