Ir al contenido
verdict:

pnpm 10.34.0

notable

Notas de la versión

note: la síntesis y las notas de la versión están en inglés

note: sin síntesis para esta release más antigua

Sintetizamos las releases recientes. Las notas de la versión originales de esta versión están aquí abajo.

release-notesgithub.com/pnpm/pnpm · 114 líneas
  1. ## Minor Changes
  3. * Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, `pnpm install` (non-frozen) would log `ERR_PNPM_TARBALL_INTEGRITY`, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.
  5. `pnpm install` now exits with `ERR_PNPM_TARBALL_INTEGRITY` and a hint pointing at the new opt-in flag.
  7. The only opt-in is **`pnpm install --update-checksums`** — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.
  9. `--force` and `pnpm update` deliberately do **not** bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. `--frozen-lockfile` behavior is unchanged. `--fix-lockfile` keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.
  11. ## Patch Changes
  13. * Pin unscoped per-registry settings (`_authToken`, `_auth`, `username`/`_password`, `tokenHelper`, inline `cert`/`key`) to the registry declared in the same config source at load time, so a later layer overriding `registry=` (workspace `.npmrc`, `pnpm-workspace.yaml`, CLI `--registry`) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
  14. * Fixed `minimumReleaseAge` handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version `time` field) by default, which made the maturity check throw `ERR_PNPM_MISSING_TIME` whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when `minimumReleaseAge` is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets `ERR_PNPM_MISSING_TIME` from the cache fast-path fall through to the network fetch even under strict mode.
  15. * Reject git resolutions whose `commit` field is not a 40-character hexadecimal SHA before invoking `git`. A malicious lockfile could otherwise smuggle a value such as `--upload-pack=<command>` through `git fetch` / `git checkout`, which on SSH or local-file transports executes the supplied command.
  16. * Reject patch files whose `diff --git` headers reference paths outside the patched package directory. Previously a malicious `.patch` file added via a pull request could write, delete, or rename arbitrary files reachable by the user running `pnpm install`.
  17. * Fixed `--prefix=<dir>` not being honored when locating the workspace root. The `--prefix → dir` rename was applied after workspace detection, so workspace settings declared in `<dir>/pnpm-workspace.yaml` were not loaded when pnpm was invoked from outside `<dir>` [#11535](https://github.com/pnpm/pnpm/issues/11535).
  18. * Reject dependency aliases that contain path-traversal segments (such as `@x/../../../../../.git/hooks`) when reading them from a package manifest or symlinking them into `node_modules`. A malicious registry package could otherwise use a transitive dependency key to make `pnpm install` create symlinks at attacker-chosen paths outside the intended `node_modules` directory.
  21. <!-- sponsors -->
  23. ## Platinum Sponsors
  25. <table>
  26. <tbody>
  27. <tr>
  28. <td align="center" valign="middle">
  29. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  30. </td>
  31. </tr>
  32. </tbody>
  33. </table>
  35. ## Gold Sponsors
  37. <table>
  38. <tbody>
  39. <tr>
  40. <td align="center" valign="middle">
  41. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  42. <picture>
  43. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  44. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  45. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  46. </picture>
  47. </a>
  48. </td>
  49. <td align="center" valign="middle">
  50. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  51. <picture>
  52. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  53. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  54. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  55. </picture>
  56. </a>
  57. </td>
  58. <td align="center" valign="middle">
  59. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  60. </td>
  61. </tr>
  62. <tr>
  63. <td align="center" valign="middle">
  64. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  65. <picture>
  66. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  67. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  68. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  69. </picture>
  70. </a>
  71. </td>
  72. <td align="center" valign="middle">
  73. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  74. <picture>
  75. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  76. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  77. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  78. </picture>
  79. </a>
  80. </td>
  81. <td align="center" valign="middle">
  82. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  83. <picture>
  84. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  85. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  86. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  87. </picture>
  88. </a>
  89. </td>
  90. </tr>
  91. <tr>
  92. <td align="center" valign="middle">
  93. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  94. <picture>
  95. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  96. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  97. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  98. </picture>
  99. </a>
  100. </td>
  101. <td align="center" valign="middle">
  102. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  103. <picture>
  104. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  105. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  106. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  107. </picture>
  108. </a>
  109. </td>
  110. </tr>
  111. </tbody>
  112. </table>
  114. <!-- sponsors end -->

ver en githubimported 2026-09-28 vía npm