Repository navigation

Stop attesting npm-family pins pnpm or a user patch overrides - #2010

Merged

Mikola Lysenko (mikolalysenko) merged 9 commits into

mainfrom

fix/npm-discovery-false-attestation

Nov 8, 2026

Merged

Stop attesting npm-family pins pnpm or a user patch overrides#2010
Mikola Lysenko (mikolalysenko) merged 9 commits into
mainfrom
fix/npm-discovery-false-attestation

Commits on Nov 4, 2026
- Stop attesting npm-family pins pnpm or a user patch overrides
  
  Mikola Lysenko (mikolalysenko)
  and
  Claude (claude)
  committed
  b4224f0
Commits on Nov 5, 2026
- Address /code-review findings on npm-family VEX discovery
  
  Mikola Lysenko (mikolalysenko)
  and
  Claude (claude)
  committed
  76bb103
- Withhold pnpm lock pins whenever a branch lock exists
  
  Mikola Lysenko (mikolalysenko)
  and
  Claude (claude)
  committed
  5df67ed
Commits on Nov 6, 2026
- Withhold pnpm pins when workspace members cannot be listed
  Claude (claude)
  committed
  ac92b08
- Describe the pnpm branch-lock mark as discovery applies it
  Claude (claude)
  committed
  ab96d63
Commits on Nov 7, 2026