pnpm: baixar versions anteriors

This release adds the `sideEffectsCache.exclude` setting, stops `pnpm install` from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.

### Minor Changes

• Added the `sideEffectsCache.exclude` setting for packages whose build depends on something pnpm cannot include in the cache key, such as the system libraries a native addon links against. pnpm builds the listed packages in every project and never restores or saves their builds through the side-effects cache, locally or on a `remoteCache` server. Under the global virtual store, each project gets its own copy of these packages and of the packages that depend on them. Entries use the same `name`, `@scope/*`, and `name@version` patterns as `minimumReleaseAgeExclude` [#5271](https://github.com/pnpm/pnpm/issues/5271).

• `pnpm login` now prints the `npm-notice` response header during web-based login. Registries use it to show the verification code that completes the sign-in in the browser.

### Patch Changes

#### Installing packages

• `pnpm install` and `pnpm add` no longer wait for the daily update check. If the command finishes first, pnpm skips the update notice and checks again next time. On a registry that accepted the connection but never answered, an install that had nothing to do used to take minutes [#16839](https://github.com/pnpm/pnpm/issues/16839).

• `pnpm install`, `pnpm add` and `pnpm update` now reuse `pnpm-lock.yaml` when the workspace configures a catalog entry that no dependency references, such as an unused entry or one whose package an `overrides` entry replaces. Before, every resolution in such a workspace resolved all dependencies again from the registry [#16923](https://github.com/pnpm/pnpm/issues/16923).

• `pnpm install` now looks up a git dependency's branch or tag once per install, even when many workspace projects depend on it. With `linkWorkspacePackages` enabled, it used to run `git ls-remote` once per project [#16899](https://github.com/pnpm/pnpm/issues/16899).

• A filtered install, such as `pnpm install --filter <pkg>`, now keeps the `pnpm-lock.yaml` entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk [#16931](https://github.com/pnpm/pnpm/issues/16931).

• pnpm now decides whether a dependency that a package also declares as an optional peer is linked as a dependency or as a peer from the shallowest path that reaches the package. When an existing lockfile records such a dependency as a regular dependency and a newly added dependency now provides the peer, pnpm records it as a peer, as a fresh install does. The lockfile entry of such a package can change on the next install [#16901](https://github.com/pnpm/pnpm/issues/16901).

• An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store [#16929](https://github.com/pnpm/pnpm/issues/16929).

#### Running commands and scripts

• pnpm no longer aborts with a core dump when the reader of its output has exited, as in `pnpm list | head -1` or `pnpm start 2>&1 | head -1`. The command finishes with its usual exit code, and a failing script's exit code is kept. A write to stdout that fails for another reason, such as a full disk, ends the command with exit code 1 [#16904](https://github.com/pnpm/pnpm/issues/16904) [pnpm/tasks#132](https://github.com/pnpm/tasks/issues/132).

• On Windows, `pnpm exec`, `pnpm run`, and commands such as `pnpm nx` now return when the command they run exits, even if it left a detached process running and pnpm's output is redirected or piped. Previously a shell reading that output waited until the detached process, such as the Nx daemon, exited [#16930](https://github.com/pnpm/pnpm/issues/16930).

• Commands that do not write the project 

This release fixes `--workspace-concurrency=Infinity`, filters set by an `updateConfig` hook, and store fetches with `enable-modules-dir=false`.

### Patch Changes

• `--workspace-concurrency=Infinity` now runs workspace projects with no concurrency limit. It used to fail with `invalid digit found in string` [#16793](https://github.com/pnpm/pnpm/issues/16793).

• `pnpm install` and other recursive commands now apply the `filter` and `filterProd` that an `updateConfig` hook sets. They used to run on every workspace project [#16792](https://github.com/pnpm/pnpm/issues/16792).

• `enable-modules-dir=false` now also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists.

<!-- sponsors -->

## Platinum Sponsors

<table>
<tbody>
<tr>
<td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
</td>
<td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
</td>
</tr>
<tr>
<td align="center" valign="middle">
<a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
</picture>
</a>
</td>
</tr>
</tbody>
</table>

## Gold Sponsors

<table>
<tbody>
<tr>
<td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
</td>
</tr>
<tr>
<td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blan

This release fixes `pnpm install` failures after an `overrides` change and on a filtered frozen install with `catalogPrune`. It also fixes several bugs in the experimental `nodeLinker.type：loaded`, which now keeps its generated files in `node_modules`.

### Patch Changes

• With `nodeLinker.type：loaded`, pnpm now writes its generated files to `node_modules`, which projects already ignore in git. The store manifest and loader are `node_modules/.pnpm/.store-manifest.json` and `node_modules/.pnpm/.store-loader.mjs`. Bin shims are in `node_modules/.bin`.

Earlier versions wrote `.pnpm-store.json` and `.pnpm-store-loader.mjs` to the project root, and a `.pnpm` directory to the root and to each workspace package. Delete them after reinstalling.

• With `nodeLinker.type：loaded`, packages that ship their own `node_modules` directory, such as `npm` with its bundled dependencies, now load from the store. Before, one such package in the install stopped every Node.js process from starting.

• With `nodeLinker.type：loaded`, scripts can now run a Node.js runtime installed through `devEngines.runtime`. Before, every script that called `node` re-ran its own shim until it failed with "Argument list too long".

• With `nodeLinker.type：loaded`, Node.js processes start faster. In a project with 13,000 stored files, the startup overhead per process dropped from 67 ms to 18 ms.

• `pnpm install` no longer fails with `ERR_PNPM_NO_MATCHING_VERSION` after a change to `overrides` when the lockfile resolves an optional peer dependency to an npm alias of another package [#16654](https://github.com/pnpm/pnpm/issues/16654).

• A frozen install with `catalogPrune` no longer removes catalog entries that `pnpm-lock.yaml` still records. Before, `pnpm install --frozen-lockfile --filter` failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` when some workspace projects were missing from disk [#16638](https://github.com/pnpm/pnpm/issues/16638).

• `pnpm install --fix-lockfile` no longer removes the `deprecated` and `hasBin` fields from lockfile entries [#6600](https://github.com/pnpm/pnpm/issues/6600).

• With `enableGlobalVirtualStore`, an install that updates `node_modules` now repairs a package in the global virtual store that an interrupted install left without some of its dependency links or package files. Before, such an install kept the incomplete package if the project's `node_modules` already recorded it [#16642](https://github.com/pnpm/pnpm/issues/16642).

• `pnpm install` now skips the Cargo and Python projects inside a nested directory that has its own `pnpm-workspace.yaml` or `.git` directory, such as a git worktree of the same workspace or a separate clone.

• The `Request took` warning for package metadata now starts timing when pnpm sends the request. Before, it also counted the time the request waited for a free request slot, so large installs printed it for requests the registry answered quickly.

<!-- sponsors -->

## Platinum Sponsors

<table>
<tbody>
<tr>
<td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
</td>
<td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
</td>
</tr>
<tr>
<td align="center" valign="middle">
<a href="https://coderabbit.ai/?utm_source=pnpm

pnpm 12.8.1 fixes `pnpm install --frozen-lockfile` rejecting lockfiles with injected workspace packages that have peers, restores the executable bit on files of local directory dependencies, makes `pnpm dedupe` converge, and uses less CPU on many-core machines.

### Patch Changes

• `pnpm install --frozen-lockfile` no longer rejects a freshly generated lockfile when an injected workspace package has peer dependencies [#16332](https://github.com/pnpm/pnpm/issues/16332).

• Executable files in a `file:` directory dependency or an injected workspace package keep their executable bit again. Since 12.8.0, pnpm installed these files without the permissions they have in their project.

• `pnpm dedupe` now reaches a stable lockfile when a package's peer suffix is long enough to be hashed. Before, each run could switch that package's key between the hashed and the spelled-out suffix, so `pnpm dedupe --check` always failed [#16331](https://github.com/pnpm/pnpm/issues/16331).

• `pnpm install --frozen-lockfile`, the default in CI, now uses less CPU on machines with more than 8 cores. Warm installs on many-core Windows machines got up to 10% faster. Frozen installs now link with at most 16 worker threads.

• `verifyDepsBeforeRun` no longer reports dependencies as outdated after a filtered install just because `pnpm-lock.yaml` has a newer modification time. It checks the lockfile against the packages that install put in place. Before, `pnpm run` reinstalled the whole workspace with lifecycle scripts on, for example after a Docker `COPY` brought in a lockfile with a newer mtime [#16322](https://github.com/pnpm/pnpm/issues/16322).

After a filtered install, `verifyDepsBeforeRun` now also checks that the install put the selected projects' dependencies in place. A `node_modules` directory alone no longer counts as proof.

• `pnpm run` and `pnpm exec` no longer install a project that has never been installed and has nothing to install. Such a project declares no dependencies, no peer dependencies that `autoInstallPeers` would fetch, and no install lifecycle scripts. The command now runs without writing `node_modules` or `pnpm-lock.yaml` [#16313](https://github.com/pnpm/pnpm/issues/16313).

• `pnpm update -g --latest` now upgrades globally installed packages beyond their saved version ranges [#16320](https://github.com/pnpm/pnpm/issues/16320).

<!-- sponsors -->

## Platinum Sponsors

<table>
<tbody>
<tr>
<td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
</td>
<td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
</td>
</tr>
<tr>
<td align="center" valign="middle">
<a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
</picture>
</a>
</td>
</tr>
</tbody>
</table>

## Gold Sponsors

<table>
<tbody>
<tr>
<td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" t

pnpm 12.6.0 ships with automatic dependency deduplication, relocatable node_modules, package.yaml manifest editing, and --save-types support.

### Minor Changes

• `autoDedupe` deduplicates compatible dependency versions during installation [#7258](https://github.com/pnpm/pnpm/issues/7258). Enable it in `pnpm-workspace.yaml` or use `pnpm install --auto-dedupe` or `pnpm add --auto-dedupe`. Frozen installs leave the lockfile unchanged.

• `pnpm install`, `pnpm run`, and `pnpm exec` on macOS and Linux now reuse a `node_modules` directory and bin shims that moved or were copied together with their project [#6937](https://github.com/pnpm/pnpm/issues/6937). The first command after the move checks the tree and records its new location, so project commands in `node_modules/.bin` keep working.

• `pnpm add --save-types` saves available `@types/*` packages in `devDependencies` alongside registry dependencies [#3868](https://github.com/pnpm/pnpm/issues/3868). Packages that declare bundled TypeScript types are skipped. Set `saveTypes：true` in `pnpm-workspace.yaml` to enable this by default.

• `package.yaml` manifests can now be updated by `pnpm add`, `pnpm update`, `pnpm remove`, `pnpm pkg`, `pnpm link`, `pnpm set-script`, and `pnpm version` [#2008](https://github.com/pnpm/pnpm/issues/2008). Existing comments and key order are preserved.

• Catalog entries can now use the `file:` and `link:` protocols [#8642](https://github.com/pnpm/pnpm/issues/8642). A relative path or bare path in an entry, such as `./tarballs/foo.tgz`, is measured from the directory holding `pnpm-workspace.yaml`.

• `pnpm tasks status` lists running and waiting tasks in each concurrency group, and waiting tasks now take available slots in arrival order with higher `priority` tasks going first [#15208](https://github.com/pnpm/pnpm/issues/15208). If workspaces use different limits for the same group, a later task can take a free slot that earlier tasks cannot use. A package script named `tasks` takes precedence; use `pnpm pm tasks status` when that script exists.

• `pnpm cache prune` deletes registry metadata cache directories that this version of pnpm can no longer read [#15046](https://github.com/pnpm/pnpm/issues/15046). `pnpm cache prune --dry-run` lists what it would delete without removing anything.

• `macosBackup.excludeModulesDir` and `macosBackup.excludeStoreDir` on macOS can now exclude newly created modules, virtual-store, and package-store directories from Time Machine [#6440](https://github.com/pnpm/pnpm/issues/6440). Set either to `true` in global configuration or using the `PNPM_CONFIG_MACOS_BACKUP_EXCLUDE_MODULES_DIR` and `PNPM_CONFIG_MACOS_BACKUP_EXCLUDE_STORE_DIR` environment variables.

• `pnpm add --tilde` is now an alias for `--save-prefix=~` [#12863](https://github.com/pnpm/pnpm/issues/12863). The Yarn `-T` shorthand is not supported.

• `progress` setting and `--no-progress` option now turn off dependency and download progress lines [#14065](https://github.com/pnpm/pnpm/issues/14065). Warnings, lifecycle output, and the dependency summary are still printed.

### Patch Changes

#### Security

• POSIX bin shims now take `cygpath` and `wslpath` from the system default path on Cygwin, MSYS2, and WSL2 so a dependency cannot redirect another package's shim [#14866](https://github.com/pnpm/pnpm/issues/14866).

• `pnpm install` warnings no longer carry the text of a package's deprecation notice, naming only the deprecated package and version [#15099](https://github.com/pnpm/pnpm/issues/15099). A deprecation warning names the newest non-deprecated version when one exists, and control characters and line separators are stripped from package identifiers and warnings.

• `pnpm install` and other commands that report configuration warnings now warn when environment variables in project `.npmrc` credentials are ignored [#15051](https://github.com/pnpm/pnpm/issues/15051).

#### Installing packages

• `pnpm install --frozen-lockfile` now succeeds when an optiona

## Patch Changes

• pnpm now reports an unknown task setting in `pnpm-workspace.yaml` and carries on. It used to refuse to start, so a project could not use a task setting that only the pnpm version its `packageManager` pins reads. The setting is still an error when the running pnpm is that pinned version.

• Python interpreter installation now retries historical release metadata requests. It caches the release list for up to 24 hours and refreshes it once after a lookup miss. When a release omits the current platform, the search samples at most eight other releases before reporting that the lookup is inconclusive.

• Python `registries` entries now route packages by exact names or trailing-prefix patterns in `packages`. Registry declaration order no longer affects resolution. A matched package resolves exclusively from its assigned registry, including transitive and build dependencies. Use `packages：["*"]` to declare the default index.

• `pnpm install` no longer fails with "Too many levels of symbolic links" when a Cargo configuration file above the workspace is a symlink, such as a `~/.cargo/config.toml` linked from a dotfiles repository.

• `pnpm install` now returns "Already up to date" in a workspace where `dedupeDirectDeps` left a project without a `node_modules` directory of its own. Such a project forced a full install on every run.

• `pnpm install` no longer refuses the repeat-install fast path just because a changed `pnpm-lock.yaml` is 16 MiB or larger. Such a lockfile forced a full install on the run after every change.

<!-- sponsors -->

## Platinum Sponsors

<table>
<tbody>
<tr>
<td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
</td>
<td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
</td>
</tr>
<tr>
<td align="center" valign="middle">
<a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
</picture>
</a>
</td>
</tr>
</tbody>
</table>

## Gold Sponsors

<table>
<tbody>
<tr>
<td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
</picture>
</a>
</td>
<td align

pnpm 12.4.2 includes security fixes for executable shims and GitHub Actions links, more reliable installs, faster peer dependency checks in workspaces, and Python lockfiles that work across compatible targets.

## Patch Changes

### Security

• Dependency executables can no longer take over another package's POSIX bin shim through its shell helpers. Reinstall dependencies to replace existing shims [#14837](https://github.com/pnpm/pnpm/issues/14837).

On Cygwin, MSYS2, and WSL, shims still use `PATH` for Windows path conversion, so dependency executables can still redirect them there.

• GitHub Actions homepage links no longer expose server credentials. GitHub server URLs now require HTTPS, with HTTP allowed only for loopback hosts.

### Installing packages

• pnpm no longer crashes at startup on FreeBSD and other Unix-like platforms. Platforms other than Windows and macOS use `~/.local/share/pnpm/store` by default [#14859](https://github.com/pnpm/pnpm/issues/14859).

• `pnpm install` on Windows no longer fails with `ERR_PNPM_PACKAGE_MANAGER_REMOVE_MODULES_DIR` when clearing `node_modules` containing linked dependencies, such as when changing `nodeLinker` [#14790](https://github.com/pnpm/pnpm/issues/14790).

• `pnpm install <pkg>` now accepts `--prod` and `--dev`, including `--prod=false` [#14868](https://github.com/pnpm/pnpm/issues/14868).

• `pnpm install` and `pnpm update` now honor `--ignore-workspace` in nested projects excluded from the surrounding workspace. The flag also skips that workspace's settings during the `packageManager` check [#14809](https://github.com/pnpm/pnpm/issues/14809).

• `pnpm install` on macOS no longer reuses stale files for `file:` tarball or git-hosted tarball dependencies.

• `pnpm install` in a single-project directory now detects `package.json` edits made while the previous install was finishing [#14890](https://github.com/pnpm/pnpm/issues/14890).

