diff --git a/Cargo.lock b/Cargo.lock
index 9bfd24e1d..69955b301 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -237,7 +237,7 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "aube"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "ambient-id",
  "assert_cmd",
@@ -301,7 +301,7 @@ dependencies = [
 
 [[package]]
 name = "aube-codes"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -309,7 +309,7 @@ dependencies = [
 
 [[package]]
 name = "aube-ffi"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube",
  "aube-codes",
@@ -322,7 +322,7 @@ dependencies = [
 
 [[package]]
 name = "aube-linker"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube-codes",
  "aube-lockfile",
@@ -348,7 +348,7 @@ dependencies = [
 
 [[package]]
 name = "aube-lockfile"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube-codes",
  "aube-manifest",
@@ -375,7 +375,7 @@ dependencies = [
 
 [[package]]
 name = "aube-manifest"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube-codes",
  "aube-util",
@@ -393,7 +393,7 @@ dependencies = [
 
 [[package]]
 name = "aube-node"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube",
  "aube-codes",
@@ -408,7 +408,7 @@ dependencies = [
 
 [[package]]
 name = "aube-registry"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube-codes",
  "aube-manifest",
@@ -439,7 +439,7 @@ dependencies = [
 
 [[package]]
 name = "aube-resolver"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube-codes",
  "aube-lockfile",
@@ -468,7 +468,7 @@ dependencies = [
 
 [[package]]
 name = "aube-runtime"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube-codes",
  "aube-manifest",
@@ -492,7 +492,7 @@ dependencies = [
 
 [[package]]
 name = "aube-scripts"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube-codes",
  "aube-manifest",
@@ -510,7 +510,7 @@ dependencies = [
 
 [[package]]
 name = "aube-settings"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube-codes",
  "aube-manifest",
@@ -523,7 +523,7 @@ dependencies = [
 
 [[package]]
 name = "aube-store"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube-util",
  "base64",
@@ -549,7 +549,7 @@ dependencies = [
 
 [[package]]
 name = "aube-util"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube-codes",
  "blake3",
@@ -570,7 +570,7 @@ dependencies = [
 
 [[package]]
 name = "aube-workspace"
-version = "1.36.0"
+version = "1.37.0"
 dependencies = [
  "aube-codes",
  "aube-manifest",
diff --git a/Cargo.toml b/Cargo.toml
index 513192d8f..ccd7980ee 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -31,7 +31,7 @@ inherits = "release"
 panic = "unwind"
 
 [workspace.package]
-version = "1.36.0"
+version = "1.37.0"
 edition = "2024"
 # Kept at the floor mise can build with (its distro packaging pins the
 # toolchain) so mise can embed the library crates. CI enforces this via
@@ -191,19 +191,19 @@ diffy = "0.5"
 # Internal crates — `version` is required so `cargo publish` can resolve
 # transitive crate dependencies via crates.io. release-plz keeps these
 # versions in sync with [workspace.package].version during release PRs.
-aube = { path = "crates/aube", version = "1.36.0", default-features = false }
-aube-codes = { path = "crates/aube-codes", version = "1.36.0" }
-aube-settings = { path = "crates/aube-settings", version = "1.36.0" }
-aube-resolver = { path = "crates/aube-resolver", version = "1.36.0" }
-aube-registry = { path = "crates/aube-registry", version = "1.36.0" }
-aube-store = { path = "crates/aube-store", version = "1.36.0" }
-aube-linker = { path = "crates/aube-linker", version = "1.36.0" }
-aube-lockfile = { path = "crates/aube-lockfile", version = "1.36.0" }
-aube-manifest = { path = "crates/aube-manifest", version = "1.36.0" }
-aube-runtime = { path = "crates/aube-runtime", version = "1.36.0" }
-aube-scripts = { path = "crates/aube-scripts", version = "1.36.0" }
-aube-workspace = { path = "crates/aube-workspace", version = "1.36.0" }
-aube-util = { path = "crates/aube-util", version = "1.36.0" }
+aube = { path = "crates/aube", version = "1.37.0", default-features = false }
+aube-codes = { path = "crates/aube-codes", version = "1.37.0" }
+aube-settings = { path = "crates/aube-settings", version = "1.37.0" }
+aube-resolver = { path = "crates/aube-resolver", version = "1.37.0" }
+aube-registry = { path = "crates/aube-registry", version = "1.37.0" }
+aube-store = { path = "crates/aube-store", version = "1.37.0" }
+aube-linker = { path = "crates/aube-linker", version = "1.37.0" }
+aube-lockfile = { path = "crates/aube-lockfile", version = "1.37.0" }
+aube-manifest = { path = "crates/aube-manifest", version = "1.37.0" }
+aube-runtime = { path = "crates/aube-runtime", version = "1.37.0" }
+aube-scripts = { path = "crates/aube-scripts", version = "1.37.0" }
+aube-workspace = { path = "crates/aube-workspace", version = "1.37.0" }
+aube-util = { path = "crates/aube-util", version = "1.37.0" }
 
