Rewriting a pnpm 12 lockfile drops the leading packageManagerDependencies document

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: pnpm12-package-manager-document-drop
• aube: 2.8.2 linux-x64 (2026-10-23)

When package.json has "packageManager": "pnpm@12.14.0", pnpm 12 writes pnpm-lock.yaml as two YAML documents. The first records packageManagerDependencies for pnpm itself. aube reads this shape (#116), but aube add is-number@7.0.0 writes only the project document. pnpm 12.14.0 install --frozen-lockfile then fails with ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE ("Cannot update packageManagerDependencies with "frozen-lockfile" because the lockfile is not up to date"). pnpm's own add keeps the document.

PNPM_BIN=/path/to/real/pnpm ./repro.sh

Putting the original first document back makes pnpm accept the rest. Found in pingdotgg/t3code.

[jdx]

Opened a fix: #1842 — rewrites now keep pnpm's leading packageManagerDependencies/configDependencies document verbatim. Thanks to mwolson for the report and the original patch.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[github-actions[bot]]

Implemented in #1842: fix(lockfile): keep pnpm's leading environment document on rewrite