pnpm
pnpm 12.9.0 · pkgs/development/tools/pnpm/generic-rust.nix
Health
Risk
risk 8 low
- +8 12.9.0 is behind upstream 12.14.0
Version
12.9.0 upstream 12.14.0
Channels
Hydra
succeeded 1d ago
Advisories
NIXPKGS-2026-2460 pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install fixed in master needs backport to nixos-26.05
NIXPKGS-2026-2458 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph fixed in master needs backport to nixos-26.05
Packaging
not read yet: the next index sweep reads it
Pull requests 1
pnpm: convert to alias
#522535 by Scrumplex · opened 4mo ago
Closed or merged in the synced window 11
Revert "pnpm_12: 12.3.4 -> 12.9.0"
#572199 by Scrumplex · closed 7d ago
[Backport release-26.05] pnpm_12: 12.3.4 -> 12.9.0
#569773 by nixpkgs-ci · merged 12d ago
pnpm_12: 12.3.4 -> 12.9.0
#566850 by Scrumplex · merged 13d ago
pnpm: point alias to pnpm_12
#562930 by diogotcorreia · merged 4w ago
[26.05] pnpm_12: init at 12.3.4
#562923 by diogotcorreia · merged 3w ago
pnpm: remove dead code used by dropped pnpm_8
#560057 by gepbird · merged 5w ago
pnpm: add missing pn/pnx bin aliases
#558475 by ykyaw · merged 5w ago
pnpm: 11.21.0 -> 11.22.0
#555164 by r-ryantm · merged 7w ago
pnpm_12: init at 12.3.4
#547612 by diogotcorreia · merged 4w ago
rustplatform.cargoSetupHook: force common system libs
#537108 by RossSmyth · merged 1d ago
Issues 0
None open.
Closed or merged in the synced window 2
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install 1.severity: security
#558809 by nixpkgs-security-tracker · closed 13d ago · 0 comments
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph 1.severity: security
#558807 by nixpkgs-security-tracker · closed 13d ago · 0 comments