chore(deps): update dependency aube to latest

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aube	tools	patch	2.2.12 → v2.2.17

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

jdx/aube (aube)

v2.2.17: : Maintenance release

Compare Source

This release only refreshes Cargo.lock dependencies and contains no user-facing changes.

Full Changelog: aubepkg/aube@v2.2.16...v2.2.17

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.2.16: : aube add installs local tarballs by their manifest name

Compare Source

aube add ./package.tgz now records the package under the name declared in the tarball's package.json, and local file: / link: / portal: dependencies now install their optionalDependencies.

Fixed

• Local tarballs are added by manifest name, not filename (#​1532 by @​jdx) — Downloaded npm artifacts are commonly named package.tgz, and aube add previously derived the dependency key from that filename, producing a bogus "package": "file:./package.tgz" entry alongside any existing dependency on the real package. For an unaliased local tarball or directory, aube add now reads package.json#name and uses it as the key, so the add replaces an existing dependency on the same package instead of adding a second one. Explicit aliases (aube add alias@file:./package.tgz) remain authoritative, and a local package whose manifest has no name is now rejected with an error. This fixes Bun checksum installs through mise (jdx/mise#13125), which download the verified artifact as package.tgz.
• Local packages install their optionalDependencies (#​1532 by @​jdx) — file:, link:, and portal: directory and tarball dependencies previously only resolved dependencies, so optional platform packages declared by a local package (such as Bun's per-platform binaries) were silently dropped. They are now resolved and linked under the local package, honoring ignoredOptionalDependencies and blockExoticSubdeps, and skipping any optional dependency already listed under dependencies so it is not installed twice.

Full Changelog: aubepkg/aube@v2.2.15...v2.2.16

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.2.15: : Embedded aube add confirmations distinguish "unavailable" from "declined"

Compare Source

Embedding hosts can now tell aube that an install confirmation could not be shown, instead of being forced to report it as a user abort.

Fixed

• Unavailable embedded confirmations no longer look like user aborts (#​1530 by @​jdx) — The aube add reputation gates (low downloads, newly published names, similar names) previously asked embedded hosts for a boolean answer. A host that could not present a prompt had to return false, which aube reported as an explicit user abort and could invent a host command such as mise add in the diagnostic. A new, backward-compatible tri-state API lets hosts answer Accept, Decline, or Unavailable:

  use aube::embed::{InstallControl, InstallPromptDecision, InstallPromptDecisionHandler};
  
  let control = InstallControl::silent().with_prompt_decision_handler(handler);

  Unavailable returns the gate's normal structured refusal with its stable error code and remediation; Decline now produces user declined to add <name> without referencing the embedding process. Existing InstallPromptHandler implementations keep working, with false treated as an explicit decline.

• Gate remediation moved into structured diagnostic help (#​1530 by @​jdx) — The --allow-low-downloads / lowDownloadThreshold / minimumPackageAge hints for the three gates are now attached as diagnostic help rather than embedded in the message text, so embedders can replace them with host-native guidance while keeping the measured reason and error code.

Full Changelog: aubepkg/aube@v2.2.14...v2.2.15

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.2.14: : Match GHSA IDs found in advisory URLs

Compare Source

This is a small bug-fix release with a single user-facing change to aube audit.

Fixed

• Audit ignores now match GHSA IDs exposed only in advisory URLs (#​1517 by @​typevolant) — Some npm bulk advisory responses expose the GHSA identifier only in the url field (e.g. an advisory whose URL ends in GHSA-w3rx-r6r6-pgpr), so advisories like GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq were still reported even when passed to --ignore or listed under audit.ignore in a workspace's YAML. The matcher now extracts the trailing advisory ID from the URL and compares it using the existing case-insensitive exact match, correctly handling trailing slashes, query strings, and fragments.

New Contributors

• @​typevolant made their first contribution in #​1517

Full Changelog: aubepkg/aube@v2.2.13...v2.2.14

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

v2.2.13: : Documentation & Site Overhaul

Compare Source

This is a documentation-focused release. There are no functional changes to the aube binary — the work is a broad refresh of the guides, CLI references, and documentation site.

Changed

• Overhauled guides and site design (#​1503 by @​jdx) — Reworked the README and onboarding, migration, configuration, security, troubleshooting, and embedding guides, added CI and container guidance, and redesigned the landing page with improved typography, responsive layouts, and light/dark themes. All 105 generated CLI pages now include examples and navigation, and the settings reference was improved. The generators were updated so these improvements survive regeneration.
• Fixed misleading --ignore-scripts help text (#​1503 by @​jdx) — The help text for --ignore-scripts now accurately describes its behavior, alongside corrections to build-script policy, jail limitations, lockfile compatibility, and command examples throughout the docs.

Full Changelog: aubepkg/aube@v2.2.12...v2.2.13

💚 Sponsor aube

aube is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If aube saves your team install time or CI minutes, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep aube fast, free, and independent.

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • Only on Tuesday (* * * * 2)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 3d5be940-f88c-4f20-85d9-1437d4068da0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

This PR does not match any of the 1 configured review trigger rule.