Skip to content
verdict:

pnpm 10.28.1

digest

Release notes

note: no summary for this digest release

Digest releases are listed without a summary. The original release notes for this version are below.

release-notesgithub.com/pnpm/pnpm · 102 lines
  1. ## Patch Changes
  3. * Fixed installation of config dependencies from private registries.
  5. Added support for object type in `configDependencies` when the tarball URL returned from package metadata differs from the computed URL [#10431](https://github.com/pnpm/pnpm/pull/10431).
  7. * Fix path traversal vulnerability in binary fetcher ZIP extraction
  9. * Validate ZIP entry paths before extraction to prevent writing files outside target directory
  10. * Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix
  11. * Both attack vectors now throw `ERR_PNPM_PATH_TRAVERSAL` error
  13. * Support plain `http://` and `https://` URLs ending with `.git` as git repository dependencies.
  15. Previously, URLs like `https://gitea.example.org/user/repo.git#commit` were not recognized as git repositories because they lacked the `git+` prefix (e.g., `git+https://`). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads.
  17. Changes:
  19. * The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver
  20. * The git resolver now recognizes plain `http://` and `https://` URLs ending in `.git` as git repositories
  21. * Removed the `isRepository` check from the tarball resolver since it's no longer needed with the new resolver order
  23. Fixes #10468
  25. * `pnpm run -r` and `pnpm run --filter` now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use `--if-present` to suppress this error [#6844](https://github.com/pnpm/pnpm/issues/6844).
  27. * Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for `./` but not `.\`. Since backslashes are directory separators on Windows, malicious packages could use paths like `foo\..\..\.npmrc` to write files outside the package directory.
  29. * When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project [#5759](https://github.com/pnpm/pnpm/issues/5759).
  31. * Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with `@` bypassed validation, and after scope normalization, path traversal sequences like `../../` remained intact.
  33. * Revert Try to avoid making network calls with preferOffline [#10334](https://github.com/pnpm/pnpm/pull/10334).
  35. * Fix `--save-peer` to write valid semver ranges to `peerDependencies` for protocol-based installs (e.g. `jsr:`) by deriving from resolved versions when available and falling back to `*` if none is available [#10417](https://github.com/pnpm/pnpm/issues/10417).
  37. * Do not exclude the root workspace project, when it is explicitly selected via a filter [#10465](https://github.com/pnpm/pnpm/pull/10465).
  40. ## Platinum Sponsors
  42. <table>
  43. <tbody>
  44. <tr>
  45. <td align="center" valign="middle">
  46. <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  47. </td>
  48. </tr>
  49. </tbody>
  50. </table>
  52. ## Gold Sponsors
  54. <table>
  55. <tbody>
  56. <tr>
  57. <td align="center" valign="middle">
  58. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  59. <picture>
  60. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  61. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  62. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  63. </picture>
  64. </a>
  65. </td>
  66. <td align="center" valign="middle">
  67. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  68. <picture>
  69. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  70. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  71. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  72. </picture>
  73. </a>
  74. </td>
  75. <td align="center" valign="middle">
  76. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  77. <picture>
  78. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  79. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  80. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  81. </picture>
  82. </a>
  83. </td>
  84. </tr>
  85. <tr>
  86. <td align="center" valign="middle">
  87. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  88. <picture>
  89. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  90. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  91. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  92. </picture>
  93. </a>
  94. </td>
  95. <td align="center" valign="middle">
  96. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  97. <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite">
  98. </a>
  99. </td>
  100. </tr>
  101. </tbody>
  102. </table>

view on githubimported 2026-09-28 via npm