Summary & Key Takeaways ​

• pnpm 11.20 provides a vital security update for users of named registries.
• The fix resolves a vulnerability where packages could be substituted from unintended sources.
• Lockfiles now include registry-qualified keys to ensure packages are sourced correctly.
• This update is essential for mitigating package-substitution risks in the supply chain.
• Projects using named registries will see lockfile changes that need to be committed.
• Ensure all collaborators are on this version or newer to maintain lockfile consistency.

Our Commentary ​

Good to see this critical security fix land in the stable 11.x branch as well. It's a reminder that even seemingly minor version bumps can carry crucial updates. If you're on pnpm 11.x and use named registries, this is an immediate update.