• `pnpm install --frozen-lockfile` now removes packages no longer reachable from any project in `pnpm-lock.yaml`. This also prevents repeated lifecycle script execution and unnecessary installs before `pnpm run` and `pnpm exec` with `verifyDepsBeforeRun` [#14891](https://github.com/pnpm/pnpm/issues/14891).

### Resolving and updating dependencies

• Node.js runtime resolution now reports network failures from unofficial-builds.nodejs.org. These failures previously omitted musl builds from `pnpm-lock.yaml`, making its contents depend on network access [#14813](https://github.com/pnpm/pnpm/issues/14813).

• `pnpm install` now rejects invalid `peerDependencies` specifiers with `ERR_PNPM_INVALID_PEER_DEPENDENCY_SPECIFICATION`. A value such as `"foo"："foo@1.0.0"` previously created a broken directory link [#14791](https://github.com/pnpm/pnpm/issues/14791).

• `pnpm deploy` now writes plain registry versions in the deployed `package.json`, without peer dependency suffixes. The lockfile retains peer bindings, and npm aliases retain their target package names [#14873](https://github.com/pnpm/pnpm/issues/14873).

• `pnpm add <git repository>` now names repositories without a `package.json` as `@owner/repo`, allowing dependencies on equally named repositories from different owners [#14870](https://github.com/pnpm/pnpm/issues/14870).

• Peer dependency resolution now deduplicates packages whose child dependency resolves an optional peer in only some workspace projects, such as `next` with `styled-jsx`'s optional `babel-plugin-macros` peer [#14800](https://github.com/pnpm/pnpm/issues/14800).

• `pnpm update` now settles the lockfile in one run when an upgrade removes the package providing an optional peer dependency [#14895](https://github.com/pnpm/pnpm/issues/14895).

• `pnpm update --no-save` now preserves override-applied specifiers for dependencies it is not updating, preventing subsequent frozen installs from failing with `ERR_PNPM_OUTDATED_LOCKFILE` [#14836](https://github.com/pnpm/pnpm/issues/14836).

• `pnpm update --no-save` now succeeds under `minimu

pnpm 12.4.1 fixes installs that failed on filesystems refusing hard links or clones, on Android, and under `nodeLinker：hoisted`. Repeat installs are faster.

## Patch Changes

### Installing packages

• `pnpm install` no longer fails with `Operation not permitted` when the filesystem refuses a hard link or a copy-on-write clone [#14722](https://github.com/pnpm/pnpm/issues/14722). Under `packageImportMethod：auto` and `clone-or-copy`, pnpm copies the file instead. EdenFS checkouts, which have no hard links, and rootless containers, which refuse the clone syscall, both hit this. An explicit `packageImportMethod: hardlink` or `clone` still reports the error.

pnpm also copies a package file whose store entry has reached the filesystem's limit on names for one file, 1024 on NTFS and 65000 on ext4. Such a file failed the install under `packageImportMethod：hardlink`, and under `auto` it stopped pnpm hard linking for the rest of the install.

• `pnpm install` no longer writes a package file through a symlink left at the path it is importing to. Copying such a file overwrote whatever the link pointed at, and created that file when the link pointed nowhere. An executable package file also made the link's target executable.

• Fixed `pnpm install` and `pnpm dlx` on Android. Registry requests crashed because pnpm found no system CA certificates, so pnpm uses bundled ones there [#14777](https://github.com/pnpm/pnpm/issues/14777). Imports also failed with "Permission denied" on filesystems that deny hard links and reflinks, and now fall back to copying [#14780](https://github.com/pnpm/pnpm/issues/14780).

• `pnpm install` no longer fails with "Invalid cross-device link" while preserving a package's nested `node_modules` directory during a Docker build [#14758](https://github.com/pnpm/pnpm/issues/14758).

• `pnpm install` no longer fails on a package tarball that carries a file at the archive root, such as the `._*` entries macOS `tar` adds [#14701](https://github.com/pnpm/pnpm/issues/14701). The file is installed at the root of the package.

A `file:` tarball packed without the usual `package/` directory is now recorded under the name and version from its own `package.json`. It was recorded under the alias the dependency was given, at version 0.0.0.

• Under `nodeLinker：hoisted`, `pnpm install` no longer re-imports packages that are already in place. A repeat install replaced the whole `node_modules` tree and reported `Packages: +N`. A package is still imported when its directory is missing, when its `package.json` no longer carries the installed version, when it is a `file:` dependency, and when it is patched. Lifecycle scripts no longer run again for a package left in place, and `pnpm rebuild` and a change to `allowBuilds` still reach it.

• `pnpm install` now runs a dependency's build scripts again when its side-effects cache entry has no files to restore [#14717](https://github.com/pnpm/pnpm/issues/14717). Such builds were skipped and nothing was put in their place, so a script whose whole effect lands outside its own package directory, such as a git hook installer, never took effect. pnpm no longer publishes empty artifacts to the shared side-effects cache either.

### Resolving and linking dependencies

• `pnpm install`, `pnpm add`, and `pnpm dedupe` now apply `ignoredOptionalDependencies` [#14729](https://github.com/pnpm/pnpm/issues/14729). Matching optional dependencies are left out of the lockfile and are not installed. pnpm 12 installed them whenever it resolved dependencies from scratch.

• `pnpm install` no longer links a transitive dependency to a workspace package when `linkWorkspacePackages` is `true` and the dependency is declared with a plain version range [#14781](https://github.com/pnpm/pnpm/issues/14781). Enabling `preferWorkspacePackages` does not change this. Set `linkWorkspacePackages：deep` to link them.

• `pnpm install` no longer leaves dangling dependency links in workspace packages located above the workspace root

## Patch Changes

• Sped up dependency resolution in large workspaces [#14352](https://github.com/pnpm/pnpm/issues/14352).

• pnpm 12 now accepts the boolean settings as command-line flags on every command that takes them in pnpm 11, for example `pnpm install --unsafe-perm`, `pnpm add foo --offline`, and `pnpm install --dangerously-allow-all-builds`. pnpm 12 rejected them with `unexpected argument`, which failed every install on Vercel, whose build runs `pnpm install --unsafe-perm` [#14346](https://github.com/pnpm/pnpm/issues/14346).

`pnpm remove` now accepts `--unsafe-perm`, the same flag `pnpm install`, `pnpm add`, and `pnpm update` take.

<!-- sponsors -->

## Platinum Sponsors

<table>
<tbody>
<tr>
<td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
</td>
<td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion" />
</picture>
</a>
</td>
</tr>
</tbody>
</table>

## Gold Sponsors

<table>
<tbody>
<tr>
<td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
</td>
</tr>
<tr>
<td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
</picture>
</a>
</td>
<td align="center" valign="middle">
<a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
<picture>
<source media="(prefers-color-scheme：light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme：dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
</picture>
</a>
</td>
<td al

## Minor Changes

• Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally.

Configure it with the new `remoteSideEffectsCache` setting. A workspace names the eligible `organization` and `packages`; everything describing the act of signing — `publish`, `keyId`, `builderId`, `trustedKeys`, `privateKey` and the provenance fields — is refused in `pnpm-workspace.yaml` and read from the global config file or the environment instead.

• Added macOS and Windows x64 and arm64 support to remote shared build artifacts [pnpm/pnpm#13771](https://github.com/pnpm/pnpm/issues/13771).

• Added the `audit.ignorePrune` setting. When set to `true`, `pnpm audit --fix` removes ignored GHSA entries that no longer appear in the audit report.

• Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject. Dependency side effects use package and source-integrity subjects, while workspace tasks use project and task subjects.

This changes shared-artifact request bodies and signed payloads. A pnpr server and its clients have to be on matching versions.

• `pnpm init` now pins the latest pnpm version, instead of the version of pnpm that ran the command. A project scaffolded by an outdated pnpm therefore no longer inherits that staleness through its own `devEngines.packageManager` / `packageManager` pin [#7490](https://github.com/pnpm/pnpm/issues/7490).

The version is read from the `latest` tag on the package-manager registries. When that lookup cannot answer — no network, an unreachable or slow registry, `offline`, or a `latest` that the `minimumReleaseAge` / `trustPolicy` settings reject — `pnpm init` pins the running version as before, and never fails or hangs on the lookup. A `latest` that is older than the running pnpm is never pinned either.

• A `scope` set in a project's `pnpm-workspace.yaml` is now ignored, with a warning naming where to set it instead. `pnpm login` records the scope as a `@scope:registry` route in the machine-global `auth.ini`, which outranks `~/.npmrc` in every project — so a repository-committed file could redirect a scope such as `@acme` for all of a user's other projects after one routine login. Use `--scope`, the `PNPM_CONFIG_SCOPE` environment variable, or the global config file instead [#13557](https://github.com/pnpm/pnpm/issues/13557).

• Verified remote build artifacts are persisted in the shared store with their signed origin metadata. Later installs reverify the artifact against current trust, policy, platform, and source before reuse, while invalid remote variants are quarantined per channel ([pnpm/pnpm#13771](https://github.com/pnpm/pnpm/issues/13771)).

• Persist completed recursive tasks so `--resume-from` skips exactly the work that passed during a matching interrupted or failed `pnpm -r run` / `pnpm -r exec` invocation. When no compatible state exists, pnpm retains its graph-based resume behavior.

• Allowed `pnpm update --patches` to refresh registry revisions through a configured pnpr server while retaining locked package versions.

• Added explicit registry revision selection with `<version>+rN` and `pnpm update --patches` for refreshing revision artifacts without changing package versions. Registry-backed lockfile policy checks recognize historical revisions, and pnpr now preserves safe revision histories from upstream registries.

• Workspace install, rebuild, pack, publish, stage, and lifecycle work now starts as soon as its dependencies finish instead of waiting for an unrelated topological group.

• `pnpm stage approve` now approves several staged packages at once. Run it without a stage id to pick from the staged versions interactively, or pass a list of stage ids. The whole batch is approved with a single one-time password, and pnpm asks for a new one only once the re

## Minor Changes

• `pnpm config get` and `pnpm config list` now show the settings pnpm acts on under their documented names:

• `registries` shows the registries pnpm resolves from, merged across every source (`.npmrc`, `pnpm-workspace.yaml`, the global config, CLI flags), in the shape the setting is written in：keyed by registry URL, with the default registry declared as the bare `@` scope. Built-in routes are included — the `@jsr` scope and the `npmjs` and `gh` prefixes — unless pointed elsewhere. Previously `pnpm config get registries` printed `undefined`.
• `update` and `audit` show the effective sections, whichever spelling set them. The deprecated internal spellings (`updateConfig`, `auditConfig`, `auditLevel`) are no longer listed.
• `catalogs` shows the complete resolved catalog set — the singular `catalog` block is its `default` entry — whichever spelling declared it.
• The `registry` and `@scope:registry` entries show the merged routes rather than raw `.npmrc` values, so they always agree with the `registries` view.

• Settings that no supported pnpm version recognizes get their own warning. A key in the global config file that this version of pnpm does not read is no longer reported with advice to move it to a project-level `pnpm-workspace.yaml` (where it would be ignored too); the warning now says the setting is not recognized by this version of pnpm, names the pnpm version that does read it when there is one (for example, `globalShims` is a pnpm v12 setting), and suggests the closest real setting name when the key looks like a typo. Unrecognized and non-camelCase keys in a project's `pnpm-workspace.yaml`, previously ignored silently, are now reported the same way. `pnpm config get <key>` and `pnpm get <key>` no longer print config-load warnings, so a script capturing the value gets the value alone.

• The `importPackage` pnpmfile hook is deprecated. pnpm now prints a warning when a pnpmfile defines it, and the hook will be removed in the next major version. It also opts the installation out of the parallel package importer, making installation slower. If you rely on this hook, comment on [#14101](https://github.com/pnpm/pnpm/issues/14101).

• `node_modules/.modules.yaml` no longer records the registries an install resolved from, and the recorded copy is dropped from the file on the first install that rewrites it.

It dated from the lockfile format that spelled a dependency's path relative to its registry, where reading an installed tree meant knowing the registries it was installed with. Dependency paths have not carried a registry for several major versions, and the recorded copy outlived its use：`pnpm list`, `pnpm why`, and single-project installs preferred it over the project's own configuration, so a project whose registry had changed since its last install was still read through the old one.

They now use the configured registries, like every other command already did.

• When `enableGlobalVirtualStore` is on, every process pnpm spawns for the project (`pnpm run`, `pnpm exec`, lifecycle scripts) now receives a `NODE_PATH` pointing at the project's hoisted `node_modules`, plus a `NODE_OPTIONS` `--import` flag that registers a resolve hook restoring `NODE_PATH` lookups for ESM imports. Dependencies that import undeclared ("phantom") packages keep resolving under the global virtual store — for both CommonJS and ESM — without installing the `@pnpm/plugin-esm-node-path` config dependency [pnpm/pnpm#9618](https://github.com/pnpm/pnpm/issues/9618). Tools run by `pnpm dlx` resolve such dependencies too：the JS CLI passes them the same environment, while the Rust CLI's dlx cache is self-contained, so its layout already exposes them.

• A registry can now declare that its abbreviated metadata carries the `time` field, so `resolutionMode：time-based` reads the full metadata document only from the registries that need it:

```yaml
resolutionMode：time-based
registries:
https://npm.internal.example/:
supportsTimeField：true
`

See the GitHub release for v11.15.1 notes.

See the GitHub release for v11.15.1 notes.

See the GitHub release for v11.15.1 notes.

See the GitHub release for v11.15.1 notes.

See the GitHub release for v11.15.0 notes.

See the GitHub release for v11.14.0 notes.

## Minor Changes

* Added `versioning.epics` to `pnpm-workspace.yaml`. An epic ties a group of member packages to a lead package, constraining every member's major version to a band derived from the lead's major: while the lead is on major `M`, members live in `M*100 … M*100+99`. Members move independently inside the band (patch, minor, and a `major` intent that stays in-band); a bump that would carry a member past the band ceiling is rejected until the lead advances its own major. When a release plan takes the lead to a new stable major, every member re-bases to the band floor in the same plan. Membership is matched with pnpm's package selectors — name globs, `./`-prefixed directory globs, and `!`-prefixed negations.

* Added the `team` command for managing organization teams and team memberships on the registry, with create, destroy, add, rm, and ls subcommands and support for --otp, --parseable, and --json flags.

* Added native workspace release management [#12952](https://github.com/pnpm/pnpm/issues/12952): the new `pnpm change` command records change intents as changesets-compatible `.changeset/*.md` files (`pnpm change status` shows the pending release plan), and the bare `pnpm version -r` consumes them — bumping versions across the workspace with dependent propagation through `workspace:` ranges, fixed groups, a `maxBump` cap, `--filter` narrowing, and `--dry-run` — writing changelogs, and recording consumed intents in a committed ledger that keeps cherry-picks and merge-backs between release branches safe. Packages can be moved onto per-package release lanes with the new `pnpm lane <name> --filter <pkg>` command and back with `pnpm lane main --filter <pkg>` (`pnpm lane` shows the membership), releasing `X.Y.Z-lane.N` prereleases from the same runs that release stable versions of the packages on the main lane. Configuration lives under the new `versioning` key of `pnpm-workspace.yaml` (`fixed`, `ignore`, `maxBump`, `lanes`, `changelog`). When two workspace projects publish the same name, intent files, `versioning.lanes`, and `versioning.fixed`/`ignore` may reference a project by its workspace-relative directory path (e.g. `"./pnpm/npm/pnpm"`) — the one additive extension to the changesets format, applied automatically by `pnpm change`.

Release changelogs default to `registry` storage (`versioning.changelog.storage`): no `CHANGELOG.md` is committed. Each release's section is composed at publish time and packed into the published tarball on top of the previously published version's changelog, and the consumed change intents are garbage-collected by a later `pnpm version -r` only once the registry confirms the version is published with its section. Set `versioning.changelog.storage: repository` to keep committed `CHANGELOG.md` files instead.

* Added a new override selector form with an empty range — `"pkg@": "<version>"` — called a convergence override. It rewrites a dependency edge only when its exact version satisfies the edge's declared range, so compatible consumers converge on one version while incompatible consumers keep their own resolution — now and for any dependent added in the future [#12794](https://github.com/pnpm/pnpm/issues/12794).

