pnpm 11.28.8

{
  "id": "03d9612d7b65dee78c66032c64be5bccfa7315630b9119febacdeb4b90f26129",
  "url": "https://github.com/pnpm/pnpm/releases/tag/v11.28.8",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "pnpm 11.28.8",
    "summary": "The standalone @pnpm/exe builds now embed Node.js 26.12.1, replacing a version that trusted certificate authority intermediates distrusted by Node.js.",
    "evidence": "The standalone @pnpm/exe builds now embed Node.js 26.12.1. The previously embedded Node.js 26.0.0 still trusted the certificate authority intermediates that Node.js distrusted in October 2026, so a standalone pnpm accepted TLS certificates issued under them.",
    "products": [
      {
        "name": {
          "value": "@pnpm/exe",
          "evidence": "The standalone @pnpm/exe builds now embed Node.js 26.12.1."
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "Node.js 26.12.1",
            "evidence": "The standalone @pnpm/exe builds now embed Node.js 26.12.1."
          }
        ],
        "affected_versions": [
          {
            "value": "Node.js 26.0.0",
            "evidence": "The previously embedded Node.js 26.0.0 still trusted the certificate authority intermediates"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-pnpm-pnpm",
  "document_id": 22197,
  "published_at": "2026-10-22T22:08:54+00:00"
}