mirror/pnpm
1
0
Fork 0
mirror of https://github.com/pnpm/pnpm.git synced 2026-04-03 15:01:48 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: improve the error messages related to trustPolicy mismatch (#10203)

Browse Source 
---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
This commit is contained in:
btea
2025-11-22 09:35:19 +08:00
committed by Zoltan Kochan
parent 8695e49dc2
commit 287712d833
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/public-feet-hide.md Normal file
View File

@@ -0,0 +1,5 @@
---
"@pnpm/npm-resolver": patch
---
Improve the error messages related to `trustPolicy` mismatch.

4
resolving/npm-resolver/src/trustChecks.ts
View File

@@ -52,7 +52,9 @@ export function failIfTrustDowngraded (
'TRUST_DOWNGRADE',
`High-risk trust downgrade for "${meta.name}@${version}" (possible package takeover)`,
{
hint: `Earlier versions had ${prettyPrintTrustEvidence(strongestEvidencePriorToRequestedVersion)}, ` +
hint: 'Trust checks are based solely on publish date, not semver. ' +
'A package cannot be installed if any earlier-published version had stronger trust evidence. ' +
`Earlier versions had ${prettyPrintTrustEvidence(strongestEvidencePriorToRequestedVersion)}, ` +
`but this version has ${prettyPrintTrustEvidence(currentTrustEvidence)}. ` +
'A trust downgrade may indicate a supply chain incident.',
}