```yaml
overrides:
"form-data@": 4.0.6
```

The value must be an exact version. When a full resolution detects that every declared range also admits a newer version, pnpm warns that the override is stale and names the version to converge on. Previously an empty range in an override selector was undocumented and behaved like a bare (unscoped) override.

## Patch Changes

* A `tokenHelper` set in the global pnpm `auth.ini` is no longer rejected as project-level configuration. The guard that blocks `tokenHelper` from a project `.npmrc` only treated `~/.npmrc` as a trusted source, so a helper written to `auth.ini` (for example by `pnpm config set`) failed on every command and could not even be removed with `pnpm config delete`. A `tokenHelper` in a workspace or project `.npmrc` is

> See full v11.0.0 changelog
> Migration guide: Migrating from v10 to v11
Minor Changes
- Added pnpm stage with publish, list, view, approve, reject, and download subcommands for npm staged publishing.
- Added a new setting trustLockfile. When true, pnpm install skips the supply-chain verification pass that re-applies minimumReleaseAge / trustPolicy='no-downgrade' to every entry in the loaded lockfile. The install treats the lockfile as already-trusted — useful for closed-source projects where every commit comes from a trusted author. Defaults to false; verification stays on by default. Set in pnpm-workspace.yaml.
Also cut the memory footprint of the verification pass itself: the per-(registry, name) trust-meta cache previously retained the full packument — dependency graphs, scripts, README, and per-version manifests — for the entire install. On large workspaces (~4k lockfile entries with minimumReleaseAge + trustPolicy: no-downgrade enabled) this could OOM CI runners with a 2GB heap cap. The cache now stores only the fields the trust check actually reads (time, per-version _npmUser.trustedPublisher, dist.attestations.provenance). The abbreviated-metadata cache is similarly projected to just the package-level modified field and the set of currently-listed version names. Fixes #11860.
- Implemented pnpm pkg command natively, following npm pkg standards.
- Implemented pnpm repo command natively, following npm repo standards.
- Implemented pnpm set-script (alias ss) natively. Adds or updates an entry in the scripts field of the project manifest, supporting package.json, package.json5, and package.yaml formats.
- Add a skip-manifest-obfuscation option for pnpm pack and pnpm publish. When enabled, the original packageManager field and publish lifecycle scripts are kept in the packed/published manifest instead of being stripped. The pnpm-specific pnpm field continues to be omitted.
Patch Changes
- Fixed pnpm dlx failing with ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND when the installed package's CAS slot is missing its package.json. Observed in the wild for pnpm dlx node@runtime:<version> when the GVS slot was populated without the synthesized manifest runtime archives need (they don't ship a package.json of their own, so the synthesized one is the only way it gets there; an existing slot from an earlier code path that skipped the synthesis stays incomplete). The bin link itself is wired up from the resolution and remains valid, so dlx now falls back to the scopeless package name when the slot's manifest is unreadable — for single-bin packages (the dlx common case, including every runtime: spec) this matches what manifest.bin would have named. Multi-bin packages already require --package=<spec> <bin> to disambiguate and don't enter this code path.
- Fixed non-determinism in pnpm dedupe and pnpm install when a dependency graph contains packages with transitive peer dependencies on each other (e.g. @aws-sdk/client-sts and @aws-sdk/client-sso-oidc) and auto-install-peers is enabled. The lockfile no longer flips between two equally-valid forms across consecutive runs. The root cause was that resolveDependencies pushed onto its pkgAddresses / postponedResolutionsQueue arrays from inside Promise.all-spawned callbacks, so completion-order timing leaked into the array order and downstream cyclic-peer suffix assignment. Fixes #8155.
- Fixed a regression introduced by #11711 where pnpm add <github-shorthand> (and any other wanted-dependency whose alias can't be parsed from the user-supplied spec, e.g. tarball URLs or pnpm/test-git-fetch#sha) was silently dropped from the manifest update and from pendingBuilds. The alias-keyed lookup added in that PR couldn't find a wantedDependency whose alias was undefined at parse time but resolved to a package name only after fetching, so the entry never made it into specsToUpsert. Restored the original index-based pairing between directDependencies and wantedDependencies; the catalog-protocol preservation that 

> See full v11.0.0 changelog: https://github.com/pnpm/pnpm/releases/tag/v11.0.0
> Migration guide: Migrating from v10 to v11

## Patch Changes

- Restored the heuristic that preserves tarball URLs in `pnpm-lock.yaml` when they cannot be derived
from name+version+registry, even with the default `lockfileIncludeTarballUrl: false`. Without this,
`pnpm install --frozen-lockfile` from an empty store fails with ERR_PNPM_FETCH_404 for packages on
registries that serve tarballs from a non-standard path — most notably GitHub Packages
(`https://npm.pkg.github.com/download/<scope>/<name>/<version>/<hash>`) and JSR.
`lockfileIncludeTarballUrl: true` continues to force the URL into the lockfile for every package
#11276.
- Run `preversion`, `version`, and `postversion` lifecycle scripts for `pnpm version`.
- Fixed `ERR_PNPM_BAD_TARBALL_SIZE` when a registry serves tarballs with an end-to-end `Content-Encoding`
(e.g. `gzip`). Tarballs are already compressed, so the fetcher now requests them with `Accept-Encoding:
identity` (matching pnpm v10's effective behavior) and, as defense in depth against misbehaving
servers, no longer enforces the strict `Content-Length` check when the response declares a
`Content-Encoding` — `Content-Length` in that case refers to the encoded payload, not the decoded
bytes the fetch implementation yields #11506.

Patch Changes
- Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.
A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.
- Fix a regression where pnpm --recursive --filter '!<pkg>' run/exec/test/add would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative --filter arguments are provided, matching the documented behavior. To include the root, pass --include-workspace-root #11341.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
───────────────┬─────────────────┬─────────────────
Sanity │Discord │Vite
───────────────┼─────────────────┼─────────────────
SerpApi │CodeRabbit │Stackblitz
───────────────┼─────────────────┴─────────────────
Workleap │Nx
───────────────┴─────────────────

Patch Changes
- When self-updating from v10's @pnpm/exe to v11+ on Intel macOS (darwin-x64), pnpm self-update now transparently switches to the JS-only pnpm package on npm instead of installing @pnpm/exe@v11+ (which doesn't ship a working binary for Intel Macs because of an upstream Node.js SEA bug — see #11423 and nodejs/node#62893). Without this, the self-update would silently leave the user with no working pnpm binary. The new install requires Node.js to be available on PATH; a warning is printed when the swap happens. All other host/version combinations are unchanged.
- pnpm self-update (with no version argument) no longer downgrades pnpm when the registry's latest dist-tag points to an older release than the currently active version. Run pnpm self-update latest to force a downgrade #11418.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
───────────────┬─────────────────┬─────────────────
Sanity │Discord │Vite
───────────────┼─────────────────┼─────────────────
SerpApi │CodeRabbit │Stackblitz
───────────────┼─────────────────┴─────────────────
Workleap │Nx
───────────────┴─────────────────

Patch Changes
- Globally-installed bins no longer fail with ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND when pnpm was installed via the standalone @pnpm/exe binary (e.g. curl -fsSL https://get.pnpm.io/install.sh | sh -) on a system without a separate Node.js installation. Previously, when which('node') failed during pnpm add --global, pnpm fell back to process.execPath, which in @pnpm/exe is the pnpm binary itself — and that path was baked into the generated bin shim, causing the shim to invoke pnpm instead of Node #11291, #4645.
- Fix an infinite fork-bomb that could happen when pnpm was installed with one version (e.g. npm install -g pnpm@A) and run inside a project whose package.json selected a different pnpm version via the packageManager field (e.g. pnpm@B), while a pnpm-workspace.yaml also existed at the project root.
The child's environment is now forced to manage-package-manager-versions=false (v10) and pm-on-fail=ignore (v11+), which disables the package-manager-version handling in whichever pnpm runs as the child.
Fixes #11337.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
───────────────┬─────────────────┬─────────────────
Sanity │Discord │Vite
───────────────┼─────────────────┼─────────────────
SerpApi │CodeRabbit │Stackblitz
───────────────┼─────────────────┴─────────────────
Workleap │Nx
───────────────┴─────────────────

Patch Changes
- When a project's packageManager field selects pnpm v11 or newer, commands that v10 would have passed through to npm (version, login, logout, publish, unpublish, deprecate, dist-tag, docs, ping, search, star, stars, unstar, whoami, etc.) are now handed over to the wanted pnpm, which implements them natively. Previously they silently shelled out to npm — making, for example, pnpm version --help print npm's help on a project with packageManager: pnpm@11.0.0-rc.3 #11328.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
───────────────┬─────────────────┬─────────────────
Sanity │Discord │Vite
───────────────┼─────────────────┼─────────────────
SerpApi │CodeRabbit │Stackblitz
───────────────┼─────────────────┴─────────────────
Workleap │Nx
───────────────┴─────────────────

Minor Changes
- Added a new dedupePeers setting that reduces peer dependency duplication. When enabled, peer dependency suffixes use version-only identifiers (name@version) instead of full dep paths, eliminating nested suffixes like (foo@1.0.0(bar@2.0.0)). This dramatically reduces the number of package instances in projects with many recursive peer dependencies #11070.
Patch Changes
- Fail on incompatible lockfiles in CI when frozen lockfile mode is enabled, while preserving non-frozen CI fallback behavior.
- When package metadata is malformed or can't be fetched, the error thrown will now show the originating error.
- Fixed intermittent failures when multiple pnpm dlx calls run concurrently for the same package. When the global virtual store is enabled, the importer now verifies file content before skipping a rename, avoiding destructive swap-renames that break concurrent processes. Also tolerates EPERM during bin creation on Windows and properly propagates enableGlobalVirtualStore through the install pipeline.
- Fixed handling of non-string version selectors in hoistPeers, preventing invalid peer dependency specifiers.
- Improve the non-interactive modules purge error hint to include the confirmModulesPurge=false workaround.
When pnpm needs to recreate node_modules but no TTY is available, the error now suggests either setting CI=true or disabling the purge confirmation prompt via confirmModulesPurge=false.
Adds a regression test for the non-TTY flow.
- Fixed false "Command not found" errors on Windows when a command exists in PATH but exits with a non-zero code. Also fixed path resolution for --filter contexts where the command runs in a different package directory.
- When a pnpm-lock.yaml contains two documents, ignore the first one. pnpm v11 will write two lockfile documents into pnpm-lock.yaml in order to store pnpm version integrities and config dependency resolutions.
- Fixed a bug preventing the clearCache function returned by createNpmResolver from properly clearing metadata cache.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
───────────────┬─────────────────┬─────────────────
Sanity │Discord │Vite
───────────────┼─────────────────┼─────────────────
SerpApi │CodeRabbit │Stackblitz
───────────────┼─────────────────┴─────────────────
Workleap │Nx
───────────────┴─────────────────

Patch Changes
- Fix a regression where pnpm-workspace.yaml without a packages field caused all directories to be treated as workspace projects. This broke projects that use pnpm-workspace.yaml only for settings (e.g. minimumReleaseAge) without defining workspace packages #10909.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
───────────────┬─────────────────┬─────────────────
Sanity │Discord │Vite
───────────────┼─────────────────┼─────────────────
SerpApi │CodeRabbit │Stackblitz
───────────────┼─────────────────┴─────────────────
Workleap │Nx
───────────────┴─────────────────

Minor Changes
- Added --all flag to pnpm approve-builds that approves all pending builds without interactive prompts #10136.
Patch Changes
- Reverted change related to setting explicitly the npm config file path, which caused regressions.
- Reverted fix related to lockfile-include-tarball-url. Fixes #10915.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
───────────────┬─────────────────┬─────────────────
Sanity │Discord │Vite
───────────────┼─────────────────┼─────────────────
SerpApi │CodeRabbit │Stackblitz
───────────────┼─────────────────┴─────────────────
Workleap │Nx
───────────────┴─────────────────

Minor Changes
- When pnpm updates the pnpm-workspace.yaml, comments, string formatting, and whitespace will be preserved.
Patch Changes
- Added -F as a short alias for the --filter option in the help output.
- Handle undefined pkgSnapshot in pnpm why -r #10700.
- Fix headless install not being used when a project has an injected self-referencing file: dependency that resolves to link: in the lockfile.
- Fixed a race condition when multiple worker threads import the same package to the global virtual store concurrently. The rename operation now tolerates ENOTEMPTY/EEXIST errors if another thread already completed the import.
- When lockfile-include-tarball-url is set to false, tarball URLs are now always excluded from the lockfile. Previously, tarball URLs could still appear for packages hosted under non-standard URLs, making the behavior flaky and inconsistent #6667.
- Fixed optimisticRepeatInstall skipping install when overrides, packageExtensions, ignoredOptionalDependencies, patchedDependencies, or peersSuffixMaxLength changed.
- Fixed pnpm patch-commit failing with "unable to access '/.config/git/attributes': Permission denied" error in environments where HOME is unset or non-standard (Docker containers, CI systems).
The issue occurred because pnpm was setting HOME and the Windows user profile env var to empty strings to suppress user git configuration when running git diff. This caused git to resolve the home directory (~) as root (/), leading to permission errors when attempting to access /.config/git/attributes.
Now uses GIT_CONFIG_GLOBAL: os.devNull instead, which is git's proper mechanism for bypassing user-level configuration without corrupting the home directory path resolution.
Fixes #6537
- Fix pnpm why -r --parseable missing dependents when multiple workspace packages share the same dependency #8100.
- Fix link-workspace-packages=true incorrectly linking workspace packages when the requested version doesn't match the workspace package's version. Previously, on fresh installs the version constraint is overridden to * in the fallback resolution paths, causing any workspace package with a matching name to be linked regardless of version #10173.
- Fixed pnpm update --interactive table breaking with long version strings (e.g., prerelease versions like 7.0.0-dev.20251209.1) by dynamically calculating column widths instead of using hardcoded values #10316.
- Explicitly tell npm the path to the global rc config file.
- The parameter set by the --allow-build flag is written to allowBuilds.
- Fix a bug in which specifying filter on pnpm-workspace.yaml would cause pnpm to not detect any projects.
- Print help message on running pnpm dlx without arguments and exit.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
───────────────┬─────────────────┬─────────────────
Sanity │Discord │Vite
───────────────┼─────────────────┼─────────────────
SerpApi │CodeRabbit │Stackblitz
───────────────┼─────────────────┴─────────────────
Workleap │Nx
───────────────┴─────────────────

Patch Changes
- Fixed version switching via packageManager field failing when pnpm is installed as a standalone executable in environments without a system Node.js #10687.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Sanity │Discord │Vite
─────────────────┼─────────────────┼───────────────
SerpApi │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Nx
─────────────────┴─────────────────

Patch Changes
- Fix auto-installed peer dependencies ignoring overrides when a stale version exists in the lockfile.
- Fixed "input line too long" error on Windows when running lifecycle scripts with the global virtual store enabled #10673.
- Update @zkochan/js-yaml to fix moderate vulnerability.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Sanity │Discord │Vite
─────────────────┼─────────────────┼───────────────
SerpApi │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Nx
─────────────────┴─────────────────

Patch Changes
- Use the /-/npm/v1/security/audits/quick endpoint as the primary audit endpoint, falling back to /-/npm/v1/security/audits when it fails #10649.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Sanity │Discord │Vite
─────────────────┼─────────────────┼───────────────
SerpApi │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Nx
─────────────────┴─────────────────

Minor Changes
- pnpm why now shows a reverse dependency tree. The searched package appears at the root with its dependents as branches, walking back to workspace roots. This replaces the previous forward-tree output which was noisy and hard to read for deeply nested dependencies.
Patch Changes
- Revert pnpm why dependency pruning to prefer correctness over memory consumption. Reverted PR: #7122.
- Optimize pnpm why and pnpm list performance in workspaces with many importers by sharing the dependency graph and materialization cache across all importers instead of rebuilding them independently for each one #10596.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Sanity │Discord │Vite
─────────────────┼─────────────────┼───────────────
SerpApi │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Nx
─────────────────┴─────────────────

Patch Changes
- Fixed an out-of-memory error in pnpm list (and pnpm why) on large dependency graphs by replacing the recursive tree builder with a two-phase approach: a BFS dependency graph followed by cached tree materialization. Duplicate subtrees are now deduplicated in the output, shown as "deduped (N deps hidden)" #10586.
- Fixed allowBuilds not working when set via .pnpmfile.cjs #10516.
- When the enableGlobalVirtualStore option is set, the pnpm deploy command would incorrectly create symlinks to the global virtual store. To keep the deploy directory self-contained, pnpm deploy now ignores this setting and always creates a localized virtual store within the deploy directory.
- Fixed minimumReleaseAgeExclude not being respected by pnpm dlx #10338.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Sanity │Discord │Vite
