Should the version of pnpm used to generate a shrinkwrap be checked in to vcs?

[vjpr]

This relates to reproducible builds.

I see a version key in shrinkwrap.yaml, and I assume this is the version of the shrinkwrap schema?

The issue is that different versions of pnpm may have bugs or install different trees. Without knowing what version of pnpm was used to generate the shrinkwrap file there is the possibility that you get into a situation where you cannot reproduce your build.

I understand the reasoning of not having it in shrinkwrap.yaml because of churn if two users use different pnpm versions. But maybe its worth including it so that a build can always be reproduced if necessary in the rare case.

[zkochan]

Good idea. There is currently a package-lock.json spec at npm and they also plan to have a created-with property.

[zkochan]

Published with v0.68.0.