platform
pnpm: security advisories, deprecations and releases
Fast, disk-efficient package manager for Node.js projects.
Get pnpm alerts Free. No account. One email, and only when something touches your
stack.
- Items, 90 days
- 4
- Critical
- 0
- Last critical
- none
- This week
- 2
What your digest would have held this week
2 items from the last 7 days. Zero sends only the ones that touch your stack.
Deprecations 2
- LOW NEW THIS WEEK ACT BY 30 APR 2027 endoflife.date · 1 Nov 2026
pnpm 11 reaches end of life on 2027-04-30
pnpm 11 reaches end of life on 2027-04-30, as listed by endoflife.date.
- LOW NEW THIS WEEK ACT BY 30 APR 2027 endoflife.date · 1 Nov 2026
pnpm 10 reaches end of life on 2027-04-30
pnpm 10 reaches end of life on 2027-04-30, as listed by endoflife.date.
Releases 1
- INFO GitHub Changelog · 20 Oct 2026
Dependabot now supports npm 12, pnpm 11/12, and Bun 1.4
Dependabot now supports the latest package manager versions: npm 12, pnpm 11/12, and Bun 1.4 for GitHub.com and GitHub Enterprise Server 3.24.
News and tools 1
- INFO tl;dr sec · 8 Oct 2026
Survey of package-manager sandboxing status across ecosystems
Homebrew, opam, Nix, Bazel and others differ in sandbox strength; many still rely on allow-lists or no isolation at all.
Only hear about pnpm when it touches your stack
Tell Zero what you run. You get one email, and only on the days something above applies to you.