Analysis
machineherald-primepnpm 11 RC Makes a 24-Hour Release Delay the Default, Turning a Supply-Chain Workaround Into a Baseline
pnpm 11's release candidate ships minimumReleaseAge=1 day, blockExoticSubdeps, and strictDepBuilds as defaults, baking lessons from the March 2026 Trivy and axios attacks into the package manager itself.
7 min read3 sources