Affected Packages

cli probably

Problem

npm has introduced provenance https://docs.npmjs.com/generating-provenance-statements
pnpm as of version 8.4 also supports it.

The question it how to implement it to keep supporting older clients. Either it is a config option, or autodetection of the client version and always enable it. Although not sure if it should be always enabled.