feat(manager): add nub package manager by colinhacks · Pull Request #44422 · renovatebot/renovate

colinhacks · 2026-07-07T17:41:31Z

Changes

Adds a nub package-manager manager.

Nub is a Node package manager published as @nubjs/nub on npm. It has its own lockfile, nub.lock, which is byte-compatible with the pnpm-lock v9 format. This manager gives nub-based projects lockfile-aware update PRs without keeping a foreign lockfile.

The manager is modeled on the existing bun manager:

Detects nub.lock, resolves the sibling package.json, and extracts dependencies through the shared npm extractor (extractPackageJson). The datasource stays npm.
Regenerates the lockfile in updateArtifacts by running nub install --lockfile-only (with --ignore-scripts unless scripts are allowed), then diffs the old and new nub.lock.
Sets supersedesManagers: ['npm'] so nub takes over from the npm manager only when nub.lock is present.
Registers nub in the Containerbase registry (toolDefinitions + allToolConfig.nub → npm @nubjs/nub), so the default binarySource=install runtime can provision it. This depends on the companion Containerbase tool: feat(tool): add nub package manager containerbase/base#7054.

Context

Please select one of the following:

This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).

Code, tests, and the manager readme were written with substantive assistance from an AI coding agent (Claude).

Documentation (please check one with an [x])

I have updated the documentation

Adds lib/modules/manager/nub/readme.md, which is auto-rendered into the docs site.

How I've tested my work (please select one)

Newly added/modified unit tests

pnpm vitest run lib/modules/manager/nub --coverage passes with 100% statement/branch/function/line coverage. The manager, metadata, and fingerprint validators, the lib/util/exec and lib/config specs, and pnpm test-schema all pass.

Add a first-party manager for nub (https://nubjs.com), modeled on the bun manager. Detects nub.lock, extracts deps via the shared npm extractor (nub.lock is pnpm-lock v9 under nub's own filename), and regenerates the lockfile with 'nub install --lockfile-only'. Registers nub as a Containerbase tool (npm datasource, @nubjs/nub) so binarySource=install can provision it.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

cla-assistant · 2026-07-07T17:41:47Z

All committers have signed the CLA.

- pass --no-frozen-lockfile so nub re-resolves the bumped manifest instead of rejecting the drift under its CI-frozen default - detect the object form `workspaces: { packages: [...] }` - add nub to ignoreScripts supportedManagers

RahulGautamSingh · 2026-07-09T19:41:14Z

+    let workspaces = res?.managerData?.workspaces;
+
+    // nub also accepts the object form `workspaces: { packages: [...] }`.
+    if (typeof workspaces === 'object' && 'packages' in workspaces) {


typeof workspaces === 'object' is also true for null, and managerData.workspaces comes straight from the parsed manifest. A "workspaces": null value makes 'packages' in workspaces throw and crashes extract. Use is.plainObject(workspaces), which also matches the prefer-is guideline.

RahulGautamSingh · 2026-07-09T19:41:14Z

+): Promise<PackageFile | null> {
+  const fileContent = await readLocalFile(packageFile, 'utf8');
+  if (!fileContent) {
+    logger.warn({ fileName: packageFile }, 'Could not read file content');


This warns when a nub.lock has no readable sibling package.json, which is an expected case and will be noisy. Use logger.debug here, as the npm manager does.

RahulGautamSingh · 2026-07-09T19:41:14Z

+  }
+  const relativeFile = upath
+    .relative(pwd, fileName)
+    .replace(/\/package\.json$/, '');


Use the regEx() utility from lib/util/regex.ts instead of a regex literal.

RahulGautamSingh · 2026-07-09T19:41:14Z

+      toolConstraints: [
+        {
+          toolName: 'nub',
+          constraint: updateArtifact?.config?.constraints?.nub,


updateArtifact and config are already in scope and always defined. Simplify to config.constraints?.nub.

RahulGautamSingh · 2026-07-09T19:41:14Z

+Used for updating projects that use [nub](https://nubjs.com) as their package manager.
+nub is a tool for JavaScript projects and therefore an alternative to managers like npm, pnpm and Yarn.
+
+nub's `nub.lock` is the pnpm lockfile v9 format under nub's own filename, so dependencies resolve through the same npm datasource as the `npm` and `bun` managers.


Avoid possessives like nub's. Rewrite, for example: the nub.lock file uses the pnpm lockfile v9 format under a nub-specific name.

RahulGautamSingh · 2026-07-09T19:41:14Z

+        { manager: 'nub', lockFiles: ['nub.lock'] },
+      ];
+      const oldLock = Buffer.from('old');
+      fs.readFile.mockResolvedValueOnce(oldLock as never);


as never bypasses the type system. Prefer typing the mock value or partial<T>() from test/util. The table-driven test lower down also hand-rolls a for loop over testCases; it.each fits better.

