pnpm version:

8.1.0

Code to reproduce the issue:

pnpm install mydep with lockfile-include-tarball-url=false in local .npmrc

Expected behavior:

pnpm install mydep should never add a tarball field to new or updated dependency entries in pnpm-lock.yaml

Actual behavior:

pnpm install sometimes adds a tarball field to new or updated dependency entries, sometimes not: it is inconsistent and flaky.

Additional information:

• node -v prints:
• 16.20.0
• Windows, macOS, or Linux?:
  macOS