 [profile.dev]
 debug = 1
diff --git a/aube.usage.kdl b/aube.usage.kdl
index 8f4e4437e..f3a3e64b1 100644
--- a/aube.usage.kdl
+++ b/aube.usage.kdl
@@ -2,7 +2,7 @@
 min_usage_version "4.0"
 name aube
 bin aube
-version "1.36.0"
+version "1.37.0"
 about "A fast Node.js package manager"
 usage "Usage: aube [OPTIONS] [COMMAND]"
 flag "-C --dir --cd --prefix" help="Change to directory before running (like `make -C` or `mise --cd`)" global=#true {
diff --git a/crates/aube-codes/CHANGELOG.md b/crates/aube-codes/CHANGELOG.md
index 800173e92..f90bf0386 100644
--- a/crates/aube-codes/CHANGELOG.md
+++ b/crates/aube-codes/CHANGELOG.md
@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-codes-v1.36.0...aube-codes-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Fixed
+
+- *(patch)* preserve existing patches and refresh hashes ([#1196](https://github.com/jdx/aube/pull/1196))
+- *(update)* warn when release age hides upgrades ([#1193](https://github.com/jdx/aube/pull/1193))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-codes-v1.35.0...aube-codes-v1.36.0) - 2026-07-29
 
 ### Other
diff --git a/crates/aube-linker/CHANGELOG.md b/crates/aube-linker/CHANGELOG.md
index e4b949746..9b178c6c0 100644
--- a/crates/aube-linker/CHANGELOG.md
+++ b/crates/aube-linker/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-linker-v1.36.0...aube-linker-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-linker-v1.35.0...aube-linker-v1.36.0) - 2026-07-29
 
 ### Other
diff --git a/crates/aube-lockfile/CHANGELOG.md b/crates/aube-lockfile/CHANGELOG.md
index bbd9b3e81..4a82b882c 100644
--- a/crates/aube-lockfile/CHANGELOG.md
+++ b/crates/aube-lockfile/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-lockfile-v1.36.0...aube-lockfile-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-lockfile-v1.35.0...aube-lockfile-v1.36.0) - 2026-07-29
 
 ### Other
diff --git a/crates/aube-manifest/CHANGELOG.md b/crates/aube-manifest/CHANGELOG.md
index 9340f7457..9ae9784cc 100644
--- a/crates/aube-manifest/CHANGELOG.md
+++ b/crates/aube-manifest/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-manifest-v1.36.0...aube-manifest-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-manifest-v1.35.0...aube-manifest-v1.36.0) - 2026-07-29
 
 ### Added
diff --git a/crates/aube-registry/CHANGELOG.md b/crates/aube-registry/CHANGELOG.md
index bb7804a17..dddb4bf91 100644
--- a/crates/aube-registry/CHANGELOG.md
+++ b/crates/aube-registry/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-registry-v1.36.0...aube-registry-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-registry-v1.35.0...aube-registry-v1.36.0) - 2026-07-29
 
 ### Other
diff --git a/crates/aube-resolver/CHANGELOG.md b/crates/aube-resolver/CHANGELOG.md
index 1024a85ce..59f6f6b67 100644
--- a/crates/aube-resolver/CHANGELOG.md
+++ b/crates/aube-resolver/CHANGELOG.md
@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-resolver-v1.36.0...aube-resolver-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Fixed
+
+- *(update)* warn when release age hides upgrades ([#1193](https://github.com/jdx/aube/pull/1193))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-resolver-v1.35.0...aube-resolver-v1.36.0) - 2026-07-29
 
 ### Fixed
diff --git a/crates/aube-runtime/CHANGELOG.md b/crates/aube-runtime/CHANGELOG.md
index 4dc2a9c6b..c84d5f83f 100644
--- a/crates/aube-runtime/CHANGELOG.md
+++ b/crates/aube-runtime/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-runtime-v1.36.0...aube-runtime-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-runtime-v1.35.0...aube-runtime-v1.36.0) - 2026-07-29
 
 ### Other
diff --git a/crates/aube-scripts/CHANGELOG.md b/crates/aube-scripts/CHANGELOG.md
index 836c4a25c..bf65963e0 100644
--- a/crates/aube-scripts/CHANGELOG.md
+++ b/crates/aube-scripts/CHANGELOG.md
@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-scripts-v1.36.0...aube-scripts-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Fixed
+
+- *(embed)* keep wrapper node first on PATH ([#1188](https://github.com/jdx/aube/pull/1188))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-scripts-v1.35.0...aube-scripts-v1.36.0) - 2026-07-29
 
