https://github.com/johnpyp/2026-04-23-aube-bun-lock-regression-matrix#observed-incorrectness-examples

Repro'd with aube v1.0.0 (https://github.com/endevco/aube.git#b170aa30)

TLDR findings:

• aube install should preserve Bun’s bun.lock byte-for-byte, but several cases either fail install or rewrite the lock differently from Bun.
• bun install --force does not mutate the same starting lockfiles, so the aube install --force churn is not Bun’s own forced-install behavior.

Specifier handling failures (when an existing bun.lock is present):

• file: directory deps are treated as registry tarballs.
• file: local tarballs are treated as registry tarballs.
• HTTP tarball deps are treated as registry tarballs.
• GitHub shorthand deps are treated as registry tarballs.
• workspace:* deps can be treated as registry tarballs *not all cases

Lock metadata loss:

• overrides can be dropped by plain aube install seen in real repo
• catalog / catalogs are dropped when Aube rewrites seen in real repo
• patchedDependencies are dropped when Aube rewrites seen in real repo
• trustedDependencies are dropped when Aube rewrite seen in real repo
• workspace package entries like sample-app@workspace:packages/app can be dropped.

Package entry churn:

• npm aliases are serialized incorrectly: Bun writes alias target identity, Aube writes alias name identity. seen in real repo
• peer deps are collapsed into concrete deps. seen in real repo
• optional peer metadata is removed. seen in real repo
• bin metadata changes shape, e.g. string to object. seen in real repo
• optional platform packages are pruned to the current platform. seen in real repo
• retained platform package entries can lose os / cpu metadata.
• transitive versions can change during rewrite, e.g. electron-to-chromium@1.5.344 becomes 1.5.343. seen in real repo

Repro and findings all generated by GPT-5.5. I've seen many these issues in my own repo, and the rest all seem legit too afaict