chore(deps): update pnpm to v11 #22
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/pnpm-11.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
10.32.1→11.1.3Release Notes
pnpm/pnpm (pnpm)
v11.1.3Compare Source
Patch Changes
pnpm installnow re-validatespnpm-lock.yamlentries against the activeminimumReleaseAgeandtrustPolicy: 'no-downgrade'policies before any tarball is fetched. Lockfiles resolved elsewhere (committed to the repo, restored from a CI cache, produced by an older pnpm) under a weaker or absent policy can no longer install a freshly-published or trust-downgraded version silently. Violating entries abort the install withERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION,ERR_PNPM_TRUST_DOWNGRADE, or the genericERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATIONwhen both policies trip in the same batch;minimumReleaseAgeExcludeandtrustPolicyExcludeare honored. Verification results are cached so repeat installs against an unchanged lockfile take a fast path, and pnpm shows a transient progress line while the registry round-trip runs.When fresh resolution picks an immature version, the behavior depends on
minimumReleaseAgeStrict:minimumReleaseAgekeeps its built-in 24-hour value — auto-adds the immature picks tominimumReleaseAgeExcludeinpnpm-workspace.yamland lets the install proceed. A single info message lists what was persisted.minimumReleaseAgeExcludeand the install continues; declining aborts before the lockfile,package.json, ornode_modulesis touched.ERR_PNPM_NO_MATURE_MATCHING_VERSIONlisting every offending entry, instead of failing on the first one the resolver hit.minimumReleaseAgeStrictauto-enables whenever the user explicitly setsminimumReleaseAge(CLI flag, env var, globalconfig.yaml, orpnpm-workspace.yaml); setminimumReleaseAgeStrict: falseto keep loose-mode auto-collect even with an explicitminimumReleaseAgevalue. Closes #10438, #10488, #11687.Allow redundant trailing base64 padding in
.npmrcauth values and report invalid auth base64 with a pnpm error.Make
pnpm self-updaterespectminimumReleaseAge(andminimumReleaseAgeExclude) when resolving which pnpm version to install.When the
latestdist-tag points to a version newer than the configured age threshold,self-updatenow selects the newest mature version instead unless excluded byminimumReleaseAgeExclude.Also makes
dlxandoutdatedsurface invalidminimumReleaseAgeExcludepatterns under the sameERR_PNPM_INVALID_MINIMUM_RELEASE_AGE_EXCLUDEerror code already used byinstall, instead of leaking the internalERR_PNPM_INVALID_VERSION_UNION/ERR_PNPM_NAME_PATTERN_IN_VERSION_UNIONcodes.Global installs respect global config build policy (e.g.,
dangerouslyAllowAllBuildsfrom config.yaml) when GVS is enabled #9249.The global virtual-store (GVS) default
allowBuilds = {}was applied before workspace manifest settings were read and before global config values (stripped byextractAndRemoveDependencyBuildOptions) were re-applied viaglobalDepsBuildConfig. This causedhasDependencyBuildOptionsto returntrue(because{}is not null), blocking restoration of global config values likedangerouslyAllowAllBuilds. As a result, global installs skipped all build scripts even when the config explicitly allowed them.This fix moves the GVS default to after workspace manifest reading and
globalDepsBuildConfigre-application, so that:allowBuildstakes precedence (if present)dangerouslyAllowAllBuildsis properly restored (if set and no workspace policy exists){}is only applied as a last resort when no policy is configured anywhereHonor
--silentwhenverifyDepsBeforeRun: installauto-installs dependencies beforepnpm runorpnpm exec, preventing install output from being written to stdout #11636.Fix lockfile parsing failures when
pnpm-lock.yamlcontains CRLF line endings and multiple YAML documents #11612.Anchor the side-effects-cache key and global-virtual-store hash to the project's script-runner Node —
engines.runtimepin when present, shellnodeotherwise — instead of pnpm's own runtime.ENGINE_NAME(the<platform>;<arch>;node<major>prefix used as the side-effects-cache key and the engine portion of the GVS hash) was computed fromprocess.version— the Node that runs pnpm itself. That was wrong in two situations:@pnpm/exeSEA bundle. The bundle has its own embedded Node, not thenodeon the user'sPATHthat actually spawns lifecycle scripts. Two pnpm installations on the same machine (one SEA, one npm-package) therefore disagreed on the cache key, partitioning the side-effects cache and the global virtual store across two Node majors even though both installs would run scripts on the same shellnode.engines.runtime/devEngines.runtimepin. When a project pins a Node version viadevEngines.runtime(pnpm v11+), pnpm downloads that Node intonode_modules/node/and uses it to run lifecycle scripts. But the hash still anchored to whichever Node ran pnpm itself, not to the pinned Node — so two installs of the same project with two different runner Nodes would still disagree on the GVS slot path even though scripts run on the same pinned Node.Three changes:
@pnpm/engine.runtime.system-node-versionnow exportsengineName(nodeVersion?). Resolves the version in this order: explicit override →getSystemNodeVersion()(which already prefersnode --versionoverprocess.versionin SEA contexts) →process.version.@pnpm/deps.graph-hashernow exportsfindRuntimeNodeVersion(snapshotKeys)— scans an iterable of lockfile snapshot keys for anode@runtime:<version>entry and returns its bare version string.calcDepStateandcalcGraphNodeHash/iterateHashedGraphNodesaccept anodeVersion?(in the options bag for the first, as a trailing parameter / ctx field for the others), forwarded toengineName(). The default (no override) preserves the pre-change behaviour. The legacyENGINE_NAMEconstant in@pnpm/constantsis unchanged so external consumers and existing tests keep working; in non-SEA, non-pinned contexts every value lines up.@pnpm/installing.deps-resolver,@pnpm/installing.deps-restorer,@pnpm/installing.deps-installer,@pnpm/building.during-install,@pnpm/building.after-install,@pnpm/deps.graph-builder) now derives the project's pinned runtime viafindRuntimeNodeVersion(Object.keys(graph))once per invocation and threads it through.On upgrade, two one-time GVS slot churns are possible:
node26) now hash under the shell-Node major (e.g.node24), matching what pacquet, the npm-publishedpnpmpackage, and any other pnpm-compatible tool already produce.devEngines.runtimepin: slots that previously hashed under the runner's Node major now hash under the pinned Node major, matching what the lifecycle scripts will actually run on.In both cases the old slots become prune-eligible.
