Ruff Author Urges pnpm Not to Disable Private Vulnerability Reporting Without Alternative
charliermarsh · x · 2026-10-05
charliermarsh responds to zkochan's move to disable private vulnerability reporting on pnpm, strongly advising against it unless another advertised responsible-disclosure mechanism (like an email address) exists. zkochan cites abuse of the feature as the reason.
Related event: pnpm Criticized for Closing Private Vulnerability Reporting Channel(2 posts)→
More from coding & agent
- CacheBack cuts 75% of agent-to-agent KV cache state, +14.7 points accuracy on FanOutQA — Maximillian Rossi · 2026-10-05
- OpenAI launches Codex Cloud with reusable environments at DevDay — Dimillian · 2026-10-05
- Google makes stateful Interactions API the default for Gemini models and Agent Platform — rseroter · 2026-10-05
- Day 3 of running an AI agent team building its own version control system — Al_Grigor · 2026-10-05
- django-admin-mcp: Expose Django admin to AI agents with a single mixin — gorenbarbaros · 2026-10-05
- Dev ports 90s Bungie game Myth to WebAssembly in a weekend using Claude Opus 5.5 — garrytan · 2026-10-05