v1.21.0: Sharper pnpm lockfile parity

A pnpm-parity polish release: lockfiles now carry the two top-level integrity checksums pnpm writes, root projects under sharedWorkspaceLockfile: false get their own lockfile back, and a handful of install correctness/UX bugs around peer-suffixed source deps and the progress bar are squared away.

Added

• packageExtensionsChecksum and pnpmfileChecksum in pnpm-lock.yaml (#883 by @rubnogueira) — aube now computes and emits the two top-level integrity keys pnpm uses to guard the effective packageExtensions map and the active .pnpmfile.cjs/.pnpmfile.mjs. The implementation is a faithful Rust port of the object-hash npm package with pnpm's exact options (respectType: false, sha256, base64, unordered arrays/objects/sets), placed immediately after overrides: and before importers: with the right blank-line separation. The result is byte-identical to pnpm on real workspaces, so round-tripping a lockfile between pnpm and aube no longer produces a gratuitous diff. aube-lock.yaml output is unchanged, and workspaces without packageExtensions or a pnpmfile omit the keys entirely. A new WARN_AUBE_PNPMFILE_CHECKSUM_FAILED covers the best-effort case where a pnpmfile can't be read for hashing.

Fixed

• Source deps with peer context no longer crash linking (#885 by @rubnogueira) — Fresh aube install --force runs that pulled a git or remote-tarball dependency which acquired a peer-context suffix (e.g. some-pkg@git+<sha>(react@18.2.0)) could fail with ERR_AUBE_MISSING_PACKAGE_INDEX. The streaming fetch keys those indices under the canonical source coordinate, but the resolver's peer-context post-pass rewrites the dep_path to include (peer@ver) or a hashed _<10hex> marker; remap_indices_to_contextualized never stripped the suffix back off, so the index was dropped. It now strips both suffix forms to recover the canonical key.

• Root workspace lockfile written under sharedWorkspaceLockfile: false (#882 by @rubnogueira) — The per-project lockfile writer explicitly skipped the . importer, so the root's own pnpm-lock.yaml (containing the root package's dependencies) silently disappeared after install. The root is now written like any other project, resolving to the workspace root directory, with existing-format preservation intact — no surprise aube-lock.yaml next to a pnpm-lock.yaml. Filtered installs additionally only rewrite lockfiles for the selected project(s). This brings the per-project path in line with pnpm's shared-workspace-lockfile=false behavior.

• Progress bar no longer overshoots on workspace:/link: deps (#884 by @rubnogueira) — A monorepo install (most visibly after aube clean) could finish with reused > resolved and emit WARN_AUBE_PROGRESS_OVERFLOW. Link deps were credited to reused once in the streaming pass and then a second time by the post-filter_graph catch-up fetch, which selected work purely by absence from indices — and link deps never populate indices. The catch-up is now scoped to non-local packages (where it belongs), and the CI summary clamps reused + downloaded <= resolved as a guard against future counter races.

• @endevco/aube npm scope restored (#887 by @jdx) — The npm publish identity was inadvertently renamed to @jdx/aube in the v1.18.2 path, but that package isn't published, breaking publish-npm. The root package, generated platform sub-packages (@endevco/aube-<os>-<arch>), the preinstall lookup, and install docs are all back on @endevco, matching what users actually install.

Full Changelog: v1.20.0...v1.21.0

💚 Sponsor aube

aube is part of jdx.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.