Just flagging that `prettier-plugin-sh@0.20.0` was published [with provenance removed](https://npmx.dev/package-timeline/prettier-plugin-sh/v/0.20.0). Projects that enforce a [trust policy](https://pnpm.io/settings/dependency-resolution#trustpolicy) won’t be able to update to this version and use the changes implemented in #520.
Activity
porada commentedon Sep 24, 2026
Looks like
[email protected]is also affected.JounQin commentedon Sep 24, 2026
Not sure what's happening.
https://github.com/un-ts/prettier/actions/runs/36015808194/job/107687914032
All releases are published by changesets on CI with trusted publishing. No
NPM_TOKENprovided or even allowed at all.