- extract: guard workspaces with isPlainObject so a `workspaces: null` value no longer throws on the `'packages' in` check - extract: demote the missing sibling package.json read to logger.debug - utils: wrap the package.json-suffix regex in regEx() - artifacts: use the destructured config for the nub tool constraint - readme: drop the possessive phrasing - tests: mock the fs util instead of fs-extra (drops `as never`), convert the command-execution cases to it.each, and cover null workspaces

colinhacks · 2026-07-10T17:19:07Z

All six addressed in 6d9ea8169:

Replaced typeof workspaces === 'object' with isPlainObject(workspaces) in extract.ts (named import, matching the manager tree's convention), so a "workspaces": null manifest no longer throws on the 'packages' in check. Added a test covering the null case.
Demoted the missing sibling package.json read to logger.debug.
Wrapped the package.json-suffix regex in regEx().
Simplified the tool constraint to config.constraints?.nub.
Reworded the readme to drop the possessive.
Reworked artifacts.spec.ts to mock the fs util instead of fs-extra, which removes the as never casts, and the command-execution cases are now it.each. Lockfile reads resolve to a Buffer; since readLocalFile is overloaded, they go through one typed handle rather than a cast.

Green locally: pnpm jest lib/modules/manager/nub (31 tests), tsc --noEmit, oxlint, prettier, and biome.

RahulGautamSingh

Else LGTM

RahulGautamSingh · 2026-07-10T18:35:52Z

@@ -0,0 +1,6 @@
+Used for updating projects that use [nub](https://nubjs.com) as their package manager.
+nub is a tool for JavaScript projects and therefore an alternative to managers like npm, pnpm and Yarn.


Suggested change

nub is a tool for JavaScript projects and therefore an alternative to managers like npm, pnpm and Yarn.

nub is a tool for JavaScript projects and therefore an alternative to managers like npm, pnpm and yarn.

consistent casing

RahulGautamSingh · 2026-07-10T18:36:19Z

+
+The `nub.lock` file uses the pnpm lockfile v9 format under a nub-specific name, so dependencies resolve through the same npm datasource as the `npm` and `bun` managers.
+
+If a `package.json` is found to be part of `nub` manager results then the same file will be excluded from the `npm` manager results unless an npm/pnpm/Yarn lock file is also found.


Suggested change

If a `package.json` is found to be part of `nub` manager results then the same file will be excluded from the `npm` manager results unless an npm/pnpm/Yarn lock file is also found.

If a `package.json` is found to be part of `nub` manager results then the same file will be excluded from the `npm` manager results unless an npm/pnpm/yarn lock file is also found.

Copilot AI review requested due to automatic review settings July 7, 2026 17:41

Copilot AI reviewed Jul 7, 2026

github-actions Bot requested a review from viceice July 7, 2026 17:41

RahulGautamSingh reviewed Jul 9, 2026

View reviewed changes

colinhacks mentioned this pull request Jul 10, 2026

feat(tool): add nub package manager containerbase/base#7054

Open

RahulGautamSingh reviewed Jul 10, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(manager): add nub package manager#44422

feat(manager): add nub package manager#44422
colinhacks wants to merge 3 commits into
renovatebot:mainfrom
colinhacks:feat/nub-manager

colinhacks commented Jul 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

cla-assistant Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

RahulGautamSingh Jul 9, 2026

Uh oh!

RahulGautamSingh Jul 9, 2026

Uh oh!

RahulGautamSingh Jul 9, 2026

Uh oh!

RahulGautamSingh Jul 9, 2026

Uh oh!

RahulGautamSingh Jul 9, 2026

Uh oh!

RahulGautamSingh Jul 9, 2026

Uh oh!

colinhacks commented Jul 10, 2026

Uh oh!

RahulGautamSingh left a comment

Uh oh!

RahulGautamSingh Jul 10, 2026

Uh oh!

RahulGautamSingh Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -0,0 +1,6 @@
		Used for updating projects that use [nub](https://nubjs.com) as their package manager.
		nub is a tool for JavaScript projects and therefore an alternative to managers like npm, pnpm and Yarn.


		The `nub.lock` file uses the pnpm lockfile v9 format under a nub-specific name, so dependencies resolve through the same npm datasource as the `npm` and `bun` managers.

		If a `package.json` is found to be part of `nub` manager results then the same file will be excluded from the `npm` manager results unless an npm/pnpm/Yarn lock file is also found.

Uh oh!

Conversation

colinhacks commented Jul 7, 2026

Changes

Context

AI assistance disclosure

Documentation (please check one with an [x])

How I've tested my work (please select one)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

cla-assistant Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

colinhacks commented Jul 10, 2026

Uh oh!

RahulGautamSingh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cla-assistant Bot commented Jul 7, 2026 •

edited

Loading