Last 7 days
0
Features: 0
Changes: 0
Fixes: 0
Deprecations: 0
pnpm
Fast, disk-efficient package manager for JavaScript projects and monorepos.
Latest pnpm changelog updates, official release notes, breaking changes, security patches, pricing changes, and developer reactions in one product feed.
Follow this pnpm release-notes page to spot useful features, risky migrations, noisy announcements, and source links before they hit your backlog.
Where pnpm updates are checked
Changes.Watch links back to official changelog and release-note sources so summaries stay easy to verify.
Related changelog channels
Use channels to follow groups of tools around a stack, workflow, or topic.
pnpm updates by type
Rolling windows show how many product updates landed in the last 7, 30, 90, and 365 days, grouped by existing changelog semantics.
0
5
30
86
Latest pnpm changelog updates
Added a pnpm cache‑path command, new setting minimumReleaseAgeExcludePrune, and renamed cleanupUnusedCatalogs to catalogPrune; workspace.yaml can no longer configure various directories and now warns about ignored settings.
Added interactive group selection for `pnpm update --global` and introduced sudo warnings for global commands to prevent accidental root installations.
Introduce registry‑qualified keys for packages from named registries to prevent substitution attacks, requiring a lockfile diff and coordinated upgrade
pnpm login now works without a TTY for web‑based registry logins, printing the auth URL and polling for approval; classic username/password still requires interactivity.
Fixed optional dependency installation where the parent was installed without its required sub‑dependency, adding an install‑check warning for incompatibilities.
Add `update.githubActionsServer` setting to configure GitHub server URL for actions and enable skipping GitHub Action dependencies via `update.githubActions=false`.
Publishing now uses the exact version from the package manifest and a new `pnpm update` changeset flag automatically creates changeset files for dependency bumps.
pnpm install now re-evaluates optional dependencies when supportedArchitectures changes, ensuring correct packages for the current architecture.
Resolve optional peer dependencies declared via peerDependenciesMeta from existing versions in the dependency graph, preventing unintended lockfile rewrites.
PeerDependencies now accept registry, npm alias, and file/git specs, with proper semver matching; bare name@version still rejected.
Fixed pnpm pack to respect workspace root ignore rules when a package has its own .npmignore
Added epics to workspace versioning, tying member package versions to a lead package's major band.
Added portable delegation for custom fetchers via a {delegate: …} envelope
Prevent crafted lockfile or scoped package names from causing path‑traversal writes outside the virtual store (security fix).
Added a new `pnpm access` command to manage package access, visibility, collaborators, MFA requirements, and team permissions.
Added new CLI commands (issues alias, prefix) and introduced a structured auth config with strict validation and OTP error URLs exposure
pnpm now computes and stores integrity hashes for tarballs that lack checksums, rejecting missing‑integrity entries during lockfile verification.
Validate config dependency names and versions to be proper npm package names and exact semver, preventing path traversal via workspace.yaml.
Introduced a dry‑run flag for `pnpm install`, per‑package SBOM output, package‑map generation, and view command can infer the project name when omitted.
Added frozenStore mode to run installs against a read‑only package store, with clear errors for missing builds and node version requirements; incompatible with force and pnpr server.
Stop expanding ${VAR} placeholders from repository‑controlled .npmrc files to prevent secret leakage (security fix).
Fixed a security issue (GHSA) by disabling ${ENV_VAR} expansion in project/workspace .npmrc files to stop leaking secrets to malicious registries.
Stops environment variable expansion in project/workspace .npmrc and pnpm workspace.yaml, preventing secret leakage; only trusted user/global/CLI/env configs can expand vars.
Security: stop expanding ${ENV_VAR} placeholders in repository‑controlled .npmrc and workspace.yaml, requiring tokens be moved to user/global config, and add signature verification for pnpm binaries, pacquet, self‑updates, and Node.js ru...
Added lockfile verification to ensure explicit tarball URLs match registry metadata, blocking tampered lockfiles (security fix).
Improve pnpm audit performance by pruning non‑vulnerable lockfile subtrees and stopping enumeration once the path cap is reached.
Added a new hoistingLimits setting for nodeLinker (none, workspaces, dependencies) to control hoisting behavior.
pnpm now rejects lockfile entries whose remote tarball block is missing the integrity field, closing a security bypass.
pnpm install now fails on tarball integrity mismatches by default, requiring an explicit opt‑in flag to update checksums
Tarball integrity mismatches now cause a hard failure by default; a new opt‑in flag (pnpm install --update-checksums) mirrors Yarn's behavior for refreshing locked checksums.
