pnpm / update detail

pnpm 10.34.4

Official pnpm changelog summary with source attribution, release tags, and community reactions.

Track this pnpm release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

pnpm·1 month ago · Jun 18, 2026, 10:52 PMFixSecurity-relevantAI-assisted summary

pnpm 10.34.4

Summary

Validate config dependency names and versions to be proper npm package names and exact semver, preventing path traversal via workspace.yaml.
Reject malicious lockfile aliases and reserved paths (e.g., ../../../escape, .bin) during hoisted node_modules construction to stop files being written outside the install root.
Harden .npmrc warnings to avoid command injection and prevent pnpm patch remove from deleting files outside the configured patches directory.

securitybugfixminorsource healthy

Official source Last checked 10 hours ago

official source

Verify the original release note

Every summary should remain traceable to the original changelog or release source.

AI-assisted summarysource healthyLast checked 10 hours ago

Official changelog

related channels

Follow this in context

Turn this pnpm release note into a weekly digest for the tools you actually use.

Create digest

related updates

More pnpm changelog updates

Product page

pnpm·2 days agoFix

pnpm 11.19

Summary

pnpm login now works without a TTY for web‑based registry logins, printing the auth URL and polling for approval; classic username/password still requires interactivity.

Official source

pnpm·4 days agoFixSecurity-relevant

pnpm 11.18

Summary

Fixed optional dependency installation where the parent was installed without its required sub‑dependency, adding an install‑check warning for incompatibilities.

security

Official source

pnpm·1 week agoFixSecurity-relevant

pnpm 11.17

Summary

Add `update.githubActionsServer` setting to configure GitHub server URL for actions and enable skipping GitHub Action dependencies via `update.githubActions=false`.

security

Official source

pnpm / update detail

pnpm 10.34.4

Official pnpm changelog summary with source attribution, release tags, and community reactions.

Track this pnpm release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

pnpm·1 month ago · Jun 18, 2026, 10:52 PMFixSecurity-relevantAI-assisted summary

pnpm 10.34.4

Summary

Validate config dependency names and versions to be proper npm package names and exact semver, preventing path traversal via workspace.yaml.
Reject malicious lockfile aliases and reserved paths (e.g., ../../../escape, .bin) during hoisted node_modules construction to stop files being written outside the install root.
Harden .npmrc warnings to avoid command injection and prevent pnpm patch remove from deleting files outside the configured patches directory.

securitybugfixminorsource healthy

Official source Last checked 10 hours ago

official source

Verify the original release note

Every summary should remain traceable to the original changelog or release source.

AI-assisted summarysource healthyLast checked 10 hours ago

Official changelog

related channels

Follow this in context

Turn this pnpm release note into a weekly digest for the tools you actually use.

Create digest

related updates

More pnpm changelog updates

Product page

pnpm·2 days agoFix

pnpm 11.19

Summary

pnpm login now works without a TTY for web‑based registry logins, printing the auth URL and polling for approval; classic username/password still requires interactivity.

Official source

pnpm·4 days agoFixSecurity-relevant

pnpm 11.18

Summary

Fixed optional dependency installation where the parent was installed without its required sub‑dependency, adding an install‑check warning for incompatibilities.

security

Official source

pnpm·1 week agoFixSecurity-relevant

pnpm 11.17

Summary

Add `update.githubActionsServer` setting to configure GitHub server URL for actions and enable skipping GitHub Action dependencies via `update.githubActions=false`.

security

Official source