{"record":{"id":"70020486ed81c60f","repo":"denoland/deno","slug":"cli-laufey-sums-lock-pins-laufey-v-pinned-but-thi","errorCode":null,"errorMessage":"cli/laufey_sums.lock pins Laufey v{pinned} but this build expects v{laufey_version} — refresh the lock file from the upstream SHA256SUMS","messagePattern":"cli/laufey_sums\\.lock pins Laufey v(.+?) but this build expects v(.+?) — refresh the lock file from the upstream SHA256SUMS","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cli/build.rs","lineNumber":361,"sourceCode":"    if !pinned.is_empty() {\n      return Some(pinned.to_string());\n    }\n  }\n  None\n}\n\n/// Confirm `cli/laufey_sums.lock` targets `laufey_version`. The lock file carries a\n/// `# version: vX.Y.Z` directive that must match the `laufey` crate version\n/// the binary is built against; a mismatch means the pinned digests are stale.\nfn check_laufey_pinned_sums_version(manifest_dir: &str, laufey_version: &str) {\n  let Some(pinned) = laufey_version_from_sums(manifest_dir) else {\n    panic!(\n      \"cli/laufey_sums.lock has no pinned laufey version — populate it for \\\n       v{laufey_version} before building\"\n    );\n  };\n  if pinned != laufey_version {\n    panic!(\n      \"cli/laufey_sums.lock pins Laufey v{pinned} but this build expects \\\n       v{laufey_version} — refresh the lock file from the upstream SHA256SUMS\"\n    );\n  }\n}\n\n/// SHA-256 digests of the vendored AppImage Type-2 runtime stubs (from\n/// `cli/tools/appimage_runtime/README.md`). Verified at build time so a\n/// silent local modification (or a bad rebase) of those checked-in binaries\n/// can't slip into a release build undetected.\nconst APPIMAGE_RUNTIME_HASHES: &[(&str, &str)] = &[\n  (\n    \"tools/appimage_runtime/runtime-x86_64\",\n    \"2fca8b443c92510f1483a883f60061ad09b46b978b2631c807cd873a47ec260d\",\n  ),\n  (\n    \"tools/appimage_runtime/runtime-aarch64\",\n    \"00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444\",","sourceCodeStart":343,"sourceCodeEnd":379,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/build.rs#L343-L379","documentation":"Same build-time consistency check (check_laufey_pinned_sums_version, cli/build.rs:352-365): cli/laufey_sums.lock carries a '# version:' directive, but it names v<pinned> while the workspace Cargo.lock resolves the laufey crate to v<laufey_version>. The digest file is therefore stale for the binary being built, and the build panics instead of shipping digests that would fail (or worse, not fail) at first launch.","triggerScenarios":"cargo update bumps laufey; editing the laufey version in a Cargo.toml without refreshing the lock; building a branch where Cargo.lock changed but cli/laufey_sums.lock did not; rebases that mix versions across files.","commonSituations":"Dependency-bump PRs that update the manifest but forget the vendored trust anchor; contributors building a feature branch after an upstream laufey bump; release automation that bumps versions inconsistently.","solutions":["Refresh cli/laufey_sums.lock from the upstream SHA256SUMS for the new laufey release and set its '# version:' directive to the Cargo.lock version.","Alternatively pin laufey back to what the lock covers: cargo update -p laufey --precise <pinned>.","Commit Cargo.lock and cli/laufey_sums.lock together in the same change so the pair never diverges."],"exampleFix":"# before: Cargo.lock has laufey 0.2.0, lock file still says\n# version: 0.1.4\n\n# after: refresh digests from the v0.2.0 SHA256SUMS\n# version: 0.2.0\nb71c0d...  laufey-linux-x86_64.tar.gz","handlingStrategy":"validation","validationCode":"# preflight: lock directive must equal the Cargo.lock laufey version\npinned=$(sed -n 's/^# version: //p' cli/laufey_sums.lock | head -1)\nresolved=$(grep -A1 'name = \"laufey\"' Cargo.lock | sed -n 's/version = \"\\(.*\\)\"/\\1/p' | head -1)\n[ \"$pinned\" = \"$resolved\" ] || echo \"laufey_sums.lock pins $pinned but Cargo.lock has $resolved\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Commit Cargo.lock and cli/laufey_sums.lock together in dependency bumps","After cargo update, re-check the directive before building","Treat the build-time panic as the intended guard — never delete the check to get a build through"],"tags":["deno","build","cargo","build-script","lockfile","version-mismatch","laufey"],"backgroundTag":"stale-lockfile","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}