{"slug": "aube", "name": "aube", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 4, "commenters": 7, "warners": 0, "score": 4.291, "rising": -1.31, "first": "2026-04-21", "latest": "2026-06-24", "why": "It's great that it's faster but what I really liked was the safety configuration defaults", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 2, "compare": 1, "warn": 0}, "spark": [0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "It's great that it's faster but what I really liked was the safety configuration defaults", "kind": "", "icon": false, "domain": "en.dev", "github_repo": null, "official_url": "", "pricing": "", "aliases": ["aube", "Aube"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 769651568, "item_id": 48103223, "url": "https://news.ycombinator.com/item?id=48103223", "by": "jdxcode", "date": "2026-05-11", "version": null, "stance": "recommend", "quote": "It has the strongest security posture of any node pm.", "excerpt": "In aube you get all this out of the box plus a lifecycle jail (next MV will have that on by default) and defaults to trustPolicy=no-downgrade (would not have helped here but still a good default). It has the strongest security posture of any node pm. https://aube.en.dev/security.html#jailed-lifecycle-scripts", "context": "", "use_case": "", "switched_from": "", "story": "TanStack NPM Packages Compromised"}, {"id": 768203328, "item_id": 48012708, "url": "https://news.ycombinator.com/item?id=48012708", "by": "esafak", "date": "2026-05-04", "version": null, "stance": "recommend", "quote": "released a faster alternative", "excerpt": "Don't fret; the creator of mise released a faster alternative: https://github.com/endevco/aube", "context": "", "use_case": "", "switched_from": "", "story": "I am worried about Bun"}, {"id": 768196880, "item_id": 48012305, "url": "https://news.ycombinator.com/item?id=48012305", "by": "Imustaskforhelp", "date": "2026-05-04", "version": null, "stance": "recommend", "quote": "Aube[0] seems interesting to me", "excerpt": "Aube[0] seems interesting to me, I have submitted it as show HN after hearing about your post. Its created by the same person who has made mise and I actually discovered it when I was browsing through on mise.en.dev website I still use bun, but I think that there are some other pathways so I am not that worried about myself personally. But that's also because I most often than not code in golang rather than typescrip", "context": "", "use_case": "", "switched_from": "", "story": "I am worried about Bun"}, {"id": 765620656, "item_id": 47851291, "url": "https://news.ycombinator.com/item?id=47851291", "by": "rsyring", "date": "2026-04-21", "version": null, "stance": "recommend", "quote": "It's great that it's faster but what I really liked was the safety configuration defaults", "excerpt": "It's great that it's faster but what I really liked was the safety configuration defaults: https://aube.en.dev/package-manager/configuration.html", "context": "", "use_case": "Package installs", "switched_from": "", "story": "aube: A New Dawn for Node Installs (from mise author)"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["vendored dependency", "drop-in npm/yarn/pnpm alternative", "package installs"], "compared": [{"slug": "bun", "name": "Bun", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "pnpm", "name": "pnpm", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48011184", "title": "I am worried about Bun", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48660267", "title": "Show HN: Nub \u2013 A Bun-like all-in-one toolkit for Node.js", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48189368", "title": "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48100706", "title": "TanStack NPM Packages Compromised", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47948568", "title": "Aube: A fast Node.js package manager", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47851271", "title": "aube: A New Dawn for Node Installs (from mise author)", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {"recommend": 1, "compare": 1}, "2026-05": {"recommend": 3, "neutral": 1}, "2026-06": {"neutral": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 778634257, "item_id": 