Ir al contenido
verdict:

pnpm 10.34.3

digest

Notas de la versión

note: la síntesis y las notas de la versión están en inglés

note: sin síntesis para esta release digest

Las releases digest se listan sin síntesis. Las notas de la versión originales de esta versión están aquí abajo.

release-notesgithub.com/pnpm/pnpm · 122 líneas
  1. ### ⚠️ Security fix — environment variables in a project `.npmrc` (action may be required)
  3. Following [GHSA-3qhv-2rgh-x77r](https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r), pnpm no longer expands `${ENV_VAR}` placeholders that come from a **repository-controlled** config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  5. - the project/workspace `.npmrc` — `registry`, `@scope:registry`, proxy URLs, URL-scoped keys (`//host/…`), and credential values (`_authToken`, `_auth`, `_password`, `username`, `tokenHelper`, `cert`, `key`);
  6. - registry URLs in `pnpm-workspace.yaml`.
  8. This release also closes a bypass where a project `.npmrc` could set `userconfig`, `globalconfig`, or `prefix` to make pnpm load a repo-supplied file as *trusted* config (via `@pnpm/npm-conf@3.0.3`).
  10. Environment variables are **still** expanded in trusted config: your user-level `~/.npmrc`, the global config, CLI options, and environment config.
  12. **If your authentication broke after upgrading**, move the token out of the committed `.npmrc`:
  14. ```sh
  15. # Writes to your user/global config, not the repository:
  16. pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN"
  17. ```
  19. Or keep the `${NPM_TOKEN}` line but put it in your user-level `~/.npmrc` instead of the repo. In **GitHub Actions**, `actions/setup-node` with `registry-url` already writes a user-level `.npmrc`, so `NODE_AUTH_TOKEN` keeps working. For other CI where editing each pipeline is hard, set `NPM_CONFIG_USERCONFIG=.npmrc` in the CI environment to declare the project `.npmrc` trusted.
  21. See https://pnpm.io/npmrc for full migration details.
  23. ## Patch Changes
  25. * Improved the warning printed when a project `.npmrc` uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running `pnpm config set "<key>" <value>` to store it in the global config, or by keeping the `${...}` line in the user-level `~/.npmrc` — with a link to https://pnpm.io/npmrc.
  26. * A repository-controlled project or workspace `.npmrc` can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set `userconfig`, `globalconfig`, or `prefix` to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set `tokenHelper`. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace `.npmrc` files are read. Fixed by upgrading `@pnpm/npm-conf` to `3.0.3`.
  29. <!-- sponsors -->
  31. ## Platinum Sponsors
  33. <table>
  34. <tbody>
  35. <tr>
  36. <td align="center" valign="middle">
  37. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  38. </td>
  39. </tr>
  40. </tbody>
  41. </table>
  43. ## Gold Sponsors
  45. <table>
  46. <tbody>
  47. <tr>
  48. <td align="center" valign="middle">
  49. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  50. <picture>
  51. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  52. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  53. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  54. </picture>
  55. </a>
  56. </td>
  57. <td align="center" valign="middle">
  58. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  59. <picture>
  60. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  61. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  62. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  63. </picture>
  64. </a>
  65. </td>
  66. <td align="center" valign="middle">
  67. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  68. </td>
  69. </tr>
  70. <tr>
  71. <td align="center" valign="middle">
  72. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  73. <picture>
  74. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  75. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  76. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  77. </picture>
  78. </a>
  79. </td>
  80. <td align="center" valign="middle">
  81. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  82. <picture>
  83. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  84. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  85. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  86. </picture>
  87. </a>
  88. </td>
  89. <td align="center" valign="middle">
  90. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  91. <picture>
  92. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  93. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  94. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  95. </picture>
  96. </a>
  97. </td>
  98. </tr>
  99. <tr>
  100. <td align="center" valign="middle">
  101. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  102. <picture>
  103. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  104. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  105. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  106. </picture>
  107. </a>
  108. </td>
  109. <td align="center" valign="middle">
  110. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  111. <picture>
  112. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  113. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  114. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  115. </picture>
  116. </a>
  117. </td>
  118. </tr>
  119. </tbody>
  120. </table>
  122. <!-- sponsors end -->

ver en githubimported 2026-09-28 vía npm