Skip to content

chore: enable pnpm trust policy no-downgrade#1378

Draft
franky47 wants to merge 3 commits intonextfrom
chore/trust-policy
Draft

chore: enable pnpm trust policy no-downgrade#1378
franky47 wants to merge 3 commits intonextfrom
chore/trust-policy

Conversation

@franky47
Copy link
Copy Markdown
Member

@franky47 franky47 commented Mar 31, 2026

Summary

  • Adds trustPolicy: no-downgrade to pnpm-workspace.yaml

This prevents installing packages whose trust level has decreased compared to previous releases. For example, if a package was previously published by a trusted publisher but now only has provenance or no trust evidence, pnpm install will fail — catching potential supply chain compromises early.

See: https://pnpm.io/settings#trustpolicy

Test plan

  • CI passes (setting is purely additive, no lockfile changes)
  • Verify pnpm install still works with the policy enabled

@franky47
chore: enable pnpm trust policy no-downgrade
3aafb78 
Prevents installing packages whose trust level has decreased compared
to previous releases (e.g. a previously trusted-publisher package
losing its provenance attestation), as a supply chain security measure.
@vercel
Copy link
Copy Markdown

vercel bot commented Mar 31, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
nuqs Ready Ready Preview, Comment Mar 31, 2026 7:22am

Request Review

@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 31, 2026 •
edited
Loading

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm vite is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: packages/e2e/react-router/v5/package.json → npm/vite@8.0.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@8.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

franky47 added 2 commits March 31, 2026 09:20
@franky47
chore: exclude chokidar@4.0.3 from trust policy
95002e5 
chokidar 4.0.3 was published without provenance attestation (restored
in 5.0.0), but it's pinned as a transitive dependency of fumadocs-mdx.
@franky47
Revert "chore: exclude chokidar@4.0.3 from trust policy"
148f397 
Reverted premature exclusion — need to investigate the trust downgrade
before bypassing the security check.
@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 31, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedvite@​8.0.0941008299100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@franky47