─────────────────┼─────────────────┼───────────────
SerpApi │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Nx
─────────────────┴─────────────────

Patch Changes
- Reverted a fix shipped in v10.29.1, which caused another issue #10571.
Reverted fix: Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #10497.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- The pnpm dlx / pnpx command now supports the catalog: protocol. Example: pnpm dlx shx@catalog:.
- Support configuring auditLevel in the pnpm-workspace.yaml file #10540.
- Support bare workspace: protocol without version specifier. It is now treated as workspace:* and resolves to the concrete version during publish #10436.
Patch Changes
- Fixed pnpm list --json returning incorrect paths when using global virtual store #10187.
- Fix pnpm store path and pnpm store status using workspace root for path resolution when storeDir is relative #10290.
- Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #10497.
- Fixed a bug where catalogMode: strict would write the literal string "catalog:" to pnpm-workspace.yaml instead of the resolved version specifier when re-adding an existing catalog dependency #10176.
- Fixed the documentation URL shown in pnpm completion --help to point to the correct page at https://pnpm.io/completion #10281.
- Skip local file: protocol dependencies during pnpm fetch. This fixes an issue where pnpm fetch would fail in Docker builds when local directory dependencies were not available #10460.
- Fixed pnpm audit --json to respect the --audit-level setting for both exit code and output filtering #10540.
- update tar to version 7.5.7 to fix security issue
Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: CVE-2026-24842
- Fix pnpm audit --fix replacing reference overrides (e.g. $foo) with concrete versions #10325.
- Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not being converted to publicHoistPattern #10271.
- pnpm help should correctly report if the currently running pnpm CLI is bundled with Node.js #10561.
- Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for node_modules/.bin, causing binaries to not be found when running commands like pnpm exec #10457.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Patch Changes
- Security fix: prevent path traversal in directories.bin field.
- When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.
This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.
Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.
- Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Patch Changes
- Fixed installation of config dependencies from private registries.
Added support for object type in configDependencies when the tarball URL returned from package metadata differs from the computed URL #10431.
- Fix path traversal vulnerability in binary fetcher ZIP extraction
- Validate ZIP entry paths before extraction to prevent writing files outside target directory
- Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix
- Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error
- Support plain http:// and https:// URLs ending with .git as git repository dependencies.
Previously, URLs like https://gitea.example.org/user/repo.git#commit were not recognized as git repositories because they lacked the git+ prefix (e.g., git+https://). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads.
Changes:
- The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver
- The git resolver now recognizes plain http:// and https:// URLs ending in .git as git repositories
- Removed the isRepository check from the tarball resolver since it's no longer needed with the new resolver order
Fixes #10468
- pnpm run -r and pnpm run --filter now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use --if-present to suppress this error #6844.
- Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for ./ but not .\. Since backslashes are directory separators on Windows, malicious packages could use paths like foo\..\..\.npmrc to write files outside the package directory.
- When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project #5759.
- Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with @ bypassed validation, and after scope normalization, path traversal sequences like ../../ remained intact.
- Revert Try to avoid making network calls with preferOffline #10334.
- Fix --save-peer to write valid semver ranges to peerDependencies for protocol-based installs (e.g. jsr:) by deriving from resolved versions when available and falling back to * if none is available #10417.
- Do not exclude the root workspace project, when it is explicitly selected via a filter #10465.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- Add support for a hook called beforePacking that can be used to customize the package.json contents at publish time #3816.
- In some cases, a filtered install (i.e. pnpm install --filter ...) was slower than running pnpm install without any filter arguments. This performance regression is now fixed. Filtered installs should be as fast or faster than a full install #10408.
Patch Changes
- Do not add a symlink to the project into the store's project registry if the store is in a subdirectory of the project #10411.
- It should be possible to declare the requiredScripts setting in pnpm-workspace.yaml #10261.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- Adding trustPolicyIgnoreAfter allows you to ignore trust policy checks for packages published more than a specified time ago#10352.
- Added project registry for global virtual store prune support.
Projects using the store are now registered via symlinks in {storeDir}/v10/projects/. This enables pnpm store prune to track which packages are still in use by active projects and safely remove unused packages from the global virtual store.
- Semi-breaking. Changed the location of unscoped packages in the virtual global store. They will now be stored under a directory named @ to maintain a uniform 4-level directory depth.
- Added mark-and-sweep garbage collection for global virtual store.
pnpm store prune now removes unused packages from the global virtual store's links/ directory. The algorithm:
1. Scans all registered projects for symlinks pointing to the store
2. Walks transitive dependencies to mark reachable packages
3. Removes any package directories not marked as reachable
This includes support for workspace monorepos - all node_modules directories within a project (including those in workspace packages) are scanned.
Patch Changes
- Throw an error if the value of the tokenHelper or <url>:tokenHelper setting contains an environment variable.
- Git dependencies with build scripts should respect the dangerouslyAllowAllBuilds settings #10376.
- Skip the package manager check when running with --global and a project packageManager is configured, and warn that the check is skipped.
- pnpm store prune should not fail if the dlx cache directory has files, not only directories #10384
- Fixed a bug (#9759) where pnpm add would incorrectly modify a catalog entry in pnpm-workspace.yaml to its exact version.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Patch Changes
- Improve error message when a package version exists but does not meet the minimumReleaseAge constraint. The error now clearly states that the version exists and shows a human-readable time since release (e.g., "released 6 hours ago") #10307.
- Fix installation of Git dependencies using annotated tags #10335.
Previously, pnpm would store the annotated tag object's SHA in the lockfile instead of the actual commit SHA. This caused ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out commit hash didn't match the stored tag object hash.
- Binaries of runtime engines (Node.js, Deno, Bun) are written to node_modules/.bin before lifecycle scripts (install, postinstall, prepare) are executed #10244.
- Try to avoid making network calls with preferOffline #10334.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Patch Changes
- Don't fail on pnpm add, when blockExoticSubdeps is set to true #10324.
- Always resolve git references to full commits and ensure HEAD points to the commit after checkout #10310.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- Semi-breaking. Block git-hosted dependencies from running prepare scripts unless explicitly allowed in onlyBuiltDependencies #10288.
- Semi-breaking. Compute integrity hash for HTTP tarball dependencies when fetching, storing it in the lockfile to prevent servers from serving altered content on subsequent installs #10287.
- Added a new setting blockExoticSubdeps that prevents the resolution of exotic protocols in transitive dependencies.
When set to true, direct dependencies (those listed in your root package.json) may still use exotic sources, but all transitive dependencies must be resolved from a trusted source. Trusted sources include the configured registry, local file paths, workspace links, trusted GitHub repositories (node, bun, deno), and custom resolvers.
This helps to secure the dependency supply chain. Packages from trusted sources are considered safer, as they are typically subject to more reliable verification and scanning for malware and vulnerabilities.
Exotic sources are dependency locations that bypass the usual trusted resolution process. These protocols are specifically targeted and blocked: Git repositories (git+ssh://...) and direct URL links to tarballs (https://.../package.tgz).
Related PR: #10265.
- Added support for allowBuilds, which is a new field that can be used instead of onlyBuiltDependencies and ignoredBuiltDependencies. The new allowBuilds field in your pnpm-workspace.yaml uses a map of package matchers to explicitly allow (true) or disallow (false) script execution. This allows for a single, easy-to-manage source of truth for your build permissions.
Example Usage. To explicitly allow all versions of esbuild to run scripts and prevent core-js from running them:
allowBuilds:
esbuild: true
core-js: false
The example above achieves the same result as the previous configuration:
onlyBuiltDependencies:
- esbuild
ignoredBuiltDependencies:
- core-js
Related PR: #10311
- Added support for --dry-run to the pack command #10301.
Patch Changes
- Show deprecation in table/list formats when latest version is deprecated #8658.
- Remove the injectWorkspacePackages setting from the lockfile on the deploy command #10294.
- Normalize the tarball URLs before saving them to the lockfile. URLs should not contain default ports, like :80 for http and :443 for https #10273.
- When a dependency is installed via a direct URL that redirects to another URL and is immutable, the original URL is normalized and saved to package.json #10197.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- Allow loading certificates from cert, ca, and key for specific registry URLs. E.g., //registry.example.com/:ca=-----BEGIN CERTIFICATE-----.... Previously this was only working via certfile, cafile, and keyfile.
These properties are supported in .npmrc, but were ignored by pnpm, this will make pnpm read and use them as well.
Related PR: #10230.
- Added a new flag called --bare to pnpm init for creating a package.json with the bare minimum of required fields #10226.
Patch Changes
- Improved reporting of ignored dependency scripts #10276.
- pnpm install should build any dependencies that were added to onlyBuiltDependencies and were not built yet #10256.
- pnpm publish -r --force should allow to run publish over already existing versions in the registry #10272.
- Don't fail with a ERR_PNPM_MISSING_TIME error if a package that is excluded from trust policy checks is missing the time field in the metadata.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- Increased network concurrency on machines with many CPU cores. pnpm now automatically selects a network concurrency between 16 and 64, based on the number of pnpm workers (calculated as workers × 3). This improves performance on high-core systems #10068.
Patch Changes
- trustPolicy should ignore the trust evidences of prerelease versions, when installing a non-prerelease version.
- Handle ENOENT errors thrown by fs.linkSync(), which can occur in containerized environments (OverlayFS) instead of EXDEV. The operation now gracefully falls back to fs.copyFileSync() in these cases #10217.
- Reverted: pnpm self-update should download pnpm from the configured npm registry #10205.
- Packages that don't have a package.json file (like Node.js) should not be reimported from the store on every install. Another file from the package should be checked in order to verify its presence in node_modules.
- Correctly read auth tokens for URLs that contain underscores #17.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- Added --lockfile-only option to pnpm list #10020.
Patch Changes
- pnpm self-update should download pnpm from the configured npm registry #10205.
- pnpm self-update should always install the non-executable pnpm package (pnpm in the registry) and never the @pnpm/exe package, when installing v11 or newer. We currently cannot ship @pnpm/exe as pkg doesn't work with ESM #10190.
- Node.js runtime is not added to "dependencies" on pnpm add, if there's a engines.runtime setting declared in package.json #10209.
- The installation should fail if an optional dependency cannot be installed due to a trust policy check failure #10208.
- pnpm list and pnpm why now display npm: protocol for aliased packages (e.g., foo npm:is-odd@3.0.1) #8660.
- Don't add an extra slash to the Node.js mirror URL #10204.
- pnpm store prune should not fail if the store contains Node.js packages #10131.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- Added support for trustPolicyExclude #10164.
You can now list one or more specific packages or versions that pnpm should allow to install, even if those packages don't satisfy the trust policy requirement. For example:
trustPolicy: no-downgrade
trustPolicyExclude:
- chokidar@4.0.3
- webpack@4.47.0 || 5.102.1
- Allow to override the engines field on publish by the publishConfig.engines field.
Patch Changes
- Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #10179.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- Node.js Runtime Installation for Dependencies. Added support for automatic Node.js runtime installation for dependencies. pnpm will now install the Node.js version required by a dependency if that dependency declares a Node.js runtime in the "engines" field. For example:
{
"engines": {
"runtime": {
"name": "node",
"version": "^24.11.0",
"onFail": "download"
}
}
}
If the package with the Node.js runtime dependency is a CLI app, pnpm will bind the CLI app to the required Node.js version. This ensures that, regardless of the globally installed Node.js instance, the CLI will use the compatible version of Node.js.
If the package has a postinstall script, that script will be executed using the specified Node.js version.
Related PR: #10141
- Added a new setting: trustPolicy.
When set to no-downgrade, pnpm will fail installation if a package’s trust level has decreased compared to previous releases — for example, if it was previously published by a trusted publisher but now only has provenance or no trust evidence.
This helps prevent installing potentially compromised versions of a package.
Related issue: #8889.
- Added support for pnpm config get globalconfig to retrieve the global config file path #9977.
Patch Changes
- When a user runs pnpm update on a dependency that is not directly listed in package.json, none of the direct dependencies should be updated #10155.
- Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #10160.
- Setting gitBranchLockfile and related settings via pnpm-workspace.yaml should work #9651.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- Support --all option in pnpm --help to list all commands #8628.
Patch Changes
- When the latest version doesn't satisfy the maturity requirement configured by minimumReleaseAge, pick the highest version that is mature enough, even if it has a different major version #10100.
- create command should not verify patch info.
- Set managePackageManagerVersions to false, when switching to a different version of pnpm CLI, in order to avoid subsequent switches #10063.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- You can now allow specific versions of dependencies to run postinstall scripts. onlyBuiltDependencies now accepts package names with lists of trusted versions. For example:
onlyBuiltDependencies:
- nx@21.6.4 || 21.6.5
- esbuild@0.25.1
Related PR: #10104.
- Added support for exact versions in minimumReleaseAgeExclude #9985.
You can now list one or more specific versions that pnpm should allow to install, even if those versions don’t satisfy the maturity requirement set by minimumReleaseAge. For example:
minimumReleaseAge: 1440
minimumReleaseAgeExclude:
- nx@21.6.5
- webpack@4.47.0 || 5.102.1
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Patch Changes
- Fix a bug where pnpm would infinitely recurse when using verifyDepsBeforeInstall: install and pre/post install scripts that called other pnpm scripts #10060.
- Fixed scoped registry keys (e.g., @scope:registry) being parsed as property paths in pnpm config get when --location=project is used #9362.
- Remove pnpm-specific CLI options before passing to npm publish to prevent "Unknown cli config" warnings #9646.
- Fixed EISDIR error when bin field points to a directory #9441.
- Preserve version and hasBin for variations packages #10022.
- Fixed pnpm config set --location=project incorrectly handling keys with slashes (auth tokens, registry settings) #9884.
- When both pnpm-workspace.yaml and .npmrc exist, pnpm config set --location=project now writes to pnpm-workspace.yaml (matching read priority) #10072.
- Prevent a table width error in pnpm outdated --long #10040.
- Sync bin links after injected dependencies are updated by build scripts. This ensures that binaries created during build processes are properly linked and accessible to consuming projects #10057.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Patch Changes
- pnpm outdated --long should work #10040.
- Replace ndjson with split2. Reduce the bundle size of pnpm CLI #10054.
- pnpm dlx should request the full metadata of packages, when minimumReleaseAge is set #9963.
- pnpm version switching should work when the pnpm home directory is in a symlinked directory #9715.
- Fix EPIPE errors when piping output to other commands #10027.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Patch Changes
- Don't print a warning, when --lockfile-only is used #8320.
- pnpm setup creates a command shim to the pnpm executable. This is needed to be able to run pnpm self-update on Windows #5700.
- When using pnpm catalogs and running a normal pnpm install, pnpm produced false positive warnings for "skip adding to the default catalog because it already exists". This warning now only prints when using pnpm add --save-catalog as originally intended.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- Added network performance monitoring to pnpm by implementing warnings for slow network requests, including both metadata fetches and tarball downloads.
Added configuration options for warning thresholds: fetchWarnTimeoutMs and fetchMinSpeedKiBps.
Warning messages are displayed when requests exceed time thresholds or fall below speed minimums
Related PR: #10025.
Patch Changes
- Retry filesystem operations on EAGAIN errors #9959.
- Outdated command respects minimumReleaseAge configuration #10030.
- Correctly apply the cleanupUnusedCatalogs configuration when removing dependent packages.
- Don't fail with a meaningless error when scriptShell is set to false #8748.
