-
-
Notifications
You must be signed in to change notification settings - Fork 1.4k
Labels
Description
Verify latest release
- I verified that the issue exists in the latest pnpm release
pnpm version
10.31
Which area(s) of pnpm are affected? (leave empty if unsure)
Lockfile
Link to the code that reproduces this issue or a replay of the bug
No response
Reproduction steps
- manually change
lockfileVersioninpnpm-lock.yamlto an older version eg.lockfileVersion: 1.0 - run
CI=1 pnpm ci
Describe the Bug
when the lockfile is not compatible with the current version of pnpm, it should definitely be an error instead of a warning when run in CI:
$ CI=1 pnpm i
WARN Ignoring not compatible lockfile at /project/pnpm-lock.yaml
Progress: resolved 1, reused 0, downloaded 0, added 0
WARN deprecated eslint@8.57.1: This version is no longer supported. Please see https://eslint.org/version-support for other options.
Progress: resolved 45, reused 45, downloaded 0, added 0
otherwise the warning will never be noticed by anyone which is a security issue because unverified versions of dependencies will be installed without the user's knowledge. this completely defeats the point of having a lockfile
Expected Behavior
an error is reported and the command exits with a non-zero exit code before installing anything
Which Node.js version are you using?
24.14.0
Which operating systems have you used?
- macOS
- Windows
- Linux
If your OS is a Linux based, which one it is? (Include the version if relevant)
ubuntu
Reactions are currently unavailable