Support for pnpm-lock.yaml now makes the PNPM lockfile the authoritative dependency source, giving release owners evidence for the exact direct and transitive versions recorded for a project.
What changes for PNPM projects
For projects containing pnpm-lock.yaml, SCA resolves dependencies from that file rather than applying NPM-based resolution. This matters because transitive dependency paths and versions can differ materially between package-management approaches.
The practical result is more defensible vulnerability and license findings for PNPM-managed applications:
- Direct and transitive packages follow the versions recorded by PNPM.
- Security triage is based on the dependency graph teams intend to install.
- License reviews can be tied to a defined lockfile state.
- Release approvals have better evidence when a dependency-related exception is requested.
Projects without pnpm-lock.yaml retain existing NPM resolution behavior. Teams do not need to reconfigure those repositories.
Resolver 2.14.11 expands deployment and artifact coverage
SCA Resolver 2.14.11, released July 22, 2026, adds ARM64 installation files for each supported operating system. This is relevant to organizations standardizing build runners on ARM-based cloud infrastructure or supporting mixed CPU architectures across engineering environments.
The resolver also adds support for extracting these formats:
.whl