- pnpm dlx should not fail when minimumReleaseAge is set #10037.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Patch Changes
- When a version specifier cannot be resolved because the versions don't satisfy the minimumReleaseAge setting, print this information out in the error message #9974.
- Fix state.json creation path when executing pnpm patch in a workspace project #9733.
- When minimumReleaseAge is set and the latest tag is not mature enough, prefer a non-deprecated version as the new latest #9987.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Minor Changes
- The minimumReleaseAgeExclude setting now supports patterns. For instance:
minimumReleaseAge: 1440
minimumReleaseAgeExclude:
- "@eslint/*"
Related PR: #9984.
Patch Changes
- Don't ignore the minimumReleaseAge check, when the package is requested by exact version and the packument is loaded from cache #9978.
- When minimumReleaseAge is set and the active version under a dist-tag is not mature enough, do not downgrade to a prerelease version in case the original version wasn't a prerelease one #9979.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Patch Changes
- The full metadata cache should be stored not at the same location as the abbreviated metadata. This fixes a bug where pnpm was loading the abbreviated metadata from cache and couldn't find the "time" field as a result #9963.
- Forcibly disable ANSI color codes when generating patch diff #9914.
Platinum Sponsors
──────────
Bit
──────────
Gold Sponsors
─────────────────┬─────────────────┬───────────────
Discord │CodeRabbit │Workleap
─────────────────┼─────────────────┴───────────────
Stackblitz │Vite
─────────────────┴─────────────────

Patch Changes
- Fix .pnp.cjs crash when importing subpath #9904.
- When resolving peer dependencies, pnpm looks whether the peer dependency is present in the root workspace project's dependencies. This change makes it so that the peer dependency is correctly resolved even from aliased npm-hosted dependencies or other types of dependencies #9913.
Platinum Sponsors
────────────
Bit
────────────
Gold Sponsors
─────────────────────────┬─────────────────────────┬───────────────────────
Discord │CodeRabbit │Workleap
─────────────────────────┼─────────────────────────┴───────────────────────
Stackblitz │Vite
─────────────────────────┴─────────────────────────

Minor Changes
- Added the cleanupUnusedCatalogs configuration. When set to true, pnpm will remove unused catalog entries during installation #9793.
- Automatically load pnpmfiles from config dependencies that are named @*/pnpm-plugin-* #9780.
- pnpm config get now prints an INI string for an object value #9797.
- pnpm config get now accepts property paths (e.g. pnpm config get catalog.react, pnpm config get .catalog.react, pnpm config get 'packageExtensions["@babel/parser"].peerDependencies["@babel/types"]'), and pnpm config set now accepts dot-leading or subscripted keys (e.g. pnpm config set .ignoreScripts true).
- pnpm config get --json now prints a JSON serialization of config value, and pnpm config set --json now parses the input value as JSON.
Patch Changes
- Semi-breaking. When automatically installing missing peer dependencies, prefer versions that are already present in the direct dependencies of the root workspace package #9835.
- When executing the pnpm create command, must verify whether the node version is supported even if a cache already exists #9775.
- When making requests for the non-abbreviated packument, add */* to the Accept header to avoid getting a 406 error on AWS CodeArtifact #9862.
- The standalone exe version of pnpm works with glibc 2.26 again #9734.
- Fix a regression in which pnpm dlx pkg --help doesn't pass --help to pkg #9823.
Platinum Sponsors
────────────
Bit
────────────
Gold Sponsors
─────────────────────────┬─────────────────────────┬───────────────────────
Discord │CodeRabbit │Workleap
─────────────────────────┼─────────────────────────┴───────────────────────
Stackblitz │Vite
─────────────────────────┴─────────────────────────

Minor Changes
- Added support for JavaScript runtime resolution
Declare Node.js, Deno, or Bun in devEngines.runtime (inside package.json) and let pnpm download and pin it automatically.
Usage example:
{
"devEngines": {
"runtime": {
"name": "node",
"version": "^24.4.0",
"onFail": "download" // we only support the "download" value for now
}
}
}
How it works:
1. pnpm install resolves your specified range to the latest matching runtime version.
2. The exact version (and checksum) is saved in the lockfile.
3. Scripts use the local runtime, ensuring consistency across environments.
Why this is better:
1. This new setting supports also Deno and Bun (vs. our Node-only settings useNodeVersion and executionEnv.nodeVersion)
2. Supports version ranges (not just a fixed version).
3. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity.
4. It can be used on any workspace project (like executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.
5. For now devEngines.runtime setting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.
Related PR: #9755.
- Add --cpu, --libc, and --os to pnpm install, pnpm add, and pnpm dlx to customize supportedArchitectures via the CLI #7510.
Patch Changes
- Fix a bug in which pnpm add downloads packages whose libc differ from pnpm.supportedArchitectures.libc.
- The integrities of the downloaded Node.js artifacts are verified #9750.
- Allow dlx to parse CLI flags and options between the dlx command and the command to run or between the dlx command and -- #9719.
- pnpm install --prod should removing hoisted dev dependencies #9782.
- Fix an edge case bug causing local tarballs to not re-link into the virtual store. This bug would happen when changing the contents of the tarball without renaming the file and running a filtered install.
- Fix a bug causing pnpm install to incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.
Platinum Sponsors
────────────
Bit
────────────
Gold Sponsors
─────────────────────────┬─────────────────────────┬───────────────────────
Discord │CodeRabbit │Workleap
─────────────────────────┼─────────────────────────┴───────────────────────
Stackblitz │Vite
─────────────────────────┴─────────────────────────

Patch Changes
- Run user defined pnpmfiles after pnpmfiles of plugins.
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬─────────────────────────┬───────────────────────
Discord │CodeRabbit │Workleap
─────────────────────────┼─────────────────────────┴───────────────────────
Stackblitz │Vite
─────────────────────────┴─────────────────────────

Patch Changes
- Fix pnpm licenses command for local dependencies #9583.
- Fix a bug in which pnpm ls --filter=not-exist --json prints nothing instead of an empty array #9672.
- Fix a deadlock that sometimes happens during peer dependency resolution #9673.
- Running pnpm install after pnpm fetch should hoist all dependencies that need to be hoisted.
Fixes a regression introduced in [v10.12.2] by [#9648]; resolves [#9689].
[v10.12.2]: https://github.com/pnpm/pnpm/releases/tag/v10.12.2Add commentMore actions
[#9648]: #9648
[#9689]: #9689
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬─────────────────────────┬───────────────────────
Discord │CodeRabbit │Workleap
─────────────────────────┼─────────────────────────┴───────────────────────
Stackblitz │Vite
─────────────────────────┴─────────────────────────

Patch Changes
- Restore hoisting of optional peer dependencies when installing with an outdated lockfile.
Regression introduced in v10.12.2 by #9648; resolves #9685.
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬─────────────────────────┬───────────────────────
Discord │CodeRabbit │Workleap
─────────────────────────┼─────────────────────────┴───────────────────────
Stackblitz │Vite
─────────────────────────┴─────────────────────────

Patch Changes
- Fixed hoisting with enableGlobalVirtualStore set to true #9648.
- Fix the --help and -h flags not working as expected for the pnpm create command.
- The dependency package path output by the pnpm licenses list --json command is incorrect.
- Fix a bug in which pnpm deploy fails due to overridden dependencies having peer dependencies causing ERR_PNPM_OUTDATED_LOCKFILE #9595.
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬─────────────────────────┬───────────────────────
Discord │CodeRabbit │Workleap
─────────────────────────┼─────────────────────────┴───────────────────────
Stackblitz │Vite
─────────────────────────┴─────────────────────────

Minor Changes
- Experimental. Added support for global virtual stores. When enabled, node_modules contains only symlinks to a central virtual store, rather than to node_modules/.pnpm. By default, this central store is located at <store-path>/links (you can find the store path by running pnpm store path).
In the central virtual store, each package is hard linked into a directory whose name is the hash of its dependency graph. This allows multiple projects on the system to symlink shared dependencies from this central location, significantly improving installation speed when a warm cache is available.
> This is conceptually similar to how NixOS manages packages, using dependency graph hashes to create isolated and reusable package directories.
To enable the global virtual store, set enableGlobalVirtualStore: true in your root pnpm-workspace.yaml, or globally via:
pnpm config -g set enable-global-virtual-store true
NOTE: In CI environments, where caches are typically cold, this setting may slow down installation. pnpm automatically disables the global virtual store when running in CI.
Short demo of the speed of installation with this new setting enabled: https://www.youtube.com/watch?v=pNDFfJvaubY&ab_channel=pnpm
Related PR: #8190
- The pnpm update command now supports updating catalog: protocol dependencies and writes new specifiers to pnpm-workspace.yaml.
- A new catalogMode setting is available for controlling if and how dependencies are added to the default catalog. It can be configured to several modes:
- strict: Only allows dependency versions from the catalog. Adding a dependency outside the catalog's version range will cause an error.
- prefer: Prefers catalog versions, but will fall back to direct dependencies if no compatible version is found.
- manual (default): Does not automatically add dependencies to the catalog.
- Added two new CLI options (--save-catalog and --save-catalog-name=<name>) to pnpm add to save new dependencies as catalog entries. catalog: or catalog:<name> will be added to package.json and the package specifier will be added to the catalogs or catalog[<name>] object in pnpm-workspace.yaml #9425.
- Semi-breaking. The keys used for side-effects caches have changed. If you have a side-effects cache generated by a previous version of pnpm, the new version will not use it and will create a new cache instead #9605.
- Added a new setting called ci for explicitly telling pnpm if the current environment is a CI or not.
Patch Changes
- Sort versions printed by pnpm patch using semantic versioning rules.
- Improve the way the error message displays mismatched specifiers. Show differences instead of 2 whole objects #9598.
- Revert #9574 to fix a regression #9596.
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬─────────────────────────┬───────────────────────
Discord │CodeRabbit │Workleap
─────────────────────────┼─────────────────────────┴───────────────────────
Stackblitz │Vite
─────────────────────────┴─────────────────────────

Patch Changes
- Fix an issue in which pnpm deploy --legacy creates unexpected directories when the root package.json has a workspace package as a peer dependency #9550.
- Dependencies specified via a URL that redirects will only be locked to the target if it is immutable, fixing a regression when installing from GitHub releases. (#9531)
- Installation should not exit with an error if strictPeerDependencies is true but all issues are ignored by peerDependencyRules #9505.
- Use pnpm_config_ env variables instead of npm_config_ #9571.
- Fix a regression (in v10.9.0) causing the --lockfile-only flag on pnpm update to produce a different pnpm-lock.yaml than an update without the flag.
- Let pnpm deploy work in repos with overrides when inject-workspace-packages=true #9283.
- Fixed the problem of path loss caused by parsing URL address. Fixes a regression shipped in pnpm v10.11 via #9502.
- pnpm -r --silent run should not print out section #9563.
Platinum Sponsors
────────────┬────────────┬─────────────────────
Bit │Bit │Syntax
────────────┴────────────┴─────────────────────
Gold Sponsors
─────────────────────────┬─────────────────────────
Discord │u|screen
─────────────────────────┼─────────────────────────
JetBrains │Nx
─────────────────────────┼─────────────────────────
CodeRabbit │Route4Me
─────────────────────────┼─────────────────────────
Workleap │Stackblitz
─────────────────────────┴─────────────────────────

Minor Changes
- A new setting added for pnpm init to create a package.json with type=module, when init-type is module. Works as a flag for the init command too #9463.
- Added support for Nushell to pnpm setup #6476.
- Added two new flags to the pnpm audit command, --ignore and --ignore-unfixable #8474.
Ignore all vulnerabilities that have no solution:
> pnpm audit --ignore-unfixable
Provide a list of CVE's to ignore those specifically, even if they have a resolution.
> pnpm audit --ignore=CVE-2021-1234 --ignore=CVE-2021-5678
- Added support for recursively running pack in every project of a workspace #4351.
Now you can run pnpm -r pack to pack all packages in the workspace.
Patch Changes
- pnpm version management should work, when dangerouslyAllowAllBuilds is set to true #9472.
- pnpm link should work from inside a workspace #9506.
- Set the default workspaceConcurrency to Math.min(os.availableParallelism(), 4) #9493.
- Installation should not exit with an error if strictPeerDependencies is true but all issues are ignored by peerDependencyRules #9505.
- Read updateConfig from pnpm-workspace.yaml #9500.
- Add support for recursive pack
- Remove url.parse usage to fix warning on Node.js 24 #9492.
- pnpm run should be able to run commands from the workspace root, if ignoreScripts is set tot true #4858.
Platinum Sponsors
────────────┬────────────┬─────────────────────
Bit │Bit │Syntax
────────────┴────────────┴─────────────────────
Gold Sponsors
─────────────────────────┬─────────────────────────
Discord │u|screen
─────────────────────────┼─────────────────────────
JetBrains │Nx
─────────────────────────┼─────────────────────────
CodeRabbit │Route4Me
─────────────────────────┼─────────────────────────
Workleap │Stackblitz
─────────────────────────┴─────────────────────────

Minor Changes
- Allow loading the preResolution, importPackage, and fetchers hooks from local pnpmfile.
Patch Changes
- Fix cd command, when shellEmulator is true #7838.
- Sort keys in pnpm-workspace.yaml #9453.
- Pass the npm_package_json environment variable to the executed scripts #9452.
- Fixed a mistake in the description of the --reporter=silent option.
Platinum Sponsors
────────────┬────────────┬─────────────────────
Bit │Bit │Syntax
────────────┴────────────┴─────────────────────
Gold Sponsors
─────────────────────────┬─────────────────────────
Discord │u|screen
─────────────────────────┼─────────────────────────
JetBrains │Nx
─────────────────────────┼─────────────────────────
CodeRabbit │Route4Me
─────────────────────────┼─────────────────────────
Workleap │Stackblitz
─────────────────────────┴─────────────────────────

Minor Changes
- Added support for installing JSR packages. You can now install JSR packages using the following syntax:
pnpm add jsr:<pkg_name>
or with a version range:
pnpm add jsr:<pkg_name>@<range>
For example, running:
pnpm add jsr:@foo/bar
will add the following entry to your package.json:
{
"dependencies": {
"@foo/bar": "jsr:^0.1.2"
}
}
When publishing, this entry will be transformed into a format compatible with npm, older versions of Yarn, and previous pnpm versions:
{
"dependencies": {
"@foo/bar": "npm:@jsr/foo__bar@^0.1.2"
}
}
Related issue: #8941.
Note: The @jsr scope defaults to https://npm.jsr.io/ if the @jsr:registry setting is not defined.
- Added a new setting, dangerouslyAllowAllBuilds, for automatically running any scripts of dependencies without the need to approve any builds. It was already possible to allow all builds by adding this to pnpm-workspace.yaml:
neverBuiltDependencies: []
dangerouslyAllowAllBuilds has the same effect but also allows to be set globally via:
pnpm config set dangerouslyAllowAllBuilds true
It can also be set when running a command:
pnpm install --dangerously-allow-all-builds
Patch Changes
- Fix a false negative in verifyDepsBeforeRun when nodeLinker is hoisted and there is a workspace package without dependencies and node_modules directory #9424.
- Explicitly drop verifyDepsBeforeRun support for nodeLinker: pnp. Combining verifyDepsBeforeRun and nodeLinker: pnp will now print a warning.
Platinum Sponsors
────────────┬────────────┬─────────────────────
Bit │Bit │Syntax
────────────┴────────────┴─────────────────────
Gold Sponsors
─────────────────────────┬─────────────────────────
Discord │u|screen
─────────────────────────┼─────────────────────────
JetBrains │Nx
─────────────────────────┼─────────────────────────
CodeRabbit │Route4Me
─────────────────────────┼─────────────────────────
Workleap │Stackblitz
─────────────────────────┴─────────────────────────

Patch Changes
- Removed bright white highlighting, which didn't look good on some light themes #9389.
- If there is no pnpm related configuration in package.json, onlyBuiltDependencies will be written to pnpm-workspace.yaml file #9404.
- The patch file path saved by the pnpm patch-commit and patch-remove commands should be a relative path #9403.
Platinum Sponsors
────────────┬────────────┬─────────────────────
Bit │Bit │Syntax
────────────┴────────────┴─────────────────────
Gold Sponsors
─────────────────────────┬─────────────────────────
Discord │u|screen
─────────────────────────┼─────────────────────────
JetBrains │Nx
─────────────────────────┼─────────────────────────
CodeRabbit │Route4Me
─────────────────────────┼─────────────────────────
Workleap │Stackblitz
─────────────────────────┴─────────────────────────

Minor Changes
- Experimental. A new hook is supported for updating configuration settings. The hook can be provided via .pnpmfile.cjs. For example:
module.exports = {
hooks: {
updateConfig: (config) => ({
...config,
nodeLinker: "hoisted",
}),
},
};
- Now you can use the pnpm add command with the --config flag to install new configurational dependencies #9377.
Patch Changes
- Do not hang indefinitely, when there is a glob that starts with !/ in pnpm-workspace.yaml. This fixes a regression introduced by #9169.
- pnpm audit --fix should update the overrides in pnpm-workspace.yaml.
- pnpm link should update overrides in pnpm-workspace.yaml, not in package.json #9365.
Platinum Sponsors
────────────┬────────────┬─────────────────────
Bit │Bit │Syntax
────────────┴────────────┴─────────────────────
Gold Sponsors
─────────────────────────┬─────────────────────────
Discord │u|screen
─────────────────────────┼─────────────────────────
JetBrains │Nx
─────────────────────────┼─────────────────────────
CodeRabbit │Route4Me
─────────────────────────┼─────────────────────────
Workleap │Stackblitz
─────────────────────────┴─────────────────────────

Patch Changes
- pnpm config set should convert the settings to their correct type before adding them to pnpm-workspace.yaml #9355.
