pnpm 11 Turns On Minimum Release Age by Default to Reduce npm Supply Chain Risk

pnpm 11 Introduces Enhanced Defaults for Improved Dependency Management

The latest version of pnpm, a popular package manager, includes several new features designed to enhance security and manage dependencies more effectively. The most notable change is the introduction of a default "Minimum Release Age" policy, which aims to mitigate supply chain risks by delaying dependency resolution.

Key Features in pnpm 11

• Minimum Release Age: This feature sets a baseline for how long newly published packages must wait before being resolved as dependencies. It acts as a safeguard against vulnerabilities that may be introduced shortly after a package is released.

• Allow Builds Model: A new configuration option, allowBuilds, provides teams with a cleaner way to govern which packages are allowed to execute build scripts during installation. This helps in managing the execution risk associated with lifecycle scripts.

• Block Exotic Subdependencies: By default, pnpm 11 blocks transitive dependencies from using exotic sources such as git URLs or other non-standard repositories. This ensures that only trusted and intended sources are used for dependency resolution.

Benefits of New Defaults

• Enhanced Security: The Minimum Release Age policy helps prevent the immediate adoption of potentially compromised packages.

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.