Repository navigation
[rush] Support for pnpm's trustPolicy setting(s) in pnpm-config.json #5750
Description
Summary
pnpm provides a suite of settings to avoid "trust policy" downgrades (i.e. blocking installations of package versions that are published without provenance, after a given package publishes with provenance):
- trustPolicy (pnpm >= 10.21.0)
- trustPolicyExclude (pnpm >= 10.22.0)
- trustPolicyIgnoreAfter (pnpm >= 10.27.0)
The trustPolicy setting is useful to catch dependency hijack attacks similar to the recent Axios error, whereby an attacker steals a maintainer's keys and they make a release outside of CI (i.e. without provenance). The other two settings are there to allowlist any known-good (but downgraded) packages, which happens occasionally in the ecosystem.
Note that going through .npmrc directly (specifying e.g. trust-policy: no-downgrade) works, so this is more of a nice-to-have if one uses pnpm-config.json, as far as I can see. The latter is more discoverable, in my opinion.
Details
The necessary changes would be broadly similar to those made to support minimumReleaseAge and minimumReleaseAgeExclude (#5405), adding the options to libraries/rush-lib/src/logic/pnpm/PnpmOptionsConfiguration.ts, as well as related schmas and interfaces.
I would be happy to implement this, if that is ok with you 😌
Standard questions
Please answer these questions to help us investigate your issue more quickly:
| Question | Answer |
|---|---|
@microsoft/rush globally installed version? |
5.172.1 |
rushVersion from rush.json? |
5.172.1 |
pnpmVersion, npmVersion, or yarnVersion from rush.json? |
10.30.0 |
(if pnpm) useWorkspaces from pnpm-config.json? |
true |
| Operating system? | Mac |
| Would you consider contributing a PR? | Yes |
Node.js version (node -v)? |
24.14.0 |
Activity
[-][rush] Support for pnpm's trustPolicy setting(s)[/-][+][rush] Support for pnpm's trustPolicy setting(s) in pnpm-config.json[/+]fpapado commentedon Apr 17, 2026
Ian Clanton-Thuon (@iclanton), I realised that similar to #5752, pnpm only reads these settings from
pnpm-workspace.yamland.npmrc, instead of the synthesisedpackage.json. I can open a followup to fix this 🔧 Sorry for missing it earlier, we had a.npmrclocally and that was getting used instead.Aside: more generally, in pnpm v11, pnpm is moving to reading config only from
pnpm-workspace.yamlorconfig.yaml(except auth settings, which can be in.npmrcstill):from the RC release notes
also from the RC notes
I mention this just in case it helps down the line 😌