Introduced `pnpm stage` subcommands for staged publishing and a new `trustLockfile` setting to skip supply‑chain verification, with reduced verification memory usage
Added experimental Rust install engine @pnpm/pacquet via configDependencies, delegating materialization while keeping resolution in pnpm.
Added experimental support for the Rust‑based install engine @pnpm/pacquet, configurable in workspace.yaml.
Add experimental @pnpm/pacquet Rust install engine preview and enable configDependencies to resolve optionalDependencies with platform filtering
pnpm install now validates lockfile entries against minimumReleaseAge and trustPolicy 'no downgrade' before downloading, aborting with new errors and supporting cached fast‑path, interactive prompts, and CI strict mode handling of immatu...
Strip sec-fetch headers from outgoing HTTP requests to prevent Azure DevOps 400 errors.
Skip installability validation in workspace status checks, using a no‑check method to avoid redundant engine/os warnings.
Added ECDSA audit signature verification and GitHub Packages support via a built‑in gh: prefix with named registry aliases.
Fixed GitLab hosted dependencies URL handling to avoid 406 errors and invalid module specifiers.
Restored lockfile heuristic to preserve tarball URLs, fixing frozen lockfile installs from registries with non‑standard tarball paths (e.g., GitHub Packages, JSR).
Fixed Windows issues: restored execute bits on node‑gyp shims, corrected pnpm/pnpx/pnx aliases in Git Bash/MSYS2, and prevented reinstall after `pnpm fetch`.
Lockfiles now store a `gitHosted: true` flag and tarball integrity for Git‑hosted dependencies, preventing tampered or substituted tarballs on install.
Fixed loading of custom .npmrc via env vars and added support for uppercase PNPM_CONFIG variables.
On Intel macOS, self‑update now automatically swaps the broken @pnpm/exe binary for the pure‑JS pnpm package, issuing a warning and requiring Node on PATH.
Drop the macOS x64 binary; Intel Mac users now see a clear preinstall error and must install via npm or stay on pnpm 10 (breaking for that platform).
Fix pnpm ci to reinstall workspace package modules after a clean step by removing the workspace state file.
Fix "too many open files" error on Windows when creating command shims in node_modules/.bin.
Fixed ENOENT symlink error on Windows for global adds using approve builds by correctly handling absolute modulesDir paths.
Added git download URLs to SBOM output and fixed handling of unknown top‑level options.
pnpm 11 requires Node 22+, runs as pure ESM and the standalone binary now needs glibc ≥ 2.27, dropping support for Node 18‑21 (breaking).
Fixed ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND for globally installed bins when using the standalone @pnpm/exe binary without a separate Node.js installation
Commands previously proxied to npm (e.g., version, login, publish, etc.) are now executed by the targeted pnpm version when the project's packageManager specifies pnpm v11 or newer.
Added `dedupePeers` setting to deduplicate peer dependencies using version‑only identifiers, dramatically reducing package instances.
Fixed regression where a workspace.yaml without a `packages` field caused all directories to be treated as workspace projects
Added `--all` flag to `pnpm approve` for approving all pending builds without prompts.
Preserve comments, string formatting, and whitespace when updating pnpm workspace.yaml.
Fixed version switching via the packageManager field when pnpm runs as a standalone executable without a system Node.js.
Corrected auto‑installed peer dependency overrides being ignored when a stale version exists in the lockfile.
Switches primary audit endpoint to `/npm/v1/security/audits/quick` with fallback to `/npm/v1/security/audits`.
pnpm why now displays a reverse dependency tree with the queried package at the root and its dependents as branches
Fixed out‑of‑memory error in `pnpm list`/`why` for large dependency graphs using a two‑phase tree builder with deduplication
Reverted the fix introduced in v10.29.1 because it caused issue #10571.
Added catalog: and bare workspace: protocol support to pnpm dlx/pnpx and enabled auditLevel configuration in workspace.yaml.
Prevent path traversal by validating and skipping symlinks outside the package root for file: and git: dependencies.
Support plain http/https .git URLs and prioritize the git resolver before the tarball resolver.
Introduce a new `beforePacking` hook to customize package.json at publish time.
Added trustPolicyIgnoreAfter, project registry, and mark‑and‑sweep garbage collection for the global virtual store, plus a semi‑breaking change to unscoped package storage layout.
Improved error messages for minimumReleaseAge violations, displaying version existence and human‑readable release age
pnpm add no longer fails when blockExoticSubdeps=true
Block git‑hosted dependencies from running prepare scripts and add blockExoticSubdeps to restrict exotic protocols in transitive deps, enhancing supply‑chain security.