48664641, "url": "https://news.ycombinator.com/item?id=48664641", "by": "colinmcd", "date": "2026-06-24", "version": null, "stance": "neutral", "quote": "", "excerpt": "Certainly. We're using subtrees now instead of submodules, lets avoids some tricky worktree/submodule interactions during local dev. We've already pulled changes since that PR landed. https://github.com/nubjs/nub/commit/b4abee87", "context": "", "use_case": "vendored dependency", "switched_from": "", "story": "Show HN: Nub \u2013 A Bun-like all-in-one toolkit for Node.js"}, {"id": 771059328, "item_id": 48191208, "url": "https://news.ycombinator.com/item?id=48191208", "by": "rubnogueira", "date": "2026-05-19", "version": null, "stance": "neutral", "quote": "now has a \"jailBuilds\" flag", "excerpt": "aube (npm/yarn/pnpm drop-in alternative) now has a \"jailBuilds\" flag that restricts access to network/filesystem access. https://aube.en.dev/package-manager/jailed-builds.html But this feels like a cat/mouse game.", "context": "", "use_case": "Drop-in npm/yarn/pnpm alternative", "switched_from": "", "story": "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised"}, {"id": 769651568, "item_id": 48103223, "url": "https://news.ycombinator.com/item?id=48103223", "by": "jdxcode", "date": "2026-05-11", "version": null, "stance": "recommend", "quote": "It has the strongest security posture of any node pm.", "excerpt": "In aube you get all this out of the box plus a lifecycle jail (next MV will have that on by default) and defaults to trustPolicy=no-downgrade (would not have helped here but still a good default). It has the strongest security posture of any node pm. https://aube.en.dev/security.html#jailed-lifecycle-scripts", "context": "", "use_case": "", "switched_from": "", "story": "TanStack NPM Packages Compromised"}, {"id": 768203328, "item_id": 48012708, "url": "https://news.ycombinator.com/item?id=48012708", "by": "esafak", "date": "2026-05-04", "version": null, "stance": "recommend", "quote": "released a faster alternative", "excerpt": "Don't fret; the creator of mise released a faster alternative: https://github.com/endevco/aube", "context": "", "use_case": "", "switched_from": "", "story": "I am worried about Bun"}, {"id": 768196880, "item_id": 48012305, "url": "https://news.ycombinator.com/item?id=48012305", "by": "Imustaskforhelp", "date": "2026-05-04", "version": null, "stance": "recommend", "quote": "Aube[0] seems interesting to me", "excerpt": "Aube[0] seems interesting to me, I have submitted it as show HN after hearing about your post. Its created by the same person who has made mise and I actually discovered it when I was browsing through on mise.en.dev website I still use bun, but I think that there are some other pathways so I am not that worried about myself personally. But that's also because I most often than not code in golang rather than typescrip", "context": "", "use_case": "", "switched_from": "", "story": "I am worried about Bun"}, {"id": 767311152, "item_id": 47956947, "url": "https://news.ycombinator.com/item?id=47956947", "by": "irskep", "date": "2026-04-29", "version": null, "stance": "compare", "quote": "aube was about 30% slower than pnpm in my testing", "excerpt": "aube was about 30% slower than pnpm in my testing on our hundreds-of-dependencies monorepo, but I'm giving it time and keeping a testing branch around. (hi jdx yes I am that guy.) Honestly this speaks to how good pnpm is more than saying aube can't get there. I'm still opening pnpm-behavior bug reports against aube daily (boo) but they are getting fixed very quickly (yay). I'm really looking forward to seeing if it's", "context": "works on a hundreds-of-dependencies monorepo", "use_case": "", "switched_from": "", "story": "Aube: A fast Node.js package manager"}, {"id": 765620656, "item_id": 47851291, "url": "https://news.ycombinator.com/item?id=47851291", "by": "rsyring", "date": "2026-04-21", "version": null, "stance": "recommend", "quote": "It's great that it's faster but what I really liked was the safety configuration defaults", "excerpt": "It's great that it's faster but what I really liked was the safety configuration defaults: https://aube.en.dev/package-manager/configuration.html", "context": "", "use_case": "Package installs", "switched_from": "", "story": "aube: A New Dawn for Node Installs (from mise author)"}]}