Resolve the GVS hash's engine portion per-snapshot when a dependency declares its own
engines.runtime, instead of using an install-wide value.Pnpm's resolver desugars a dep's
engines.runtimeintodependencies.node: 'runtime:<version>', and the bin linker spawns that dep's lifecycle scripts through the pinned Node downloaded into<pkgDir>/node_modules/node/. The GVS hash and the side-effects-cache key prefix were still anchored to the install-wide runtime — so a pinning snapshot's slot encoded the wrong Node major, and a reinstall on the same host could read the cached side-effects under a key whose<platform>;<arch>;node<major>triple disagreed with the Node the build actually ran on.Per-snapshot resolution now matches what
bins/linkeralready does on a per-package basis:@pnpm/deps.graph-hasheraddsreadSnapshotRuntimePin(children)— reads thenodeentry from one snapshot's graph children and extracts the version from anode@runtime:value. Pairs with the existingfindRuntimeNodeVersion(snapshotKeys)install-wide fallback (also now exported from@pnpm/deps.graph-hasherrather than@pnpm/engine.runtime.system-node-version, where it was a poor fit —system-node-versionis about probing the host Node, not parsing lockfile-derived strings).calcDepStateandcalcGraphNodeHashconsultreadSnapshotRuntimePin(graph[depPath].children)first and only fall back to the install-widenodeVersionparameter when the snapshot doesn't pin its own Node.Pacquet mirrors the same precedence at the
calc_graph_node_hashcall site inpackage-manager/src/virtual_store_layout.rs— a newfind_own_runtime_node_major(snapshot)helper reads each snapshot'sdependenciesfor anodeentry withPrefix::Runtimeand overrides the install-wide engine when present.On upgrade, snapshots of dependencies that declare their own
engines.runtimere-hash under that dep's pinned Node instead of the install-wide value. The old slots become prune-eligible. Closes #11690.Fixed
pnpm publishfailing with a 404 when authentication relied on OIDC trusted publishing alongside an.npmrcwritten byactions/setup-node(_authToken=${NODE_AUTH_TOKEN}) withoutNODE_AUTH_TOKENbeing set. Unresolved${VAR}placeholders in auth values are now treated as empty rather than passed through verbatim, so the literal placeholder no longer surfaces as a bearer token when OIDC fallback is the intended auth source #11513.Fix
devEngines.packageManager(singular form, withoutonFail) defaulting toonFail: "error"instead of the documentedpmOnFail: "download". As a result, a project that pinned a different pnpm version viadevEngines.packageManagerand ranpnpm installfrom a mismatched pnpm version failed with a hard error, even though the migration table frommanagePackageManagerVersions: truetopmOnFail: download (default)promises the install would auto-download the wanted version #11676.The array form of
devEngines.packageManagerkeeps its existing per-element defaults (errorfor the last entry,ignorefor the rest), since those reflect explicit prioritization by the user. ExplicitonFailvalues continue to win.Fix
devEngines.packageManagernot writingpackageManagerDependenciestopnpm-lock.yamlwhen the lockfile lacks an env-doc entry. Previously the lockfile sync skipped resolution unless an existingpackageManagerDependencies.pnpmentry needed refreshing, so a fresh install withoutonFail: "download"left the resolved pnpm version unrecorded — contradicting the documented behavior that the resolved version is stored inpnpm-lock.yaml#11674.Warn when
package.jsoncontains a legacypnpmfield with settings pnpm no longer reads frompackage.json(e.g.pnpm.overrides,pnpm.patchedDependencies). Previously these were silently ignored after the upgrade from v10, leaving users unaware that their overrides/patched dependencies had stopped taking effect #11677.v11.1.2Compare Source
Patch Changes
convertEnginesRuntimeToDependencies: switch the runtime-dependency write toObject.definePropertyso the CodeQLjs/prototype-polluting-assignmentrule treats the assignment as safe regardless of the property name (follow-up to #11609).Address CodeQL static-analysis findings: guard manifest dependency writes against prototype-polluting keys (
__proto__,constructor,prototype), and replace a potentially super-linear semver-detection regex in registry 404 hints with an O(n) parser.Strip
sec-fetch-*headers from outgoing HTTP requests. These headers are automatically added by undici'sfetch()implementation per the Fetch spec but cause Azure DevOps Artifacts to return HTTP 400 for uncached upstream packages, as ADO interprets them as browser requests #11572.Fix
minimumReleaseAgehandling for cached abbreviated metadata.The version-spec cache fast path no longer rethrows
ERR_PNPM_MISSING_TIMEunderstrictPublishedByCheck; it now falls through to the registry-fetch path, consistent with the adjacent mtime-gated cache block.When the registry returns 304 Not Modified for a package whose cached metadata is abbreviated (no per-version
time), pnpm now re-fetches withfullMetadata: trueifminimumReleaseAgeis active and the package was modified after the cutoff. The upgraded metadata is persisted to disk so subsequent installs don't repeat the fetch. Previously the abbreviated meta was used as-is and the maturity check fell back to its warn-and-skip path, silently bypassing the quarantine and emitting a misleading "metadata is missing the time field" warning.Closes #11619.
Fix
pnpm upgrade --interactive --latest -rnot respecting named catalog groups. Previously, upgrading a dependency using a named catalog (e.g."catalog:foo") would incorrectly rewritepackage.jsonto"catalog:"and place the updated version in the default catalog instead of the named one #10115.Fixed
optimisticRepeatInstallskippingpnpm-lock.yamlmerge conflict resolution when the existingnode_modulesstate appears up to date.Fix
minimumReleaseAge/resolutionMode: time-basedinstalls failing on lockfiles whosetime:block is missing entries. The npm-resolver's peek-from-store fast path now surfacespublishedAtfrom the lockfile rather than discarding it, and falls through to a registry metadata fetch when the time-based cutoff can't be computed from the data on hand.v11.1.1Compare Source
Patch Changes
checkDepsStatus(run byverifyDepsBeforeRun). Previously the status check calledfindWorkspaceProjects, which validates each project'senginesandos/cpu/libcand warns about useless fields in non-root manifests — work that the install pipeline already performs. With nonodeVersionthreaded through, the engine check also fell back to the system Node fromPATHand emitted spurious "Unsupported engine" warnings before scripts ran. Status-only callers now usefindWorkspaceProjectsNoCheck; install paths continue to validate.pnpm add <alias>:@​scope/pkgfor named registries. The local resolver was claiming any specifier containing/as a local directory, sopnpm add bit:@​teambit/bit(withbitconfigured undernamedRegistries) installed a bogus link tobit:@​teambit/bit/instead of resolving from the configured registry. The local resolver now runs after the named-registry resolver in the resolution chain.@zkochan/cmd-shimto 9.0.3. The sh shim it writes for.cmd/.battargets now escapes the/Cswitch as//C, so it survives the path translation Git Bash applies when launchingcmd.exe. Without this, a bare/Cwas rewritten toC:\before reaching cmd.exe — the switch was dropped, cmd started interactively, and the calling script saw the cmd banner instead of the wrapped command's output. Affects any cmd-shim-wrapped batch script invoked from Git Bash / MSYS / Cygwin on Windows. See pnpm/cmd-shim#55.v11.1.0Compare Source
Minor Changes
Added
pnpm audit signaturesto verify ECDSA registry signatures for installed packages against keys from/-/npm/v1/keys#7909. Scoped registries are respected, and registries without signing keys are skipped.Added support for installing packages from the GitHub Packages npm registry via a built-in
gh:prefix (e.g.pnpm add gh:@​acme/private), and, more broadly, for arbitrary named registries in the style of vlt's named-registry aliases. Authentication is picked up from the existing per-URL.npmrcentries (e.g.//npm.pkg.github.com/:_authToken=...), so no separate auth mechanism is required.Additional aliases — or an override for the built-in
ghalias, for GitHub Enterprise Server — can be configured undernamedRegistriesinpnpm-workspace.yaml:With this,
work:@​corp/lib@^2.0.0resolves againsthttps://npm.work.example.com/. #11324.Allow setting sbom spec version using
--sbom-spec-version#11389.Add
--no-runtimeflag (config:runtime=false) to skip installing runtime entries (e.g. Node.js downloaded viadevEngines.runtime) without modifying the lockfile. The lockfile keeps the runtime entry so frozen-lockfile validation still passes; only the runtime fetch and.binlinking are skipped. Useful in CI matrices where the runtime is provisioned externally (e.g. viapnpm runtime -g set node <version>) beforepnpm installruns.Added the
pnpm bugscommand that opens a package's bug tracker URL in the browser. With no arguments, it reads the current project'spackage.json; with one or more package names, it fetches each package's metadata from the registry and opens its bug tracker. Falls back to<repository>/issueswhen thebugsfield is missing #11279.Added
pnpm ownercommand to manage package owners on the registry.Patch Changes
Added "published X ago by Y" information to the
pnpm viewcommand output, similar tonpm view. This is useful when comparing againstminimumReleaseAge.For example,
pnpm view pnpmnow shows:pnpm publishnow honors the configured HTTP/HTTPS proxy (includinghttps_proxy/http_proxy/no_proxyenvironment variables) when polling the registry'sdoneUrlduring the web-based authentication flow. Previously the poll bypassed the proxy, causing the registry to respond403from a different source IP and the login to never complete #11561.pnpm add -gnow installs each space-separated package into its own isolated directory by default. To bundle multiple packages into the same isolated install (so that they share dependencies and are removed together), pass them as a comma-separated list. For example:pnpm add -g foo barinstallsfooandbaras two independent globals — removing one does not affect the other.pnpm add -g foo,bar qarbundlesfooandbarinto a single isolated install whileqaris installed on its own.Related: #11587.
