Aller au contenu
verdict:

pnpm 11.4.0

notable

Notes de version

note: la synthèse et les notes de version sont en anglais

note: pas de synthèse pour cette release plus ancienne

Nous synthétisons les releases récentes. Les notes de version originales de cette version sont ci-dessous.

release-notesgithub.com/pnpm/pnpm · 135 lignes
  1. ## Minor Changes
  3. * Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, `pnpm install` (non-frozen) would log `ERR_PNPM_TARBALL_INTEGRITY`, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.
  5. `pnpm install` now exits with `ERR_PNPM_TARBALL_INTEGRITY` and a hint pointing at the new opt-in flag.
  7. The only opt-in is **`pnpm install --update-checksums`** — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.
  9. `--force` and `pnpm update` deliberately do **not** bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. `--frozen-lockfile` behavior is unchanged. `--fix-lockfile` keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.
  11. * `pnpm runtime set <name> <version>` now saves the runtime to `devEngines.runtime` by default instead of `engines.runtime`. Pass `--save-prod` (or `-P`) to save it to `engines.runtime` instead [#11948](https://github.com/pnpm/pnpm/issues/11948).
  13. ## Patch Changes
  15. * Fix a credential disclosure issue where an unscoped `_authToken` (or `_auth`, or `username` + `_password`, or `tokenHelper`) defined in one source — `~/.npmrc`, `~/.config/pnpm/auth.ini`, a workspace `.npmrc`, CLI flags, etc. — would be sent as an `Authorization` header to whichever registry a different (potentially untrusted) source named. The same fix extends to client TLS credentials (`cert`, `key`) so they aren't presented to a registry their author didn't choose.
  17. pnpm now rewrites each unscoped per-registry setting (`_authToken`, `_auth`, `username`, `_password`, `tokenHelper`, `cert`, `key`) to its URL-scoped form at load time, using the `registry=` value declared in the same source (or the npmjs default registry if the source declares none). A later layer overriding `registry=` therefore cannot pull an unscoped credential along, because it is already pinned to the URL its author intended. `ca`/`cafile` are intentionally not rescoped — they're trust anchors, not credentials, and corporate MITM-proxy setups rely on them applying globally.
  19. Every rescope emits a deprecation warning telling the user where the setting was pinned and how to write it directly. npm has rejected unscoped credentials outright since `npm@9`, and pnpm intends to remove support in a future major release. To target a specific registry, write the setting URL-scoped (e.g. `//registry.example.com/:_authToken=...` or `//registry.example.com/:cert=...`).
  21. `@pnpm/network.auth-header`: removed the `defaultRegistry` parameter from `createGetAuthHeaderByURI` and `getAuthHeadersFromCreds`. Now that credentials are URL-scoped at load time, the merged `configByUri` never contains the empty-string "default registry" placeholder slot, so re-keying it onto the merged default registry is no longer needed.
  23. * Fix `pnpm deploy` crashing with `ENOENT: ... lstat '<deployDir>/node_modules'` when `configDependencies` declares pacquet (`pacquet` or `@pnpm/pacquet`). The deploy directory never installs config dependencies, so the install engine they designate isn't on disk to invoke; the nested install now skips them.
  25. * Reject git resolutions whose `commit` field is not a 40-character hexadecimal SHA before invoking `git`. A malicious lockfile could otherwise smuggle a value such as `--upload-pack=<command>` through `git fetch` / `git checkout`, which on SSH or local-file transports executes the supplied command.
  27. * Limit concurrent project manifest reads while listing large workspaces to avoid `EMFILE` errors.
  29. * Reject patch files whose `diff --git` headers reference paths outside the patched package directory. Previously a malicious `.patch` file added via a pull request could write, delete, or rename arbitrary files reachable by the user running `pnpm install`.
  31. * Improve the log message that pnpm prints after auto-adding entries to `minimumReleaseAgeExclude` when `minimumReleaseAge` is set without `minimumReleaseAgeStrict`. The message previously referred to the internal "loose mode" terminology, which wasn't searchable in the docs; it now tells the user to set `minimumReleaseAgeStrict` to `true` if they want these updates gated behind a prompt instead [#11747](https://github.com/pnpm/pnpm/issues/11747).
  33. * Reject dependency aliases that contain path-traversal segments (such as `@x/../../../../../.git/hooks`) when reading them from a package manifest or symlinking them into `node_modules`. A malicious registry package could otherwise use a transitive dependency key to make `pnpm install` create symlinks at attacker-chosen paths outside the intended `node_modules` directory.
  35. * Reject `pnpm-lock.yaml` entries whose remote tarball `resolution:` block is missing the `integrity` field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips `integrity:`) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under `--frozen-lockfile`. pnpm now fails closed at lockfile-read time with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`. Git-hosted tarballs (`gitHosted: true` or a URL on codeload.github.com / bitbucket.org / gitlab.com) and `file:` tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.
  37. * Validate `devEngines.runtime` and `engines.runtime` version ranges for `node`, `deno`, and `bun` when `onFail` is set to `error` or `warn`. Previously these settings only had an effect with `onFail: 'download'` — the `error` and `warn` modes silently did nothing [#11818](https://github.com/pnpm/pnpm/issues/11818). Violations now throw `ERR_PNPM_BAD_RUNTIME_VERSION`.
  39. * Require provenance before treating trusted publisher metadata as the strongest trust evidence.
  42. <!-- sponsors -->
  44. ## Platinum Sponsors
  46. <table>
  47. <tbody>
  48. <tr>
  49. <td align="center" valign="middle">
  50. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  51. </td>
  52. </tr>
  53. </tbody>
  54. </table>
  56. ## Gold Sponsors
  58. <table>
  59. <tbody>
  60. <tr>
  61. <td align="center" valign="middle">
  62. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  63. <picture>
  64. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  65. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  66. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  67. </picture>
  68. </a>
  69. </td>
  70. <td align="center" valign="middle">
  71. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  72. <picture>
  73. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  74. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  75. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  76. </picture>
  77. </a>
  78. </td>
  79. <td align="center" valign="middle">
  80. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  81. </td>
  82. </tr>
  83. <tr>
  84. <td align="center" valign="middle">
  85. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  86. <picture>
  87. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  88. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  89. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  90. </picture>
  91. </a>
  92. </td>
  93. <td align="center" valign="middle">
  94. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  95. <picture>
  96. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  97. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  98. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  99. </picture>
  100. </a>
  101. </td>
  102. <td align="center" valign="middle">
  103. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  104. <picture>
  105. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  106. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  107. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  108. </picture>
  109. </a>
  110. </td>
  111. </tr>
  112. <tr>
  113. <td align="center" valign="middle">
  114. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  115. <picture>
  116. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  117. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  118. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  119. </picture>
  120. </a>
  121. </td>
  122. <td align="center" valign="middle">
  123. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  124. <picture>
  125. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  126. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  127. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  128. </picture>
  129. </a>
  130. </td>
  131. </tr>
  132. </tbody>
  133. </table>
  135. <!-- sponsors end -->

voir sur githubimported 2026-09-28 via npm