Repository navigation
Node.js LTS rollout of minimum Corepack 0.31.0? #627
Description
Issue
New releases of pnpm and npm signed with the new npm "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U" published to https://registry.npmjs.org/-/npm/v1/keys cannot be installed with the version of Corepack currently distributed with Node.js LTS versions without using workarounds.
For instance,
corepack install -g pnpm@9executed using Node.js 22.13.1 Active LTS (with bundled corepack@0.30.0) on Ubuntu 24.04.1 LTS results in the error "Cannot find matching keyid":
$ corepack install -g pnpm@9
Installing pnpm@9.15.5...
Internal Error: Cannot find matching keyid: {"signatures":[{"sig":"MEQCIHGqHbvc2zImUPEPFpT4grh6rMYslel+lAjFArx8+RUdAiBfnJA+bgmUvO5Lctfkq+46KKDQdx/8RhLPge3pA+EdHA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"keys":[{"expires":null,"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="}]}
-
The same problem can be expected to affect any new releases of Yarn Modern aka berry.Yarn v1 Classic is frozen, but could also be affected if security fixes are released. -
Also older releases of pnpm are currently affected. See Please don't make error of fetching latest version information if packageManager field is specified. #625.
Request
Please clarify if minimum corepack@0.31.0 will be rolled out to Node.js Maintenance and Active LTS status versions 18.x, 20.x and 22.x.
Note: corepack@0.31.0 is already rolled out in the Current Node.js 23.7.0 version.
Related
- Newly published versions of package managers distributed from npm cannot be installed due to key id mismatch #612
- Safeguards for keyid mismatch #616
Workaround
In some situations it is possible to follow the README > Manual Installs section and execute the following to pull in a corrected version of Corepack with updated keys from https://registry.npmjs.org/-/npm/v1/keys:
npm install -g corepack@0.31.0Status
- Node.js
18.x(Maintenance LTS) - Node.js
20.x(Maintenance LTS) - Node.js
22.x(Active LTS)
Activity
MikeMcC399 commentedon Feb 3, 2025
MikeMcC399 commentedon Feb 3, 2025
richardlau commentedon Feb 3, 2025
Corepack 0.31.0 should make it's way into Node.js LTS eventually. The default general policy is for things to be in a current release (i.e. at this time Node.js 23) for two weeks before being eligible for LTS. Node.js 23.7.0 just came out last week (30 Jan), so normally we'd be looking at this being eligible for LTS releases after the end of next week.
cc @nodejs/releasers
MikeMcC399 commentedon Feb 3, 2025
@richardlau
Thank you very much for filling me in on the release processes! I know what to expect now.
stevebeauge commentedon Feb 3, 2025
Why can't one simply update corepack itself?
I can run
npm install -g corepack@latest. It will install the latest version of corepack. It won't work however (at least on windows), becauseC:\Program Files\nodejs(which containscorepackexecutable) appears in the PATH env beforeC:\Users\myuser\AppData\Roaming\npm.Is there any hard link between nodejs and corepack ?
MikeMcC399 commentedon Feb 3, 2025
@stevebeauge
I've been able to update Corepack on Windows 11. I suggest you open a separate issue for your problem as it probably depends on how you have installed Node.js and other environment parameters.
chore: Update Node and add workaround for Node issue
reconbot commentedon Feb 6, 2025
While one can update corepack this breaks all installs on CI servers who use LTS, even if they use the latest version of LTS (like on github actions) until this bubbles down to being installed by default. This will be a significant amount of failures.
EDIT: it does look like we're working to prevent this from happening in the future #616
I don't know if it's possible to make an exception on waiting for release as this is a large impact.
MikeMcC399 commentedon Feb 6, 2025
@reconbot
In some cases it's possible to update Corepack on top of a Node.js LTS installation. It looks like a lot of users are working around it like this at the moment judging by postings in the https://github.com/pnpm/pnpm/issues list.
I mentioned some of the delays in Safeguards for keyid mismatch #616 (comment) . It's not just a question of Node.js picking up the Corepack version, but then often the next stage in the supply chain, like GitHub Actions or Docker images, needs to pick this up as well. There probably isn't a one-size-fits-all solution at the moment.
MikeMcC399 commentedon Feb 7, 2025
@stevebeauge
Edit: This is now added to the Manual installs section of the README document.
nodejs-20: backport corepack update to 0.31.0
nodejs-20: backport corepack update to 0.31.0
MikeMcC399 commentedon Feb 10, 2025
Corepack Download stats give some indication of the impact that the currently bundled versions of Corepack are having. There is a ten-fold increase in downloads at this time.
MikeMcC399 commentedon Feb 10, 2025
MikeMcC399 commentedon Feb 11, 2025
I'm seeing Node.js v22.14.0 released with Corepack
0.31.0👍🏻3 remaining items
MikeMcC399 commentedon Feb 11, 2025
@marco-ippolito
Thank you for sharing your planning! It's good to have confirmation that Corepack
0.31.0is planned for the nextv20.xrelease.v20release. 🤭chore: Update Node and add workaround for Node issue
fix(deps): move to node 22 to fix corepack
MikeMcC399 commentedon Feb 20, 2025
FelixBlaisThon commentedon Feb 24, 2025
MikeMcC399 commentedon Feb 24, 2025
FelixBlaisThon commentedon Feb 24, 2025
MikeMcC399 commentedon Feb 26, 2025
marco-ippolito commentedon Feb 26, 2025
Node v20 with the fix should be out around 13th of March
MikeMcC399 commentedon Mar 13, 2025
This issue is now resolved. Each of the latest supported Node.js versions includes a minimum of corepack@0.31.0:
v18.20.70.31.0v20.19.00.31.0v22.14.00.31.0v23.9.00.31.0pataar commentedon Mar 13, 2025
Thanks for checking this and keeping this thread up-to-date.
feat(node-versions): raise the minimums of supported ranges to those …
fix(deps): move to node 22 to fix corepack
fix(deps): update unocss monorepo to v66 (major) (#1053)