--- title: pnpm 11.20 | daily.dev description: pnpm 11.20 fixes a security issue where packages resolved from a named registry could be confused with same-name, same-version packages from another registry... canonical: https://daily.dev/posts/pnpm-11-20-mxmbrrwud twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: pnpm 11.20 | daily.dev og:description: pnpm 11.20 fixes a security issue where packages resolved from a named registry could be confused with same-name, same-version packages from another registry... og:url: https://daily.dev/posts/pnpm-11-20-mxmbrrwud og:image: https://api.daily.dev/og/posts/mXMbrRWuD.png og:image:alt: pnpm 11.20 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # pnpm 11.20 **[Fast, disk space efficient package manager \| pnpm](https://daily.dev/sources/pnpm-blog)** · 5 min read · 0 upvotes · 0 comments ## Summary pnpm 11.20 fixes a security issue where packages resolved from a named registry could be confused with same-name, same-version packages from another registry because the lockfile keyed entries only by name and version. Lockfiles now record registry-qualified keys for named-registry packages, closing this substitution risk. The release also adds a built-in npmjs: alias for pinning to the public registry even behind a proxy, stops empty proxy environment variables or config values from breaking installs, hardens pnpm rebuild against path traversal in a malicious lockfile's package names, and speeds up dependency resolution by caching packument filtering and parsed semver comparisons. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does pnpm now record registry-qualified keys in the lockfile for named registries? Because the lockfile previously keyed packages only by name and version, so if two named registries served the same package name and version, both collapsed into one lockfile entry and whichever resolved first determined the tarball everyone installed. As of pnpm 11.20, packages from a named registry are recorded as name@registryName:version, such as foo@work:1.0.0, so each registry gets its own entry, fixing a package-substitution risk present in pnpm 11.1.0 through 11.19.x. _Teams juggling multiple registries can track lockfile security fixes like this one on daily.dev._ ### What happens if I run an older pnpm version after upgrading the lockfile to 11.20's registry-qualified format? An older pnpm reads the re-keyed lockfile fine for frozen installs, but if it performs a non-frozen install that updates the lockfile, it writes entries back in the old unqualified shape since it cannot produce registry-qualified keys itself. The next install on pnpm 11.20 or newer re-qualifies them again, causing the lockfile to flip back and forth while exposing the project to the substitution vulnerability whenever it's in the old shape. _Anyone rolling out a pnpm upgrade across a team can avoid version-mismatch pitfalls by following changes like this on daily.dev._ ### How do I pin an npm dependency to the public npm registry when my .npmrc registry setting points to an internal proxy? Use the built-in npmjs: alias introduced in pnpm 11.20, which resolves to https://registry.npmjs.org/ with no configuration needed, unlike npm: which is just an alias protocol that still resolves through whatever the registry setting points at. If you mirror or proxy npmjs, you can override the npmjs: alias in namedRegistries to point at your mirror instead. _Developers configuring registry proxies can keep up with pnpm alias behavior changes on daily.dev._ ## Similar posts on daily.dev - [pnpm 11.28.5](https://daily.dev/posts/pnpm-11-28-5-cwufxwdeo) · Fast, disk space efficient package manager \| pnpm · 4 upvotes · 0 comments - [pnpm 11.23](https://daily.dev/posts/pnpm-11-23-migxmswxe) · Fast, disk space efficient package manager \| pnpm · 3 upvotes · 0 comments - [pnpm 11 Adds Supply Chain Protection Defaults for Minimum Re...](https://daily.dev/posts/pnpm-11-adds-supply-chain-protection-defaults-for-minimum-re--wxgk3vhhu) · Socket · 101 upvotes · 6 comments - [pnpm 12.10.0](https://daily.dev/posts/pnpm-12-10-0-1jmwtjsma) · Fast, disk space efficient package manager \| pnpm · 6 upvotes · 0 comments - [pnpm 11 cuts the npm umbilical cord](https://daily.dev/posts/pnpm-11-cuts-the-npm-umbilical-cord-vhucinbuf) · Bytes by ui.dev · 50 upvotes · 5 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#pnpm](https://daily.dev/tags/pnpm) [View this post on daily.dev](https://daily.dev/posts/pnpm-11-20-mxmbrrwud) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"pnpm 11.20","url":"https://daily.dev/posts/pnpm-11-20-mxmbrrwud","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pnpm-11-20-mxmbrrwud"},"datePublished":"2026-08-23T12:17:51.530Z","dateModified":"2026-08-23T12:22:43.017Z","description":"pnpm 11.20 fixes a security issue where packages resolved from a named registry could be confused with same-name, same-version packages from another registry...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Fast, disk space efficient package manager | pnpm","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Fast, disk space efficient package manager | pnpm","logo":"https://media.daily.dev/image/upload/s--JKuzGOiX--/f_auto,q_auto/v1787487440/logos/pnpm-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/pnpm-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pnpm-11-20-mxmbrrwud","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,pnpm","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Fast, disk space efficient package manager | pnpm","item":"https://daily.dev/sources/pnpm-blog"},{"@type":"ListItem","position":3,"name":"pnpm 11.20"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pnpm-11-20-mxmbrrwud#faq","mainEntity":[{"@type":"Question","name":"Why does pnpm now record registry-qualified keys in the lockfile for named registries?","acceptedAnswer":{"@type":"Answer","text":"Because the lockfile previously keyed packages only by name and version, so if two named registries served the same package name and version, both collapsed into one lockfile entry and whichever resolved first determined the tarball everyone installed. As of pnpm 11.20, packages from a named registry are recorded as name@registryName:version, such as foo@work:1.0.0, so each registry gets its own entry, fixing a package-substitution risk present in pnpm 11.1.0 through 11.19.x. Teams juggling multiple registries can track lockfile security fixes like this one on daily.dev."}},{"@type":"Question","name":"What happens if I run an older pnpm version after upgrading the lockfile to 11.20's registry-qualified format?","acceptedAnswer":{"@type":"Answer","text":"An older pnpm reads the re-keyed lockfile fine for frozen installs, but if it performs a non-frozen install that updates the lockfile, it writes entries back in the old unqualified shape since it cannot produce registry-qualified keys itself. The next install on pnpm 11.20 or newer re-qualifies them again, causing the lockfile to flip back and forth while exposing the project to the substitution vulnerability whenever it's in the old shape. Anyone rolling out a pnpm upgrade across a team can avoid version-mismatch pitfalls by following changes like this on daily.dev."}},{"@type":"Question","name":"How do I pin an npm dependency to the public npm registry when my .npmrc registry setting points to an internal proxy?","acceptedAnswer":{"@type":"Answer","text":"Use the built-in npmjs: alias introduced in pnpm 11.20, which resolves to https://registry.npmjs.org/ with no configuration needed, unlike npm: which is just an alias protocol that still resolves through whatever the registry setting points at. If you mirror or proxy npmjs, you can override the npmjs: alias in namedRegistries to point at your mirror instead. Developers configuring registry proxies can keep up with pnpm alias behavior changes on daily.dev."}}]} ```