- pnpm config get should read auth related settings via npm CLI #9345.
- Replace leading ~/ in a path in .npmrc with the home directory #9217.
Platinum Sponsors
────────────┬────────────┬─────────────────────
Bit │Bit │Syntax
────────────┴────────────┴─────────────────────
Gold Sponsors
─────────────────────────┬─────────────────────────
Discord │u|screen
─────────────────────────┼─────────────────────────
JetBrains │Nx
─────────────────────────┼─────────────────────────
CodeRabbit │Route4Me
─────────────────────────┼─────────────────────────
Workleap │Stackblitz
─────────────────────────┴─────────────────────────

Patch Changes
- pnpm self-update should always update the version in the packageManager field of package.json.
- Fix running pnpm CLI from pnpm CLI on Windows when the CLI is bundled to an executable #8971.
- pnpm patch-commit will now use the same filesystem as the store directory to compare and create patch files.
- Don't show info output when --loglevel=error is used.
- peerDependencyRules should be set in pnpm-workspace.yaml to take effect.
Platinum Sponsors
────────────┬────────────┬─────────────────────
Bit │Bit │Syntax
────────────┴────────────┴─────────────────────
Gold Sponsors
─────────────────────────┬─────────────────────────
Discord │u|screen
─────────────────────────┼─────────────────────────
JetBrains │Nx
─────────────────────────┼─────────────────────────
CodeRabbit │Route4Me
─────────────────────────┼─────────────────────────
Workleap │Stackblitz
─────────────────────────┴─────────────────────────

Patch Changes
- The pnpm CLI process should not stay hanging, when --silent reporting is used.
- When --loglevel is set to error, don't show installation summary, execution time, and big tarball download progress.
- Don't ignore pnpm.patchedDependencies from package.json #9226.
- When executing the approve-builds command, if package.json contains onlyBuiltDependencies or ignoredBuiltDependencies, the selected dependency package will continue to be written into package.json.
- When a package version cannot be found in the package metadata, print the registry from which the package was fetched.
Platinum Sponsors
────────────┬────────────┬─────────────────────
Bit │Bit │Syntax
────────────┴────────────┴─────────────────────
Gold Sponsors
─────────────────────────┬─────────────────────────
Discord │u|screen
─────────────────────────┼─────────────────────────
JetBrains │Nx
─────────────────────────┼─────────────────────────
CodeRabbit │Route4Me
─────────────────────────┼─────────────────────────
Workleap │Stackblitz
─────────────────────────┴─────────────────────────

Patch Changes
- The pnpm config set command should change the global .npmrc file by default.
This was a regression introduced by #9151 and shipped in pnpm v10.5.0.
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬───────────────────────
Discord │u|screen
─────────────────────────┼───────────────────────
JetBrains │Nx
─────────────────────────┼───────────────────────
CodeRabbit │Route4Me
─────────────────────────┴───────────────────────
Workleap
─────────────────────────

Patch Changes
- Throw an error message if a pnpm-workspaces.yaml or pnpm-workspaces.yml file is found instead of a pnpm-workspace.yaml #9170.
- Fix the update of pnpm-workspace.yaml by the pnpm approve-builds command #9168.
- Normalize generated link paths in package.json #9163
- Specifying overrides in pnpm-workspace.yaml should work.
- pnpm dlx should ignore settings from the package.json file in the current working directory #9178.
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬───────────────────────
Discord │u|screen
─────────────────────────┼───────────────────────
JetBrains │Nx
─────────────────────────┼───────────────────────
CodeRabbit │Route4Me
─────────────────────────┴───────────────────────
Workleap
─────────────────────────

Minor Changes
- Allow to set the "pnpm" settings from package.json via the pnpm-workspace.yaml file #9121.
- Added support for automatically syncing files of injected workspace packages after pnpm run #9081. Use the sync-injected-deps-after-scripts setting to specify which scripts build the workspace package. This tells pnpm when syncing is needed. The setting should be defined in a .npmrc file at the root of the workspace. Example:
sync-injected-deps-after-scripts[]=compile
- The packages field in pnpm-workspace.yaml became optional.
Patch Changes
- pnpm link with no parameters should work as if --global is specified #9151.
- Allow scope registry CLI option without --config. prefix such as --@scope:registry=https://scope.example.com/npm #9089.
- pnpm link <path> should calculate relative path from the root of the workspace directory #9132.
- Fix a bug causing catalog snapshots to be removed from the pnpm-lock.yaml file when using --fix-lockfile and --filter. #8639
- Fix a bug causing catalog protocol dependencies to not re-resolve on a filtered install #8638.
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬───────────────────────
Discord │u|screen
─────────────────────────┼───────────────────────
JetBrains │Nx
─────────────────────────┼───────────────────────
CodeRabbit │Route4Me
─────────────────────────┴───────────────────────
Workleap
─────────────────────────

Patch Changes
- Throws an error when the value provided by the --allow-build option overlaps with the pnpm.ignoredBuildDependencies list #9105.
- Print pnpm's version after the execution time at the end of the console output.
- Print warning about ignored builds of dependencies on repeat install #9106.
- Setting init-package-manager should work.
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬───────────────────────
Discord │u|screen
─────────────────────────┼───────────────────────
JetBrains │Nx
─────────────────────────┼───────────────────────
CodeRabbit │Route4Me
─────────────────────────┴───────────────────────
Workleap
─────────────────────────

See breaking changes in v10
Minor Changes
- pnpm approve-builds --global works now for allowing dependencies of globally installed packages to run postinstall scripts.
- The pnpm add command now supports a new flag, --allow-build, which allows building the specified dependencies. For instance, if you want to install a package called bundle that has esbuild as a dependency and want to allow esbuild to run postinstall scripts, you can run:
pnpm --allow-build=esbuild add bundle
This will run esbuild's postinstall script and also add it to the pnpm.onlyBuiltDependencies field of package.json. So, esbuild will always be allowed to run its scripts in the future.
Related PR: #9086.
- The pnpm init command adds a packageManager field with the current version of pnpm CLI #9069. To disable this behaviour, set the init-package-manager setting to false.
Patch Changes
- pnpm approve-builds should work after two consecutive pnpm install runs #9083.
- Fix instruction for updating pnpm with corepack #9101.
- The pnpm version specified by packageManager cannot start with v.
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬───────────────────────
Discord │u|screen
─────────────────────────┼───────────────────────
JetBrains │Nx
─────────────────────────┼───────────────────────
CodeRabbit │Route4Me
─────────────────────────┴───────────────────────
Workleap
─────────────────────────

See breaking changes in v10
Minor Changes
- Added a new setting called strict-dep-builds. When enabled, the installation will exit with a non-zero exit code if any dependencies have unreviewed build scripts (aka postinstall scripts) #9071.
Patch Changes
- Fix a false negative of verify-deps-before-run after pnpm install --production|--no-optional #9019.
- Print the warning about blocked installation scripts at the end of the installation output and make it more prominent.
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬───────────────────────
Discord │u|screen
─────────────────────────┼───────────────────────
JetBrains │Nx
─────────────────────────┼───────────────────────
CodeRabbit │Route4Me
─────────────────────────┴───────────────────────
Workleap
─────────────────────────

Patch Changes
- Don't read a package from side-effects cache if it isn't allowed to be built #9042.
- pnpm approve-builds should work, when executed from a subdirectory of a workspace #9042.
- pnpm deploy --legacy should work without injected dependencies.
- Add information about how to deploy without "injected dependencies" to the "pnpm deploy" error message.
Platinum Sponsors
────────────┬────────────
Bit │Bit
────────────┴────────────
Gold Sponsors
─────────────────────────┬───────────────────────
Discord │u|screen
─────────────────────────┼───────────────────────
JetBrains │Nx
─────────────────────────┼───────────────────────
CodeRabbit │Route4Me
─────────────────────────┴───────────────────────
Workleap
─────────────────────────

See breaking changes in v10
Minor Changes
- Packages executed via pnpm dlx and pnpm create are allowed to be built (run postinstall scripts) by default.

If the packages executed by dlx or create have dependencies that have to be built, they should be listed via the --allow-build flag. For instance, if you want to run a package called bundle that has esbuild in dependencies and want to allow esbuild to run postinstall scripts, run:

pnpm --allow-build=esbuild dlx bundle

Related PR: #9026.
Patch Changes
- Quote args for scripts with shell-quote to support new lines (on POSIX only) #8980.
- Fix a bug in which pnpm deploy fails to read the correct projectId when the deploy source is the same as the workspace directory #9001.
- Proxy settings should be respected, when resolving Git-hosted dependencies #6530.
- Prevent overrides from adding invalid version ranges to peerDependencies by keeping the peerDependencies and overriding them with prod dependencies #8978.
- Sort the package names in the "pnpm.onlyBuiltDependencies" list saved by pnpm approve-builds.
Platinum Sponsors
────────────┬────────────┬──────────────
Bit │Bit │Figma
────────────┴────────────┴──────────────
Gold Sponsors
───────────────────────┬─────────────────────────
Discord │Prisma
───────────────────────┼─────────────────────────
u|screen │JetBrains
───────────────────────┼─────────────────────────
Nx │CodeRabbit
───────────────────────┼─────────────────────────
Route4Me │Workleap
───────────────────────┴─────────────────────────
Canva
───────────────────────

Patch Changes
- Verify that the package name is valid when executing the publish command.
- When running pnpm install, the preprepare and postprepare scripts of the project should be executed #8989.
- Quote args for scripts with shell-quote to support new lines (on POSIX only) #8980.
- Proxy settings should be respected, when resolving Git-hosted dependencies #6530.
- Replace strip-ansi with the built-in util.stripVTControlCharacters #9009.
Platinum Sponsors
Gold Sponsors

Patch Changes
- Ensure that recursive pnpm update --latest <pkg> updates only the specified package, with dedupe-peer-dependents=true.
Platinum Sponsors
Gold Sponsors

Patch Changes
- Fixed the Regex used to find the package manifest during packing #8938.
- pnpm update --filter <pattern> --latest <pkg> should only change the specified package for the specified workspace, when dedupe-peer-dependents is set to true #8877.
- Exclude .
DS_Store file at patch-commit #8922.
- Fix a bug in which pnpm patch is unable to bring back old patch without specifying @version suffix #8919.

Patch Changes
- Fixed publish/pack error with workspace dependencies with relative paths #8904.
It was broken in v9.4.0 (398472c).
- Use double quotes in the command suggestion by pnpm patch on Windows #7546.
- Do not fall back to SSH, when resolving a git-hosted package if git ls-remote works via HTTPS #8906.
- Improve how packages with blocked lifecycle scripts are reported during installation.
Always print the list of ignored scripts at the end of the output.
Include a hint about how to allow the execution of those packages.

Patch Changes
- pnpm remove should not link dependencies from the workspace, when link-workspace-packages is set to false #7674.
- Installation with hoisted node_modules should not fail, when a dependency has itself in its own peer dependencies #8854.

Minor Changes
- Metadata directory version bumped to force fresh cache after we shipped a fix to the metadata write function.
This change is backward compatible as install doesn't require a metadata cache.
Patch Changes
- pnpm update --global should not crash if there are no any global packages installed #7898.
- Fix an exception when running pnpm update --interactive if catalogs are used.

Patch Changes
- Don't ever save mutated metadata to the metadata cache.

Patch Changes
- pnpm publish --json should work #8788.

Minor Changes
- Added support for pnpm pack --json to print packed tarball and contents in JSON format #8765.
Patch Changes
- pnpm exec should print a meaningful error message when no command is provided #8752.
- pnpm setup should remove the CLI from the target location before moving the new binary #8173.
- Fix ERR_PNPM_TARBALL_EXTRACT error while installing a dependency from GitHub having a slash in branch name #7697.
- Don't crash if the use-node-version setting is used and the system has no Node.js installed #8769.
- Convert settings in local .npmrc files to their correct types.
For instance, child-concurrency should be a number, not a string #5075.
- pnpm should fail if a project requires a different package manager even if manage-package-manager-versions is set to true.
- pnpm init should respect the --dir option #8768.

Patch Changes
- Detection of circular peer dependencies should not crash with aliased dependencies #8759.
Fixes a regression introduced in the previous version.
- Fix race condition of symlink creations caused by multiple parallel dlx processes.

Patch Changes
- Fixed some edge cases where resolving circular peer dependencies caused a dead lock #8720.

Minor Changes
- The self-update now accepts a version specifier to install a specific version of pnpm.
E.g.:
Patch Changes
- Fix Cannot read properties of undefined (reading 'name') that is printed while trying to render the missing peer dependencies warning message #8538.

Patch Changes
- Don't purge node_modules, when typing "n" in the prompt that asks whether to remove node_modules before installation #8655.
- Fix a bug causing pnpm to infinitely spawn itself when manage-package-manager-versions=true is set and the .tools directory is corrupt.
- Use crypto.hash, when available, for improved performance #8629.
- Fixed a race condition in temporary file creation in the store by including worker thread ID in filename.
Previously, multiple worker threads could attempt to use the same temporary file.
Temporary files now include both process ID and thread ID for uniqueness #8703.
- All commands should read settings from the package.json at the root of the workspace #8667.
- When manage-package-manager-versions is set to true, errors spawning a self-managed version of pnpm will now be shown (instead of being silent).
- Pass the find command to npm, it is an alias for npm search

Patch Changes
- When checking whether a file in the store has executable permissions, the new approach checks if at least one of the executable bits (owner, group, and others) is set to 1.
Previously, a file was incorrectly considered executable only when all the executable bits were set to 1.
This fix ensures that files with any executable permission, regardless of the user class, are now correctly identified as executable #8546.

Patch Changes
- pnpm update --latest should not update the automatically installed peer dependencies #6657.
- pnpm publish should be able to publish from a local tarball #7950.
- The pnpx command should work correctly on Windows, when pnpm is installed via the standalone installation script #8608.
- Prevent EBUSY errors caused by creating symlinks in parallel dlx processes #8604.
- Fix maximum call stack size exceeded error related to circular workspace dependencies #8599.

Minor Changes
- Fix peer dependency resolution dead lock #8570.
This change might change some of the keys in the snapshots field inside pnpm-lock.yaml but it should happen very rarely.
- pnpm outdated command supports now a --sort-by=name option for sorting outdated dependencies by package name #8523.
- Added the ability for overrides to remove dependencies by specifying "-" as the field value #8572.
For example, to remove lodash from the dependencies, use this configuration in package.json:
Patch Changes
- Fixed an issue where pnpm list --json pkg showed "private": false for a private package #8519.
- Packages with libc that differ from pnpm.supportedArchitectures.libc are not downloaded #7362.
- Prevent ENOENT errors caused by running store prune in parallel #8586.
- Add issues alias to pnpm bugs #8596.

Minor Changes
- Experimental: added pnpm cache commands for inspecting the metadata cache #8512.
Patch Changes
- Fix a regression in which pnpm deploy with node-linker=hoisted produces an empty node_modules directory #6682.
- pnpm deploy should work in workspace with shared-workspace-lockfile=false #8475.
- Don't print a warning when linking packages globally #4761.

Minor Changes
- Support for a new CLI flag, --exclude-peers, added to the list and why commands.
When --exclude-peers is used, peer dependencies are not printed in the results, but dependencies of peer dependencies are still scanned #8506.
- Added a new setting to package.json at pnpm.auditConfig.ignoreGhsas for ignoring vulnerabilities by their GHSA code #6838.
Patch Changes
- Throw an exception if pnpm switches to the same version of itself.
- Reduce memory usage during peer dependencies resolution.

Minor Changes
- Minor breaking change.
This change might result in resolving your peer dependencies slightly differently but we don't expect it to introduce issues.
Patch Changes
- pnpm deploy should write the node_modules/.modules.yaml to the node_modules directory within the deploy directory #7731.
- Don't override a symlink in node_modules if it already points to the right location pnpm/symlink-dir#54.

Minor Changes
- Added a new command for upgrading pnpm itself when it isn't managed by Corepack: pnpm self-update.
This command will work, when pnpm was installed via the standalone script from the pnpm installation page #8424.
Patch Changes
- CLI tools installed in the root of the workspace should be added to the PATH, when running scripts and use-node-version is set.
- pnpm setup should never switch to another version of pnpm.
- Ignore non-string value in the os, cpu, libc fields, which checking optional dependencies #8431.
- Remember the state of edit dir, allow running pnpm patch-commit the second time without having to re-run pnpm patch.

Patch Changes
- Fixed passing public-hoist-pattern and hoist-pattern via env variables #8339.
- pnpm setup no longer creates Batch/Powershell scripts on Linux and macOS #8418.
- When dlx uses cache, use the real directory path not the symlink to the cache #8421.
- pnpm exec now supports executionEnv #8356.
- Remove warnings for non-root pnpm field, add warnings for non-root pnpm subfields that aren't executionEnv #8143.
- Replace semver in "peerDependency" with workspace protocol #8355.
- Fix a bug in patch-commit in which relative path is rejected #8405.
- Update Node.js in @pnpm/exe to v20.

Minor Changes
- Added pnpm version management.
If the manage-package-manager-versions setting is set to true, pnpm will switch to the version specified in the packageManager field of package.json #8363.
This is the same field used by Corepack.
Example:
- Added the ability to apply patch to all versions #8337.
