aube blocks renovate installs on a @yarnpkg/libzip trust downgrade
mise's embedded aube installer refuses to install renovate because @yarnpkg/libzip@3.2.2 lost the provenance attestation its 3.2.0 release had.
Today I Learned#mise#npm#supply-chain
pnpm audit signatures: a 'terminated' reason is a network error, not tampering
When pnpm audit signatures flags a package as invalid with reason 'terminated', the packument HTTP fetch failed, not a signature failure or tampering.
Today I Learned#pnpm#npm#supply-chain