pnpm now refuses uWebSockets.js as a transitive dependency: would you reconsider npm, or allow a mirror?

I maintain fulmine.js, an Express 5 compatible server built on uWebSockets.js. It depends on github:uNetworking/uWebSockets.js#v20.69.0, as the README says to do.

Since pnpm 10.26.0 (December 2025) the setting blockExoticSubdeps is true by default: a dependency resolved from git is allowed only when it is listed in the user's own package.json, never as a dependency of a dependency. So today, on a clean project:

$ pnpm add fulmine.js
ERR_PNPM_EXOTIC_SUBDEP  Exotic dependency "uWebSockets.js" (resolved via git-repository) is not allowed in subdependencies when blockExoticSubdeps is enabled

Adding uWebSockets.js as a direct dependency does not help, and neither does pnpm.overrides: the check is on the spec in my package's dependencies. The only way through is blockExoticSubdeps=false in the user's .npmrc, which turns a security setting off for the whole project. npm has the same knob (allow-git), off by default but turned on in a number of company registries and CI images, and a Docker image without git fails at install time too.

I know the position on npm is an old one and has its reasons. I am asking anyway, because the package managers are now moving against git dependencies in general, and every library that builds on uWebSockets.js is hit at install time, before its users have run a single line.

Two things I would ask, either one would settle it:

1. Publish to the npm registry again, under your name, from the same tag. The tarball is what npm pack github:uNetworking/uWebSockets.js#v20.69.0 already produces, binaries included, so it is a npm publish per release and nothing else changes.
2. If not, your ok to publish a verbatim mirror under a clearly different name (for example @fulmine/uwebsockets.js or @nigrosimone/uwebsockets.js), same tarball, same license and copyright, one version per tag of yours, with a README saying it is a mirror and pointing here. It is allowed by the Apache-2.0 license, I would still rather ask than do it.

Thank you for the work on uWebSockets.js.

Start with the README's installation guidance and the dependency specification described in the issue. Review the npm pack output for tag v20.69.0 and the stated package-manager restrictions, then determine whether publishing the package or authorizing a verbatim mirror is acceptable. Done means the maintainers choose and document one supported installation path.