pack does not resolve catalog: dependencies

[skoch13]

Summary

aube pack leaves catalog: dependency specifiers in the packed package.json, while pnpm 11.22.0 resolves them to concrete versions. This causes consumers such as @vscode/vsce to fail semver validation.

Reproduction

In a pnpm workspace containing a package with catalog dependencies:

{
  "devDependencies": {
    "@types/vscode": "catalog:",
    "@rspack/core": "catalog:"
  }
}

Run:

aube --dir path/to/package pack --pack-destination /tmp/aube-pack
pnpm --dir path/to/package pack --pack-destination /tmp/pnpm-pack

With aube 1.41.0, the packed manifest contains:

"@types/vscode": "catalog:"

With pnpm 11.22.0, it contains the resolved version, for example:

"@types/vscode": "1.105.0"

Both commands successfully create a tarball. The difference is only in the packed manifest.

Context

The project uses pnpm-workspace.yaml with a default catalog. The same behavior occurs when invoking pnpm through the aube shim; the shim resolves to aube 1.41.0.

Official aube documentation describes aube pack as matching pnpm pack, and pnpm documents replacing catalog: during pack/publish. Could you confirm whether this is a known limitation or bug, and whether catalog resolution is intended to be supported by aube pack?

Environment

• aube 1.41.0
• pnpm 11.22.0
• macOS arm64

[jdx]

Confirmed — this was a bug in aube’s pack manifest handling. aube pack copied package.json into the archive without applying the publish-time catalog transformation.

I opened PR #1334, which resolves default and named catalog: references in dependencies, devDependencies, optionalDependencies, and peerDependencies. The same transformation is shared with directory-based aube publish, and the source package.json remains unchanged.

Thanks for the clear reproduction.

AI-assisted — Tool: Codex; model: unavailable; version: unavailable.