How Forest Compares to Wally

Wally  pioneered package management for Roblox, and much of the open-source Luau ecosystem was published there first. Forest is what comes next: every open-source Wally package is already mirrored on Forest, so you start with the entire catalog and gain everything Wally never had.

The short version: Wally is a lean tool with GitHub-based publishing, and anything beyond public packages means running your own server. Forest is a full-service registry: accounts with two-factor authentication, teams with real access control, hosted private packages, enforced licensing, and an open-source, independently verifiable delivery pipeline, serving more than one platform from a single CLI. Switching costs minutes, not weekends, and there is no library you would leave behind.

At a glance

Everything on Wally is already installable here

Forest mirrors the open-source Wally catalog: unmodified source, automatically updated as authors release new versions upstream, with each author’s scope reserved for them to claim. Evaluating Forest costs you nothing you rely on today:

forest i evaera/promise

If you publish on Wally, your scope is being held for you; claim it by verifying the same GitHub identity, and the packages become yours to manage on Forest, with future Wally releases still mirroring in.

Private packages without running servers

On Wally, private code means hosting your own registry, so someone on your team now owns a server: deployment, uptime, authentication, and backups. On Forest, that infrastructure is our job. Mark a package private at publish time and it never appears in search, downloads require an authenticated account with access, and tarballs are served only through short-lived signed URLs. Every account and every Studio includes 10 private packages free; Pro removes the limit.

Teams are a first-class concept

Wally manages package ownership as a list of GitHub users edited through CLI commands, which stops scaling the moment a team needs to control who can see what. Forest’s Studios are organizations with ranks (owner, admin, member), custom roles and per-package permission grants, pending-invite management, and an audit log. Packages belong to the Studio rather than to whoever happened to publish them, so members can come and go without orphaning anything.

Licensing is enforced, not assumed

On Wally, a license is optional metadata; a dependency with no stated license is a legal question mark your team inherits. Forest refuses to let that question mark enter the registry: a license (an SPDX identifier or a LICENSE file) is required to publish, and every version carries a license safety rating so consumers can see at a glance what they are agreeing to. Teams shipping commercial games care about this before their lawyers make them.

A pipeline you can verify yourself

Everything that touches package bytes on Forest, from forest publish on the author’s machine to forest install on yours, is open source. A tarball’s SHA-256 is its storage key, its URL, and the integrity value in your lockfile, and the CLI recomputes that hash on every download and refuses to install on a mismatch. The publish gateway deploys only from its public repository through GitHub Actions, with signed build-provenance attestations binding each deployment to a commit. You do not have to take the registry’s word for what it serves; you can check.

Realms: placement belongs to your project

Wally encodes placement intent in package metadata through server and shared realms, a decision the package author makes for you. Forest deliberately has none of that: there is one Packages/ tree, and you decide where it mounts in the datamodel, because placement is a property of your project, not of somebody else’s package. Projects that want a server-only tree use the two-manifest pattern, which makes the split explicit and visible in your project structure, and mirrored server-realm Wally packages slot cleanly into it.

One CLI, more than one platform

Wally is a Roblox tool and will stay one. Forest serves Roblox and UEFN from the same registry, the same account, and the same forest.json mental model. If your studio ships on more than one platform, or ever might, your package workflow is already there.