missing PAT in lock file

[baixiaoyu2997]

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

No response

Which area(s) of pnpm are affected? (leave empty if unsure)

Lockfile

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

1. rm pnpm-lock.yml
2. pnpm i
3. check lockfile

Describe the Bug

In my project, I am referencing a private GitHub repository as a package. When my PNPM version is greater than 8.6.9, it causes the Personal Access Token (PAT) to be missing in the lockfile.

You can see that before the upgrade, there was a PAT in the version field, but after upgrading to 8.6.10, it is no longer present.

Expected Behavior

have PAT in version

Which Node.js version are you using?

18.16.0

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response

[zkochan]

Probably this started happening after this was merged: #6806

cc @KSXGitHub

[KSXGitHub]

The token already presents in specifier. Why do you need it in version as well? Does it cause pnpm install to stop working?

[baixiaoyu2997]

The token already presents in specifier. Why do you need it in version as well? Does it cause pnpm install to stop working?

can't work on vercel

[KSXGitHub]

I see. So this bug can be fixed either by re-adding auth token to version or make pnpm fetch infer auth token from the specifier.

[KSXGitHub]

@baixiaoyu2997 In the meantime, you need to provide your vercel builder a private SSH key that has access to the private repositories.

[KSXGitHub]

@zkochan

Probably this started happening after this was merged: #6806

This PR was later reverted and replaced by #6832

[baixiaoyu2997]

@baixiaoyu2997 In the meantime, you need to provide your vercel builder a private SSH key that has access to the private repositories.

yes, i have, the latest version still has this problem, so, i switched back to 8.6.9 again, any update on this?

[jon301]

Hi
I have the same issue on the latest version.
Pinning to 8.6.9 works fine