Tämä on vanhempi versio. Uusin versio on 12.15.0. pnpm 12.15.0 · Julkaistu:
10.28.2 kuuluu julkaisusarjaan 10, jota tuetaan 30. huhtikuuta 2027 asti. endoflife.date
Asennustiedostot 10.28.2
| Arkkitehtuuri | Tyyppi | Laajuus | Tiedostokoko | Lataus | SHA256 |
|---|---|---|---|---|---|
| 64-bittinen | Portable | — | — | github.com | VirusTotal |
| ARM64 | Portable | — | — | github.com | VirusTotal |
Linkki ja SHA256-tiiviste ovat peräisin Windows Package Managerin yhteisön manifestista. Vertaa ladatun tiedoston tiivistettä ennen kuin suoritat sen.
Muutosloki
Patch Changes
- Security fix: prevent path traversal in directories.bin field.
- When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.
This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.
Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.
- Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────
