trust downgrade for `webpack-dev-middleware` v7

[slorber]

Have you used AI?

None

Bug Description

Hey

I don't know if this should be considered a bug, but since this package is widely used, I just wanted to report this little DX annoyance in case you'd want to fix it.

pnpm can detect package trust-level downgrades (staged publishing -> trusted publishing -> provenance -> publish) to prevent malicious takeovers.

https://pnpm.io/settings/dependency-resolution#trustpolicy

Unfortunately it's not based on semver but publication dates, and v8 has trusted publishing while v7 doesn't.

Due to the recent v7 npm publish after a v8 that uses trusted publishing, we now have a downgrade detected:

This means newly initialized Docusaurus sites using pnpm with trustPolicy: no-downgrade will get an error such as:

[ERR_PNPM_TRUST_DOWNGRADE] High-risk trust downgrade for "webpack-dev-middleware@7.4.6" (possible package takeover)

This error happened while installing the dependencies of @docusaurus/core@3.10.1
 at webpack-dev-server@5.2.6

It doesn't seem mandatory to fix the problem, but if you can publish a v7 with trusted publishing, that would fix the problem and prevent users from getting this pnpm error.

Link to Minimal Reproduction and step to reproduce

N/A

Expected Behavior

no trust downgrade

Actual Behavior

trust downgrade detected by pnpm

Environment

N/A

Is this a regression?

None

Last Working Version

No response

Additional Context

No response

[alexander-akait]

@slorber just interesting why you can't update to v8?

[slorber]

I already have upgraded for the upcoming Docusaurus v4

However Docusaurus v3 users using pnpm with strict settings will get this error when initializing or upgrading a v3 site. Not a big deal and will be fixed by Docusaurus v4, just wanted to report.