Bun top-level patchedDependencies is not applied when installing from bun.lock

[mwolson]

• Repro: https://github.com/mwolson/tmp-aube-issues/tree/main/bun-patched-dependencies
• Observed with: aube 1.14.1 linux-x64 (2026-05-15)
• Bun used to validate expected behavior: 1.3.14

Summary

When a project uses Bun's top-level patchedDependencies field, native Bun applies the patch during install, but aube does not appear to apply it when installing from the same package.json and text bun.lock.

The aube config docs show patch support through aube.patchedDependencies / pnpm.patchedDependencies, but the Bun rollout docs do not mention whether Bun's top-level patchedDependencies field is intentionally supported or unsupported.

Repro

git clone https://github.com/mwolson/tmp-aube-issues.git
cd tmp-aube-issues/bun-patched-dependencies
./repro.sh

If bun is shimmed locally, the script also accepts an explicit native Bun path:

BUN_BIN=/path/to/real/bun ./repro.sh

Expected

Both native Bun and aube install is-number@7.0.0 with the patch applied. The repro patch changes numeric handling so isNumber(41) is false and isNumber(42) is true.

Actual

Native Bun applies the patch. Aube installs successfully, but the package remains unpatched:

aube did not apply Bun patchedDependencies

This showed up in a real Bun project as a missing patched export from effect@4.0.0-beta.59 after aube install.

[jdx]

Thanks for the clear repro. I tracked this down to install-time patch loading only reading pnpm.patchedDependencies, aube.patchedDependencies, and workspace-yaml entries from the manifest side. The Bun lockfile parser preserved the top-level patchedDependencies, but the linker never saw Bun-only package.json#patchedDependencies declarations.

I opened #724 to fix it. That PR reads Bun top-level patchedDependencies, keeps the existing precedence (bun < pnpm/aube < workspace yaml), and adds both unit coverage and an install-level Bun fixture regression. I also ran your linked repro against the local debug build and it passes with the patch.

This comment was generated by Codex.

[mwolson]

Fix confirmed in aube 1.15.0