
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Key Features • How To Use • Comparison with LuaRocks • Related Projects • Contributing
lux.toml file.lx fmt
stylua
or emmylua_codestyle.lx check
emmylua-analyzer-rustlx lint
luacheckextra.rockspec file, everything just works.luarocks if it knows it has
to preserve maximum compatibility..luarc.json
file so they can be picked up by lua-language-server.[!WARNING]
Lux, while generally functional, is a work in progress and does not have a
1.0release yet.
Feel free to consult the documentation on how to get started with Lux!
It features a tutorial and several guides to make you good at managing Lua projects.
As this project is still a work in progress, some LuaRocks features have not been (fully) implemented yet. On the other hand, Lux has some features that are not present in LuaRocks.
The following table provides a brief comparison:
| Lux | LuaRocks v3.13.0 | |
|---|---|---|
| Project format | TOML / Lua | Lua |
| Add/remove dependencies | :white_check_mark: | :x: |
| Parallel builds/installs | :white_check_mark: | :x: |
| Proper lockfile support with integrity checks | :white_check_mark: | :x: (basic, dependency versions only) |
| Run tests with busted | :white_check_mark: | :white_check_mark: |
| Linting with luacheck | :white_check_mark: | :x: |
| Code formatting with stylua | :white_check_mark: | :x: |
| Automatic lua detection/installation | :white_check_mark: | :x: |
| Default build specs | :white_check_mark: | :white_check_mark: |
| Custom build backends | :white_check_mark:1 | :white_check_mark: |
rust-mlua build spec | :white_check_mark: (builtin) | :white_check_mark: (external build backend) |
treesitter-parser build spec | :white_check_mark: (builtin) | :white_check_mark: (external build backend) |
| Install prebuilt binary rocks | :white_check_mark: | :white_check_mark: |
| Install multiple packages with a single command | :white_check_mark: | :x: |
| Install packages using version constraints | :white_check_mark: | :x: |
Auto-detect external dependencies and Lua headers with pkg-config | :white_check_mark: | :x: |
| Resolve multiple versions of the same dependency at runtime | :white_check_mark: | :white_check_mark: |
| Pack and upload prebuilt binary rocks | :white_check_mark: | :white_check_mark: |
| Luarocks.org manifest namespaces | :white_check_mark: | :white_check_mark: |
| Luarocks.org dev packages | :white_check_mark: | :white_check_mark: |
| Versioning | SemVer2 | arbitrary |
| Rockspecs with CVS/Mercurial/SVN/SSCM sources | :x: (YAGNI3) | :white_check_mark: |
| Static type checking | :white_check_mark: | :x: |
Generate a .luarc file with dependencies | :white_check_mark: | :x: |
| Git dependencies in local projects | :white_check_mark: | :x: |
| Vendor sources for offline use | :white_check_mark: | :x: |
| Load RockSpecs and LuaRocks manifests with full sandboxing | :white_check_mark: | :x: |
Lux includes the following packages and libraries:
lux-cli: The main CLI for interacting with projects and installing Lua packages
from the command line.
lux-lua: The Lux Lua API, which provides:
lux.loader for resolving dependencies on require at runtime.lux-lua for Lua 5.1, 5.2, 5.3, 5.4, 5.5 and LuaJIT.
lux-cli uses lux-lua for commands like lx lua, lx run and lx path.lux-lib: The Lux library for Rust. A dependency of lux-cli and lux-lua.
[!NOTE]
We do not yet provide a way to install
lux-luaas a Lua library using Lux. See #663. Lux can detect a lux-lua installation using pkg-config or via theLUX_LIB_DIRenvironment variable.Our prebuilt binary release artifacts are bundled with
lux-lua.
Dependencies:
gnupg, libgpg-error and gpgme (*nix only)If building without the vendored feature:
libgit2opensslIf building with the vendored feature:
perl and perl-coremakeTo link gpgme statically on Linux and macOS, set the environment variable
SYSTEM_DEPS_LINK=static.
We usually recommend building with the vendored feature enabled,
to statically link libgit2 and openssl:
SYSTEM_DEPS_LINK="static" cargo build --locked --profile release --features vendored
Or, to build with dynamically linked libraries:
cargo build --locked --profile release
On Windows/MSVC, you must disable the gpgme feature:
cargo build --locked --profile release --no-default-features --features vendored
You can build lux-lua for a given Lua version with:
cargo xtask51 dist-lua # lux-lua for Lua 5.1
cargo xtask52 dist-lua # for Lua 5.2
cargo xtask53 dist-lua # ...
cargo xtask54 dist-lua
cargo xtask55 dist-lua
cargo xtaskjit dist-lua
This will install lux-lua to target/dist/share/lux-lua/<lua>/lux.so
and a pkg-config .pc file to target/dist/lib/lux-lua*.pc.
To build completions:
cargo xtask dist-completions
To build man pages:
cargo xtask dist-man
To build the binary distributions for your platform,
bundled with completions, man pages and lux-lua:
cargo xtask dist-package
If you would like to use the latest version of Lux with Nix, you can import our flake. It provides an overlay and packages for:
lux-cli: The Lux CLI package.lux-lua51 The Lux Lua API for Lua 5.1lux-lua52 The Lux Lua API for Lua 5.2lux-lua53 The Lux Lua API for Lua 5.3lux-lua54 The Lux Lua API for Lua 5.4lux-lua55 The Lux Lua API for Lua 5.5lux-luajit The Lux Lua API for LuaJITIf you have a lux-lua build and pkg-config in a Nix devShell,
Lux will auto-detect lux-lua.
luarocks under the hood, and will soon be undergoing a rewrite to use Lux instead.Credits go to the LuaRocks team for maintaining LuaRocks and luarocks.org for as long as they have. Without their prior work Lux would not be possible.
Contributions are more than welcome! See CONTRIBUTING.md for a guide.
Supported via a compatibility layer that uses LuaRocks as a backend. ↩
Mostly compatible with the LuaRocks version parser, which allows an arbitrary number of version components. To comply with SemVer, we treat anything after the third version component (except for the specrev) as a prerelease/build version. ↩
FAQs
Unknown package
We found that lux-lib demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.