@pnpm.io 11.5 adds support for recognizing npm staged publishes after staged approval metadata triggered a false downgrade signal.

As npm adds more release paths, registry metadata needs to make it clear how each package version was published.

pnpm 11.5 Adds Support for Recognizing npm Staged Publishes ...

pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publi...

Socket (socket.dev)

https://bsky.app/profile/socket.dev/post/3mngudpejss2x

#Security #SupplyChain #Bluesky