patchedDependencies patch files without diff --git headers fail: "patch section missing file path"

[mwolson]

• Repro repo: https://github.com/mwolson/tmp-aube-issues
• Case: pnpm-patch-plain-unified-diff
• aube version: 1.26.0 (also reproduced on 1.25.2)
• pnpm versions that apply the same patch: 10.24.0, 11.11.0

A patchedDependencies patch file written as a plain unified diff, starting directly with --- a/<path> / +++ b/<path> and no diff --git header line, fails aube install:

× failed to link workspace node_modules
╰─▶ failed to apply patch for is-number@7.0.0: patch section missing file path

Native pnpm applies the same patch file from the same pnpm-workspace.yaml entry. Patches generated by pnpm patch-commit or aube patch-commit are unaffected since they emit git-style headers; this only bites patch files written by hand or by tools that emit plain diff -u output, which pnpm's applier accepts. I hit it migrating a real pnpm workspace where one of thirteen patches was a hand-written unified diff.

To reproduce:

git clone https://github.com/mwolson/tmp-aube-issues
cd tmp-aube-issues/pnpm-patch-plain-unified-diff
PNPM_BIN=/path/to/real/pnpm ./repro.sh

The script installs with native pnpm first and verifies the patch applied, then repeats with aube install. It exits 0 when aube applies the patch and non-zero when the issue is observed.

Workaround: prepend a diff --git a/<path> b/<path> line to each file section of the patch; aube then applies it (an index line is not required).

I did not find an existing discussion covering this; #383 was a different patch-application failure (CRLF handling, fixed by #384). The docs pages for patch / patch-commit do not currently document a required patch format, so if git-style-only is intentional, a docs callout would help pnpm migrations.

This report was written with the help of Claude.

[jdx]

Thanks for the detailed report and reproduction. This was aube assuming every patch section had a diff --git header, even though pnpm also accepts plain unified diffs that begin with --- / +++ headers.

PR #1021 fixes the parser to accept these patches while retaining the existing path-traversal and symlink protections. The follow-up coverage includes multi-file and multi-hunk patches, bare diff -u paths, additions/deletions, CRLF handling, and zero-count hunks. The supplied end-to-end reproduction now passes with the debug build, and CI currently has no reported failures.

This comment was generated by Codex.

[mwolson]

Retested with aube 1.31.0 (linux-x64, 2026-07-21) against the minimal repro in https://github.com/mwolson/tmp-aube-issues (pnpm-patch-plain-unified-diff).

repro.sh now exits 0: aube applies the plain unified-diff patch the same way native pnpm 11.15.1 does.

Fix shipped in aube 1.27.0 via #1021. Marking the maintainer reply as the answer.