[risu729]

Summary

• allow only @nubjs/nub to run its reviewed lifecycle script
• preserve mise's default-deny behavior for every other package in the install graph
• remove the skipped-postinstall warning for supported npm, aube, and pnpm installs

Why keep the npm backend

Nub publishes platform-specific GitHub release archives, and mise's GitHub backend can select and install them correctly. However, extracting those archives is not equivalent to installing the npm package.

@nubjs/nub's postinstall.js performs installer-side fixups. In addition to setting executable bits for the platform binaries, it refreshes existing ~/.nub/shims hardlinks so an upgrade does not leave the optional npm, pnpm, and yarn shims pointing at the previous Nub binary. A direct GitHub-backend extraction bypasses that refresh; affected users would have to rerun nub pm shim manually after upgrades.

Keeping the existing npm backend and setting allow_builds = ["@nubjs/nub"] preserves upstream's install behavior without opting into arbitrary lifecycle scripts. On npm 11.16.0 and newer, mise translates this to the per-package --allow-scripts=@nubjs/nub flag. The same registry option maps to the corresponding narrow build approval for aube and pnpm.

Discussion: #11119

Popularity

• GitHub: 2,961 stars, 46 forks, last push 2026-07-20
• Latest release: v0.4.13, published 2026-07-15
• npm: 80,092 downloads from 2026-06-20 through 2026-07-19

Validation

• mise run build
• mise run lint-fix
• installed @nubjs/nub@0.4.13 using Node 26.5.0's bundled npm 11.17.0 with --allow-scripts=@nubjs/nub --foreground-scripts
• confirmed the postinstall ran and nub --version returned v0.4.13

Summary by CodeRabbit

• Chores
  • Updated package configuration to use an explicit npm backend setup.
  • Enabled build support for the @nubjs/nub package.
  • Existing package description and test configuration remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: ee340a92-8b43-412b-8a19-c2962406fe66

📥 Commits

Reviewing files that changed from the base of the PR and between 126e775 and 7c9be1c.

📒 Files selected for processing (1)

• registry/nub.toml

---

📝 Walkthrough

Walkthrough

The Nub registry entry replaces the npm backend shorthand with an explicit backend object and enables builds for @nubjs/nub.

Changes

Nub backend configuration

Layer / File(s)	Summary
Explicit npm backend options registry/nub.toml	The backend declaration now uses an npm object with options.allow_builds containing @nubjs/nub; existing metadata remains unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

I’m a bunny hopping through the config tonight,
An npm backend now shines just right.
Builds are allowed for Nub’s little name,
The metadata stays in the same game.
Hop, hop—clean settings take flight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: allowing Nub's postinstall lifecycle script in the registry config.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR enables @nubjs/nub's postinstall script by adding allow_builds = ["@nubjs/nub"] to the npm backend options in registry/nub.toml. The change is necessary because nub's postinstall refreshes ~/.nub/shims hardlinks on upgrades — a step that a raw GitHub-backend extraction cannot replicate.

• The backend entry is reformatted from a plain string to an inline object with options = { allow_builds = [\"@nubjs/nub\"] }, exactly matching the pattern already used by registry/amp.toml and others.
• Only the specific package is allowlisted, preserving mise's default-deny behavior for every other package in the install graph.

Confidence Score: 5/5

Safe to merge — the one-line registry change is minimal, correctly scoped, and follows established conventions.

The change adds a single allow_builds entry for @nubjs/nub using the same inline options format already validated by other registry entries (amp.toml, wrangler.toml, etc.). The allowlist is narrowly scoped to the one package that needs its postinstall script, the PR description explains the motivation clearly, and the popularity metrics satisfy the registry entry requirements.

No files require special attention.

Important Files Changed

Filename	Overview
registry/nub.toml	Converts the simple string backend entry to an inline object with allow_builds = ["@nubjs/nub"], matching the established pattern used by amp.toml and others. The allowlist is correctly scoped to only the package that requires postinstall.

_{Reviews (1): Last reviewed commit: "registry: allow nub postinstall" | Re-trigger Greptile}