pnpm runtime set <name> <version>no longer fails in the root of a multi-package workspace with theADDING_TO_ROOTerror. Installing the workspace root is a valid target for a runtime, so the command now bypasses that safety check.Fix
pnpm --versionhanging for the lifetime of the worker pool after the version was printed.main.ts's--versionshort-circuit returned before reaching the command-handlerfinallythat callsfinishWorkers(), so the worker pool thatswitchCliVersionhad spawned during integrity resolution stayed alive and held the Node event loop open. The CLI entry now runsfinishWorkers()from its ownfinally, so every exit path tears the pool down.Repro:
pnpm --versionin a workspace whosedevEngines.packageManagerversion already matches the running pnpm +onFail: "download".switchCliVersionresolves the integrity (spawning workers), finds nothing to swap, returns. The version prints, then the process hangs.v11.0.9Compare Source
Patch Changes
https://gitlab.com/<user>/<project>/-/archive/<sha>/<project>-<sha>.tar.gzinstead of the GitLab API endpoint that contained an encoded slash (%2F) between user and project. The encoded slash both triggered406 Not Acceptableresponses from GitLab and produced virtual store directory names that Node refused to import (ERR_INVALID_MODULE_SPECIFIER) #11533.NPM_CONFIG_USERCONFIG(and its lowercasenpm_config_userconfigform) as a low-priority fallback when locating the user-level.npmrc. This restores compatibility with environments that point npm at a custom auth file via that env var — most notablyactions/setup-node, which writes registry credentials to${runner.temp}/.npmrcand exportsNPM_CONFIG_USERCONFIGto reference it. Without this, GitHub Actions workflows usingactions/setup-nodeto authenticate to private registries broke after upgrading to pnpm v11. PNPM-prefixed env vars andnpmrcAuthFilefrom the globalconfig.yamlcontinue to take precedence #11539.pnpm packnot bundling dependencies listed inbundleDependencies(orbundledDependencies). The npm-packlist upgrade in pnpm 11 changed its API to require the caller to pre-populate the dependency tree, which the wrapper was not doing —bundleDependencieswere silently dropped from the tarball #11519.SyntaxError: Invalid regular expression flagsinstead of printing a clear "requires Node.js v22.13" error when launched on an unsupported Node.js version. The Node.js version check inbin/pnpm.mjswas effectively dead code because the staticimportof the bundleddist/pnpm.mjswas hoisted by the ES module loader and parsed before the check could run #11546.pnpm --prefix=<dir> installoverwriting the existingpnpm-workspace.yamlin<dir>withset this to true or falseplaceholders. The renamed--prefixoption (which maps todir) was not honored when locating the workspace root, so the workspace manifest'sallowBuildssettings were not loaded into config and got clobbered when ignored builds were auto-populated #11535.pnpm publish --provenancefailing with a 422 from the registry when the package version contained semver build metadata (e.g.1.0.0-canary.0+abc1234). The+<build>segment is now stripped before packing so that the version embedded in the tarball, the metadata sent to the registry, and the sigstore provenance subject all agree #11518.v11.0.8Compare Source
Patch Changes
pnpm-lock.yamlwhen they cannot be derived from name+version+registry, even with the defaultlockfileIncludeTarballUrl: false. Without this,pnpm install --frozen-lockfilefrom an empty store fails withERR_PNPM_FETCH_404for packages on registries that serve tarballs from a non-standard path — most notably GitHub Packages (https://npm.pkg.github.com/download/<scope>/<name>/<version>/<hash>) and JSR.lockfileIncludeTarballUrl: truecontinues to force the URL into the lockfile for every package #11276.preversion,version, andpostversionlifecycle scripts forpnpm version.ERR_PNPM_BAD_TARBALL_SIZEwhen a registry serves tarballs with an end-to-endContent-Encoding(e.g.gzip). Tarballs are already compressed, so the fetcher now requests them withAccept-Encoding: identity(matching pnpm v10's effective behavior) and, as defense in depth against misbehaving servers, no longer enforces the strictContent-Lengthcheck when the response declares aContent-Encoding—Content-Lengthin that case refers to the encoded payload, not the decoded bytes the fetch implementation yields #11506.v11.0.7Compare Source
Patch Changes
Restore the execute bit on the
node-gypshims packed inside@pnpm/exe(dist/node-gyp-bin/node-gyp,dist/node-gyp-bin/node-gyp.cmd, anddist/node_modules/node-gyp/bin/node-gyp.js). Without this,pnpm/action-setup's standalone path (used on runners with Node.js < 22.13) failed any install whose lifecycle script invokednode-gyp rebuildwithsh: 1: node-gyp: Permission denied#11483.Fixed the
pn,pnpx, andpnxaliases failing in Git Bash / MSYS2 on Windows when pnpm was installed via@pnpm/exe(or afterpnpm self-update) #11486. Runningpnpx(orpnx) printed the cmd.exe banner and dropped the user into an interactive command prompt instead of runningpnpm dlx. Thebinfield rewrite on Windows was pointing those aliases at.cmdfiles; cmd-shim's Bash shim for a.cmdtarget wraps it inexec cmd /C ..., and MSYS2 mangles/Cinto a Windows path before cmd.exe sees it. The aliases are now.exehardlinks of the SEA binary, which detects which name it was launched as viaprocess.execPathand prependsdlxforpnpx/pnx.Fix
pnpm installrecreatingnode_modulesafterpnpm fetch.pnpm fetchrecords emptyhoistPatternandpublicHoistPatternin.modules.yaml; since v11 removed the explicit-config gate, the follow-up install treated those as a hoist-pattern change and purged the modules directory. The fetch step now flags the modules manifest withvirtualStoreOnly: trueso the next install skips the hoist-pattern comparison and completes the missing post-import linking in place #11488.Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.
