note: la síntesis y las notas de la versión están en inglés
note: sin síntesis para esta release digest
Las releases digest se listan sin síntesis. Las notas de la versión originales de esta versión están aquí abajo.
release-notesgithub.com/pnpm/pnpm · 76 líneas
- ## Patch Changes
- * Security fix: prevent path traversal in `directories.bin` field.
- * When pnpm installs a `file:` or `git:` dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into `node_modules`.
- This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) and have their contents copied when the package is installed.
- Note: This only affects `file:` and `git:` dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.
- * Fixed optional dependencies to request full metadata from the registry to get the `libc` field, which is required for proper platform compatibility checks [#9950](https://github.com/pnpm/pnpm/issues/9950).
- ## Platinum Sponsors
- <table>
- <tbody>
- <tr>
- <td align="center" valign="middle">
- <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
- </td>
- </tr>
- </tbody>
- </table>
- ## Gold Sponsors
- <table>
- <tbody>
- <tr>
- <td align="center" valign="middle">
- <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <picture>
- <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
- <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
- <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
- </picture>
- </a>
- </td>
- <td align="center" valign="middle">
- <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <picture>
- <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
- <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
- <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
- </picture>
- </a>
- </td>
- <td align="center" valign="middle">
- <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <picture>
- <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
- <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
- <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
- </picture>
- </a>
- </td>
- </tr>
- <tr>
- <td align="center" valign="middle">
- <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <picture>
- <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
- <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
- <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
- </picture>
- </a>
- </td>
- <td align="center" valign="middle">
- <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
- <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite">
- </a>
- </td>
- </tr>
- </tbody>
- </table>