@pnpm/crypto.shasums-file 1100.2.4 → 1100.2.5

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @pnpm/crypto.shasums-file
 
+## 1100.2.5
+
+### Patch Changes
+
+- Resolving a Node.js runtime now fails when unofficial-builds.nodejs.org cannot be reached. pnpm used to ignore that failure and leave the musl builds out of `pnpm-lock.yaml`. `pnpm update` then wrote a different lockfile on a machine whose network blocks the mirror [pnpm/pnpm#14813](https://github.com/pnpm/pnpm/issues/14813).
+
+- Updated dependencies:
+  - @pnpm/crypto.hash@1100.0.5
+
 ## 1100.2.4
 
 ### Patch Changes

package/lib/index.d.ts

@@ -1,3 +1,4 @@
+import { PnpmError } from '@pnpm/error';
 import type { FetchFromRegistry } from '@pnpm/fetching.types';
 import { RUNTIME_SHASUMS_DIR } from './diskCache.js';
 import { type ArmoredKey, fetchVerifiedNodeShasums } from './verifyNodeShasums.js';
@@ -42,4 +43,14 @@ export declare function fetchVerifiedNodeShasumsFileCached(fetch: FetchFromRegis
 export declare function fetchShasumsFileCached(fetch: FetchFromRegistry, shasumsUrl: string, opts?: FetchShasumsFileCachedOpts): Promise<ShasumsFileItem[]>;
 export declare function parseShasumsFile(shasumsFileContent: string): ShasumsFileItem[];
 export declare function fetchShasumsFileRaw(fetch: FetchFromRegistry, shasumsUrl: string): Promise<string>;
+/**
+ * A mirror answered a SHASUMS file request with a non-ok status. Callers that
+ * treat some statuses as expected (a mirror that never published a given
+ * release answers 404) match on {@link status}; every other failure mode
+ * reaches them as a plain fetch error.
+ */
+export declare class FetchShasumsFileError extends PnpmError {
+    readonly status: number;
+    constructor(shasumsUrl: string, status: number);
+}
 export declare function pickFileChecksumFromShasumsFile(body: string, fileName: string): string;

package/lib/index.js

@@ -75,11 +75,24 @@ export function parseShasumsFile(shasumsFileContent) {
 export async function fetchShasumsFileRaw(fetch, shasumsUrl) {
     const res = await fetch(shasumsUrl);
     if (!res.ok) {
-        throw new PnpmError('FAILED_DOWNLOAD_SHASUM_FILE', `Failed to fetch integrity file: ${shasumsUrl} (status: ${res.status})`);
+        throw new FetchShasumsFileError(shasumsUrl, res.status);
     }
     const body = await res.text();
     return body;
 }
+/**
+ * A mirror answered a SHASUMS file request with a non-ok status. Callers that
+ * treat some statuses as expected (a mirror that never published a given
+ * release answers 404) match on {@link status}; every other failure mode
+ * reaches them as a plain fetch error.
+ */
+export class FetchShasumsFileError extends PnpmError {
+    status;
+    constructor(shasumsUrl, status) {
+        super('FAILED_DOWNLOAD_SHASUM_FILE', `Failed to fetch integrity file: ${shasumsUrl} (status: ${status})`);
+        this.status = status;
+    }
+}
 const SHA256_REGEX = /^[a-f0-9]{64}$/;
 export function pickFileChecksumFromShasumsFile(body, fileName) {
     const line = body.split('\n').find(line => line.trim().endsWith(`  ${fileName}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/crypto.shasums-file",
-  "version": "1100.2.4",
+  "version": "1100.2.5",
   "description": "Utils for working with shasums files",
   "keywords": [
     "pnpm",
@@ -29,7 +29,7 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/crypto.hash": "1100.0.4",
+    "@pnpm/crypto.hash": "1100.0.5",
     "@pnpm/error": "1100.1.4",
     "@pnpm/fetching.types": "1100.0.3",
     "openpgp": "^6.3.1"
@@ -37,7 +37,7 @@
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@openpgp/web-stream-tools": "0.3.1",
-    "@pnpm/crypto.shasums-file": "1100.2.4"
+    "@pnpm/crypto.shasums-file": "1100.2.5"
   },
   "engines": {
     "node": ">=22.13"