Dette er en ældre version. Den nyeste version er 12.16.1. pnpm 12.16.1 · Udgivet:
10.28.2 er en del af udgivelseslinjen 10, som understøttes indtil den 30. april 2027. endoflife.date
Installationsfiler 10.28.2
| Arkitektur | Type | Omfang | Filstørrelse | Download | SHA256 |
|---|---|---|---|---|---|
| 64-bit | Portabel | — | — | github.com | VirusTotal |
| ARM64 | Portabel | — | — | github.com | VirusTotal |
Link og SHA256 stammer fra fællesskabets manifest i Windows Package Manager. Sammenlign hashen for den downloadede fil, før du kører den.
Udgivelsesnoter
Patch Changes
- Security fix: prevent path traversal in directories.bin field.
- When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.
This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.
Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.
- Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────
