Stop storing integrity for git dependencies
#525
Conversation
|
Would there be value in storing the git sha, since the URL might not contain it? |
ruyadorno
changed the title
integrity for git dependencies
the sha is already what gets stored in the |
|
will restate what I said in the meeting, half in jest but also half seriously: if this feature isn't working in a consistent way that accomplishes what it says it does, entirely removing it is imo potentially a candidate for a patch release. |
while this will not remove the values that are being ignored, it does ensure that we don't throw EINTEGRITY errors for git dependencies which expect a specific integrity value. see npm/rfcs#525
while this will not remove the values that are being ignored, it does ensure that we don't throw EINTEGRITY errors for git dependencies which expect a specific integrity value. see npm/rfcs#525
|
We run into the same problem today and now our ci pipline is stuck, because it does calculate a different hash than any other development machine. If we can help to test this issue, please let us know. The problem came with the upgrade from npm 8.1.2 -> 8.3.1 - so we downgraded and it looks better now. |
|
npm@8.5.2 no longer compares the stored integrity field to the generated data |
This is relevant for