hmm, would it catch people changing unrelated peerDeps? we…

hey @pnpm.io! question: is there an easy way to validate, given two pairs of package.json+lockfiles, that the second lockfile is purely a result of the changes in the package.json? we have CI that tries to check this to ensure incoming PRs aren’t tampering with the lockfile but it’s quite messy

2 25

pnpm 18 May

Yes, just update to pnpm 11.1.3 and you should be fine.

1 4

Samuel

@samuel.fm

hmm, would it catch people changing unrelated peerDeps? we basically want to validate that the lockfile has not been touch in any way, even if it's something like `pnpm dedupe`

1 3

pnpm 18 May

no, but all these additional checks make install slower. Hence I am not sure we will do anything non-security related by default. This is more like a correctness check.

1 3

Samuel 18 May

completely fair - just wondering if there’s a built-in way to run this correctionness check in CI! no worries if not, just thought I’d ask :)

not at the moment

🫡 thank you regardless, we just switched the bluesky app to pnpm and it’s like a breath of fresh air after being stuck on yarn 1 so long

3 1 10