pnpm 12.7
pnpm 12.7 lets the global node shim follow .nvmrc and .node-version,
adds pnpm install --allow-build and pnpm publish --publish-wait-timeout,
and creates pnpm-workspace.yaml from the workspaces field of package.json.
pnpm install --force no longer installs optional dependencies built for other
platforms. This release also carries security fixes and a long list of bug
fixes.
pnpm 11.28
pnpm 11.28 adds the forceIgnoresPlatform setting and pnpm update --peer,
and brings a large batch of fixes from pnpm 12 to the JavaScript CLI: pnpm deploy, --filter, nodeLinker: hoisted, and custom modulesDir setups all
behave better. It also carries security fixes for shell completion, bin shims
on Nix, lifecycle scripts inside a custom modulesDir, and userAgent
placeholders in pnpm-workspace.yaml.
pnpm 12.6
pnpm 12.6 ships with automatic dependency deduplication, relocatable
node_modules, --save-types for installing @types/* packages alongside
their counterparts, package.yaml manifest editing, and file: / link:
protocols in catalogs.
pnpm 12.5
pnpm 12.5 expands Python support with editable project packages, shared workspace
environments, automatic interpreter downloads, and lockfiles for multiple
platforms and Python versions. It also accepts Package URLs in pnpm add, adds
machine-wide task concurrency groups, and cleans up obsolete registry metadata
with pnpm cache prune.
pnpm 12.4
pnpm 12.4 installs crates and Python packages next to npm packages in the same
workspace, adds pnpm pipeline to run a workspace's tasks the way a CI job
would, and ships binaries for six more platforms. pnpr 0.1.0-alpha.11, released
alongside 12.4.1, serves Cargo, Python, and container registries beside npm,
publishes across all of them in one transaction, and signs users in through
OIDC.
pnpm 11.26
pnpm 11.26 brings the JavaScript CLI level with what pnpm 12 gained over the
past two weeks: workspace: ranges in catalogs, the supply-chain flags on
remove and update, pnpm change check for CI, and pnpm deploy without
injected dependencies.
pnpm 12.2-12.3
pnpm 12.2 and 12.3 are largely a catch-up pair: a long list of things pnpm 11
did that the Rust CLI did not, put back. Catalogs learned the workspace:
protocol, pnpm remove and pnpm update gained the supply-chain flags, every
project-aware global command became a real executable, and hostname resolution
went back to the system resolver on Linux and Windows. Large workspaces install
noticeably faster.
pnpm 12.1
pnpm 12.1 brings the new workspace task scheduler to the Rust CLI, persists successful recursive tasks for precise retries, expands shared build artifacts to macOS and Windows, and moves login credentials into pnpm's structured global configuration. pnpr 0.1.0-alpha.9, released with it, makes the artifact tier independent and horizontally scalable through S3-compatible storage.
pnpm 11.25
pnpm 11.25 replaces topological batches with a task scheduler, adds configurable
workspace task dependencies and per-task concurrency, and makes interrupted
recursive runs resumable from the work that actually passed. It also introduces
registry revisions, signed build artifacts shared through pnpr, batch approval
for staged packages, automatic pruning of stale audit exceptions, and a
pnpm init pin that follows the latest released pnpm.
pnpm 12.0
pnpm 12 is stable. It is a rewrite of pnpm in Rust. Upgrading should not feel like a migration. The documentation now defaults to pnpm 12, with the pnpm 11 documentation available from the version selector.
The few things that behave differently are listed in What's different in pnpm 12. This post covers what is new.
pnpm 11.24
pnpm 11.24 brings back pnpm approve-builds --global, which isolated global installs took away in v11.0, and makes recursive batch publishing group its packages by registry so a credential mismatch is caught before anything is published. It also stops --frozen-lockfile from failing over the pnpm version the lockfile pins.
pnpm 11.23
pnpm 11.23 gives the registries setting a shape that describes each registry once — its tarball layout, the scopes routed to it, the prefix it answers to — so an Artifactory or GitLab registry can finally keep its tarball URLs out of pnpm-lock.yaml. It adds virtualStoreType, makes undeclared imports resolve under ESM with the global virtual store without a plugin, teaches pnpm config get to report the settings pnpm actually acts on, and warns about settings no pnpm version recognizes.
pnpm 11.21-11.22
pnpm 11.21 and 11.22 teach pnpm install to update the lockfile in place for most everyday changes instead of re-resolving the whole dependency graph, stop recording SSH URLs that break installs on CI, make global installs switch over atomically and global interactive updates select whole install groups, add pnpm cache path, and take away a project's ability to relocate pnpm's machine-level state through pnpm-workspace.yaml.
What's different in pnpm 12
pnpm 12 is a rewrite of pnpm in Rust, and it is stable. Upgrading should not feel like a migration. Apart from the differences below, it keeps the commands, flags, settings, and lockfile format of pnpm 11, and the documentation applies to both versions.