Added support for `cert`, `ca`, and `key` fields in .npmrc to load TLS certificates for specific registry URLs.
Auto‑adjust network concurrency (16‑64) based on CPU cores, improving performance on high‑core systems.
Added a lockfile‑only flag to `pnpm list` and improved handling of aliased packages and Node.js mirror URLs.
Added `trustPolicyExclude` option to whitelist packages/versions that bypass the trust policy, with support for overriding `publishConfig.engines` on publish.
Added automatic Node.js runtime installation for dependencies based on their "engines" field, ensuring CLI apps and postinstall scripts use the required Node version.
Added `--all` option to `pnpm help` to list every command.
Allow specifying exact dependency versions for postinstall scripts and trusted version lists via onlyBuiltDependencies.
Fixed infinite recursion when verifyDepsBeforeInstall scripts call other pnpm scripts and corrected handling of scoped registry keys and project‑level config keys with slashes, plus removed pnpm‑specific CLI options before npm publish.
Fixed bugs: outdated command long flag, version switching with symlinked home directory, and EPIPE errors when piping output.
Suppress spurious warning when only a lockfile is used
Added network performance monitoring with configurable warning thresholds (fetchWarnTimeoutMs, fetchMinSpeedKiBps) for slow fetches and tarball downloads.
Improved error messages when version specifiers fail the minimumReleaseAge check
minimumReleaseAgeExclude now supports glob patterns
Store full metadata cache separately from abbreviated metadata, fixing missing "time" field when loading cached metadata
Introduce minimumReleaseAge setting to delay installing newly published packages, with optional exclusions for specific deps (security mitigation).
Fixed a crash in .pnp.cjs when importing subpaths.
Introduced `cleanupUnusedCatalogs` config and expanded `pnpm config` capabilities (INI/JSON output, property path support, dot‑leading keys, and auto‑loading pnpmfiles from plugin dependencies).
Added devEngines.runtime to declare and automatically install a JavaScript runtime (Node.js, Deno, or Bun) per project, with version resolution stored in the lockfile.
User-defined pnpmfiles are now run after the pnpmfiles provided by plugins.
Added support for multiple pnpmfiles by allowing pnpmfile to accept a list and auto‑loading from @pnpm/plugin config dependencies, with alphabetical init order and optional explicit ordering.
Fix pnpm licenses command for local dependencies
Restores hoisting of optional peer dependencies when using an outdated lockfile.
Fix hoisting when `enableGlobalVirtualStore` is true
Added experimental global virtual store support, enabling projects to symlink shared dependencies from a central store for faster installs.
Fixed regressions affecting pnpm deploy (unexpected directories, overrides handling) and lockfile generation with the --lockfile-only flag
Added init option to generate a package.json with type=module and corresponding CLI flag.
Added support for loading preResolution, importPackage, and fetchers hooks from a local pnpmfile (minor enhancement).
Add JSR package support via `pnpm add jsr:<pkg>` syntax
Removed bright white highlighting that conflicted with light themes
Add experimental hook via .pnpmfile.cjs for updating configuration settings and a new --config flag for pnpm add
pnpm config set now casts values to their proper types before writing to workspace.yaml
Config get/list now include settings from pnpm workspace.yaml and config set can store values there when no .npmrc is present.
Removed warnings after explicitly approving a package with no builds.
Fixed pnpm dlx when using the `--allow-build` flag.
Fix pnpm install with prod=false crashing in projects containing a workspace.yaml, addressing regression #9233.
Fix running pnpm CLI from pnpm CLI on Windows when the CLI is bundled as an executable.
Ensure pnpm self‑update always updates the packageManager field in package.json
`pnpm self-update` now always syncs the version in the `packageManager` field of package.json.
Fixed CLI hanging when silent reporting is used and suppressed extra output at error log level.
workspace.yaml now supports all .npmrc settings using camelCase and file: tarball dependencies get faster install caching
Prevent broken installations on failed self‑update and ignore package.json settings during self‑update
Fixed regression where `pnpm config set` altered the local .npmrc instead of the global one.
Added validation error when a pnpm workspaces.yaml/yml is present instead of pnpm workspace.yaml.
Workspace settings can now be defined in pnpm workspace.yaml and the packages field is optional; added automatic sync of injected workspace packages via .npmrc.
Fixed corepack update instructions and now prints pnpm version after execution time
Add error when allow‑build option overlaps with ignoredBuildDependencies list
Introduced a new `strictDepBuilds` setting that aborts installation if dependencies contain unreviewed postinstall scripts
Prevent reading packages from the side‑effects cache when they aren't permitted to be built
Breaking changes introduced in v10 (see v10 release notes).
