Update packageManager hash

[karlhorky]

Tell us more.

I recently learned from @viceice that Corepack adds a hash to the packageManager field in package.json:

   "packageManager": "[email protected]+sha512.14e915759c11f77eac07faba4d019c193ec8637229e62ec99eefb7cf3c3b75c64447882b7c485142451ee3a6b408059cdfb7b7fa0341b975f12d0f7629c71195"

Since [email protected] (PRs nodejs/corepack#413 and nodejs/corepack#291), this is performed:

1. Automatically when any pnpm or yarn command is run, when no packageManager field present in package.json
2. On demand, when corepack use <package manager>@<version> is run, also when there is a packageManager field present in package.json

Proposal

During Renovate updates of a package in the packageManager field: if a hash is found in the packageManager version, upgrade that hash version as well, eg. using corepack use <package manager>@<version>

Alternatives Considered

Another new GitHub Actions workflow, similar to my other GitHub Actions workflows:

• upgrading pnpm patch versions on automatic Renovate dependency upgrades
• fix for link: protocol
• npm Overrides (before it was supported)

[rarkins]

We should definitely add this.

Is it possible that Renovate can determine the sha on its own without requiring to run corepack?

If not, then is it ok for Renovate to partially update on its own like it does today (e.g. bump to [email protected]) and then run corepack use [email protected] and corepack will detect the mismatched SHA and change it?

[karlhorky]

Is it possible that Renovate can determine the sha on its own without requiring to run corepack?

Maybe npm show ... dist.shasum could be an alternative way to compute the hash?

• Feature request: instructions on how to determine the hash for the packageManager field in package.json nodejs/corepack#231 (comment)

[karlhorky]

If not, then is it ok for Renovate to partially update on its own like it does today (e.g. bump to [email protected]) and then run corepack use [email protected] and corepack will detect the mismatched SHA and change it?

Yes, I tested this to be working

[rarkins]

In that case let's stick with your idea for "corepack use" as part of Renovate's artifact updating. One downside is that Renovate has different codepaths for npm, yarn and pnpm so we'll need to put it in a common utils so they don't repeat unnecessarily

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

To get started, please read our guide on creating a minimal reproduction.

Good luck,

The Renovate team