 ### Other
diff --git a/crates/aube-settings/CHANGELOG.md b/crates/aube-settings/CHANGELOG.md
index 44267681f..dc2c172cf 100644
--- a/crates/aube-settings/CHANGELOG.md
+++ b/crates/aube-settings/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-settings-v1.36.0...aube-settings-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-settings-v1.35.0...aube-settings-v1.36.0) - 2026-07-29
 
 ### Other
diff --git a/crates/aube-store/CHANGELOG.md b/crates/aube-store/CHANGELOG.md
index 0d28f04e2..fa6e3b9ec 100644
--- a/crates/aube-store/CHANGELOG.md
+++ b/crates/aube-store/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-store-v1.36.0...aube-store-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-store-v1.35.0...aube-store-v1.36.0) - 2026-07-29
 
 ### Other
diff --git a/crates/aube-util/CHANGELOG.md b/crates/aube-util/CHANGELOG.md
index 96a8dacf8..15495ae9d 100644
--- a/crates/aube-util/CHANGELOG.md
+++ b/crates/aube-util/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-util-v1.36.0...aube-util-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-util-v1.35.0...aube-util-v1.36.0) - 2026-07-29
 
 ### Other
diff --git a/crates/aube-workspace/CHANGELOG.md b/crates/aube-workspace/CHANGELOG.md
index 4f0a0a537..094175e08 100644
--- a/crates/aube-workspace/CHANGELOG.md
+++ b/crates/aube-workspace/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/aube-workspace-v1.36.0...aube-workspace-v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/aube-workspace-v1.35.0...aube-workspace-v1.36.0) - 2026-07-29
 
 ### Other
diff --git a/crates/aube/CHANGELOG.md b/crates/aube/CHANGELOG.md
index be140192f..dc32b5e28 100644
--- a/crates/aube/CHANGELOG.md
+++ b/crates/aube/CHANGELOG.md
@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.37.0](https://github.com/jdx/aube/compare/v1.36.0...v1.37.0) - 2026-07-31
+
+### Added
+
+- *(scripts)* use pnpm trusted dependency list ([#1199](https://github.com/jdx/aube/pull/1199))
+- *(embed)* allow runtimes to leave PATH unchanged ([#1189](https://github.com/jdx/aube/pull/1189))
+
+### Fixed
+
+- *(add)* trust exact popular package names ([#1198](https://github.com/jdx/aube/pull/1198))
+- *(patch)* preserve existing patches and refresh hashes ([#1196](https://github.com/jdx/aube/pull/1196))
+- *(update)* warn when release age hides upgrades ([#1193](https://github.com/jdx/aube/pull/1193))
+- *(update)* honor release age in upgrade reports ([#1192](https://github.com/jdx/aube/pull/1192))
+- *(embed)* keep wrapper node first on PATH ([#1188](https://github.com/jdx/aube/pull/1188))
+- *(runtime)* keep activated shims in script PATH ([#1187](https://github.com/jdx/aube/pull/1187))
+- *(licenses)* resolve packages from hoisted layout ([#1183](https://github.com/jdx/aube/pull/1183))
+
+### Other
+
+- refresh benchmarks for v1.36.0 ([#1185](https://github.com/jdx/aube/pull/1185))
+
 ## [1.36.0](https://github.com/jdx/aube/compare/v1.35.0...v1.36.0) - 2026-07-29
 
 ### Added
diff --git a/docs/cli/commands.json b/docs/cli/commands.json
index 71a79f92f..7b60300b1 100644
--- a/docs/cli/commands.json
+++ b/docs/cli/commands.json
@@ -13660,7 +13660,7 @@
   "config": {
     "props": {}
   },
-  "version": "1.36.0",
+  "version": "1.37.0",
   "usage": "Usage: aube [OPTIONS] [COMMAND]",
   "complete": {
     "script": {
diff --git a/docs/cli/index.md b/docs/cli/index.md
index b4da46d02..909d5d23b 100644
--- a/docs/cli/index.md
+++ b/docs/cli/index.md
@@ -3,7 +3,7 @@
 
 **Usage**: `aube [FLAGS] <SUBCOMMAND>`
 
-**Version**: 1.36.0
+**Version**: 1.37.0
 
 - **Usage**: `aube [FLAGS] <SUBCOMMAND>`
 
diff --git a/release.json b/release.json
index e262a1eca..d598f0ebe 100644
--- a/release.json
+++ b/release.json
@@ -1,4 +1,4 @@
 {
-  "version": "1.36.0",
-  "releasedAt": "2026-07-29T17:52:01Z"
+  "version": "1.37.0",
+  "releasedAt": "2026-07-31T14:06:34Z"
 }