--- title: pnpm 11.4 | daily.dev description: pnpm 11.4 patches a cluster of supply-chain vulnerabilities: tarball-integrity mismatches now cause a hard install failure by default instead of silently... canonical: https://daily.dev/posts/pnpm-11-4-a0a6ji7lc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: pnpm 11.4 | daily.dev og:description: pnpm 11.4 patches a cluster of supply-chain vulnerabilities: tarball-integrity mismatches now cause a hard install failure by default instead of silently... og:url: https://daily.dev/posts/pnpm-11-4-a0a6ji7lc og:image: https://api.daily.dev/og/posts/A0A6ji7lC.png og:image:alt: pnpm 11.4 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # pnpm 11.4 **[Fast, disk space efficient package manager \| pnpm](https://daily.dev/sources/pnpm-blog)** · 5 min read · 0 upvotes · 0 comments ## Summary pnpm 11.4 patches a cluster of supply-chain vulnerabilities: tarball-integrity mismatches now cause a hard install failure by default instead of silently re-resolving and overwriting the locked hash, with a narrowly scoped --update-checksums opt-in for legitimate refreshes. Unscoped credentials (_authToken, _auth, cert, key, etc.) are now automatically rewritten to their URL-scoped form so they can no longer leak to a different registry. Lockfile entries missing integrity hashes are now rejected outright, git resolutions must use full 40-character SHAs (blocking command injection via crafted commit fields), patch files can no longer write outside the package directory, and dependency aliases with path-traversal segments are rejected. Separately, pnpm runtime set now writes to devEngines.runtime instead of engines.runtime by default, with --save-prod restoring the old behavior. Several other bug fixes are included, such as fixing pnpm deploy crashes and EMFILE errors on large workspaces. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happens now if pnpm install detects a tarball integrity mismatch against the lockfile? As of pnpm 11.4, a tarball hash mismatch against the lockfile is a hard install failure, throwing ERR_PNPM_TARBALL_INTEGRITY, instead of the previous behavior of silently re-resolving from the registry and overwriting the locked integrity value. The only opt-in bypass is the new --update-checksums flag, which mirrors yarn's flag of the same name and prints a warning when used. Neither --force nor pnpm update bypass this check. _Track breaking changes like this before they surprise a CI pipeline, on daily.dev._ ### How does pnpm 11.4 prevent unscoped npm credentials from leaking to the wrong registry? pnpm 11.4 rewrites each unscoped per-registry credential setting (_authToken, _auth, username, _password, tokenHelper, cert, key) into its URL-scoped form at load time, pinning it to the registry declared in the same config source. This stops a later config layer from overriding registry= and pulling an unscoped credential along with it. Each rescope prints a deprecation warning, since npm has rejected unscoped credentials since npm@9 and pnpm plans to remove support entirely in a future major version. _Developers hardening their registry configs can follow security-relevant releases like this on daily.dev._ ### Why does pnpm now reject git dependency resolutions with a non-SHA commit field? Because a commit field that isn't a full 40-character hexadecimal SHA could smuggle a value like --upload-pack= through git fetch or git checkout, letting a malicious lockfile execute an arbitrary command on SSH or local-file transports. pnpm 11.4 rejects any git resolution whose commit field fails that SHA format check before invoking git at all. _Anyone auditing lockfiles for injection risks can keep up with fixes like this on daily.dev._ ## Similar posts on daily.dev - [pnpm 11.28.5](https://daily.dev/posts/pnpm-11-28-5-cwufxwdeo) · Fast, disk space efficient package manager \| pnpm · 4 upvotes · 0 comments - [pnpm 12.10.0](https://daily.dev/posts/pnpm-12-10-0-1jmwtjsma) · Fast, disk space efficient package manager \| pnpm · 6 upvotes · 0 comments - [pnpm 11.10 Hardens Registry Authentication to Block Token Re...](https://daily.dev/posts/pnpm-11-10-hardens-registry-authentication-to-block-token-re--fwa9evwsm) · Socket · 2 upvotes · 0 comments - [pnpm 11 cuts the npm umbilical cord](https://daily.dev/posts/pnpm-11-cuts-the-npm-umbilical-cord-vhucinbuf) · Bytes by ui.dev · 50 upvotes · 5 comments - [pnpm 11.23](https://daily.dev/posts/pnpm-11-23-migxmswxe) · Fast, disk space efficient package manager \| pnpm · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#nodejs](https://daily.dev/tags/nodejs), [#npm](https://daily.dev/tags/npm), [#pnpm](https://daily.dev/tags/pnpm) [View this post on daily.dev](https://daily.dev/posts/pnpm-11-4-a0a6ji7lc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"pnpm 11.4","url":"https://daily.dev/posts/pnpm-11-4-a0a6ji7lc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pnpm-11-4-a0a6ji7lc"},"datePublished":"2026-08-23T12:17:33.487Z","dateModified":"2026-08-23T12:25:06.002Z","description":"pnpm 11.4 patches a cluster of supply-chain vulnerabilities: tarball-integrity mismatches now cause a hard install failure by default instead of silently...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Fast, disk space efficient package manager | pnpm","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Fast, disk space efficient package manager | pnpm","logo":"https://media.daily.dev/image/upload/s--JKuzGOiX--/f_auto,q_auto/v1787487440/logos/pnpm-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/pnpm-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pnpm-11-4-a0a6ji7lc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,nodejs,npm,pnpm","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Fast, disk space efficient package manager | pnpm","item":"https://daily.dev/sources/pnpm-blog"},{"@type":"ListItem","position":3,"name":"pnpm 11.4"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pnpm-11-4-a0a6ji7lc#faq","mainEntity":[{"@type":"Question","name":"What happens now if pnpm install detects a tarball integrity mismatch against the lockfile?","acceptedAnswer":{"@type":"Answer","text":"As of pnpm 11.4, a tarball hash mismatch against the lockfile is a hard install failure, throwing ERR_PNPM_TARBALL_INTEGRITY, instead of the previous behavior of silently re-resolving from the registry and overwriting the locked integrity value. The only opt-in bypass is the new --update-checksums flag, which mirrors yarn's flag of the same name and prints a warning when used. Neither --force nor pnpm update bypass this check. Track breaking changes like this before they surprise a CI pipeline, on daily.dev."}},{"@type":"Question","name":"How does pnpm 11.4 prevent unscoped npm credentials from leaking to the wrong registry?","acceptedAnswer":{"@type":"Answer","text":"pnpm 11.4 rewrites each unscoped per-registry credential setting (_authToken, _auth, username, _password, tokenHelper, cert, key) into its URL-scoped form at load time, pinning it to the registry declared in the same config source. This stops a later config layer from overriding registry= and pulling an unscoped credential along with it. Each rescope prints a deprecation warning, since npm has rejected unscoped credentials since npm@9 and pnpm plans to remove support entirely in a future major version. Developers hardening their registry configs can follow security-relevant releases like this on daily.dev."}},{"@type":"Question","name":"Why does pnpm now reject git dependency resolutions with a non-SHA commit field?","acceptedAnswer":{"@type":"Answer","text":"Because a commit field that isn't a full 40-character hexadecimal SHA could smuggle a value like --upload-pack= through git fetch or git checkout, letting a malicious lockfile execute an arbitrary command on SSH or local-file transports. pnpm 11.4 rejects any git resolution whose commit field fails that SHA format check before invoking git at all. Anyone auditing lockfiles for injection risks can keep up with fixes like this on daily.dev."}}]} ```