Packages / pnpm / Security

ModerateVulnerabilityGHSA-hg3w-7f8c-63hpPublished 26 Jun 2026

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Affected · pnpm

  • < 10.33.4
  • >= 11.0.0, < 11.0.7

Fixed in

11.0.7

npm install pnpm@11.0.7

  1. Affected

    0.0.1 – 10.33.3

    936 releases

  2. Fixed

    10.33.4 – 10.34.7

    9 releases

  3. Affected

    11.0.0 – 11.0.6

    7 releases

  4. Fixed

    11.0.7 – 12.14.0

    78 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.