pnpm v10 patched dependency hash downgraded from SHA256 to MD5

[Silic0nS0ldier]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

npm

Package manager version

pnpm 10

Language version

No response

Manifest location and content before the Dependabot update

• pnpm-workspace.yaml
• pnpm-lock.yaml
• package.json
• extension/package.json
• packages/git/package.json
• build_defs/rollup_bundle/package.json
• build_defs/vsce_package/package.json

dependabot.yml content

• .github/dependabot.yaml

Updated dependency

rollup from 4.34.8 to 4.34.9.
@types/node from 22.13.7 to 22.13.8 (issue observed in 2 PRs, the merge commit for this applied the downgrade to main branch, note this particular change is also affected by #11837).

What you expected to see, versus what you actually saw

Hash for patched dependency watcher@2.3.1 to be untouched.

Native package manager behavior

Untouched SHA256 hash for watcher@2.3.1 (prior to pnpm v9 this was an MD5 hash).

Images of the diff or a link to the PR, issue, or logs

Silic0nS0ldier/vscode-git-monolithic-extension#90
Silic0nS0ldier/vscode-git-monolithic-extension#89 (downgrade merged here)

Smallest manifest that reproduces the issue

// package.json
{
    "dependencies": {
        "watcher": "2.3.1"
    },
    "pnpm": {
        "patchedDependencies": {
            "watcher@2.3.1": "patches/watcher@2.3.1.patch"
        }
    }
}

patches/watcher@2.3.1.patch

[robaiken]

Hi @Silic0nS0ldier. We don't officially support pnpm 10 yet. Looks like @yeikel started working on this in PR #11434, but I'm not sure where things stand with it now.

If anyone from the community wants to jump in and help finish the pnpm 10 support, that would be awesome! Happy to lend a hand with this too if it helps get this released.

[scul946]

Here is another issue dealing with the pnpm 10 support: #11246

[robaiken]

@Silic0nS0ldier Can you confirm that this is still an issue since the pnpm 10.11.1 release?

[Silic0nS0ldier]

I can confirm the issue has been fixed.