Problem
The repo pins pnpm 11.1.3, which is affected by 14 published advisories — 8 high, 6 medium. Surfaced by CodeRabbit on #485; the numbers below are from the GitHub Advisory Database (gh api "/advisories?ecosystem=npm&affects=pnpm"), not from the review.
| Severity |
Advisory |
Vulnerable |
Patched |
| high |
GHSA-qrv3-253h-g69c |
>= 11.0.0, < 11.8.0 |
11.8.0 |
| high |
GHSA-72r4-9c5j-mj57 |
>= 11.0.0, < 11.7.0 |
11.7.0 |
| high |
GHSA-fr4h-3cph-29xv |
>= 11.0.0, < 11.7.0 |
11.7.0 |
| high |
GHSA-w466-c33r-3gjp |
>= 11.0.0, < 11.5.3 |
11.5.3 |
| high |
GHSA-gj8w-mvpf-x27x |
>= 11.0.0, < 11.5.3 |
11.5.3 |
| high |
GHSA-5wx6-mg75-v57r |
>= 11.0.0, < 11.5.3 |
11.5.3 |
| high |
GHSA-rxhj-4m44-96r4 |
>= 11.0.0, < 11.4.0 |
11.4.0 |
| high |
GHSA-hwx4-2j3j-g496 |
>= 11.0.0, < 11.4.0 |
11.4.0 |
| medium |
GHSA-4gxm-v5v7-fqc4 |
>= 11.0.0, < 11.5.3 |
11.5.3 |
| medium |
GHSA-3qhv-2rgh-x77r |
>= 11.0.0, < 11.5.3 |
11.5.3 |
| medium |
GHSA-cjhr-43r9-cfmw |
>= 11.0.0, < 11.4.0 |
11.4.0 |
| medium |
GHSA-p4xf-rf54-rj3x |
>= 11.0.0, < 11.4.0 |
11.4.0 |
| medium |
GHSA-q6j5-fjx5-2mc3 |
>= 11.0.0, < 11.4.0 |
11.4.0 |
| medium |
GHSA-54hh-g5mx-jqcp |
>= 11.0.0, < 11.4.0 |
11.4.0 |
Corrected 2026-08-18. This table originally listed ten advisories. The real
count against 11.1.3 is fourteen (8 high, 6 medium) — flagged during review
of the fixing PR and re-derived from
gh api "/advisories?ecosystem=npm&affects=pnpm" --paginate with range matching
against 11.1.3. The original included GHSA-v23m-ccfg-pq9h, whose range is
>= 11.3.0, < 11.5.3 and therefore does not cover 11.1.3, and omitted five
that do: GHSA-hwx4-2j3j-g496 (high), GHSA-cjhr-43r9-cfmw,
GHSA-p4xf-rf54-rj3x, GHSA-q6j5-fjx5-2mc3, GHSA-54hh-g5mx-jqcp (medium).
"8 high" came out right only because the wrongly-included high and the omitted
high cancelled. The remediation is unchanged: the floor is still 11.8.0.
Minimum safe version: 11.8.0.
Why this matters here specifically
pnpm-workspace.yaml sets allowBuilds: for esbuild, sharp, and workerd — so postinstall scripts do run in CI. GHSA-5wx6-mg75-v57r is precisely "Manifest identity spoof satisfies allowBuilds and runs attacker code", which makes that combination the sharp end of this list rather than a theoretical one.
pnpm runs in every CI job via setup-env, and in publish-npm.yml — the workflow that holds id-token: write for npm trusted publishing.
Scope
Eight declaration lines across six files, plus the lockfile:
package.json:5 "packageManager": "pnpm@11.1.3"
.github/workflows/publish-npm.yml:53 version: "11.1.3" (dev job)
.github/workflows/publish-npm.yml:107 version: "11.1.3" (release job)
.github/actions/setup-env/action.yml:202 version: "11.1.3"
docs/src/content/docs/development.md:21 prerequisites table + corepack line
docs/src/content/docs/development.md:40 "verify your setup" snippet
README.md:124 "pnpm 11+" floor
AGENTS.md:114 "pnpm (>= 11.1)" floor
Corrected 2026-08-18. Line numbers for publish-npm.yml were 89/172; they are
53/107. Three more declaration sites were missed — development.md's verify-setup
snippet is the notable one, since running it would have confirmed a vulnerable
install as correct.
pnpm-lock.yaml needs regenerating, and pnpm 11.8+ may bump lockfileVersion — which is why this wants its own PR and its own full CI run rather than riding along with something else.
Note minimumReleaseAge: 10080 in pnpm-workspace.yaml means the 7-day cooldown applies to the bump itself unless the target release is already older than that.
Not fixed in #485
#485 is release tooling. The pnpm pin is pre-existing, touches six files plus a regenerated lockfile, and deserves independent CI validation — folding it in would have muddied a PR that had already been through ten review rounds. Filing here instead.
Acceptance
Problem
The repo pins pnpm 11.1.3, which is affected by 14 published advisories — 8 high, 6 medium. Surfaced by CodeRabbit on #485; the numbers below are from the GitHub Advisory Database (
gh api "/advisories?ecosystem=npm&affects=pnpm"), not from the review.>= 11.0.0, < 11.8.0>= 11.0.0, < 11.7.0>= 11.0.0, < 11.7.0>= 11.0.0, < 11.5.3>= 11.0.0, < 11.5.3>= 11.0.0, < 11.5.3>= 11.0.0, < 11.4.0>= 11.0.0, < 11.4.0>= 11.0.0, < 11.5.3>= 11.0.0, < 11.5.3>= 11.0.0, < 11.4.0>= 11.0.0, < 11.4.0>= 11.0.0, < 11.4.0>= 11.0.0, < 11.4.0Minimum safe version:
11.8.0.Why this matters here specifically
pnpm-workspace.yamlsetsallowBuilds:foresbuild,sharp, andworkerd— so postinstall scripts do run in CI. GHSA-5wx6-mg75-v57r is precisely "Manifest identity spoof satisfies allowBuilds and runs attacker code", which makes that combination the sharp end of this list rather than a theoretical one.pnpm runs in every CI job via
setup-env, and inpublish-npm.yml— the workflow that holdsid-token: writefor npm trusted publishing.Scope
Eight declaration lines across six files, plus the lockfile:
pnpm-lock.yamlneeds regenerating, and pnpm 11.8+ may bumplockfileVersion— which is why this wants its own PR and its own full CI run rather than riding along with something else.Note
minimumReleaseAge: 10080inpnpm-workspace.yamlmeans the 7-day cooldown applies to the bump itself unless the target release is already older than that.Not fixed in #485
#485 is release tooling. The pnpm pin is pre-existing, touches six files plus a regenerated lockfile, and deserves independent CI validation — folding it in would have muddied a PR that had already been through ten review rounds. Filing here instead.
Acceptance
>= 11.8.0(latest stable preferred)pnpm-lock.yamlregenerated; anylockfileVersionchange called out in the PRmake cigreengh api "/advisories?ecosystem=npm&affects=pnpm"shows no remaining advisory matching the pinned version