●Change8

Migrating to pnpm v10.34.1

Version v10.34.1 introduces 1 breaking change. This guide details how to update your code.

Released: 5/27/2026

1
Breaking Changes
1
Migration Steps
2
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

pnpm-lock.yamlERR_PNPM_MISSING_TARBALL_INTEGRITY

Breaking Changes

●Issue #1

pnpm now rejects `pnpm-lock.yaml` entries where remote tarball resolutions are missing the `integrity` field, failing with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`. Previously, hash verification was skipped, allowing potential tampering if the lockfile was altered and the remote content was compromised. To fix, ensure all remote tarball entries in `pnpm-lock.yaml` include the `integrity` field, unless they are git-hosted or `file:` tarballs.

Migration Steps

  1. 1
    Ensure all remote tarball entries in `pnpm-lock.yaml` include the `integrity` field to prevent lockfile tampering vulnerabilities, unless the tarball is git-hosted or uses a `file:` protocol.

Release Summary

This patch introduces a critical security fix by enforcing the presence of the `integrity` field in remote tarball resolutions within `pnpm-lock.yaml`, failing builds if it is missing to prevent package tampering.

Need More Details?

View the full release notes and all changes for pnpm v10.34.1.

View Full Changelog