deps: update corepack to 0.36.0

deps/corepack/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [0.36.0](https://github.com/nodejs/corepack/compare/v0.35.0...v0.36.0) (2026-08-28)
+
+
+### Features
+
+* add `COREPACK_ON_UNVERIFIED_DOWNLOAD` env variable ([#856](https://github.com/nodejs/corepack/issues/856)) ([0125d89](https://github.com/nodejs/corepack/commit/0125d89ac904672bb42bc48bb6612d137beeccda))
+* fall back to package-root metadata when dist.signatures is missing on the version endpoint ([#870](https://github.com/nodejs/corepack/issues/870)) ([b26c9d5](https://github.com/nodejs/corepack/commit/b26c9d52fdbc5db326e631de3f6557f7e1b7e55d))
+* only load closest env file, for every commands ([#891](https://github.com/nodejs/corepack/issues/891)) ([b856c51](https://github.com/nodejs/corepack/commit/b856c516c3d0a92ded6b3f9cbbaa0d3f3eb094f1))
+* update package manager versions ([#852](https://github.com/nodejs/corepack/issues/852)) ([7e613b8](https://github.com/nodejs/corepack/commit/7e613b84b079411cb9eab1f90b254597fb9ef70c))
+* use range from `devEngines` when no `packageManager` is set ([#892](https://github.com/nodejs/corepack/issues/892)) ([dec830b](https://github.com/nodejs/corepack/commit/dec830b035f540d1b4ebc516e81fbf43c5e0ffcf))
+
+
+### Bug Fixes
+
+* **npmRegistryUtils:** env vars names in integrity check fail error message ([#854](https://github.com/nodejs/corepack/issues/854)) ([8ca01c3](https://github.com/nodejs/corepack/commit/8ca01c3fbeed6c8b5d1bb94df1aacb3fe6cff846))
+* strip trailing slashes from COREPACK_NPM_REGISTRY ([#871](https://github.com/nodejs/corepack/issues/871)) ([b81e92c](https://github.com/nodejs/corepack/commit/b81e92c2338ed6c4c38cfe1239002a261e47e6d5))
+
 ## [0.35.0](https://github.com/nodejs/corepack/compare/v0.34.7...v0.35.0) (2026-05-15)
 
 

deps/corepack/README.md

@@ -127,9 +127,9 @@ Depending on the value of `devEngines.packageManager.onFail`:
   of mismatch.
 
 If the top-level `packageManager` field is missing, Corepack will use the
-package manager defined in `devEngines.packageManager` – in which case you must
-provide a specific version in `devEngines.packageManager.version`, ideally with
-a hash, as explained in the previous section:
+package manager defined in `devEngines.packageManager`. You should provide a
+specific version in `devEngines.packageManager.version`, ideally with a hash, as
+explained in the previous section:
 
 ```json
 {
@@ -142,6 +142,16 @@ a hash, as explained in the previous section:
 }
 ```
 
+When `devEngines.packageManager.version` is a range rather than a specific
+version, Corepack resolves it the same way as when a range is given on the
+command line: the latest version matching the range is looked up on the npm
+registry, which means the resolution requires network access (or a cache
+containing a matching version, see [Offline Workflow](#offline-workflow)), and
+may change over time. Set `COREPACK_ENABLE_AUTO_PIN=1` to have Corepack add the
+resolved version to the `packageManager` field. When
+`devEngines.packageManager.version` is missing, Corepack falls back to its
+[Known Good Release](#known-good-releases) for that package manager.
+
 ## Known Good Releases
 
 When running Corepack within projects that don't list a supported package
@@ -349,6 +359,19 @@ same major line. Should you need to upgrade to a new major, use an explicit
   environment variables are required and as plain text. If you want to send an
   empty password, explicitly set `COREPACK_NPM_PASSWORD` to an empty string.
 
+- `COREPACK_ON_UNVERIFIED_DOWNLOAD` can be set to:
+  - `warn` (case insensitive): attempting to download an unsigned version without
+    providing a hash will emit a warning to stderr.
+  - `error` (case insensitive): attempting to download an unsigned version without
+    providing a hash will fail with an error, and nothing gets downloaded.
+  - `strict-warn` (case insensitive): same as `warn`, and additionally emits a
+    warning when downloading a version that is not pinned by a hash, even when
+    its signature can be verified.
+  - `strict-error` (case insensitive): same as `error`, and additionally fails
+    when downloading a version that is not pinned by a hash, even when its
+    signature can be verified.
+  - `ignore` (or any other unsupported value): disables that security feature.
+
 - `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` are supported through
   [`NODE_USE_ENV_PROXY=1`](https://nodejs.org/api/cli.html#node_use_env_proxy1).