Danny Thuering @danny.webmobix.com · May 13 I upgraded to pnpm 11 for disk space savings and monorepo support. Today the TanStack npm worm compromised packages using hijacked GitHub Actions tokens and a prepare lifecycle script. pnpm 11 blocked both vectors out of the box, no config needed. #nodejs #security #pnpm #supplychain #devops
4 likes 2 replies
?
Replies
Does pnpm 11 come configured with minimumReleaseAge: 1440 out of the box? O_o
Wrote up what happened and what to check: https://dthuering.com/posts/why-i-am-glad-i-upgraded-to-pnpm-11.html