A new
gitHosted: truefield is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.Allow user-level preferences in the global
config.yaml. The following settings can now be set in~/.config/pnpm/config.yaml(or viapnpm config set --location global) instead of being restricted topnpm-workspace.yaml:agent,globalVirtualStoreDir,initPackageManager,initType,registrySupportsTimeField,scriptShell,shellEmulator,sideEffectsCache,sideEffectsCacheReadonly,stateDir,strictDepBuilds,trustPolicy,trustPolicyExclude,trustPolicyIgnoreAfter,updateNotifier,useStderr,verifyDepsBeforeRun,verifyStoreIntegrity,virtualStoreDir,virtualStoreDirMaxLength#11474.Make trusted publishing (OIDC) take precedence over a configured static
_authTokeninpnpm publish, mirroring the npm CLI's behavior. When OIDC succeeds, the OIDC-derived token overrides any pre-configured_authToken; when OIDC is not applicable (no CI environment, exchange fails, registry has no trusted publisher configured), the static token is used as a fallback. This applies on every package during recursive publish, so each workspace package independently attempts trusted publishing.Additionally, the
NPM_ID_TOKENenv var is now honored as a CI-agnostic injection point for an OIDC ID token. Previously OIDC was only attempted on GitHub Actions or GitLab; now any CI provider that exposes its own OIDC mechanism (e.g. CircleCI'sCIRCLE_OIDC_TOKEN_V2, Buildkite, etc.) can forward its token viaNPM_ID_TOKENand trusted publishing will work without pnpm needing to recognize the provider explicitly.--pm-on-fail=ignore(and other universal options like--loglevel,--reporter) is now honored when combined with--helpor--version. Previously the CLI argument parser short-circuited those flags before universal options were preserved, sopnpm audit --pm-on-fail=ignore --helpandpnpm --pm-on-fail=ignore --versionreported the strict packageManager mismatch instead of running the requested action #11487.Fix a regression where
pnpm --recursive --filter '!<pkg>' run/exec/test/addwould include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative--filterarguments are provided, matching the documented behavior. To include the root, pass--include-workspace-root#11341.Restore npm-CLI-compatible
--jsonstdout output forpnpm publish(#11476). pnpm 11 reimplemented publish natively (#10591) and inadvertently dropped the per-package JSON object that pnpm 10 emitted transitively via the npm CLI, silently breaking downstream tooling — most notablynx release publish, which parses stdout JSON to confirm success (nrwl/nx#35575). On success, the output is now:pnpm publish --json→ single object{ id, name, version, size, unpackedSize, shasum, integrity, filename, files, entryCount, bundled }, mirroringnpm publish --json.pnpm publish -r --json→ array of those objects, mirroringpnpm pack --json's shape choice.pnpm publish -r --report-summary→ existingpnpm-publish-summary.jsonenvelope{ publishedPackages: [...] }is preserved, but each entry is upgraded to the same per-package shape (additive —nameandversionare still present).pnpm config get @​<scope>:registrynow reports the same URL thatpnpm publishand the resolvers actually use. Previously,config getonly consulted.npmrc, whilepublish/install used the merged map that includespnpm-workspace.yaml'sregistriesblock — so the two could diverge silently and a publish could go to the wrong registry #11492.v11.0.6Compare Source
Patch Changes
pnpm_config_npmrc_auth_fileandpnpm_config_userconfigenv vars not actually loading the custom.npmrc. The env vars were parsed and assigned to the resolved config, but only afterloadNpmrcConfighad already read the default~/.npmrc— so the custom file path was set but never read. The relevant env vars are now consulted before the user-level.npmrcis loaded #11465.pnpm-workspace.yamlwhen updating it. Existing keys keep their position, and new keys are inserted in alphabetical position when the existing keys are already sorted (with a leadingpackageskey allowed) or appended at the end otherwise.pnpm self-updateon installations originally set up by pnpm v10. v10 addedPNPM_HOMEdirectly to PATH and wrote apnpmbootstrap shim there. v11 setup writes shims underPNPM_HOME/bininstead, so when a v10 user upgrades to v11 the legacy shim atPNPM_HOMEkeeps pointing into the old.tools/<version>install —pnpm --versioncontinues to report the pre-update version even though the new version was installed underglobal/v11. Self-update now detects this layout, refreshes the legacy shims so the upgrade actually takes effect, and prints a hint suggestingpnpm setupto migrate PATH to the v11 layout. #11464.nodeLinker,hoistPattern) are present inconfig.yamland silently ignored. Previously these settings were dropped without any feedback, leaving users unsure why their global configuration had no effect. The warning suggests moving those settings to a project-levelpnpm-workspace.yaml, or sharing them across projects via config dependencies.overrideshas an invalid shape or contains a non-string value.readPackagedependency map fields, includingdevDependencies, and reject falsy non-object invalid values instead of silently accepting them.pnpm config,pnpm set, andpnpm getby toleratingconfigDependenciesinstall failures. For these commands, a failure to installconfigDependencies(for example because the registry auth token has not been written yet) is now logged at debug level and the command proceeds. All other commands still surface the install error #10684.allowBuildsas an install-state input and clear previously ignored builds when they are explicitly disallowed.catalog:protocol with thepnpm dlx/pnpxcommand, resulting in a catalog entry not found error.PNPM_CONFIG_*(uppercase) environment variables in addition topnpm_config_*. Previously, only the lowercase form was honored, so env vars renamed per the v11 migration guide (e.g.PNPM_CONFIG_USERCONFIG) silently had no effect on case-sensitive systems like macOS and Linux #11465.v11.0.5Compare Source
Patch Changes
Drop the
darwin-x64artifact from@pnpm/exeand from the GitHub release page. The Node.js SEA mechanismpnpm pack-appuses produces a binary that segfaults at startup on Intel Macs because of an upstream Node.js bug (nodejs/node#62893, tracked alongside #59553; the Node.js team has opted not to fix it on the grounds that x64 macOS is being phased out). Re-signing withcodesignorldiddoesn't help — the corruption is in LIEF's Mach-O surgery, before signing.Intel Mac users should install pnpm via
npm install -g pnpm(uses the system Node.js, no SEA), or stay on pnpm 10.x.@pnpm/exe's preinstall on Intel Mac now exits with a clear error pointing at these alternatives.Closes #11423.
