<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[🦋 📦 @pnpm.io 11.5 adds support for recognizing npm staged publishes after staged approval metadata triggered a false downgrade signal.]]></title><description><![CDATA[<p><img src="https://board.circlewithadot.net/assets/plugins/nodebb-plugin-emoji/emoji/android/1f98b.png?v=28325c671da" class="not-responsive emoji emoji-android emoji--butterfly" style="height:23px;width:auto;vertical-align:middle" title="🦋" alt="🦋" /> <img src="https://board.circlewithadot.net/assets/plugins/nodebb-plugin-emoji/emoji/android/1f4e6.png?v=28325c671da" class="not-responsive emoji emoji-android emoji--package" style="height:23px;width:auto;vertical-align:middle" title="📦" alt="📦" /> @pnpm.io 11.5 adds support for recognizing npm staged publishes after staged approval metadata triggered a false downgrade signal.</p><p>As npm adds more release paths, registry metadata needs to make it clear how each package version was published.</p><p></p><div class="card col-md-9 col-lg-6 position-relative link-preview p-0">



<a href="https://socket.dev/blog/pnpm-11-5-adds-support-for-recognizing-npm-staged-publishes" title="pnpm 11.5 Adds Support for Recognizing npm Staged Publishes ...">
<img src="https://cdn.sanity.io/images/cgdhsj6q/production/e1bb94bf0c46665f4340b88dc24e774748442c71-1672x941.png?w=1000&amp;q=95&amp;fit=max&amp;auto=format" class="card-img-top not-responsive" style="max-height:15rem" alt="Link Preview Image" />
</a>



<div class="card-body">
<h5 class="card-title">
<a href="https://socket.dev/blog/pnpm-11-5-adds-support-for-recognizing-npm-staged-publishes">
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes ...
</a>
</h5>
<p class="card-text line-clamp-3">pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publi...</p>
</div>
<a href="https://socket.dev/blog/pnpm-11-5-adds-support-for-recognizing-npm-staged-publishes" class="card-footer text-body-secondary small d-flex gap-2 align-items-center lh-2">



<img src="https://socket.dev/favicon-32x32.png" alt="favicon" class="not-responsive overflow-hiddden" style="max-width:21px;max-height:21px" />









<p class="d-inline-block text-truncate mb-0">Socket <span class="text-secondary">(socket.dev)</span></p>
</a>
</div><p></p><p><img src="https://board.circlewithadot.net/assets/plugins/nodebb-plugin-emoji/emoji/android/1f517.png?v=28325c671da" class="not-responsive emoji emoji-android emoji--link" style="height:23px;width:auto;vertical-align:middle" title="🔗" alt="🔗" /> <a href="https://bsky.app/profile/socket.dev/post/3mngudpejss2x" rel="nofollow noopener"><span>https://</span><span>bsky.app/profile/socket.dev/po</span><span>st/3mngudpejss2x</span></a></p><p><a href="https://mstdn.feddit.social/tags/Security" rel="tag">#<span>Security</span></a> <a href="https://mstdn.feddit.social/tags/SupplyChain" rel="tag">#<span>SupplyChain</span></a> <a href="https://mstdn.feddit.social/tags/Bluesky" rel="tag">#<span>Bluesky</span></a></p>]]></description><link>https://board.circlewithadot.net/topic/01005098-4d1c-4014-9171-a39123f11be0/@pnpm.io-11.5-adds-support-for-recognizing-npm-staged-publishes-after-staged-approval-metadata-triggered-a-false-downgrade-signal.</link><generator>RSS for Node</generator><lastBuildDate>Sat, 13 Jun 2026 09:35:50 GMT</lastBuildDate><atom:link href="https://board.circlewithadot.net/topic/01005098-4d1c-4014-9171-a39123f11be0.rss" rel="self" type="application/rss+xml"/><pubDate>Thu, 04 Jun 2026 10:41:22 GMT</pubDate><ttl>60</ttl></channel></rss>