Aquesta és una versió anterior. La versió actual és la 2.8.3. aube 2.8.3 · Data de publicació:
Fitxers d’instal·lació 1.29.1
| Arquitectura | Tipus | Àmbit | Mida del fitxer | Baixa | SHA256 |
|---|---|---|---|---|---|
| 64 bits | ZIP → Portable | — | — | github.com | VirusTotal |
| ARM64 | ZIP → Portable | — | — | github.com | VirusTotal |
L’enllaç i l’SHA256 provenen del manifest comunitari del Gestor de paquets del Windows. Convé comparar el hash del fitxer baixat abans d’executar-lo.
Notes de la versió
A small but security-relevant patch release that closes a minimumReleaseAge bypass in aube add.
Fixed
- aube add now honors minimumReleaseAge when pinning manifest versions (#1056 by @jdx) — Previously the version written into package.json came straight from the packument with no release-age cutoff, so dist-tag adds (including the default aube add pkg) and --save-exact could pin a freshly published version that full resolution would have gated — exactly the version most likely to be a compromised latest in a supply-chain attack. The manifest step now routes through the resolver's pick_version, so gated latest tags are steered to the newest version clearing the cutoff, deliberate exact pins and non-latest tags are still honored (or refused under minimumReleaseAgeStrict=true with ERR_AUBE_NO_MATURE_MATCHING_VERSION), and minimumReleaseAgeExclude exemptions apply consistently. Offline adds skip the gate as before.
Note that this activates the default 24h gate for add picks, which was silently inert for dist-tag and exact adds until now:
$ aube add caniuse-lite # latest published 15h ago
+ caniuse-lite@1.0.30001805 # newest version ≥24h old; before: 1.0.30001806
💚 Sponsor aube
aube is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.
If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.