Added validation for package name during `pnpm publish`.
Added new commands `pnpm ignored builds` and `pnpm approve builds`, an `optimisticRepeatInstall` setting, and a `pnpm.ignoredBuiltDependencies` config field.
Fixed recursive `pnpm update latest <pkg>` to update only the specified package when `dedupePeerDependents=true`.
Lifecycle scripts of dependencies are disabled by default; whitelist via `pnpm.onlyBuiltDependencies` (breaking security change).
Fixed the regex used to locate the package manifest during packing
Fixed publish/pack errors with workspace dependencies that use relative paths (regressed in v9.4.0).
Fix pnpm remove not linking workspace dependencies when 'link workspace packages' is disabled.
Bump metadata directory version to force a fresh cache after fixing metadata write issues (backward compatible).
Prevent saving mutated metadata to the metadata cache, fixing a cache corruption issue
Adjusted certain commands to bypass the packageManager field validation in package.json.
Fix pnpm publish when using a publish JSON configuration (issue #8788)
Add JSON output for `pnpm pack` including tarball metadata and contents.
Prevent crashes when detecting circular peer dependencies that involve aliased packages.
Fix deadlock issue when resolving circular peer dependencies.
Self-update now supports specifying a version to install a specific pnpm release
Fixed bugs: node_modules purge prompt handling, infinite spawn when .tools is corrupt, race condition in temporary file creation, and silent errors when self-managing pnpm versions.
Fixed executable permission detection: now any executable bit (owner, group, or others) being set marks the file as executable.
Prevent EBUSY errors when creating symlinks in parallel dlx processes.
Fixed peer dependency deadlock and several bugs (private flag display, ENOENT on parallel prune, libc mismatch downloads).
Added experimental pnpm cache commands for inspecting metadata cache.
Add new CLI flag `--exclude-peers` to omit peer dependencies from results while still scanning their transitive dependencies.
Optimized peer dependency resolution to prevent infinite loops and OOM, introducing a minor breaking change in how peers are resolved across the dependency graph.
Added a new `pnpm self update` command to upgrade pnpm when not managed by Corepack, updating the `packageManager` field in a project.
Fixed handling of public hoist patterns and environment‑variable hoist patterns; corrected dlx cache path resolution and patched relative‑path rejection in patch commits.
Added version management: pnpm now respects the packageManager field and can switch to the specified pnpm version when enabled.
Add support for specifying Node version per package via pnpm.executionEnv.nodeVersion for lifecycle scripts.
Deduplicate binary names to avoid race conditions during installation.
Added support for catalogs declared in workspace.yaml and automatic creation of the pnpx script.
Add a `strict-store-pkg-content-check` flag to relax package validity checks when identical content appears under different names/versions (feature).
Lockfile dependency keys longer than 1000 characters are now truncated to prevent out‑of‑memory and RangeError failures.
Enforced strict package manager version checking when `strict version` is enabled, causing pnpm to error on mismatched versions in package.json.
Optimized detection of missing peer dependencies during the resolution stage
Fix bug where an optional dependency was omitted when optional=false for conflicting package requirements
Reduced memory usage during peer dependencies resolution
Improve peers resolution performance by utilizing additional cache.
Added `virtualStoreDirMaxLength` setting to limit directory path length (default 120), helpful on Windows.
Upgrade tar dependency to v6.2.1.
Fix conversion of lockfiles with Git-hosted dependencies to the new lockfile format (issue #7990).
Convert lockfiles containing local or git dependencies to the new format
Fix aliased dependencies resolution on repeat install with existing lockfile
pnpm now errors with ERR PNPM INVALID SCRIPT SHELL WINDOWS when scriptShell is a .bat/.cmd on Windows, recommending .exe due to Node.js April 2024 changes (breaking).
Fix optional dependencies not being linked into dependent node_modules (issue #7943).
pnpm install with --frozen-lockfile now works with lockfiles generated by pnpm v8 when no updates are needed.
Drop support for Node.js 16/17; pnpm now bundles its own Node runtime and adds strict Corepack packageManager checks
pnpm config get now outputs array values as a comma‑separated list instead of blank.
Preserve child process exit code on `pnpm run` (fixes #7817).
Fix detection of the active Node.js version during headless installations (issue #7801).
Print the correct error code when a package fails to be added to the store.
Removed the vulnerable `ip` package from project dependencies.
Removed the vulnerable "ip" package from the project dependencies.
Fixed concurrent prompts when purging multiple node_modules directories
Use object-hash library instead of node-object-hash for side‑effects cache keys (improved hashing).
