pnpm 10.16 Introduces Security Feature to Delay New Package Installations
By
ivanb
8mo ago· 3 min readenNews
85/100
Golden Brown
Bagelometer↗
Sesame, salt, and substance. A flagship bake.
Score85TypenewsSentimentpositive
Summary
pnpm 10.16 introduces a new security feature called 'minimumReleaseAge' that delays installation of newly released package versions to mitigate supply chain attacks. This setting requires a specified number of minutes to pass after a version is published before pnpm will install it, helping to avoid compromised packages that are typically discovered and removed within an hour.
Key quotes
· 3 pulledTo reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies.
The new setting is called minimumReleaseAge. It specifies the number of minutes that must pass after a version is published before pnpm will install it.
In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour.
Minor Changes