pnpm dlx(andpnpx/pnx/pnpm create) now runs the same interactiveapprove-buildsprompt aspnpm add -gwhen the package being launched depends on transitive packages with install scripts. Previously, the v11strictDepBuildsdefault made dlx fail withERR_PNPM_IGNORED_BUILDSand required users to re-run with--allow-build=<pkg>for every offending dependency. dlx also now removes the partially-populated cache directory when the install fails, so a subsequent run starts clean instead of reusing a broken install whose builds were silently skipped #11444.72629fc: Fixpnpm -g ls --jsonandpnpm -g ls --parseableso they emit valid JSON and parseable output respectively, matching pnpm 10 behavior. Since the isolated global packages refactor in pnpm 11, the global list command had a custom path that always printed plain text and ignored--json/--parseable, which broke tools likenpm-check-updatesthat parse the JSON output #11440.pnpm -g ls --depth=<n>(with n > 0) now errors when more than one isolated global install would be involved, since each install has its own lockfile and merging their transitive trees would be incoherent. When the request can be narrowed to a single install group, the regularlistflow is used and the full dependency tree is shown.Fixed
pnpm publishto honorpublishConfig.registryfrompackage.jsonwhen publishing a single package. The native publish flow introduced in v11 was reading the registry from.npmrconly, ignoring the per-package override #11419.When
strictPeerDependenciesistrue, theERR_PNPM_PEER_DEP_ISSUESerror once again renders the peer dependency issues inline using the same format aspnpm peers check, so users (and CI tools like Renovate) can see what failed without runningpnpm peers checkseparately #11439.The
WARNand error code labels in pnpm's output now wrap in brackets ([WARN],[ERR_PNPM_FOO]). Previously the labels relied entirely on a colored background to stand out, which meant they blended into the surrounding text in terminals without color (e.g. whenNO_COLORis set or output is piped). The brackets are painted in the same color as the badge background, so they appear as ordinary padding in color-capable terminals — only the no-color rendering changes.v11.0.4Compare Source
Patch Changes
pnpm cinot reinstalling workspace packagenode_modulesdirectories after the clean step #11427.pnpm ciperforms a fresh install after the clean step.pnpm-lock.yamlduringpnpm cleanwhenlockfile: trueis configured inpnpm-workspace.yaml. The lockfile is only removed when the--lockfileoption is passed topnpm clean.pnpm self-update(with no version argument) no longer downgrades pnpm when the registry'slatestdist-tag points to an older release than the currently active version. Runpnpm self-update latestto force a downgrade #11418.minimumReleaseAgeStrictnow defaults totruewhenever the user explicitly setsminimumReleaseAge(viapnpm-workspace.yaml, the globalconfig.yaml, the CLI, orpnpm_config_*env vars).v11.0.3Compare Source
Patch Changes
node_modules/.bin#11412.ERR_PNPM_FETCH_404when installing a project whose lockfile depends on afile:tarball. The previous behavior dropped thetarballfield fromfile:and git-hosted resolutions whenlockfile-include-tarball-url=false(the default), even though those URLs cannot be reconstructed from the package name, version, and registry #11407.v11.0.2Compare Source
Patch Changes
ENOENTsymlink failure whenpnpm add -gtriggers the approve-builds prompt. The global add flow used to forward an absolutemodulesDir(<installDir>/node_modules) into the install run byapprove-builds. The install layer treatedmodulesDiras a path relative tolockfileDirand joined it again, producing a doubled path on Windows becausepath.joindoes not collapse an embedded absolute path. The hoist step then tried tomkdirand symlink under<installDir>\<installDir>\node_modules\.pnpm\node_modules\...and failed withENOENT#11403.packageManagerDependenciesgoing stale when pnpm is invoked through corepack. The lockfile sync (and thedevEngines.packageManagerversion check) previously ran only when pnpm was invoked directly; under corepack the entire block was skipped, so a stale entry would persist even after the running pnpm version changed. The lockfile sync now runs regardless of how pnpm was invoked, while the pnpm-managed version switch (onFail: 'download') remains skipped under corepack so it doesn't fight corepack's own version selection #11397.publishConfig.directorywhen packages publish from a generated directory #11239.os/cpuentries (e.g.["!win32"]) being incorrectly rejected whensupportedArchitecturesexpands to multiple platforms #11375.v11.0.1Compare Source
Patch Changes
pnpm runscripts.nullnamed catalogs in workspace manifests withInvalidWorkspaceManifestErrorinstead of crashing with a rawTypeError.pnpm sbomemittedNOASSERTION(SPDX) and omitted the distribution reference (CycloneDX) for git dependencies. Now emits the git URL with commit hash, e.g.git+https://github.com/user/repo.git#commit.pnpm self-updatenow keepspackage.json'spackageManageranddevEngines.packageManagerin sync. When the legacypackageManagerfield pins pnpm, both fields are rewritten to the new exact pnpm version on update —packageManagertopnpm@<version>(without an integrity hash), anddevEngines.packageManager.versionto the same exact<version>(dropping any range operator). When onlydevEngines.packageManageris declared, the existing range-preserving behavior is unchanged #11388.pnpm audit --fixso that the log output order matches the order written topnpm-workspace.yaml.packageManagerDependenciesentry whendevEngines.packageManagerdeclares a pnpm version that the lockfile no longer satisfies. Previously, the stale entry was kept even though the running pnpm matched the declared version, silently breaking the integrity record #11387.v11.0.0Compare Source
Highlights
Major
minimumReleaseAgedefaults to 1 day (newly published packages are not resolved for 24h) andblockExoticSubdepsdefaults totrue.allowBuildsreplaces the old build-dependency settings —onlyBuiltDependencies,onlyBuiltDependenciesFile,neverBuiltDependencies,ignoredBuiltDependencies, andignoreDepScriptshave been removed.pnpm add -ggets its own directory with its ownpackage.json,node_modules, and lockfile.pnpm publish,login,logout,view,deprecate,unpublish,dist-tag, andversionno longer delegate to the npm CLI, and the remaining npm passthrough commands now throw "not implemented".pnpm audituses npm's bulk advisories endpoint — the legacy/security/auditsendpoints are gone. CVE-based filtering has been replaced with GHSA-based filtering: migrateauditConfig.ignoreCvesentries toauditConfig.ignoreGhsas..npmrcis auth/registry only — all other settings must live inpnpm-workspace.yamlor the new globalconfig.yaml, and environment variables use thepnpm_config_*prefix.node@runtime:<version>no longer extracts the bundlednpm,npx, andcorepack, roughly halving the files pnpm has to hash, write, and link.Minor
pnpm ci,pnpm sbom,pnpm clean,pnpm peers check,pnpm runtime set,pnpm docs/home,pnpm ping,pnpm search,pnpm star/unstar/stars,pnpm whoami,pnpm with, andpnpm pack-app, pluspn/pnxshort aliases..pnpmfile.mjs, which takes priority over.pnpmfile.cjswhen present.pnpm audit --fix=updatefixes vulnerabilities by updating packages in the lockfile instead of adding overrides, andpnpm audit --fix --interactivelets you select which advisories to fix.pnpm pack-apppacks a CommonJS entry into a standalone executable for one or more target platforms using Node.js Single Executable Applications.Major Changes
Requirements
Security & Build Defaults
Changed default values:
optimisticRepeatInstallis nowtrue,verifyDepsBeforeRunis nowinstall,minimumReleaseAgeis now1440(1 day), andminimumReleaseAgeStrictisfalse. Newly published packages will not be resolved until they are at least 1 day old. This protects against supply chain attacks by giving the community time to detect and remove compromised versions. To opt out, setminimumReleaseAge: 0inpnpm-workspace.yaml#11158.strictDepBuildsistrueby default.blockExoticSubdepsistrueby default.Removed deprecated build dependency settings:
