An open index of dependabot pull requests across open source projects.

pnpm

Ecosystem:
npm
Package URL:
pkg:npm/pnpm
Total PRs:
1,370 Dependabot PRs
Latest PR:
11 days ago
Unique Repositories:
379 repositories
Unique Repos (30 days):
5 repositories
Security Advisories
pnpm: `stage download` writes outside its destination directory via manifest name/version traversal
GHSA-v23m-ccfg-pq9h CVE-2026-55700 HIGH published 27 days ago • updated 3 days ago
## Summary The staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on `main` by [pnpm/pnpm#12303](https://g...
pnpm: Unsafe default behavior breaks integrity check
GHSA-54hh-g5mx-jqcp CVE-2026-50573 MODERATE published 27 days ago • updated 6 days ago
While it is unclear whether this should be classified as a vulnerability, it is being reported through this channel because the current behavior ma...
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
GHSA-cjhr-43r9-cfmw CVE-2026-50017 MODERATE published 27 days ago • updated 6 days ago
## Summary pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local `.npmrc` file. In the repr...
pnpm vulnerable to Command Injection via environment variable substitution
GHSA-2phv-j68v-wwqx CVE-2025-69262 HIGH published 7 months ago • updated about 17 hours ago
## Summary A command injection vulnerability exists in pnpm when using environment variable substitution in `.npmrc` configuration files with `tok...
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
GHSA-qrv3-253h-g69c HIGH published 27 days ago • updated 6 days ago
## Summary `pnpm` accepts package names from the env lockfile `configDependencies` section and uses those names directly when creating config depe...
Recent PRs
Bump pnpm from 11.1.3 to 11.2.2

gflohr/pdf-lab #54

11.1.3 → 11.2.2 Minor PR
Closed 2 months ago 1 comment
gflohr
Package Details
Name: pnpm
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/pnpm
JSON API: View JSON
Security Advisories

28

Active advisories
HIGH 14
MODERATE 14
View All npm Advisories
Package Information
Description:

Fast, disk space efficient package manager

Repository: https://github.com/pnpm/pnpm
Homepage: https://pnpm.io
Latest Release: 10.11.0
about 1 year ago
Dependent Repos: 2,954
Dependent Packages: 1,314
Downloads: 88,232,668
Ranking: Top 0.3962% by dependent repos Top 0.0377% by downloads Top 0.0551% by dependent pkgs
PR Status
Open 649 (47.4%)
Merged 206 (15.0%)
Closed 433 (31.6%)
PR Types
Major 327 (23.9%)
Minor 708 (51.7%)
Patch 253 (18.5%)