为什么 pnpm 不再在仓库的 .npmrc 中展开环境变量
pnpm 以前会在它找到的所有地方展开 ${ENV_VAR} 占位符 —— 包括你刚克隆的仓库中的 .npmrc 和 pnpm-workspace.yaml 文件。这最终成为恶意仓库窃取你环境中的秘密的一种方式。从 v10.34.2 和 v11.5.3 开始，pnpm 不再在仓库控制的注册表和凭据设置中展开环境变量。
🌐 pnpm used to expand ${ENV_VAR} placeholders everywhere it found them — including in the .npmrc and pnpm-workspace.yaml files that live inside the repository you just cloned. That turned out to be a way for a malicious repository to steal the secrets in your environment. As of v10.34.2 and v11.5.3, pnpm stops expanding environment variables in repository-controlled registry and credential settings.
这是一个安全修复（GHSA-3qhv-2rgh-x77r），并且对于某些设置来说这是一个破坏性更改。本文解释了该攻击、具体更改内容以及如何迁移。
🌐 This was a security fix (GHSA-3qhv-2rgh-x77r), and it is a breaking change for some setups. This post explains the attack, what exactly changed, and how to migrate.