Fixed pnpm pack to correctly include manifest changes made by a prepack script.
Prevent registry configuration from previous installations overriding current settings
Resolve the current working directory to its real path before any operation to avoid path mismatches.
Added a new `hoist workspace packages` option and extended `pnpm dedupe` to accept all install‑command flags.
Added experimental store‑inspection commands (`pnpm cat index`, `pnpm cat file`, `pnpm find hash`) to view index files, file contents by hash, and locate packages by hash.
Fixed repeated‑install reporting so optional dependencies aren’t listed as newly added
Added basic authorization header support.
Updated lockfile format to omit domain in dependency keys when tarballs are hosted on a different domain, preventing duplicate installations.
Fixed crash when workspace.yaml is empty (issue #7307)
Fixed out‑of‑memory crash that occurred with many peer dependencies when using the hoisted node linker.
Increase default concurrent network request limit on machines with >16 CPUs
Fixed regression from v8.10.0 where repeat installs rebuilt already‑built dependencies
Remove the unused `registry` field from tarball resolutions in lock.yaml (backward‑compatible lockfile change).
Add support for specifying multiple architectures (including libc) via the supportedArchitectures field to install optional dependencies for different platforms.
Disabled reflink usage on Windows to prevent related issues.
Fixed selection result output for `pnpm update --interactive`.
Use reflinks by default on macOS/Windows and add pnpm.onlyBuiltDependenciesFile to restrict which packages can run install scripts.
Add a reporter option to hide the project name prefix in run command logs
Skip prepublishOnly scripts for git‑hosted dependencies.
Use a worker to create symlinks inside node_modules/.pnpm, speeding up installations.
Fix a bug where the pnpm server could hang when a tarball worker was requested while another worker was exiting (7041).
Fix error message when pnpm store server reports undefined property errors, showing the underlying cause instead of a generic message
Fix extraction of older tarball versions
Use a worker pool for extracting packages and stream tarballs directly to memory, improving install performance.
Improved error handling: friendlier messages for unknown commands, suppressed stack traces in pnpm dlx failures, and retry logic for env use cleanup.
Fix token lookup: Authorization token is now correctly read from configuration when URLs include explicit default ports (443 for HTTPS, 80 for HTTP).
Fixed install error messages for missing lockfile and suppressed "added" stats during lockfile‑only installs.
Fix installation flow when optional dependencies have failing non‑optional sub‑dependencies.
Temporarily revert the fix for issue #6805 to address a regression introduced by issue #6827.
Temporarily revert the fix for issue #6805
Implemented deterministic unpacking for tarballs with duplicate files – the last occurrence is used when extracting.
Add publishConfig.registry support for publishing and make pnpm rebuild upload built artifacts to the content‑addressable store.
Scripts executed concurrently now output in separate terminal sections, and the --parallel flag works within a single project.
Fix installation of git-hosted dependencies without a package.json when fetched from cache.
Improve performance of auth token search
Improved performance of auth token search (issue #6717)
Resolve peer dependencies by preferring non‑aliased packages when both aliased and non‑aliased exist
Prefer non-aliased dependencies over aliased ones when resolving peer dependencies.
Fixed several crash and error handling issues, including missing APPDATA on Windows, malformed tar headers, and improved error messages for patch failures and global updates.
Update dedupe peer dependents logic to use package path instead of ID for compatibility checks.
Revert lockfile version to 6.0 to fix parsing issues in older pnpm versions
Improved peer dependency deduplication: now uses the package path for compatibility checks and sorts groups by peer count to maximize deduplication benefits
Lockfile now stores the values of autoInstallPeers and excludeLinksFromLockfile in a new "settings" field, bumps lockfile format to v6.1, and throws an error if frozen installations use mismatched settings.
Lockfile format upgraded to v6.1 and now records `autoInstallPeers` and `excludeLinksFromLockfile` settings; frozen install fails if settings differ.
Fixed pnpm rebuild failure when node linker is hoisted and optional dependencies are skipped
Improved missing command error messages with “did you mean” suggestions
Fix pnpm link -g to avoid modifying package.json
Added `pnpm patch remove` command as a new feature.
Fixed linking of bin files for local workspace dependencies when the node linker is set to hoisted.
Added support for the `--provenance` CLI option in `pnpm publish`.
Patch node-fetch to fix an error that occurs on Node.js 20 (issue #6424).
Added warning when publishConfig.directory of an injected workspace dependency does not exist.
Patch node-fetch to fix error on Node.js 20.
Added custom gzip compression level for `pnpm pack` and a `--check` flag for `pnpm dedupe` that validates without modifying files