Ranged catalog: override makes aube write a version specifier that pnpm rejects

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: pnpm-catalog-ranged-override-specifier
• aube: 2.8.1 linux-x64 (2026-10-20) (also 2.7.2)

The root depends on "is-odd": "catalog:", with this pnpm-workspace.yaml:

catalog:
  is-odd: 3.0.1

overrides:
  "is-odd@^3": "catalog:"

Starting from a pnpm-written lockfile without the dependency, aube install --lockfile-only writes the importer entry as specifier: 3.0.1. pnpm 11.10.0 and 12.14.0 write specifier: 'catalog:', and both reject the aube-written lockfile in install --frozen-lockfile:

ERR_PNPM_OUTDATED_LOCKFILE
  - is-odd (lockfile: 3.0.1, manifest: catalog:)

PNPM_BIN=/path/to/real/pnpm ./repro.sh

A related difference: with an override that has no range (is-number: "catalog:"), pnpm leaves is-number out of catalogs: and aube 2.8.1 still lists it. #1788 may not cover the case where the override value is catalog: itself.

I found this in pingdotgg/t3code, where "undici@^8": "catalog:" made pnpm reject the lockfile after an aube add in another workspace package.

[jdx]

Thanks for the repro. #1816 fixes both cases.

The root cause was that aube expanded catalog: to the catalog version before matching overrides, so is-odd@^3 matched 3.0.1. pnpm matches the selector against the manifest text (catalog:), so a ranged override never applies to a catalog: dependency. aube now does the same, which keeps specifier: 'catalog:' in the importer. Separately, an entry that an override points at via catalog: is no longer listed under catalogs:, matching pnpm.

I compared the generated pnpm-lock.yaml against pnpm 12.9.1 on 10 setups (ranged and unranged overrides, link:, npm: aliases) and it was byte-identical in all of them. I did not check pnpm 11.x. One side effect: a lockfile aube wrote earlier with specifier: 3.0.1 now reads as outdated and is rewritten on the next install.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[mwolson]

Retested with aube 2.8.2 linux-x64 (2026-10-23):

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: pnpm-catalog-ranged-override-specifier

PNPM_BIN=/path/to/real/pnpm ./repro.sh

It now exits 0 with native pnpm 12.14.0 as the control. aube keeps the importer specifier: 'catalog:', and pnpm 12.14.0 install --frozen-lockfile accepts the aube-written lockfile.

Fix shipped in aube 2.8.2 via #1816. Marking your reply as the answer.