[rush] regression in rush update in 5.128.2

[thomasballinger]

In Rush 5.128.2 and beyond (probably from #4752?) the hashes for a project in a rush update never match so the shrinkwrap file always appears out of date.

See Zulip discussion

Summary

rush update doesn't "resolve," every time I run it I get

The shrinkwrap file (pnpm-lock.yaml) contains the following issues:
  Some injected dependencies' package.json might have been modified.

Repro steps

after adding a dependenciesMeta

  "dependenciesMeta": {
    "convex": {
      "injected": true
    }
  },

running rush update twice should not produce

The shrinkwrap file (pnpm-lock.yaml) contains the following issues:
  Some injected dependencies' package.json might have been modified.

this should only happen the first time.

Standard questions

Please answer these questions to help us investigate your issue more quickly:

Question	Answer
@microsoft/rush globally installed version?	5.128.2
rushVersion from rush.json?	5.128.2
useWorkspaces from rush.json?	true
Operating system?	Mac
Would you consider contributing a PR?	No
Node.js version (node -v)?	18.18.0

[lianghx-319]

same issue when upgrade from 5.128.1 to 5.13x.x

[witcher112]

Potential fix: #4992 (awaiting review at the moment)