Different integrity hashes

[hrasekj]

Hello,

why does PNPM use both SHA1 and SHA512 hashes in its lockfile? I notice that some packages use SHA1 while others use SHA512 for integrity checks. What's the reason behind using these two different hash algorithms?

Also, when updating packages, I noticed that some integrity hashes get rewritten from SHA1 to SHA512. Is this normal behavior?

[zkochan]

pnpm uses whatever is provided in the package document returned by the registry. SHA512 is preferred. If you get SHA1 it means that's the only checksum the registry have returned.

[hrasekj]

Ok, that means npm registry changed the integrity checksum hash itself? And when checked for updates, my lock file was updated too? 🤔