From e11702f1f1599d7f6abb076cce8bf91e4e11c2b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Tue, 20 Jan 2026 09:09:32 +0100 Subject: [PATCH] prefetch-npm-deps: exclude deprecated field from packument whitelist The 'deprecated' field can be modified by package maintainers at any time via 'npm deprecate', even for already-published versions. This causes hash mismatches when the npm registry adds deprecation notices to packages that were previously not deprecated. For lockfile-based installs, the version is already resolved, so the deprecation hint used by npm-pick-manifest for version selection is not needed. The only behavioral change is that users won't see deprecation warnings during 'npm install', which is an acceptable tradeoff for reproducible builds. This was discovered when tar@7.5.2 was deprecated upstream, breaking builds in downstream projects using fetcherVersion=2. --- pkgs/build-support/node/prefetch-npm-deps/src/main.rs | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/build-support/node/prefetch-npm-deps/src/main.rs b/pkgs/build-support/node/prefetch-npm-deps/src/main.rs index 53cc075bfdc0..5ab0413cdcad 100644 --- a/pkgs/build-support/node/prefetch-npm-deps/src/main.rs +++ b/pkgs/build-support/node/prefetch-npm-deps/src/main.rs @@ -65,8 +65,6 @@ const ALLOWED_VERSION_FIELDS: &[&str] = &[ "cpu", // Lifecycle scripts "scripts", - // Version selection hint (npm-pick-manifest) - "deprecated", ]; fn normalize_packument(