Dub combines short links with conversion and partner attribution
Dub goes beyond turning a long URL into a short one. Its web application manages branded links, click analytics, conversion events, and affiliate programs. The monorepo also contains a command-line client, email templates, embeddable partner interfaces, Prisma models, a Stripe app, Tinybird definitions, shared UI, and utility packages. That scope makes sense for a marketing platform, but it is far larger than the needs of a team that only wants redirects.
Our checkout at commit e06a128 had 4,424 files, about 492,884 source lines, and occupied 17.6 MB before installation. The repository uses Next.js, TypeScript, Tailwind, Prisma, NextAuth, Turborepo, and hosted data services. Dub's README recommends Node 23.11.0 and pnpm 9.15.9. Matching those versions matters because its troubleshooting advice starts by checking them, then removing generated and dependency directories before another install and build.
The redirect path depends on several data systems
Dub uses MySQL for users and link metadata, Redis to cache link records for redirects, and Tinybird's ClickHouse service for click-event analytics. User-created images live in S3-compatible object storage. GitHub OAuth or email links handle sign-in, while QStash supports workflows such as imports, exports, webhooks, payouts, and scheduled jobs. This division supports a serious hosted product, though each boundary adds configuration, credentials, failure modes, and billing.
The scale of that assembly appeared in our install: 2,633 packages and 2,585 MB on disk after 66 seconds. That is a heavy contributor environment and an expensive clean CI cache. The repository itself has no Dockerfile and the self-host guide says Docker is unsupported. Local development can run MySQL plus a PlanetScale simulator and Mailhog through Compose, but Tinybird and Upstash setup remain separate documented steps.
What happened when we ran it
Our pnpm installation succeeded in 66 seconds in an unprivileged Node 22 container with 3 CPUs, 8 GB of RAM, and no secrets. The build ran for 296 seconds, completed 5 of 6 tasks, then failed in apps/web. The log printed a Next.js warning about an exported revalidate field, a stale browser-mapping-data warning, and finally Killed with exit code 137.
The log does not say why the web process was killed, so we will not label it an out-of-memory failure or blame the warnings before it. Exit 137 and the word Killed are the concrete findings. The build had run for 4 minutes 40.268 seconds according to its own task summary, but our allowed measurement records the stage as 296 seconds. Either way, a clean build did not finish within this 8 GB sandbox.
Tests failed separately after 9 seconds. Three of 4 tasks succeeded, while packages/stripe-app exited 1. The visible tail shows utility declaration files being produced and the workspace task summary, but it does not include a failed assertion. We can say the Stripe app test task failed in our run; we cannot infer whether it needed Stripe credentials, hit a code defect, or failed for some other reason.
Self-hosting currently recreates Dub's cloud architecture
The self-host guide calls for accounts with Tinybird, Upstash, PlanetScale, Vercel, GitHub, and either Cloudflare or AWS. Operators also need an application domain and usually a separate short domain. Setup includes deploying Tinybird data sources, creating Redis and QStash credentials, adapting the Prisma schema for the chosen domain, configuring OAuth, creating object-storage access, and placing the Next.js application on Vercel. Resend and Unsplash are optional for specific features.
Our 2,585 MB installation is smaller than the operational dependency list suggests. The guide's caveats say Tinybird, Upstash, PlanetScale, and Vercel are currently required, and describe native database replacements as a future goal rather than current behavior. This is control over source and data placement, but it is not an offline package that can be moved unchanged into a private Kubernetes cluster. An open issue asks about exactly that gap and feature parity outside Vercel.
Cache behavior and redirect safety deserve local tests
An August 2026 issue reports that deleted or re-keyed links can continue redirecting for about 5 seconds because the in-process LRU cache is not cleared with the Redis and Vercel caches. Another open report says a redir_url query parameter can replace a stored destination, creating an arbitrary-redirect path. Both reports cite specific code and reproduction behavior, which makes them suitable targets for regression tests in any exposed deployment.
The repository's 5 workflow files did not give our generic commands a clean result: the build stopped at 296 seconds and the Stripe package failed at 9 seconds. Self-hosters should test redirect invalidation, destination authority, custom domains, authentication, analytics ingestion, and webhook delivery against the exact commit they deploy. A valid dashboard login does not prove that the public redirect edge behaves correctly under mutation or hostile input.
Open-core licensing changes the build-versus-buy choice
Dub describes its core as AGPLv3 and keeps enterprise code under /ee behind a commercial license. Teams that distribute modifications or operate a network service should review their AGPL source obligations. They should also identify whether required SSO or enterprise behavior sits in the commercially licensed area before investing in a fork. The repository's API response showed no latest GitHub Release, so operators need their own commit and upgrade policy rather than assuming release tags define deployment points.
The repository was pushed on August 26, 2026, and GitHub listed 150 open issues and pull requests together. Current activity is a better health signal than the missing Release entry. Dub is compelling for companies that need attribution and affiliate workflows together and are comfortable with its hosted architecture. For an ordinary short domain, Shlink or YOURLS asks for far less infrastructure and source-build patience.