- Change the default edit dir location when running pnpm patch from a temporary directory to node_modules/.pnpm_patches/pkg[@version] to allow the code editor to open the edit dir in the same file tree as the main project #8379.
- Substitute environment variables in config keys #6679.
Patch Changes
- pnpm install should run node-gyp rebuild if the project has a binding.gyp file even if the project doesn't have an install script #8293.
- Print warnings to stderr #8342.
- Peer dependencies of optional peer dependencies should be automatically installed #8323.

Minor Changes
- Support specifying node version (via pnpm.executionEnv.nodeVersion in package.json) for running lifecycle scripts per each package in a workspace #6720.
- Overrides now support the catalogs: protocol #8303.
Patch Changes
- The pnpm deploy command now supports the catalog: protocol #8298.
- The pnpm outdated command now supports the catalog: protocol #8304.
- Correct the error message when trying to run pnpm patch without node_modules/.modules.yaml #8257.
- Silent reporting fixed with the pnpm exec command #7608.
- Add registries information to the calculation of dlx cache hash #8299.

Minor Changes
- Added support for catalogs 8122.
- Bundled pnpm setup now creates the pnpx script #8230.
Patch Changes
- Read authentication information from .npmrc in the current directory when running dlx #7996.
- Updated @pnpm/tabtab to v0.5.4, enabling zsh autocomplete lazy loading #8236.
- Installation with filtering will now work, when dedupe-peer-dependents is set to true #6300.
- Fixed dlx not actually using the Node.js version specified by --use-node-version.

Minor Changes
- Some registries allow the exact same content to be published under different package names and/or versions.
This breaks the validity checks of packages in the store.
To avoid errors when verifying the names and versions of such packages in the store, you may now set the strict-store-pkg-content-check setting to false #4724.
Patch Changes
- Fix package-manager-strict-version missing in config #8195.
- If install is performed on a subset of workspace projects, always create an up-to-date lockfile first.
So, a partial install can be performed only on a fully resolved (non-partial) lockfile #8165.
- Handle workspace protocol with any semver range specifier, when used in peer dependencies #7578.

Minor Changes
- Semi-breaking.
Dependency key names in the lockfile are shortened if they are longer than 1000 characters.
We don't expect this change to affect many users.
Affected users most probably can't run install successfully at the moment.
This change is required to fix some edge cases in which installation fails with an out-of-memory error or "Invalid string length (RangeError: Invalid string length)" error.
The max allowed length of the dependency key can be controlled with the peers-suffix-max-length setting #8177.
Patch Changes
- Set reporter-hide-prefix to true by default for pnpm exec.
In order to show prefix, the user now has to explicitly set reporter-hide-prefix=false #8174.

Minor Changes
- If package-manager-strict-version is set to true, pnpm will fail if its version doesn't exactly match the version in the "packageManager" field of package.json.
Patch Changes
- Update @yarnpkg/pnp to the latest version, fixing issue with node: imports #8161.
- Deduplicate bin names to prevent race condition and corrupted bin scripts #7833.
- pnpm doesn't fail if its version doesn't match the one specified in the "packageManager" field of package.json #8087.
- exec now also streams prefixed output when --recursive or --parallel is specified just as run does #8065.

Patch Changes
- Improved the performance of the resolution stage by changing how missing peer dependencies are detected #8144.

Patch Changes
- Fix a bug in which a dependency that is both optional for one package but non-optional for another is omitted when optional=false #8066.
- Clear resolution cache before starting peer dependencies resolution #8109.
- Reduce memory usage by peer dependencies resolution #8072.

Patch Changes
- Reduced memory usage during peer dependencies resolution #8084.
- Details in the pnpm licenses output are not misplaced anymore #8071.

Patch Changes
- Improve the performance of the peers resolution stage by utilizing more cache #8058.
- Overrides with link: now preserve absolute path #8053.
- Fix incorrect path when resolving relative file: overrides for workspace package #8053.
- Print a better error message when resolution-mode is set to time-based and the registry fails to return the "time" field in the package's metadata.
- Fix shell completion on MinGW-w64 environment.

Minor Changes
- New setting called virtual-store-dir-max-length added to modify the maximum allowed length of the directories inside node_modules/.pnpm.
The default length is set to 120 characters.
This setting is particularly useful on Windows, where there is a limit to the maximum length of a file path #7355.
Patch Changes
- A dependency is hoisted to resolve an optional peer dependency only if it satisfies the range provided for the optional peer dependency #8028.
- Details in the pnpm outdated output are wrapped correctly #8037.
- Fix Cannot read properties of undefined (reading 'missingPeersOfChildren') exception that happens on install #8041.
- Explicitly throw an error when user attempts to run publish or pack when bundledDependencies is set but node-linker isn't hoisted.
- pnpm update should not fail when there's an aliased local workspace dependency #7975.

Patch Changes
- Lockfiles that have git-hosted dependencies specified should be correctly converted to the new lockfile format #7990.
- Don't upgrade the lockfile format on pnpm install --frozen-lockfile #7991.

Patch Changes
- Lockfiles with local or git-hosted dependencies are now successfully converted to the new lockfile format #7955.
- Resolve peer dependencies correctly, when they have prerelease versions #7977.
- Fix aliased dependencies resolution on repeat install with existing lockfile, when the aliased dependency doesn't specify a version or range #7957.
- The lockfile should be saved in the new format even if it is up-to-date.

Patch Changes
- Fix aliased dependencies resolution on repeat install with existing lockfile #7957.
- The engines.pnpm field in the package.json files of dependencies should be ignored #7965.

Patch Changes
- If the script-shell option is configured to a .bat/.cmd file on Windows, pnpm will now error with ERR_PNPM_INVALID_SCRIPT_SHELL_WINDOWS.
Newer versions of Node.js released in April 2024 do not support executing these files directly without behavior differences.
If the script-shell option is necessary for your use-case, please set a .exe file instead.
- Print a hint about the package-manager-strict setting, when pnpm doesn't match the version specified in the packageManager field in package.json.
- pnpm completion command should work in the standalone version of pnpm #7948.

Patch Changes
- Fixed an issue where optional dependencies were not linked into the dependent's node_modules #7943.

Patch Changes
- pnpm install --frozen-lockfile should work with lockfiles generated by pnpm v8, if they don't need updates #7934.

Patch Changes
- pnpm config get prints a comma-separated list for an array value instead of nothing.
- It should be possible to publish a tarball with custom dist-tag #7845.
- Print the list of packages that were not built because they are ignored by configuration settings.

Patch Changes
- The exit code of the child process should be preserved on pnpm run #7817.
- When sorting packages in a workspace, take into account workspace dependencies specified as peerDependencies #7813.
- Add --ignore-scripts argument to prune command #7836.

Patch Changes
- Correctly detect the active Node.js version during headless installation #7801.
- The npm CLI executed from pnpm should not use Corepack #7747.

Patch Changes
- Print the right error code when a package fails to be added to the store #7679.
- Don't fail on a tarball that appears to be not a USTAR or GNU TAR archive.
Still try to unpack the tarball #7120.
- Always add a name and version field to the index files in the store #7115.
- Deleting a dependencies field via a readPackage hook should work #7704.
- Symlinks should be resolved and uploaded to the side-effects cache #7691.

Patch Changes
- Remove vulnerable "ip" package from the dependencies #7652.

Patch Changes
- When purging multiple node_modules directories, pnpm will no longer print multiple prompts simultaneously.
- Don't print an unnecessary warning when adding new dependencies to a project that uses hoisted node_modules.
- Linking globally the command of a package that has no name in package.json #4761.
- Installation should work with lockfile created by pnpm v9.0.0-alpha.4

Patch Changes
- Use the object-hash library instead of node-object-hash for hashing keys of side-effects cache #7591.
- bundledDependencies should never be added to the lockfile with false as the value #7576.
Platinum Sponsors
Gold Sponsors
Our Silver Sponsors

Upgrade to v8.15.1 or newerMinor Changes
- When the license field does not exist in package.json but a license file exists, try to match and extract the license name #7530.
Patch Changes
- Running pnpm update -r --latest will no longer downgrade prerelease dependencies #7436.
- --aggregate-output should work on scripts executed from the same project #7556.
- Prefer hard links over reflinks on Windows as they perform better #7564.
- Reduce the length of the side-effects cache key. Instead of saving a stringified object composed from the dependency versions of the package, use the hash calculated from the said object #7563.
- Throw an error if pnpm update --latest runs with arguments containing versions specs. For instance, pnpm update --latest foo@next is not allowed #7567.
- Don't fail in Windows CoW if the file already exists #7554.
Platinum Sponsors
Gold Sponsors
Our Silver Sponsors

Patch Changes
- pnpm pack should work as expected when "prepack" modifies the manifest #7558.
Platinum Sponsors
Gold Sponsors
Our Silver Sponsors

Patch Changes
- Registry configuration from previous installation should not override current settings #7507.
- pnpm dlx should not fail, when executed from package.json "scripts" 7424.
- A git-hosted dependency should not be added to the store if it failed to be built #7407.
- pnpm publish should pack "main" file or "bin" files defined in "publishConfig" #4195.
Platinum Sponsors
Gold Sponsors
Our Silver Sponsors

Patch Changes
- Resolve the current working directory to its real location before doing any operations #6524.
- Allow using token helpers in pnpm publish #7316.
- Handle Git repository names containing capital letters #7488.
- When hoisted-workspace-packages is true don't hoist the root package even if it has a name. Otherwise we would create a circular symlink.
Our Gold Sponsors
Our Silver Sponsors

Minor Changes
- A new option added for hoisting packages from the workspace. When hoist-workspace-packages is set to true, packages from the workspace are symlinked to either <workspace_root>/node_modules/.pnpm/node_modules or to <workspace_root>/node_modules depending on other hoisting settings (hoist-pattern and public-hoist-pattern) #7451.
- The pnpm dedupe command now accepts more command line options that the pnpm install command also accepts. Example: pnpm dedupe --store-dir=local-store-dir
Patch Changes
- The package information output by cat-index should be sorted by key.
- pnpm deploy should not touch the target directory if it already exists and isn't empty #7351.
- pnpm add a-module-already-in-dev-deps will show a message to notice the user that the package was not moved to "dependencies" #926 and fix #7319.
- Don't install Node.js when use-node-version is set in a WebContainer #7478.
- Fix copy-on-write on Windows Dev Drives #7468.
Our Gold Sponsors
Our Silver Sponsors

Minor Changes
- New commands added for inspecting the store:- pnpm cat-index: Prints the index file of a specific package in the store. The package is specified by its name and version:

pnpm cat-index <pkg name>@<pkg version>

- pnpm cat-file: Prints the contents of a file based on the hash value stored in the index file. For example:

pnpm cat-file sha512-mvavhfVcEREI7d8dfvfvIkuBLnx7+rrkHHnPi8mpEDUlNpY4CUY+CvJ5mrrLl18iQYo1odFwBV7z/cOypG7xxQ==

- (EXPERIMENTAL) pnpm find-hash: Lists the packages that include the file with the specified hash. For example:

pnpm find-hash sha512-mvavhfVcEREI7d8dfvfvIkuBLnx7+rrkHHnPi8mpEDUlNpY4CUY+CvJ5mrrLl18iQYo1odFwBV7z/cOypG7xxQ==

This command is experimental. We might change how it behaves.
Related issue: #7413.
- A new setting added for symlinking injected dependencies from the workspace, if their dependencies use the same peer dependencies as the dependent package. The setting is called dedupe-injected-deps #7416.
- Use --fail-if-no-match if you want the CLI fail if no packages were matched by the command #7403.
Patch Changes
- pnpm list --parseable should not print the same dependency multiple times #7429.
- Fix error message texts in the pnpm env commands #7456.
- Better support for light themed terminals by the pnpm update --interactive command #7439.
- Fix EPERM error that occasionally happened on Windows during renames in the store #7213.
- Fix error as in update -i -r with Git specifiers #7415.
- Added support for boolean values in 'bundleDependencies' package.json fields when installing a dependency. Fix to properly handle 'bundledDependencies' alias #7411.
Our Gold Sponsors
Our Silver Sponsors

Patch Changes
- Don't report dependencies with optional dependencies as being added on repeat install.
This was a bug in reporting #7384.
- Fix a bug where --fix-lockfile crashes on tarballs #7368.
- Do not create empty patch directory.
- Installation should not fail if an empty node_modules directory cannot be removed #7405.

Minor Changes
- Add support for basic authorization header #7371.
Patch Changes
- Fix a bug where pnpm incorrectly passes a flag to a run handler as a fallback command #7244.
- When dedupe-direct-deps is set to true, commands of dependencies should be deduplicated #7359.

Minor Changes
- (IMPORTANT) When the package tarballs aren't hosted on the same domain on which the registry (the server with the package metadata) is, the dependency keys in the lockfile should only contain /<pkg_name>@<pkg_version, not <domain>/<pkg_name>@<pkg_version>.
Patch Changes
- pnpm add a-module-already-in-dev-deps will show a message to notice the user that the package was not moved to "dependencies" #926.
- The modules directory should not be removed if the registry configuration has changed.
- Fix missing auth tokens in registries with paths specified (e.g. //npm.pkg.github.com/pnpm). #5970 #2933

Patch Changes
- Don't fail on an empty pnpm-workspace.yaml file #7307.

Patch Changes
- Fixed out-of-memory exception that was happening on dependencies with many peer dependencies, when node-linker was set to hoisted #6227.

Patch Changes
- (Important) Increased the default amount of allowed concurrent network request on systems that have more than 16 CPUs #7285.
- pnpm patch should reuse existing patch when shared-workspace-file=false #7252.
- Don't retry fetching missing packages, since the retries will never work #7276.
- When using pnpm store prune --force alien directories are removed from the store #7272.
- Downgraded npm-packlist because the newer version significantly slows down the installation of local directory dependencies, making it unbearably slow.
- Fixed a performance regression on running installation on a project with an up to date lockfile #7297.
- Throw an error on invalid pnpm-workspace.yaml file #7273.

Patch Changes
- Fixed a regression that was shipped with pnpm v8.10.0.
Dependencies that were already built should not be rebuilt on repeat install.
This issue was introduced via the changes related to supportedArchitectures.
Related issue #7268.

Minor Changes
- Support for multiple architectures when installing dependencies #5965.
- The pnpm licenses list command now accepts the --filter option to check the licenses of the dependencies of a subset of workspace projects #5806.
Patch Changes
- Allow scoped name as bin name #7112.
- When running scripts recursively inside a workspace, the logs of the scripts are grouped together in some CI tools. (Only works with --workspace-concurrency 1)
- Print a warning when installing a dependency from a non-existent directory #7159
- Should fetch dependency from tarball url when patching dependency installed from git #7196
- pnpm setup should add a newline at the end of the updated shell config file #7227.
- Improved the performance of linking bins of hoisted dependencies to node_modules/.pnpm/node_modules/.bin #7212.
- Wrongful ELIFECYCLE error on program termination #7164.
- pnpm publish should not pack the same file twice sometimes #6997.

Patch Changes
- Don't use reflink on Windows #7186.
- Do not run node-gyp rebuild if preinstall lifecycle script is present #7206.

Minor Changes
- 🚀Performance improvement: Use reflinks instead of hard links by default on macOS and Windows Dev Drives #5001.
- The list of packages that are allowed to run installation scripts now may be provided in a separate configuration file.
The path to the file should be specified via the pnpm.onlyBuiltDependenciesFile field in package.json.
For instance:
- Add disallow-workspace-cycles option to error instead of warn about cyclic dependencies
- Allow env rm to remove multiple node versions at once, and introduce env add for installing node versions without setting as default #7155.
Patch Changes
- Fix memory error in pnpm why when the dependencies tree is too big, the command will now prune the tree to just 10 end leafs and now supports --depth argument #7122.
- Use neverBuiltDependencies and onlyBuiltDependencies from the root package.json of the workspace, when shared-workspace-lockfile is set to false #7141.
- Optimize peers resolution to avoid out-of-memory exceptions in some rare cases, when there are too many circular dependencies and peer dependencies #7149.
- Instead of pnpm.overrides replacing resolutions, the two are now merged.
This is intended to make it easier to migrate from Yarn by allowing one to keep using resolutions for Yarn, but adding additional changes just for pnpm using pnpm.overrides.

Minor Changes
- Add --hide-reporter-prefix' option for run\ command to hide project name as prefix for lifecycle log outputs of running scripts #7061.
Patch Changes
- Pass through the --ignore-scripts command to install, when running pnpm dedupe --ignore-scripts #7102.
- Throw meaningful error for config sub commands#7106.
- When the node-linker is set to hoisted, the package.json files of the existing dependencies inside node_modules will be checked to verify their actual versions.
The data in the node_modules/.modules.yaml and node_modules/.pnpm/lock.yaml may not be fully reliable, as an installation may fail after changes to dependencies were made but before those state files were updated #7107.
- Don't update git-hosted dependencies when adding an unrelated dependency #7008.

Patch Changes
- Don't run the prepublishOnly scripts of git-hosted dependencies #7026.
- Fix a bug in which use-node-version or node-version isn't passed down to checkEngine when using pnpm workspace, resulting in an error #6981.
- Don't print out each deprecated subdependency separately with its deprecation message.
Just print out a summary of all the deprecated subdependencies #6707.
