Conversation
m-maillot
temporarily deployed
to
build-preproduction
GitHub Actions
Inactive
revu-bot
left a comment
revu-bot
left a comment
There was a problem hiding this comment.
pnpm Update: 10.24.0 → 10.33.0
This PR updates the packageManager field in package.json to bump pnpm from 10.24.0 to 10.33.0 with an integrity hash.
| File | Lines | Severity | Issue | Action |
|---|---|---|---|---|
package.json |
54 | CRITICAL | Integrity hash appears truncated | Verify and replace with the correct full hash |
Overall Assessment
The update is straightforward and follows the correct pattern of pinning both the version and an integrity hash via Corepack. However, the SHA-512 hash included in the packageManager field appears to be truncated, which is a correctness concern that could cause Corepack verification to fail or silently pass with a wrong hash.
| }, | ||
| "version": "0.0.0", | ||
| "packageManager": "pnpm@10.24.0" | ||
| "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319" |
There was a problem hiding this comment.
[CRITICAL] Integrity hash appears truncated
The SHA-512 hash appended to the packageManager field looks incomplete. A valid SHA-512 digest encoded in hex is 128 characters long; the one present here is only 126 characters:
10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319
Why it matters:
- Corepack uses this hash to verify the downloaded pnpm binary. A truncated hash will either fail verification outright or — depending on the Corepack version — silently skip it, defeating the purpose of pinning the hash.
- CI/CD pipelines relying on Corepack integrity checks could break or be bypassed.
How to get the correct value:
Run the following command locally and copy the output directly into package.json:
corepack use pnpm@10.33.0Corepack will rewrite the packageManager field with the verified, full-length hash. Alternatively, check the official pnpm release page for the published SHA-512 checksum.
|
|
🎉 Deployment for commit 778cb73 : IngressesDocker images
|
3 participants
No description provided.