aube writes catalog: into pnpm-lock.yaml overrides and importer specifiers

[mwolson]

• aube: 1.41.0 linux-x64 (2026-08-16)
• pnpm: 11.22.0 (CLI reports 11.10.0 for the same binary)
• OS: Linux x64
• Case: https://github.com/mwolson/tmp-aube-issues/tree/main/pnpm-catalog-override-lock-write
• Script: https://github.com/mwolson/tmp-aube-issues/blob/main/pnpm-catalog-override-lock-write/repro.sh

pnpm 11 resolves catalog: before it writes pnpm-lock.yaml. With a workspace catalog of is-number: 7.0.0 and overrides: { is-number: "catalog:" }, a pnpm lockfile stores:

overrides:
  is-number: 7.0.0

and the importer records specifier: 7.0.0, even though package.json still says "is-number": "catalog:".

#249 already taught aube to read that shape, so aube install --frozen-lockfile accepts a pnpm-written lockfile. The writer still emits the raw catalog: string. After aube add or a non-frozen aube install that rewrites the lock, official pnpm frozen CI dies:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
The current "overrides" configuration doesn't match the value found in the lockfile

Restore only the overrides map to 7.0.0 and the next error is the importer specifier:

ERR_PNPM_OUTDATED_LOCKFILE
* 1 dependencies are mismatched:
  - is-number (lockfile: catalog:, manifest: 7.0.0)

aube frozen-installs its own rewrite. The lockfile is only toxic to real pnpm.

I hit this adding a single package in a catalog-heavy monorepo whose GitHub vp install uses official pnpm 11. Grafting the new package onto the previous pnpm-shaped lockfile made CI green again.

Reproduction

From the case directory, with PNPM_BIN or AUBESHIM_REAL_PNPM pointed at real pnpm:

git clone https://github.com/mwolson/tmp-aube-issues.git
cd tmp-aube-issues/pnpm-catalog-override-lock-write
./repro.sh

The script exits 1 on aube 1.41.0. It first lets pnpm write a green lockfile, then runs aube add --filter app is-odd@3.0.1, and checks both error layers. is-odd is only there to force a lockfile write. A non-frozen aube install after adding that dep to the manifest by hand does the same rewrite.

Equivalent by hand:

mkdir -p repro/packages/app && cd repro

cat > package.json <<'EOF'
{ "name": "catalog-override-lock-write", "private": true }
EOF

cat > pnpm-workspace.yaml <<'EOF'
packages:
  - "packages/*"

catalog:
  is-number: 7.0.0

overrides:
  is-number: "catalog:"
EOF

cat > packages/app/package.json <<'EOF'
{
  "name": "app",
  "version": "1.0.0",
  "private": true,
  "devDependencies": {
    "is-number": "catalog:"
  }
}
EOF

# Real pnpm, not an aube/aubeshim shim.
CI=1 pnpm install --ignore-scripts --lockfile-only
CI=1 pnpm install --frozen-lockfile --ignore-scripts   # ok

aube add --filter app is-odd@3.0.1 --ignore-scripts
CI=1 pnpm install --frozen-lockfile --ignore-scripts   # LOCKFILE_CONFIG_MISMATCH
aube install --frozen-lockfile --ignore-scripts        # ok

Expected

When aube writes pnpm-lock.yaml, emit the same catalog-resolved override value and importer specifier that pnpm writes, and that #249 already treats as fresh on the way in.

Related

• Bugs affecting complex pnpm workspaces #174 (the --frozen-lockfile rejects catalog: references in overrides comment)
• lockfile: resolve catalog: in overrides + honor override-rewritten importer specs #249 (read-path only: resolve catalog: when comparing, accept override-rewritten importer specs)

[jdx]

Confirmed and fixed in PR #1344.

The resolver already expanded the catalog override for package resolution, but the lockfile graph retained the raw override map and original importer specifier. The fix now stores catalog-expanded override metadata and the effective override target for direct importers, while preserving catalog: for ordinary catalog dependencies where no override fires.

I ran the provided reproduction against the current debug build with pnpm 11.22.0. It now reports:

native pnpm accepted aube’s rewritten lockfile
pass: aube wrote catalog-resolved override and importer specifiers

Thanks for the especially clear two-layer reproduction.

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.

[mwolson]

Retested with aube 2.2.0 (linux-x64, 2026-08-25) against the minimal repro in https://github.com/mwolson/tmp-aube-issues (pnpm-catalog-override-lock-write).

repro.sh now exits 0: after aube add --filter app is-odd@3.0.1, the rewritten pnpm-lock.yaml stores overrides: { is-number: 7.0.0 } and importer specifier: 7.0.0, and a subsequent native pnpm 11.22.0 --frozen-lockfile install succeeds.

Fix shipped in aube 2.0.1 via #1344 catalog-overrides-pnpm-output. Marking the maintainer reply as the answer.