pnpm 10.25 改进了证书处理，添加了一个裸 pnpm init，并提供了若干提高使用体验的修复。

🌐 pnpm 10.25 improves certificate handling, adds a bare pnpm init, and ships several quality-of-life fixes.

我们在沙伊-胡卢德 2.0 上很幸运。

🌐 We got lucky with Shai-Hulud 2.0.

在2025年11月，一个自我复制的 npm 蠕虫攻击了796个软件包，这些软件包每月下载量达1.32亿次。该攻击利用 preinstall 脚本来窃取凭据、安装持久后门，并在某些情况下清除整个开发者环境。我们没有受到影响——并不是因为我们有强大的防御能力，而是因为在攻击期间我们没有运行 npm install 或 npm update。

🌐 In November 2025, a self-replicating npm worm compromised 796 packages with 132 million monthly downloads. The attack used preinstall scripts to steal credentials, install persistent backdoors, and in some cases wipe entire developer environments. We weren't affected—not because we had robust defenses, but because we didn't run npm install or npm update during the attack window.

运气不是一种安全策略。

🌐 Luck isn't a security strategy.

pnpm 现在可以在高核心机器上自动扩展网络并发，并提供多个可靠性修复。

🌐 pnpm now scales network concurrency automatically on high-core machines and ships several reliability fixes.

向 pnpm list 添加了 --lockfile-only 选项，并对 pnpm self-update 进行了各种改进。

🌐 Added --lockfile-only option to pnpm list and various improvements to pnpm self-update.

已新增支持从信任策略中排除软件包以及在发布时覆盖 engines 字段。

🌐 Added support for excluding packages from trust policy and overriding the engines field on publish.

添加了对 Node.js 运行时依赖安装的支持以及用于配置信任策略的设置。

🌐 Added support for Node.js runtime installation for dependencies and a setting for configuring trust policy.

此版本为 pnpm help 命令添加了 --all 标志，用于打印所有命令。

🌐 This release adds a --all flag for the pnpm help command to print all commands.

此版本为两个设置添加了版本范围控制：[onlyBuiltDependencies] 和 [minimumReleaseAgeExclude]。

小幅更改​

🌐 Minor Changes

通过实现针对慢速网络请求的警告（包括元数据获取和压缩包下载），已将网络性能监控添加到 pnpm 中。

🌐 Added network performance monitoring to pnpm by implementing warnings for slow network requests, including both metadata fetches and tarball downloads.

添加了警告阈值的配置选项：fetchWarnTimeoutMs 和 fetchMinSpeedKiBps。当请求超过时间阈值或低于速度最小值时，会显示警告信息

🌐 Added configuration options for warning thresholds: fetchWarnTimeoutMs and fetchMinSpeedKiBps. Warning messages are displayed when requests exceed time thresholds or fall below speed minimums

相关的 PR: #10025。

🌐 Related PR: #10025.

补丁更改​

🌐 Patch Changes

• Retry filesystem operations on EAGAIN errors #9959.

• Outdated command respects minimumReleaseAge configuration #10030.

• Correctly apply the cleanupUnusedCatalogs configuration when removing dependent packages.

• Don't fail with a meaningless error when scriptShell is set to false #8748.

• pnpm dlx should not fail when minimumReleaseAge is set #10037.

小幅更改​

🌐 Minor Changes

minimumReleaseAgeExclude 设置现在支持模式。