Nimble

ID

nimble

Home page

https://github.com/nim-lang/nimble

Version requirement

>= 0.22

Platforms

🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows

Operations

installed · search · install · remove · sync

purl types

pkg:nim · pkg:nimble

CLI name

nimble

Every call

nimble --noColor --accept <command>

Issues and PRs

📦 manager: nimble

Source

meta_package_manager/managers/nimble.py

Nimble, the package manager of the Nim language.

A package is a Nim library or binary, identified by the bare name the registry publishes it under.

Caution

The inventory forces --ver, and that flag is the whole difference between a useful listing and a misleading one. Without it nimble list --installed prints package names and nothing else, so every package would be reported with no version at all while looking perfectly healthy. Upstream tracked the flag being ignored as nim-lang/nimble#1469, closed as completed; the fix is what sets the requirement floor below.

Note

Both listings open with a three-line legend describing the format, whose own lines look exactly like the records that follow: a {PackageName} placeholder where a name goes, and a └── @{Version} (...) placeholder where a version goes. Both parsers therefore demand a real value, refusing the brace-wrapped placeholders, rather than skipping a fixed number of header lines that a future release could renumber.

Note

Records span two lines, a name followed by one indented line per version held, which is what makes this a class rather than a bundled definition. Nimble keeps several versions of a package side by side, so the versions are reduced here to the newest per name.

Note

No outdated: Nimble has no command reporting which installed packages have newer releases.

No upgrade either, and that is a deliberate reading rather than an oversight. nimble upgrade is documented as upgrading “a list of packages in the lock file”, which is a project operation on a nimble.lock and not something that acts on the machine. Installing a package again does fetch the newest release, but Nimble adds it beside the version already held rather than replacing it, so reporting that as an upgrade would misstate what happened.

Documentation: Nimble README.

What mpm adds to nimble

Through mpm, nimble gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover nimble alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your nimble commands, in mpm

You already know nimble: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With nimble	With mpm
List what’s installed	nimble list --installed --ver	mpm --nimble installed
Search for a package	nimble search parsetoml	mpm --nimble search parsetoml
Install a package	nimble install checksums	mpm install pkg:nimble/checksums
Remove a package	nimble uninstall checksums	mpm remove pkg:nimble/checksums

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated
orphans
search	✓	exact and extended search backfilled by mpm
install	✓
upgrade
upgrade_all
remove	✓
sync	✓
cleanup
doctor

Selecting and configuring nimble

Deselect nimble for a single run with --no-nimble, or persist the choice in your configuration:

[mpm]
nimble = false

The arguments and environment variables listed in the box atop this page are forced on every nimble call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.nimble]
timeout = 900

mpm config-template nimble prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around nimble, one mpm command each:

• Snapshot and clone a machine: mpm --nimble dump nimble.toml, then mpm restore nimble.toml on the next one.

• Export a compliance SBOM: mpm --nimble sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Nimble’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: Nim package index (pkg:nim)

• Retraction: Index revert: the registry is a single packages.json in nim-lang/packages mapping a name to a git URL, so withdrawal is a pull request deleting the entry; the code itself lives in third-party repositories that can also vanish under the index

• Publish date: ❌ the index carries no versions at all, only names and URLs, versions being the git tags of the repository each entry points at, so nothing in it dates a release

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is probed by running:

$ nimble --version
nimble v0.22.2 compiled at 2026-04-24 03:34:24
git hash: couldn't determine git hash

and extracted with:

r"nimble[ \t]+v(?P<version>\S+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Nimble well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ nimble --noColor --accept list --installed --ver
Package list format:
{PackageName}
└── @{Version} ({CheckSum})[Special Versions (if any)] ({InstallPath})
parsetoml
├── @0.7.2 (2a9fb57ef1f6460fd61b1cfab2d83af44f788a25) (/Users/kde/.nimble/pkgs2/parsetoml-0.7.2-2a9fb57ef1f6460fd61b1cfab2d83af44f788a25)
└── @0.7.1 (586fe63467a674008c4445ed1b8ac882177d7103) (/Users/kde/.nimble/pkgs2/parsetoml-0.7.1-586fe63467a674008c4445ed1b8ac882177d7103)

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --nimble installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

• 7.7.0.dev0 (unreleased)

  • Add Nimble package manager, with installed, search, install, remove and sync support. The inventory forces --ver, without which every package is reported with no version at all.