pnpm 11.17.0

pnpm 11.17.0 has been released — the fast, disk-space-efficient package manager just got a solid update with improved GitHub Actions dependency management and important security hardening.

GitHub Actions Integration Gets Smarter

The headline feature in pnpm 11.17 is overhauled support for managing GitHub Actions dependencies. A new setting, update.githubActionsServer, lets you specify a custom base URL for GitHub servers — perfect for teams using GitHub Enterprise Server. When unset, pnpm falls back to GITHUB_SERVER_URL or https://github.com by default.

Both pnpm outdated and pnpm update now handle private GitHub Action repositories gracefully. Instead of crashing when an action's refs can't be read, pnpm skips them with a clear warning.

Setting update.githubActions to false makes pnpm skip all GitHub Actions dependencies during update checks — a welcome quality-of-life improvement for CI-heavy projects that don't need action version bumps.

Security Hardening

This release fixes a potential denial-of-service vector in the token polling mechanism for web-based authentication. The token poller no longer reads response bodies on non-OK or pending (HTTP 202) responses, and caps any token response body it does read at 64 KiB. This prevents a malicious or compromised registry from exhausting memory during the polling loop.

Bug Fixes

• catalog: references in pnpr server — Fixed catalog: references in dependencies and overrides failing to resolve when installing through a pnpm server
• General reliability — Various minor patches improving edge-case handling in dependency resolution

Upgrade Now

pnpm 11.17.0 is available on npm now. Upgrade with npm install -g pnpm or corepack prepare [email protected] --activate. Check the full release notes for the complete list of changes.