Specifying hash in the package json is not working

Do you want to request a feature or report a bug?

Report a bug

What is the current behavior?

I have a stable branch in my project that gets updated every time the CI build passes. Eventually we want to be able to use that branch in our package.json, but I'm facing yarn issues with bad hash. See this other related issue: https://github.com/yarnpkg/yarn/issues/1916.

So to try and fix the hash issue we decided to specify the commit hash in the package.json itself, but yarn seems to be ignoring that entry.

If the current behavior is a bug, please provide the steps to reproduce.

Here is our package.json entry:

{
   ...
   "dependencies": {
      "grommet": "https://github.com/grommet/grommet/tarball/stable#85a1b40e4616fe54e4e13fdd9350128d1f0508e6",
   }
}

Here is the yarn.lock section:

"grommet@https://github.com/grommet/grommet/tarball/stable#85a1b40e4616fe54e4e13fdd9350128d1f0508e6":
  version "1.3.4"
  resolved "https://github.com/grommet/grommet/tarball/stable#2e18b1cba634cd1cfda9a3d601ae74fe77eacee1"

What is the expected behavior?

You can see that the yarn.lock resolved to latest hash in my stable branch, where I was expecting it to resolve to the hash that I've specified.

Please mention your node.js, yarn and operating system version.

Node: v7.3.0 NPM: 3.10.10 Yarn: 0.21.3