From aa378c0be68ca966cf5cf9c51fc81271b35b3e49 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Fri, 26 Jun 2026 22:13:40 -0700 Subject: [PATCH 1/2] pnpm_8: mark insecure --- pkgs/development/tools/pnpm/default.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix index 4339c86d09cb..d89bd2034f84 100644 --- a/pkgs/development/tools/pnpm/default.nix +++ b/pkgs/development/tools/pnpm/default.nix @@ -9,6 +9,15 @@ let "8" = { version = "8.15.9"; hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY="; + knownVulnerabilities = [ + "CVE-2026-48995" + "CVE-2026-50014" + "CVE-2026-50015" + "CVE-2026-50016" + "CVE-2026-50017" + "CVE-2026-50573" + "CVE-2026-55699" + ]; }; "9" = { version = "9.15.9"; From b0ed2e0e81db3459e16c7fdc9d1572092ac73573 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Fri, 26 Jun 2026 22:13:03 -0700 Subject: [PATCH 2/2] pnpm_9: mark insecure --- pkgs/development/tools/pnpm/default.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix index d89bd2034f84..bd06623361bb 100644 --- a/pkgs/development/tools/pnpm/default.nix +++ b/pkgs/development/tools/pnpm/default.nix @@ -22,6 +22,15 @@ let "9" = { version = "9.15.9"; hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc="; + knownVulnerabilities = [ + "CVE-2026-48995" + "CVE-2026-50014" + "CVE-2026-50015" + "CVE-2026-50016" + "CVE-2026-50017" + "CVE-2026-50573" + "CVE-2026-55699" + ]; }; # 10.29.3 made a breaking change: https://github.com/pnpm/pnpm/issues/10601. # Pnpm packages that depend on electron builder must be upgraded to 26.8.2 or newer