Claude Bot 563fbbb416 fix(install): reject unsupported integrity hash algorithms in lockfiles ...

Previously, if a lockfile contained an integrity hash with an
unrecognized algorithm (e.g., "md5-AAAA"), the tag would parse as
unknown and the integrity verification would be silently skipped. This
meant a tampered lockfile could disable integrity checking entirely.

Now all lockfile parsers (bun.lock, yarn.lock, pnpm-lock.yaml,
package-lock.json) reject non-empty integrity strings with unsupported
hash algorithms. As defense-in-depth, the tarball extraction step also
errors when an npm package lacks a supported integrity hash.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-02-12 04:48:27 +00:00

..

__snapshots__

Add bunfig.toml support for test randomize, seed, and rerunEach options (#23286)

2025-10-06 19:48:16 -07:00

create

docs: more consistency + minor updates (#24764)

2025-11-21 14:06:19 -08:00

env

fix: BUN_OPTIONS bare flags getting trailing whitespace (#26464)

2026-01-26 14:02:36 -08:00

hot

feat(minify): optimize Error constructors by removing 'new' keyword (#22493)

2025-09-09 15:00:40 -07:00

init

fix(init): respect --minimal flag for agent rule files (#26051)

2026-01-13 18:33:42 -08:00

inspect

fix(debugger): retroactively report tests when TestReporter.enable is called (#25986)

2026-01-14 13:32:51 -08:00

install

fix(install): reject unsupported integrity hash algorithms in lockfiles

2026-02-12 04:48:27 +00:00

run

fix multi-run.test.ts on windows (#26590)

2026-01-29 23:35:53 -08:00

test

feat(test): add --retry flag and emit separate testcase entries for retries in JUnit XML (#26866)

2026-02-10 10:58:21 -08:00

watch

Add BUN_WATCHER_TRACE environment variable for debugging file watcher events (#23533)

2025-10-12 11:29:48 -07:00

bun.test.ts

fix(bun getcompletes) add windows support and remove TODO panic (#24620)

2025-11-12 12:41:47 -08:00

bunfig-test-options.test.ts

Add bunfig.toml support for test randomize, seed, and rerunEach options (#23286)

2025-10-06 19:48:16 -07:00

console-depth.test.ts

ci: run modified tests first (#24463)

2025-11-07 21:49:58 -08:00

heap-prof.test.ts

feat(cli): add --heap-prof and --heap-prof-text flags for heap profiling (#26326)

2026-01-22 15:27:37 -08:00

update_interactive_formatting.test.ts

fix update interactive to keep npm aliases (#23903)

2025-11-03 02:12:24 -08:00

update_interactive_install.test.ts

fix(update): 'l' key now selects package in interactive update (#26265)

2026-01-19 22:46:36 -08:00

update_interactive_snapshots.test.ts

Update interactive spacing (#21156)

2025-07-19 04:11:28 -07:00

user-agent.test.ts

Add --user-agent flag to customize HTTP request User-Agent header (#21894)

2025-08-15 17:51:35 -07:00