Summary & Key Takeaways ​

• pnpm 12 Beta 4 includes a crucial security fix for projects utilizing named registries.
• The vulnerability allowed for potential package substitution from unintended registries.
• Lockfiles now record registry-qualified keys to pin packages to their correct source.
• This change prevents a package-substitution risk, improving supply chain security.
• Users of named registries will see a lockfile diff upon updating, which should be committed.
• All team members should update to this version or newer to maintain lockfile consistency.

Our Commentary ​

This is a big deal for anyone relying on private registries. The idea that a package could be swapped out from a different source is genuinely unsettling. We've seen enough supply chain attacks to know this kind of fix is absolutely essential. It's a beta, but the security implications make it a must-mention.