lodash.defaults invalid checksum

[shellscape]

pnpm version: 5.17.1

Code to reproduce the issue:

This happens in CI, so I'm not able to provide debug output. We have lodash.kebabcase installed as a devDep. Upon running pnpm install we receive ERROR  Got unexpected checksum for "https://registry.npmjs.org/lodash.defaults/-/lodash.defaults-4.2.0.tgz". Wanted "sha1-+wMJF/hqMTTlvJvsDWngAT3f7bI=". Got "sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ== sha1-0JF4cW/+pN3p5ft7N/bwgCJ0WAw=".

Expected behavior:

Successful install.

Actual behavior:

See above

Additional information:

Worth noting that npm install doesn't seem to share the same behavior.

• node -v prints: 14.15.3
• Windows, macOS, or Linux?: Linux

[zkochan]

What happens locally? Maybe there was some merge conflict and the checksum of a different package got resolved to lodash.defaults. Try to remove the lockfile and node_modules and run pnpm install

[shellscape]

I attempted to remove the lockfile and ran pnpm install again to regenerate it several times. Removed the dependency and added it back again. The only thing that worked for me was editing the lock file manually to update the sha type and signature. We haven't seen that issue since, but it was a weird one. I suppose we can close this one now, but I couldn't consider it resolved. Perhaps a temporary glitch.

[zkochan]

We probably can add some more sophisticated error logging for this.

[zkochan]

It seems like a merge conflict issue.

That wanted checksum is for the lodash.flattendeep@4.4.0 package.

[zkochan]

related #3188

[zkochan]

closing in favor of #3188

[zkochan]

🚢 5.18.5

[shellscape]

@zkochan thank you!