- Fixed an ENOENT error that was sometimes happening during install with "hoisted" node_modules #6756.

Patch Changes
- Improve performance of installation by using a worker for creating the symlinks inside node_modules/.pnpm #7069.
- Tarballs that have hard links are now unpacked successfully.
This fixes a regression introduced in v8.7.0, which was shipped with our new in-house tarball parser #7062.

Patch Changes
- Fix a bug causing the pnpm server to hang if a tarball worker was requested while another worker was exiting #7041.
- Fixes a regression published with pnpm v8.7.3.
Don't hang while reading package.json from the content-addressable store #7051.
- Allow create scoped package with preferred version. #7053
- Reverting a change shipped in v8.7 that caused issues with the pnpm deploy command and "injected dependencies" #6943.

Patch Changes
- Fixed an issue with extracting some old versions of tarballs #6991.
- Side-effects cache will now be leveraged when running install in a workspace that uses dedicated lockfiles for each project #6890.
- Reduce concurrency in the pnpm -r publish command #6968.
- Improved the pnpm update --interactive output by grouping dependencies by type.
Additionally, a new column has been added with links to the documentation for outdated packages #6978.

Minor Changes
- Improve performance of installation by using a worker pool for extracting packages and writing them to the content-addressable store #6850
- The default value of the resolution-mode setting is changed to highest.
This setting was changed to lowest-direct in v8.0.0 and some users were not happy with the change.
A twitter poll concluded that most of the users want the old behaviour (resolution-mode set to highest by default). This is a semi-breaking change but should not affect users that commit their lockfile #6463.
Patch Changes
- Warn when linking a package with peerDependencies #615.
- Add support for npm lockfile v3 in pnpm import #6233.
- Override peerDependencies in pnpm.overrides #6759.
- Respect workspace alias syntax in pkg graph #6922
- Emit a clear error message when users attempt to specify an undownloadable node version #6916.
- pnpm patch should write patch files with a trailing newline #6905.
- Dedupe deps with the same alias in direct dependencies 6966
- Don't prefix install output for the dlx command.
- Performance optimizations.
Package tarballs are now download directly to memory and built to an ArrayBuffer.
Hashing and other operations are avoided until the stream has been fully received #6819.

Patch Changes
- Make the error message friendlier when a user attempts to run a command that does not exist #6887.
- pnpm patch should work correctly when shared-workspace-file is set to false #6885.
- pnpm env use should retry deleting the previous Node.js executable #6587.
- pnpm dlx should not print an error stack when the underlying script execution fails #6698.
- When showing the download progress of large tarball files, always display the same number of digits after the decimal point #6901.
- Report download progress less frequently to improve performance #6906.
- pnpm install --frozen-lockfile --lockfile-only should fail if the lockfile is not up to date with the package.json files #6913.

Patch Changes
- Change the install error message when a lockfile is wanted but absent to indicate the wanted lockfile is absent, not present.
This now reflects the actual error #6851.
- When dealing with a local dependency that is a path to a symlink, a new symlink should be created to the original symlink, not to the actual directory location.
- The length of the temporary file names in the content-addressable store reduced in order to prevent ENAMETOOLONG errors from happening #6842.
- Don't print "added" stats, when installing with --lockfile-only.
- Installation of a git-hosted dependency should not fail if the pnpm-lock.yaml file of the installed dependency is not up-to-date #6865.
- Don't ignore empty strings in params #6594.
- Always set dedupe-peer-dependents to false, when running installation during deploy #6858.
- When several containers use the same store simultaneously, there's a chance that multiple containers may create a temporary file at the same time.
In such scenarios, pnpm could fail to rename the temporary file in one of the containers.
This issue has been addressed: pnpm will no longer fail if the temporary file is absent but the destination file exists.
- Authorization token should be found in the configuration, when the requested URL is explicitly specified with a default port (443 on HTTPS or 80 on HTTP) #6863.

Patch Changes
- Installation succeeds if a non-optional dependency of an optional dependency has failing installation scripts #6822.
- The length of the temporary file names in the content-addressable store reduced in order to prevent ENAMETOOLONG errors from happening #6842.
- Ignore empty patch content when patch-commit.
- Sort keys in packageExtensions before calculating packageExtensionsChecksum #6824.
- Pass the right scheme to git ls-remote in order to prevent a fallback to git+ssh that would result in a 'host key verification failed' issue #6806
- The "postpublish" script of a git-hosted dependency is not executed, while building the dependency #6822.

Patch Changes
- Temporarily revert the fix to #6805 to fix the regression it caused #6827.

Patch Changes
- When the same file is appended multiple times into a tarball, the last occurrence is selected when unpacking the tarball.
- Added support for publishConfig.registry in package.json for publishing #6775.
- pnpm rebuild now uploads the built artifacts to the content-addressable store.
- If a command cannot be created in .bin, the exact error message is now displayed.
- Treat linked dependencies with a tag version type as up-to-date #6592.
- pnpm setup now prints more details when it cannot detect the active shell.

Patch Changes
- Ensure consistent output for scripts executed concurrently, both within a single project and across multiple projects.
Each script's output will now be printed in a separate section of the terminal, when running multiple scripts in a single project using regex #6692.
- The --parallel CLI flag should work on single project #6692.
- Optimizing project manifest normalization, reducing amoung of data copying #6763.
- Move loading wantedLockfile outside dependenciesHierarchyForPackage, preventing OOM crash when loading the same lock file too many times #6757.
- Replace ineffective use of ramda difference with better alternative #6760.

Patch Changes
- Installation of a git-hosted dependency without package.json should not fail, when the dependency is read from cache #6721.
- Local workspace bin files that should be compiled first are linked to dependent projects after compilation #1801.
- Prefer versions found in parent package dependencies only #6737.
- Multiple performance optimizations implemented by @zxbodya:
- avoid copying preferredVersions object #6735
- avoid object copy in resolvePeersOfNode #6736
- preferredVersions in resolveDependenciesOfImporters #6748
- remove ramda isEmpty usages #6753
- use Maps and Sets instead of objects #6749
- optimize splitNodeId, fix invalid nodeId #6755

Patch Changes
- Improve the performance of searching for auth tokens #6717.

Patch Changes
- In cases where both aliased and non-aliased dependencies exist to the same package, non-aliased dependencies will be used for resolving peer dependencies, addressing issue #6588.
- Ignore the port in the URL, while searching for authentication token in the .npmrc file #6354.
- Don't add the version of a local directory dependency to the lockfile.
This information is not used anywhere by pnpm and is only causing more Git conflicts #6695.

Patch Changes
- When running a script in multiple projects, the script outputs should preserve colours #2148.
- Don't crash when the APPDATA env variable is not set on Windows #6659.
- Don't fail when a package is archived in a tarball with malformed tar headers #5362.
- Peer dependencies of subdependencies should be installed, when node-linker is set to hoisted #6680.
- Throw a meaningful error when applying a patch to a dependency fails.
- pnpm update --global --latest should work #3779.
- pnpm license ls should work even when there is a patched git protocol dependency #6595

Patch Changes
- Change lockfile version back to 6.0 as previous versions of pnpm fail to parse the version correctly #6648
- When patching a dependency, only consider files specified in the 'files' field of its package.json.
Ignore all others #6565
- Should always treat local file dependency as new dependency #5381
- Output a warning message when "pnpm" or "resolutions" are configured in a non-root workspace project #6636

Patch Changes
- When dedupe-peer-dependents is enabled (default), use the path (not id) to determine compatibility.
- Some minor performance improvements by removing await from loops #6617.

Minor Changes
- Some settings influence the structure of the lockfile, so we cannot reuse the lockfile if those settings change.
As a result, we need to store such settings in the lockfile.
This way we will know with which settings the lockfile has been created.
- A new setting, exclude-links-from-lockfile, is now supported. When enabled, specifiers of local linked dependencies won't be duplicated in the lockfile.
Patch Changes
- Don't print "Lockfile is up-to-date" message before finishing all the lockfile checks #6544.
- When updating dependencies, preserve the range prefix in aliased dependencies.
So npm:foo@1.0.0 becomes npm:foo@1.1.0.
- Print a meaningful error when a project referenced by the workspace: protocol is not found in the workspace #4477.
- pnpm rebuild should not fail when node-linker is set to hoisted and there are skipped optional dependencies #6553.
- Peers resolution should not fail when a linked in dependency resolves a peer dependency.
- Build projects in a workspace in correct order #6568.

Patch Changes
- Expanded missing command error, including 'did you mean' #6492.
- When installation fails because the lockfile is not up-to-date with the package.json file(s), print out what are the differences #6536.
- Normalize current working directory on Windows #6524.

Minor Changes
- pnpm patch-remove command added #6521.
Patch Changes
- pnpm link -g <pkg-name> should not modify the package.json file #4341.
- The deploy command should not ask for confirmation to purge the node_modules directory #6510.
- Show cyclic workspace dependency details #5059.
- Node.js range specified through the engines field should match prerelease versions #6509.

Minor Changes
- pnpm publish supports the --provenance CLI option #6435.
Patch Changes
- Link the bin files of local workspace dependencies, when node-linker is set to hoisted 6486.
- Ask the user to confirm the removal of node_modules directory unless the --force option is passed.
- Do not create a node_modules folder with a .modules.yaml file if there are no dependencies inside node_modules.

Patch Changes
- Patch node-fetch to fix an error that happens on Node.js 20 #6424.

Minor Changes
- A custom compression level may be specified for the pnpm pack command using the pack-gzip-level setting #6393.
- Add --check flag to pnpm dedupe.
No changes will be made to node_modules or the lockfile.
Exits with a non-zero status code if changes are possible.
- pnpm install --resolution-only re-runs resolution to print out any peer dependency issues #6411.
Patch Changes
- Warn user when publishConfig.directory of an injected workspace dependency does not exist #6396.
- Use hard links to link the node executable on Windows machines #4315.

Minor Changes
- Allow env variables to be specified with default values in .npmrc.
This is a convention used by Yarn too.
Patch Changes
- Add -g to mismatch registries error info when original command has -g option #6224.
- Don't fail with EBUSY error when trying to copy a file from the store #6201
- pnpm config get <key> should print boolean values #6360
- Don't print an info message about linked dependencies if they are real linked dependencies specified via the link: protocol in package.json #6372

Patch Changes
- Repeat installation should work on a project that has a dependency with parentheses in the scope name #6348.
- Error summary should be reported as expected.
- Update @yarnpkg/shell to fix issues in the shell emulator #6320.
- Installation should not fail when there is a local dependency in a directory that starts with the @ character #6332.
- Registries are now passed to the preResolution hook.

Minor Changes
- A new setting has been added called dedupe-direct-deps, which is disabled by default. When set to true, dependencies that are already symlinked to the root node_modules directory of the workspace will not be symlinked to subproject node_modules directories.
This feature was enabled by default in v8.0.0 but caused issues, so it's best to disable it by default #6299.
- Add ignore-workspace-cycles to silence workspace cycle warning #6308.
Patch Changes
- Print the right lowest supported Node.js version in the error message, when pnpm is executed with an old Node.js version #6297.
- Improve the outdated lockfile error message #6304.

Configuration Updates
- auto-install-peers: enabled by default.
- dedupe-peer-dependents: enabled by default.
- resolve-peers-from-workspace-root: enabled by default.
- save-workspace-protocol: set to rolling by default.
- resolution-mode: set to lowest-direct by default.
- publishConfig.linkDirectory: enabled by default.
Lockfile Modifications
- Lockfile v6 is adopted.
This new format improves the readability of the lockfile by removing hashes from package IDs.
It also has some rearrangement of fields in the importers section.
The new pnpm-lock.yaml file is more resistant to git merge conflicts!
- The registry field is removed from the resolution object in pnpm-lock.yaml.
- A lockfile is generated even for projects with no dependencies.
Other Changes
- When there's a files field in the package.json, only the files that are listed in it will be deployed.
The same logic is applied when injecting packages.
This behaviour can be changed by setting the deploy-all-files setting to true (Related issue #5911).
- Direct dependencies are deduped.
If a dependency is present in both a project and the workspace root, it will only be linked to the workspace root.

Patch Changes
- pnpm audit should work even if there are no package.json file, just a pnpm-lock.yaml file.
- Dedupe direct dependencies after hoisting.
- Don't remove automatically installed peer dependencies from the root workspace project, when dedupe-peer-dependents is true #6154.

Patch Changes
- Should use most specific override rule when multiple rules match the same target #6210.
- Fix regression introduced in v7.30.1 #6271.

Minor Changes
- Allow to set a custom directory for storing patch files via the patches-dir setting #6215
Patch Changes
- New directories should be prepended to NODE_PATH in command shims, not appended.
- Retry copying file on EBUSY error #6201.

Patch Changes
- Command shim should not set higher priority to the node_modules/.pnpm/node_modules directory through the NODE_PATH env variable, then the command's own node_modules directory #5176.
- extend-node-path is set back to true by default. It was set to false in v7.29.2 in order to fix issues with multiple versions of Jest in one workspace.
It has caused other issues, so now we keep extending NODE_PATH.
We have fixed the Jest issue with a different solution #6213.

Patch Changes
- Settings related to authorization should be set/deleted by npm CLI #6181.

Minor Changes
- A new setting is now supported: dedupe-peer-dependents.
Patch Changes
- The configuration added by pnpm setup should check if the pnpm home directory is already in the PATH before adding to the PATH.
- Add skipped status in exec report summary when script is missing #6139.
- pnpm env -g should fail with a meaningful error message if pnpm cannot find the pnpm home directory, which is the directory into which Node.js is installed.
- Should not throw an error when local dependency use file protocol #6115.
- Fix the incorrect error block when subproject has been patched #6183

Minor Changes
- Add --report-summary for pnpm exec and pnpm run #6008.
- Show path info for pnpm why --json or --long #6103.
- Extends the pnpm.peerDependencyRules.allowedVersions package.json option to support the parent>child selector syntax.
This syntax allows for extending specific peerDependencies #6108.
Patch Changes
- Update the lockfile if a workspace has a new project with no dependencies.
- Fix a case of installs not being deterministic and causing lockfile changes between repeat installs.
When a dependency only declares peerDependenciesMeta and not peerDependencies, dependencies, or optionalDependencies, the dependency's peers were not considered deterministically before.
- patch-commit should auto apply patches in workspaces #6048
- Automatically fix conflicts in v6 lockfile.
- pnpm config set should write to the global config file by default #5877.

Patch Changes
- Add store path description to the pnpm cli help.
- Print a hint that suggests to run pnpm store prune, when a tarball integrity error happens.
- Don't retry installation if the integrity checksum of a package failed and no lockfile was present.
- Fail with a meaningful error message when cannot parse a proxy URL.
- The strict-ssl, ca, key, and cert settings should work with HTTPS proxy servers #4689.

Patch Changes
- Wrap text in pnpm audit output for better readability #5981
- Fix "cross-device link not permitted" error when node-linker is set to hoisted #5992.

Patch Changes
- Fixed out of memory error that sometimes happens when node-linker is set to hoisted #5988.
- Fixed EMFILE: too many open files by using graceful-fs for reading bin files of dependencies #5887.
- Fix lockfile v6 on projects that use patched dependencies #5967.

Minor Changes
- Add a `pnpm dedupe` command that removes dependencies from the lockfile by re-resolving the dependency graph. This work similar to yarn's `yarn dedupe --strategy highest` command #5958
Patch Changes
- Packages hoisted to the virtual store are not removed on repeat install, when the non-headless algorithm runs the installation #5971.
- `prepublishOnly` and `prepublish` should not be executed on `pnpm pack` #2941.

Patch Changes
- Show dependency paths info in `pnpm audit` output #3073
- The store integrity check should validate the side effects cache of the installed package. If the side effects cache is broken, the package needs to be rebuilt #4997.
- Add more info to the description of the `--force` option in the `pnpm install` command #5932.
- Don't crash when a bin file is not found and `prefer-symlinked-executables` is `true` #5946.
- `pnpm install --fix-lockfile` should not fail if the package has no dependencies #5878.

Minor Changes
- When patching a dependency that is already patched, the existing patch is applied to the dependency, so that the new edit are applied on top of the existing ones. To ignore the existing patches, run the patch command with the `--ignore-existing` option #5632.
- When `extend-node-path` is set to `false`, the `NODE_PATH` environment variable is not set in the command shims #5910
Patch Changes
- Ensure the permission of bin file when `prefer-symlinked-executables` is set to `true` #5913.
- If an external tool or a user have removed a package from node_modules, pnpm should add it back on install. This was only an issue with `node-linker=hoisted`.

Patch Changes
- Don't break lockfile v6 on repeat install if `use-lockfile-v6` is not set to `true`.