onlyBuiltDependencies,onlyBuiltDependenciesFile,neverBuiltDependencies,ignoredBuiltDependencies, andignoreDepScripts#11220.Use the
allowBuildssetting instead. It is a map where keys are package name patterns and values are booleans:truemeans the package is allowed to run build scriptsfalsemeans the package is explicitly denied from running build scriptsSame as before, by default, none of the packages in the dependencies are allowed to run scripts. If a package has postinstall scripts and it isn't declared in
allowBuilds, an error is printed.Before:
After:
Removed
allowNonAppliedPatchesin favor ofallowUnusedPatches.Removed
ignorePatchFailures; patch application failures now throw an error.Store
<algo>-<digest>). Using hex format improves performance since file paths in the content-addressable store use hex representation, eliminating base64-to-hex conversion during path lookups.package.jsonfrom the content-addressable store during resolution and installation. This reduces I/O and speeds up repeat installs #10473.$STORE/index/, package metadata is stored in a single SQLite database at$STORE/index.dbwith MessagePack-encoded values. This reduces filesystem syscall overhead, improves space efficiency for small metadata entries, and enables concurrent access via SQLite's WAL mode. Packages missing from the new index are re-fetched on demand #10500 #10826.Global Packages
Global installs (
pnpm add -g pkg) andpnxnow use the global virtual store by default. Packages are stored at{storeDir}/linksinstead of per-project.pnpmdirectories. This can be disabled by settingenableGlobalVirtualStore: false#10694.Isolated global packages. Each globally installed package (or group of packages installed together) now gets its own isolated installation directory with its own
package.json,node_modules/, and lockfile. This prevents global packages from interfering with each other through peer dependency conflicts, hoisting changes, or version resolution shifts.Key changes:
pnpm add -g <pkg>creates an isolated installation in{pnpmHomeDir}/global/v11/{hash}/pnpm remove -g <pkg>removes the entire installation group containing the packagepnpm update -g [pkg]re-installs packages in new isolated directoriespnpm list -gscans isolated directories to show all installed global packagespnpm install -g(no args) is no longer supported; usepnpm add -g <pkg>insteadGlobally installed binaries are now stored in a
binsubdirectory ofPNPM_HOMEinstead of directly inPNPM_HOME. This prevents internal directories likeglobal/andstore/from polluting shell autocompletion whenPNPM_HOMEis on PATH #10986. After upgrading, runpnpm setupto update your shell configuration.Breaking changes to
pnpm link:pnpm link <pkg-name>no longer resolves packages from the global store. Only relative or absolute paths are accepted. For example, usepnpm link ./fooinstead ofpnpm link foo.pnpm link --globalis removed. Usepnpm add -g .to register a local package's bins globally.pnpm link(no arguments) is removed. Usepnpm link <dir>with an explicit path instead.Configuration
pnpm no longer reads all settings from
.npmrc. Only auth and registry settings are read from.npmrcfiles. All other settings (likehoistPattern,nodeLinker,shamefullyHoist, etc.) must be configured inpnpm-workspace.yamlor the global~/.config/pnpm/config.yaml#11189.Network settings (
httpProxy,httpsProxy,noProxy,localAddress,strictSsl,gitShallowHosts) are now written toconfig.yaml(global) orpnpm-workspace.yaml(local) instead of.npmrc/auth.ini. They are still readable from.npmrcfor easier migration from the npm CLI #11209.pnpm no longer reads
npm_config_*environment variables. Usepnpm_config_*environment variables instead (e.g.,pnpm_config_registryinstead ofnpm_config_registry).pnpm no longer reads the npm global config at
$PREFIX/etc/npmrc.pnpm loginwrites auth tokens to~/.config/pnpm/auth.ini.New
registriessetting inpnpm-workspace.yaml:Auth tokens in
~/.npmrcstill work — pnpm continues to read~/.npmrcas a fallback for registry authentication. The newnpmrcAuthFilesetting can be used to point to a different file instead of~/.npmrc.Replace workspace project specific
.npmrcwithpackageConfigsinpnpm-workspace.yaml.A workspace manifest with
packageConfigslooks something like this:Or this:
pnpm no longer reads settings from the
pnpmfield ofpackage.json. Settings should be defined inpnpm-workspace.yaml#10086.pnpm config get(without--json) no longer prints INI formatted text. Instead, it prints JSON for objects and arrays, and raw strings for strings, numbers, booleans, and nulls.pnpm config get --jsonstill prints all types of values as JSON, as before.pnpm config get <array>now prints a JSON array.pnpm config listnow prints a JSON object instead of INI formatted text.pnpm config listandpnpm config get(without argument) now hide auth-related settings.pnpm config listandpnpm config get(without argument) now show top-level keys as camelCase. Exception: keys that start with@or//are preserved (their cases don't change).pnpm config getandpnpm config listno longer load non-camelCase options from the workspace manifest (pnpm-workspace.yaml).Removed Commands & npm Passthrough
pnpm no longer falls back to the npm CLI. Commands that were previously passed through to npm (
access,bugs,docs,edit,find,home,issues,owner,ping,prefix,profile,pkg,repo,search,set-script,star,stars,team,token,unstar,whoami,xmas) and their aliases (s,se) now throw a "not implemented" error, with a suggestion to use the npm CLI directly #10642. Other previously passed-through commands —view(info,show,v),login(adduser),logout,deprecate,unpublish,dist-tag, andversion— have been reimplemented natively in pnpm (see New Commands below).pnpm publishnow works without thenpmCLI.The One-time Password feature now reads from
PNPM_CONFIG_OTPinstead ofNPM_CONFIG_OTP:If the registry requests OTP and the user has not provided it via the
PNPM_CONFIG_OTPenvironment variable or the--otpflag, pnpm will prompt the user directly for an OTP code.If the registry requests web-based authentication, pnpm will print a scannable QR code along with the URL.
Since the new
pnpm publishno longer callsnpm publish, some undocumented features may have been unknowingly dropped. If you rely on a feature that is now gone, please open an issue at https://github.com/pnpm/pnpm/issues. In the meantime, you can usepnpm pack && npm publish *.tgzas a workaround.Removed the
pnpm servercommand #10463.Removed support for the
useNodeVersionandexecutionEnv.nodeVersionfields.devEngines.runtimeandengines.runtimeshould be used instead #10373.Removed support for
hooks.fetchers. We now have a new API for custom fetchers and resolvers via thefetchersfield ofpnpmfile.Lifecycle Scripts
npm_config_*environment variables from the pnpm config during lifecycle scripts. Only well-knownnpm_*env vars are now set, matching Yarn's behavior #11116.CLI Output
$ commandinstead of> pkg@version stage path\n> command, and shows project name and path only when running in a different directory. The$ commandline is printed to stderr to keep stdout clean for piping #11132.pnpm peers checkto view the issues #11133.Lockfile
patchedDependencieslockfile format fromRecord<string, { path: string, hash: string }>toRecord<string, string>(selector to hash). Existing lockfiles with the old format are automatically migrated #10911.Other
The default value of the
typefield in thepackage.jsonfile of the project initialized bypnpm initcommand has been changed tomodule.Added support for lowercase options in
pnpm add:-d,-p,-o,-e#9197.When using the
pnpm addcommand only:-pis now an alias for--save-prodinstead of--parseable-dis now an alias for--save-devinstead of--loglevel=infoThe root workspace project is no longer excluded when it is explicitly selected via a filter #10465.
