[rush-lib] Hash full shrinkwrap entry to detect sub-dependency resolution changes

[Copilot]

Summary

Fixed the issue where _getIntegrityForPackage and _addDependencyRecursive were using resolution.integrity when available, which doesn't capture changes to sub-dependency resolutions. Now the full shrinkwrap entry is always hashed, ensuring any change to dependency resolution is detected by build orchestrators.

Details

Changed both _getIntegrityForPackage (workspace path) and _addDependencyRecursive (legacy path) to always hash the full shrinkwrapEntry object instead of using resolution.integrity directly:

• The full entry includes dependencies, optionalDependencies, and resolution, capturing any resolution changes
• Preserved existing encoding formats (base64 in PnpmShrinkwrapFile.ts, hex in PnpmProjectShrinkwrapFile.ts) for backward compatibility

Code Review Notes:
Two pre-existing concerns were identified:

1. Encoding inconsistency: PnpmShrinkwrapFile.ts uses base64 while PnpmProjectShrinkwrapFile.ts uses hex. This inconsistency existed before this change and was preserved for backward compatibility.
2. JSON.stringify order: Property order is maintained by ES2015+ JavaScript and the YAML parser provides deterministic output, so this is acceptable.

How it was tested

• All 528 existing tests pass
• Added test case verifying different sub-dependency resolutions produce different integrity hashes
• Updated snapshot expectations to reflect new hash format

Impacted documentation

None

Original prompt

The logic in PnpmShrinkwrapFile._getIntegrityForPackage does not produce a new hash for a package if the resolutions of its dependencies change. Consider the scenario where:
Importer depends on foo@1 depends on [email protected]
Importer depends on bar@2 depends on [email protected]
Importer depends on baz@3 depends on [email protected]

If the resolution of baz@3>qux changes from [email protected] to [email protected], this will currently not manifest as a change to the shrinkwrap-deps.json file, which means that build orchestrators that rely on this tool to detect changes to resolution will not detect a change and will assume outputs are constant, even if a downstream bundler that follows the import graph will produce different output.

It should suffice for the entry in shrinkwrap-deps.json to contain a hash of the full package entry from the shrinkwrap file, since this will contain both the integrity hash and all resolutions of sub-dependencies.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[dmichon-msft]

@copilot Run rush change --no-fetch --bulk --bump-type minor --message "${description of the change}" to generate the necessary change file.

[Copilot]

@copilot Run rush change --no-fetch --bulk --bump-type minor --message "${description of the change}" to generate the necessary change file.

Generated the change file in commit 57b7def.