completely fair - just wondering if there’s a built-in way…

hey @pnpm.io! question: is there an easy way to validate, given two pairs of package.json+lockfiles, that the second lockfile is purely a result of the changes in the package.json? we have CI that tries to check this to ensure incoming PRs aren’t tampering with the lockfile but it’s quite messy

2 25

pnpm 18 May

Yes, just update to pnpm 11.1.3 and you should be fine.

1 4

Samuel 18 May

hmm, would it catch people changing unrelated peerDeps? we basically want to validate that the lockfile has not been touch in any way, even if it's something like `pnpm dedupe`

1 3

pnpm 18 May

no, but all these additional checks make install slower. Hence I am not sure we will do anything non-security related by default. This is more like a correctness check.

1 3

Samuel

@samuel.fm

completely fair - just wondering if there’s a built-in way to run this correctionness check in CI! no worries if not, just thought I’d ask :)

not at the moment

🫡 thank you regardless, we just switched the bluesky app to pnpm and it’s like a breath of fresh air after being stuck on yarn 1 so long

3 1 10