Hoisted Yarn v1 install misses transitive dependency

[mwolson]

• Repro repo: https://github.com/mwolson/tmp-aube-issues
• Case: yarn-hoisted-transitive-dependency
• Observed with: aube 1.14.1 linux-x64 (2026-05-15)
• Native package manager used for control: Yarn classic 1.22.22
• Lockfile generated with: /usr/bin/yarn install --ignore-scripts
• Aube mode: --node-linker=hoisted

Summary

When aube installs from a Yarn v1 yarn.lock in hoisted mode, the resulting dependency tree can omit a transitive dependency that the installed package needs at runtime.

The reduced case uses magic-string@0.25.9, which declares sourcemap-codec as a dependency. Native Yarn classic installs the generated lockfile in a way that lets magic-string load successfully. Aube installs the same lockfile with --node-linker=hoisted, but magic-string fails when it tries to load sourcemap-codec.

Expected behavior

In hoisted mode, magic-string should be able to load its declared dependency sourcemap-codec.

Actual behavior

After:

aube install --frozen-lockfile --ignore-scripts --node-linker=hoisted --disable-global-virtual-store

this fails:

require("magic-string");

with:

Error: Cannot find module 'sourcemap-codec'
Require stack:
- .../node_modules/magic-string/dist/magic-string.cjs.js

sourcemap-codec is present in yarn.lock and is declared by magic-string.

Repro

git clone https://github.com/mwolson/tmp-aube-issues.git
cd tmp-aube-issues/yarn-hoisted-transitive-dependency

YARN_BIN=/usr/bin/yarn ./repro.sh

YARN_BIN should point to a real Yarn classic binary. If omitted, defaults to system yarn on PATH.

Notes

The repro uses --disable-global-virtual-store for the aube install. Without that, unrelated packages already present in the global virtual store can potentially mask missing dependency links.

This was originally noticed while testing a react-scripts@5.0.0 project in hoisted mode, where react-scripts failed to load react-dev-utils/crossSpawn. The current repro reduces that to a 15-line Yarn lockfile with magic-string@0.25.9.

[jdx]

Thanks for the reduced repro. I included this in #733.

The same Yarn classic parser bug was storing dependency values as full dep paths instead of dep-path tails, so linker reconstruction could miss declared transitives like sourcemap-codec, including in hoisted mode. The PR adds regression coverage for this case too.

This comment was generated by Codex.

[mwolson]

Fix confirmed in aube 1.15.0