Skip to content
verdict:

pnpm 10.34.1

digest

Release notes

note: no summary for this digest release

Digest releases are listed without a summary. The original release notes for this version are below.

release-notesgithub.com/pnpm/pnpm · 99 lines
  1. ## Patch Changes
  3. * Reject `pnpm-lock.yaml` entries whose remote tarball `resolution:` block is missing the `integrity` field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips `integrity:`) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under `--frozen-lockfile`. pnpm now fails closed at lockfile-read time with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`. Git-hosted tarballs (`gitHosted: true` or a URL on codeload.github.com / bitbucket.org / gitlab.com) and `file:` tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.
  6. <!-- sponsors -->
  8. ## Platinum Sponsors
  10. <table>
  11. <tbody>
  12. <tr>
  13. <td align="center" valign="middle">
  14. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  15. </td>
  16. </tr>
  17. </tbody>
  18. </table>
  20. ## Gold Sponsors
  22. <table>
  23. <tbody>
  24. <tr>
  25. <td align="center" valign="middle">
  26. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  27. <picture>
  28. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  29. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  30. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  31. </picture>
  32. </a>
  33. </td>
  34. <td align="center" valign="middle">
  35. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  36. <picture>
  37. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  38. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  39. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  40. </picture>
  41. </a>
  42. </td>
  43. <td align="center" valign="middle">
  44. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  45. </td>
  46. </tr>
  47. <tr>
  48. <td align="center" valign="middle">
  49. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  50. <picture>
  51. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  52. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  53. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  54. </picture>
  55. </a>
  56. </td>
  57. <td align="center" valign="middle">
  58. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  59. <picture>
  60. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  61. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  62. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  63. </picture>
  64. </a>
  65. </td>
  66. <td align="center" valign="middle">
  67. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  68. <picture>
  69. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  70. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  71. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  72. </picture>
  73. </a>
  74. </td>
  75. </tr>
  76. <tr>
  77. <td align="center" valign="middle">
  78. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  79. <picture>
  80. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  81. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  82. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  83. </picture>
  84. </a>
  85. </td>
  86. <td align="center" valign="middle">
  87. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  88. <picture>
  89. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  90. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  91. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  92. </picture>
  93. </a>
  94. </td>
  95. </tr>
  96. </tbody>
  97. </table>
  99. <!-- sponsors end -->

view on githubimported 2026-09-28 via npm