[@types/node] 20.x/22.x cannot be installed with pnpm trustPolicy: no-downgrade (undici-types ~6.21.0) #75622

FYI, informational only.

• @types/node@20.19.43 and @types/node@22.20.4 (the latest of their lines) depend on undici-types ~6.21.0. Earlier 20.x/22.x releases use ~6.19.2, ~6.19.8 or ~6.20.0.
• Every undici-types version in those ranges was published without provenance after 6.19.1/6.19.2 had it, so pnpm's trustPolicy: no-downgrade rejects them and the whole install fails.
• undici restored trusted publishing on the 6.x line from 6.23.0, but those releases are outside the pinned ranges. (See undici-types@6 published without provenance nodejs/undici#4666, Definition Request: Keyboard cordova plugin #4699, [link to our undici issue].)

Reproduce (lockfile-only):

mkdir t && cd t
echo '{"name":"t","version":"0.0.0","private":true,"dependencies":{"@types/node":"22.20.4"}}' > package.json
printf 'trustPolicy: no-downgrade\n' > pnpm-workspace.yaml
npx pnpm@10.29.3 install --lockfile-only --ignore-scripts

Possible options, entirely your call:

• (a) nothing: users can add trustPolicyExclude: ["undici-types@6.21.0"];
• (b) widen the pin once a trusted undici-types release exists that matches the undici bundled with Node 20/22.

We understand the typings should track Node's bundled undici. Thanks for maintaining these.

Igor Santos-Grueiro