prefetch-npm-deps: exclude deprecated field from packument whitelist

The 'deprecated' field can be modified by package maintainers at any time
via 'npm deprecate', even for already-published versions. This causes
hash mismatches when the npm registry adds deprecation notices to packages
that were previously not deprecated.

For lockfile-based installs, the version is already resolved, so the
deprecation hint used by npm-pick-manifest for version selection is not
needed. The only behavioral change is that users won't see deprecation
warnings during 'npm install', which is an acceptable tradeoff for
reproducible builds.

This was discovered when tar@7.5.2 was deprecated upstream, breaking
builds in downstream projects using fetcherVersion=2.

This commit is contained in:

Jörg Thalheim

2026-01-20 09:11:24 +01:00

parent 4f8f31a0fd

commit e11702f1f1

1 changed files with 0 additions and 2 deletions

									
										pkgs/build-support/node/prefetch-npm-deps/src/main.rs
									
		-2
	
												View File
												
				@@ -65,8 +65,6 @@ const ALLOWED_VERSION_FIELDS: &[&str] = &[

				    "cpu",

				    // Lifecycle scripts

				    "scripts",

				    // Version selection hint (npm-pick-manifest)

				    "deprecated",

				];

				fn normalize_packument(