Yarn v1 lockfile install misses declared scoped dependency

[mwolson]

• Repro repo: https://github.com/mwolson/tmp-aube-issues
• Case: yarn-scoped-dependency-linking
• Observed with: aube 1.14.1 linux-x64 (2026-05-15)
• Native package manager used for control: Yarn classic 1.22.22
• Lockfile generated with: /usr/bin/yarn install --ignore-scripts

Summary

When aube installs from a Yarn v1 yarn.lock, the resulting dependency tree can miss a declared scoped dependency of another package.

The reduced case uses @rollup/plugin-replace@2.4.1, which declares @rollup/pluginutils as a dependency. Native Yarn classic installs the generated lockfile in a way that lets @rollup/plugin-replace load successfully. Aube installs the same lockfile, but @rollup/plugin-replace fails when it tries to load @rollup/pluginutils.

(To clarify just in case - I am not assuming that aube intends to preserve Yarn or npm-style top-level phantom dependency access. This case is narrower: the missing package is a declared dependency of the package that is requiring it.)

Expected behavior

Either:

1. @rollup/pluginutils should be linked so @rollup/plugin-replace can load its own declared dependency, or
2. if this Yarn v1 scoped-dependency shape is intentionally unsupported, aube should ideally document that limitation.

Actual behavior

After:

aube install --frozen-lockfile --ignore-scripts --disable-global-virtual-store

this fails:

require("@rollup/plugin-replace");

with:

Error: Cannot find module '@rollup/pluginutils'
Require stack:
- .../node_modules/.aube/@rollup+plugin-replace@2.4.1/node_modules/@rollup/plugin-replace/dist/rollup-plugin-replace.cjs.js

@rollup/pluginutils is present in yarn.lock and is declared by @rollup/plugin-replace.

Repro

git clone https://github.com/mwolson/tmp-aube-issues.git
cd tmp-aube-issues/yarn-scoped-dependency-linking

YARN_BIN=/usr/bin/yarn ./repro.sh

YARN_BIN should point to a real Yarn classic binary. If omitted, system yarn from PATH is used.

Notes

The repro uses --disable-global-virtual-store for the aube install. Without that, an unrelated package already present in the global virtual store can mask the failure by making a compatible scoped package reachable through the shared store’s parent-directory resolution path.

This was originally noticed in a react-scripts@5.0.0 build path involving workbox-build, where workbox-build failed to load its declared dependency @apideck/better-ajv-errors. The current repro reduces that to a much smaller scoped-dependency case.

[jdx]

Thanks for the reduced repro. I opened #733 for this.

The fix unquotes Yarn classic dependency keys and normalizes parsed dependency edges to dep-path tails, so scoped dependencies like @rollup/pluginutils are linked under the package that declares them.

This comment was generated by Codex.

[mwolson]

Fix confirmed in aube 1.15.0