Audit
pnpm auditnow calls npm's/-/npm/v1/security/advisories/bulkendpoint. The legacy/-/npm/v1/security/audits{,/quick}endpoints have been retired by the registry, so the legacy request/response contract is no longer supported.The bulk endpoint does not return CVE identifiers. CVE-based filtering has been replaced with GitHub advisory ID (GHSA) filtering:
auditConfig.ignoreCves→auditConfig.ignoreGhsas(the previous key is no longer recognized)pnpm audit --ignore <id>/pnpm audit --ignore-unfixablenow read and write GHSAs instead of CVEsurl(https://github.com/advisories/GHSA-xxxx-xxxx-xxxx)To migrate: replace each
CVE-YYYY-NNNNNentry in yourauditConfig.ignoreCveswith the correspondingGHSA-xxxx-xxxx-xxxxvalue (visible in theMore infocolumn ofpnpm auditoutput) and move it underauditConfig.ignoreGhsas.Package Manager Settings
Breaking: removed the
managePackageManagerVersions,packageManagerStrict, andpackageManagerStrictVersionsettings. They existed only to derive theonFailbehavior for the legacypackageManagerfield, and thepmOnFailsetting introduced alongsidepnpm withsubsumes all three — it directly sets theonFailbehavior of bothpackageManageranddevEngines.packageManager. TheCOREPACK_ENABLE_STRICTenvironment variable is no longer honored (it only gatedpackageManagerStrict); usepmOnFailinstead.Migration:
managePackageManagerVersions: truepmOnFail: download(default)managePackageManagerVersions: falsepmOnFail: ignorepackageManagerStrict: falsepmOnFail: warnpackageManagerStrictVersion: truepmOnFail: errorCOREPACK_ENABLE_STRICT=0pmOnFail: warnRuntime Installs
node@runtime:<version>(includingpnpm env useandpnpm runtime set node) no longer extracts the bundlednpm,npx, andcorepackfrom the Node.js archive. This cuts roughly half of the files pnpm has to hash, write to the CAS, and link during installation, making runtime installs noticeably faster. Users who still neednpmcan install it as a separate package.Minor Changes
New Commands
pnpm view(info,show,v) command for viewing package metadata from the registry #11064.pnpm login(andpnpm adduseralias) command for authenticating with npm registries. Supports web-based login with QR code as well as classic username/password login #11094.pnpm logoutcommand for logging out of npm registries. Revokes the authentication token on the registry and removes it from the local auth config file #11213.pnpm deprecateandpnpm undeprecatecommands for setting and removing deprecation messages on package versions without delegating to the npm CLI #11120.pnpm unpublishcommand. Supports unpublishing specific versions, version ranges via semver, and entire packages with--force#11128.pnpm dist-tagcommand (ls,add,rmsubcommands) #11218.pnpm sbomcommand for generating Software Bill of Materials in CycloneDX 1.7 and SPDX 2.3 JSON formats #9088.pnpm cleancommand that safely removesnode_modulesdirectories from all workspace projects #10707. Use--lockfileto also removepnpm-lock.yamlfiles.pnpm runtime set <runtime name> <runtime version spec> [-g]for installing runtimes. Deprecatedpnpm env usein favor of the new command.pnpm audit --fix=update#10341.pnpm cicommand for clean installs #6100. The command runspnpm cleanfollowed bypnpm install --frozen-lockfile. Designed for CI/CD environments where reproducible builds are critical. Aliases:pnpm clean-install,pnpm ic,pnpm install-clean#11003.pnpm peers checkcommand that checks for unmet and missing peer dependency issues by reading the lockfile #7087.versioncommand natively in pnpm to support workspaces andworkspace:protocols correctly. The new command allows bumping package versions (major, minor, patch, etc.) with full workspace support and git integration #10879.pnpm audit --fixnow supports a new interactive mode via--interactive/-i.pnpm docscommand and its aliaspnpm home. This command opens the package documentation or homepage in the browser. When the package has no valid homepage, it falls back tohttps://npmx.dev/package/<name>.pnpm pingcommand to test registry connectivity. Provides a simple way to verify connectivity to the configured registry without requiring external tools.searchcommand and its aliases (s,se,find).star,unstar,stars, andwhoamicommands.pnpm with <version|current> <args...>command. Runs pnpm at a specific version (or the currently active one) for a single invocation, bypassing the project'spackageManageranddevEngines.packageManagerpins.pnpm pack-appcommand that packs a CommonJS entry file into a standalone executable for one or more target platforms, using the Node.js Single Executable Applications API under the hood.Configuration
Added support for a global YAML config file named
config.yaml.Configuration is now split into two categories:
rcfile and local.npmrc.config.yamland localpnpm-workspace.yaml.Added support for loading environment variables whose names start with
pnpm_config_into config. These environment variables override settings frompnpm-workspace.yamlbut not CLI arguments.Added support for reading
allowBuildsfrompnpm-workspace.yamlin the global package directory for global installs.Added support for
pnpm config get globalconfigto retrieve the global config file path #9977.Added a new setting
virtualStoreOnlythat populates the virtual store without creating importer symlinks, hoisting, bin links, or running lifecycle scripts. This is useful for pre-populating a store (e.g., in Nix builds) without creating unnecessary project-level artifacts.pnpm fetchnow uses this mode internally #10840.Added support for specifying the pnpm version via
devEngines.packageManagerinpackage.json. Unlike thepackageManagerfield, this supports version ranges. The resolved version is stored inpnpm-lock.yamland reused if it still satisfies the range #10932.Added a new
dedupePeerssetting that reduces peer dependency duplication. When enabled, peer dependency suffixes use version-only identifiers (name@version) instead of full dep paths, eliminating nested suffixes like(foo@1.0.0(bar@2.0.0)). This dramatically reduces the number of package instances in projects with many recursive peer dependencies #11070.Config dependencies are now installed into the global virtual store (
{storeDir}/links/) and symlinked intonode_modules/.pnpm-config/. This allows config dependencies to be shared across projects that use the same store, avoiding redundant fetches and imports #10910. Config dependency and package manager integrity info is now stored inpnpm-lock.yamlinstead of inlined inpnpm-workspace.yaml: the workspace manifest contains only clean version specifiers forconfigDependencies, while the resolved versions, integrity hashes, and tarball URLs are recorded in the lockfile as a separate YAML document. The env lockfile section also storespackageManagerDependenciesresolved during version switching and self-update. Projects using the old inline-hash format are automatically migrated on install #10912 #10964.Added
nodeDownloadMirrorssetting to configure custom Node.js download mirrors inpnpm-workspace.yaml. This replaces thenode-mirror:<channel>.npmrcsetting, which is no longer read #11194:pnpm dlxandpnpm createnow respect security and trust policy settings (minimumReleaseAge,minimumReleaseAgeExclude,minimumReleaseAgeStrict,trustPolicy,trustPolicyExclude,trustPolicyIgnoreAfter) from project-level configuration #11183.pnpm initnow writes adevEngines.packageManagerfield instead of thepackageManagerfield wheninit-package-manageris enabled.Added a new setting
runtimeOnFailthat overrides theonFailfield ofdevEngines.runtime(andengines.runtime) in the root project'spackage.json. Accepted values:ignore,warn,error,download. For example, settingruntimeOnFail=downloadmakes pnpm download the declared runtime version even when the manifest does not setonFail: "download".Added a new setting
minimumReleaseAgeIgnoreMissingTime, which istrueby default. When enabled, pnpm skips theminimumReleaseAgematurity check if the registry metadata does not include thetimefield. Set tofalseto fail resolution instead.Store
Hooks & Pnpmfiles
.mjsextension. When.pnpmfile.mjsexists, it takes priority over.pnpmfile.cjsand only one is loaded #9730.CLI & Other
clean,setup,deploy, andrebuildcommands now prefer user scripts over built-in commands. When a project'spackage.jsonhas a script with the same name,pnpmexecutes the script instead of the built-in command. Addedpurgeas an alias for the built-incleancommand, which always runs the built-in regardless of scripts #11118.-Fas a short alias for the--filteroption..are hidden and cannot be run directly viapnpm run. They can only be called from other scripts. Hidden scripts are also omitted from thepnpm runlisting #11041.pnpm approve-buildsnow accepts positional arguments for approving or denying packages without the interactive prompt. Prefix a package name with!to deny it. Only mentioned packages are affected; the rest are left untouched #11030.allowBuildsare automatically added topnpm-workspace.yamlwith a placeholder value, so users can manually set them totrueorfalse#11030.pnandpnxshort aliases forpnpmandpnpx(pnpm dlx) #11052.pnpm store prunenow displays the total size of removed files #11047.pnpm audit --fixnow adds the minimum patched version for each advisory tominimumReleaseAgeExcludeinpnpm-workspace.yaml, so the security fix can be installed without waiting forminimumReleaseAge#11216.optimisticRepeatInstallskipsshouldRefreshResolutionhooks #10995.Performance
node-fetchwith nativeundicifor HTTP requests throughout pnpm #10537.node_modules, avoiding the overhead of creating a temp dir and renaming per package #11088.gunzipSyncchunk size for fewer buffer allocations during tarball decompression #11086.If-Modified-Sincefor conditional metadata fetches, avoiding re-downloading unchanged registry metadata #11161.minimumReleaseAge, reducing the amount of data fetched from the registry #11160.Patch Changes
Switched to
process.stderr.writeinstead ofconsole.errorfor script logging #11140.Respected the
frozen-lockfileflag when migrating config dependencies #11067.Removed the
--workspaceflag from theversioncommand #11115.Handled
ENOTSUPerror in the clone import path during parallel I/O #11117.Fixed
pnpm auditcommand.Updated dependencies to fix vulnerabilities.
pnpm now checks whether a package is installable for non-npm-hosted packages (e.g., git or tarball dependencies) after the manifest has been fetched.
pnpm now explicitly passes the path of the global
rcconfig file tonpm.Fixed YAML formatting preservation in
pnpm-workspace.yamlwhen running commands likepnpm update. Previously, quotes and other formatting were lost even when catalog values didn't change.Closes #10425
The parameter set by the
--allow-buildflag is now written toallowBuilds.Fixed a bug in which specifying
filterinpnpm-workspace.yamlwould cause pnpm to not detect any projects.Deferred patch errors until all patches in a group are applied, so that one failed patch does not prevent other patches from being attempted.
pnpm now fails on incompatible lockfiles in CI when frozen lockfile mode is enabled #10978.
