2026-06-08 16:44:38 +08:00
|
|
|
# pnpm 9.x and its bundled dependencies
|
|
|
|
|
# These are build-time tool internals, not runtime application code.
|
|
|
|
|
# pnpm is only used for dependency installation and process management.
|
|
|
|
|
# All require upgrading to pnpm 10.x (major breaking change).
|
|
|
|
|
# Tracked: https://github.com/pnpm/pnpm/releases/tag/v10.0.0
|
|
|
|
|
|
|
|
|
|
# pnpm core
|
2026-06-08 16:32:52 +08:00
|
|
|
CVE-2025-69262
|
|
|
|
|
CVE-2025-69263
|
2026-06-08 16:44:38 +08:00
|
|
|
|
|
|
|
|
# glob (bundled in pnpm 9.x, not our dependency)
|
|
|
|
|
CVE-2025-64756
|
|
|
|
|
|
|
|
|
|
# minimatch (bundled in pnpm 9.x)
|
|
|
|
|
CVE-2026-26996
|
|
|
|
|
CVE-2026-27903
|
|
|
|
|
CVE-2026-27904
|
|
|
|
|
|
|
|
|
|
# picomatch (bundled in pnpm 9.x)
|
|
|
|
|
CVE-2026-33671
|
|
|
|
|
|
|
|
|
|
# tar (bundled in pnpm 9.x)
|
|
|
|
|
CVE-2026-23745
|
|
|
|
|
CVE-2026-23950
|
|
|
|
|
CVE-2026-24842
|
|
|
|
|
CVE-2026-26960
|
|
|
|
|
CVE-2026-29786
|
|
|
|
|
CVE-2026-31802
|
