Post

It looks like the latest @pnpm.io authentication settings changes have broken all my deploy pipelines both on GitHub and on Railway. I am all for hardening the dependency supply chain but I am also all for adding deprecation warnings while things are not broken yet. pnpm.io/npmrc

pnpm.iopnpm.io

17/6/26, 8:32 pm0 reposts1 like

pnpm

@pnpm.io

17 June

That would give attackers time to use the vulnerability pnpm.io/blog/2026/06...

pnpm.ioWhy pnpm no longer expands environment variables in a repository's .npmrc | pnpmpnpm used to expand $ placeholders everywhere it found them — including in the .npmrc and pnpm-workspace.yaml files that live inside the repository you just cloned. That turned out to be a way for a m...

Theo Ephraim

@theozero.bsky.social

17 June

The env-var advice here is a bit misleading: `export "pnpm_config_//..."` won't run in any shell. You need env or something that writes the child's environ directly. varlock.dev can help securely inject token (NO PLAINTEXT) but a nicer injection mechanism would help.

varlock.devVarlock - AI-safe .env filesAI-safe .env files: schemas for agents, secrets for humans. Validate, secure, and share environment variables with type-safety, leak prevention, and integrations for Next.js, Vite, Astro, and more.

pnpm

@pnpm.io

20 June

We are open to suggestions. This was the fastest solution

Thilo Maier

@maier.tech

20 June

The thing that confused me on your authentication settings page pnpm.io/npmrc#enviro... was this suggestion: `export "pnpm_config_//registry.npmjs.org/:_authToken=$NPM_TOKEN"` This does not work locally nor with my cloud provider. It would be helpful to clarify how this works or remove it.

pnpm.ioAuthentication Settings | pnpmThe settings on this page contain sensitive credentials and are stored in INI-formatted files. Do not commit these files to your repository.

Theo Ephraim

@theozero.bsky.social

22 June

I’ll do some digging and open a PR