Fixed
strictDepBuildsandallowBuildschecks being bypassed when a package's build side-effects are cached in the store #11039.In GVS mode,
pnpm approve-buildsnow runs a full install instead of rebuild, ensuring that GVS hash directories and symlinks are updated correctly after changingallowBuilds#11043.Fixed a crash in the lockfile merger when merging non-semver version strings (e.g.
link:,file:, git URLs) #11102.Handled
ENOTSUPerror inlinkOrCopyduring parallel imports #11103.Skipped linking bins that already reference the correct target. This avoids redundant I/O during repeated installs and prevents permission errors when the store is read-only (e.g. Docker layer caching, CI prewarm, NFS) #11069.
Fixed
_passwordhandling for the default registry to decode from base64 before use, consistent with scoped registry behavior #11089.Fixed a bug where the CAS locker cache was not updated when a file already existed with correct integrity #11085.
Prevented catalog entries from being removed by
cleanupUnusedCatalogswhen they are referenced only from workspaceoverrides#11075.Resolved patch file paths during
pnpm fetch#11054.Fixed invalid specifiers for peers on all non-exact version selectors #11049.
Fixed false "Command not found" error on Windows when the command exists but exits with a non-zero exit code #11000.
Prepended
Bearerto the authorization token generated bytokenHelperif it is missing, aligning with npm's behavior #11097.Propagated error cause when throwing
PnpmErrorin@pnpm/npm-resolver#10990.Fixed SQLite race condition during store initialization on Windows.
Removed
rimrafSyncinimportIndexedDirfast-path error handler #11168.Fixed
pnpm dedupe --checkunexpectedly failing due to non-deterministic resolution #11110.Fixed empty files not being rejected in
isEmptyDirOrNothing#11182.Fixed
.bat/.cmdtoken helpers not working on Windows due to missingshell: trueoption.v10.33.4: pnpm 10.33.4Compare Source
Patch Changes
Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.
A new
gitHosted: truefield is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.Fix a regression where
pnpm --recursive --filter '!<pkg>' run/exec/test/addwould include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative--filterarguments are provided, matching the documented behavior. To include the root, pass--include-workspace-root#11341.Platinum Sponsors
Gold Sponsors
v10.33.3: pnpm 10.33.3Compare Source
Patch Changes
@pnpm/exeto v11+ on Intel macOS (darwin-x64),pnpm self-updatenow transparently switches to the JS-onlypnpmpackage on npm instead of installing@pnpm/exe@v11+(which doesn't ship a working binary for Intel Macs because of an upstream Node.js SEA bug — see #11423 and nodejs/node#62893). Without this, the self-update would silently leave the user with no workingpnpmbinary. The new install requires Node.js to be available onPATH; a warning is printed when the swap happens. All other host/version combinations are unchanged.pnpm self-update(with no version argument) no longer downgrades pnpm when the registry'slatestdist-tag points to an older release than the currently active version. Runpnpm self-update latestto force a downgrade #11418.Platinum Sponsors
Gold Sponsors
v10.33.2: pnpm 10.33.2Compare Source
Patch Changes
Globally-installed bins no longer fail with
ERR_PNPM_NO_IMPORTER_MANIFEST_FOUNDwhen pnpm was installed via the standalone@pnpm/exebinary (e.g.curl -fsSL https://get.pnpm.io/install.sh | sh -) on a system without a separate Node.js installation. Previously, whenwhich('node')failed duringpnpm add --global, pnpm fell back toprocess.execPath, which in@pnpm/exeis the pnpm binary itself — and that path was baked into the generated bin shim, causing the shim to invoke pnpm instead of Node #11291, #4645.Fix an infinite fork-bomb that could happen when pnpm was installed with one version (e.g.
npm install -g pnpm@A) and run inside a project whosepackage.jsonselected a different pnpm version via thepackageManagerfield (e.g.pnpm@B), while apnpm-workspace.yamlalso existed at the project root.The child's environment is now forced to
manage-package-manager-versions=false(v10) andpm-on-fail=ignore(v11+), which disables the package-manager-version handling in whichever pnpm runs as the child.Fixes #11337.
Platinum Sponsors
Gold Sponsors
v10.33.1: pnpm 10.33.1Compare Source
Patch Changes
packageManagerfield selects pnpm v11 or newer, commands that v10 would have passed through to npm (version,login,logout,publish,unpublish,deprecate,dist-tag,docs,ping,search,star,stars,unstar,whoami, etc.) are now handed over to the wanted pnpm, which implements them natively. Previously they silently shelled out to npm — making, for example,pnpm version --helpprint npm's help on a project withpackageManager: pnpm@11.0.0-rc.3#11328.Platinum Sponsors
Gold Sponsors
v10.33.0: pnpm 10.33Compare Source
Minor Changes
dedupePeerssetting that reduces peer dependency duplication. When enabled, peer dependency suffixes use version-only identifiers (name@version) instead of full dep paths, eliminating nested suffixes like(foo@1.0.0(bar@2.0.0)). This dramatically reduces the number of package instances in projects with many recursive peer dependencies #11070.Patch Changes
Fail on incompatible lockfiles in CI when frozen lockfile mode is enabled, while preserving non-frozen CI fallback behavior.
When package metadata is malformed or can't be fetched, the error thrown will now show the originating error.
Fixed intermittent failures when multiple
pnpm dlxcalls run concurrently for the same package. When the global virtual store is enabled, the importer now verifies file content before skipping a rename, avoiding destructive swap-renames that break concurrent processes. Also tolerates EPERM during bin creation on Windows and properly propagatesenableGlobalVirtualStorethrough the install pipeline.Fixed handling of non-string version selectors in
hoistPeers, preventing invalid peer dependency specifiers.Improve the non-interactive modules purge error hint to include the
confirmModulesPurge=falseworkaround.When pnpm needs to recreate
node_modulesbut no TTY is available, the error now suggests either settingCI=trueor disabling the purge confirmation prompt viaconfirmModulesPurge=false.Adds a regression test for the non-TTY flow.
Fixed false "Command not found" errors on Windows when a command exists in PATH but exits with a non-zero code. Also fixed path resolution for
--filtercontexts where the command runs in a different package directory.When a pnpm-lock.yaml contains two documents, ignore the first one. pnpm v11 will write two lockfile documents into pnpm-lock.yaml in order to store pnpm version integrities and config dependency resolutions.
Fixed a bug preventing the
clearCachefunction returned bycreateNpmResolverfrom properly clearing metadata cache.Platinum Sponsors
Gold Sponsors
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
731eb8d2e4105fe33faf105fe33faff45175c7fcf45175c7fc672581949767258194978a62dca2698a62dca269fe7870d450fe7870d450aadd75bf4baadd75bf4bbaf899a877baf899a877e39ac088faView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.