diff --git a/.changeset/public-feet-hide.md b/.changeset/public-feet-hide.md new file mode 100644 index 0000000000..ef8c7556c3 --- /dev/null +++ b/.changeset/public-feet-hide.md @@ -0,0 +1,5 @@ +--- +"@pnpm/npm-resolver": patch +--- + +Improve the error messages related to `trustPolicy` mismatch. diff --git a/resolving/npm-resolver/src/trustChecks.ts b/resolving/npm-resolver/src/trustChecks.ts index 3b9fdaeb5f..9416e409c7 100644 --- a/resolving/npm-resolver/src/trustChecks.ts +++ b/resolving/npm-resolver/src/trustChecks.ts @@ -52,7 +52,9 @@ export function failIfTrustDowngraded ( 'TRUST_DOWNGRADE', `High-risk trust downgrade for "${meta.name}@${version}" (possible package takeover)`, { - hint: `Earlier versions had ${prettyPrintTrustEvidence(strongestEvidencePriorToRequestedVersion)}, ` + + hint: 'Trust checks are based solely on publish date, not semver. ' + + 'A package cannot be installed if any earlier-published version had stronger trust evidence. ' + + `Earlier versions had ${prettyPrintTrustEvidence(strongestEvidencePriorToRequestedVersion)}, ` + `but this version has ${prettyPrintTrustEvidence(currentTrustEvidence)}. ` + 'A trust downgrade may indicate a supply chain incident.', }