Summary & Key Takeaways ​

• pnpm 11.28.3 updates undici to address a security advisory.
• It fixes "database disk image is malformed" errors when multiple pnpm processes share a store.
• The release ensures proper handling of JavaScript built-in object property names like constructor and toString.
• Previously, these names caused crashes or silent failures in various pnpm commands and operations.
• The update also prevents re-resolution of up-to-date lockfiles in specific peer dependency scenarios.
• POSIX bin shims now function correctly within Nix builds.
• pnpm now correctly passes unknown options to pinned pnpm versions.

Our Commentary ​

This isn't just a patch; it's a critical patch. The "database disk image is malformed" error sounds like a nightmare scenario for developers. And the constructor name issue? That's a subtle, insidious bug that could lead to all sorts of head-scratching. We're glad to see these core stability issues addressed. It makes you wonder how many projects were silently failing because of these edge cases.