Eight things differ. Six of them change a result, and two reject command-line syntax that pnpm 11 accepted. This post collects them in one place.
pnpm 11.20
pnpm 11.20 fixes a package-substitution risk in projects that install from more than one registry: packages resolved from a named registry are now recorded in the lockfile under registry-qualified keys. It also adds a built-in npmjs: alias, stops empty proxy settings from failing installs, hardens pnpm rebuild against a malicious lockfile, and speeds up dependency resolution.
pnpm 11.15-11.19
pnpm 11.15 through 11.19 teach pnpm update and pnpm outdated to update GitHub Actions, let pnpm update write changesets for the bumps it makes, introduce cleaner update and audit settings sections, add publishConfig.name for publishing a package under a different name, harden pnpm self-update against project-supplied configuration, make web-based login work without a TTY, and accept = as a save-prefix. They also cut peak resolution memory by several times on large workspaces and speed up repeat installs after compatible dependency changes.
pnpm 11.11-11.14
pnpm 11.11 through 11.14 add native workspace release management (pnpm change, pnpm lane, and a bare pnpm version -r), a pnpm doctor command that diagnoses your installation end to end, the pnpm access and pnpm team commands for managing packages and organizations on the registry, convergence overrides, and scheme-carrying peerDependencies specifiers. They also fix a path-traversal vulnerability, cut peak memory during cold-cache resolution by roughly 30%, and resolve a peer dependency deadlock.
pnpm 11.10
pnpm 11.10 adds the _auth setting for CI-friendly registry authentication, new pnpm prefix and pnpm issues commands, and the ability for pnpm self-update to install pnpm v12 (the Rust port). It also improves pnpm up accuracy, speeds up resolution against registries that ignore abbreviated metadata, and hardens global package management, pnpm deploy, and pnpm pack-app.
pnpm 11.9
pnpm 11.9 computes missing tarball integrity for registries that cannot publish checksums, adds pnpm sbom --exclude-peers, improves audit performance on cyclic lockfiles, fixes peer-resolution nondeterminism, and tightens exclusion handling for minimumReleaseAge and trustPolicy.
pnpm 11.8
pnpm 11.8 adds install dry-run previews, Node.js package map generation, richer SBOM output, pnpm view defaulting to the current package, and correct pnpm run --no-bail exit codes. It also includes a config-dependency lockfile traversal fix and many install/update determinism fixes.
pnpm 11.7
pnpm 11.7 adds a frozenStore setting for installing against a read-only package store, a --batch flag for publishing a whole workspace in one request, scope-specific auth tokens, and full resolving installs delegated to pacquet. It also hardens lockfile alias handling, makes several install paths deterministic, and ships a number of publish and Windows fixes.
pnpm 11.6
pnpm 11.6 adds a file-free way to supply registry authentication through npm_config_//… and pnpm_config_//… environment variables, raises the default network concurrency, and skips full re-resolution when only pnpm-lock.yaml is missing. It also infers platform fields for optional dependencies so foreign-platform binaries are never downloaded.
pnpm 11.5
pnpm 11.5 adds a hoistingLimits setting for controlling how far dependencies hoist in nodeLinker: hoisted installs, replaces the interactive prompt library to fix scrolling in long choice lists, recognizes staged publishes in the trust scale, and ships several install and dist-tag fixes.
pnpm 11.4
pnpm 11.4 closes a cluster of supply-chain holes around lockfile integrity, credential scoping, git resolutions, patch files, and dependency aliases, makes tarball-integrity mismatches a hard install failure by default (with a narrowly-scoped --update-checksums opt-in), and changes pnpm runtime set to write to devEngines.runtime instead of engines.runtime by default.
pnpm 11.3
pnpm 11.3 adds support for npm's staged publishing (pnpm stage), the new trustLockfile setting for skipping the supply-chain verification pass on already-trusted lockfiles, and native implementations of pnpm pkg, pnpm repo, and pnpm set-script. It also adds a --skip-manifest-obfuscation flag for pack / publish and cuts the memory footprint of minimumReleaseAge / trustPolicy verification on large workspaces.
pnpm 11.2
pnpm 11.2 ships an experimental opt-in into pacquet (the Rust port of pnpm) as the install backend, expands config dependencies to install one level of optionalDependencies (so the esbuild/swc platform-binary pattern works for config deps too), wires up the long-documented pnpm login --scope flag, and surfaces runtime entries (Node.js, Deno, Bun) in pnpm outdated and pnpm update --interactive.
pnpm 11.1
pnpm 11.1 adds a few new commands — pnpm audit signatures, pnpm bugs, and pnpm owner — alongside support for installing from arbitrary named registries (including a built-in alias for the GitHub Packages npm registry), the ability to skip runtime installation in CI, and several fixes.
pnpm 11.0
pnpm 11 is here! This release tightens the security defaults introduced throughout the v10 cycle, drops the npm CLI fallback for publishing in favor of a native implementation, replaces the JSON-per-package store index with a single SQLite database, and isolates global installs so they no longer interfere with each other.
It also requires Node.js 22 or newer — pnpm itself is now pure ESM.
Upgrading from v10? See the Migrating from v10 to v11 guide. Most config changes are mechanical and can be applied by the pnpm-v10-to-v11 codemod.
pnpm 10.32
pnpm 10.32 adds an --all flag to pnpm approve-builds for approving all pending builds without interactive prompts.
pnpm 10.31
pnpm 10.31 preserves comments and formatting when updating pnpm-workspace.yaml, and includes numerous bug fixes.
pnpm 10.30
pnpm 10.30 redesigns pnpm why to show a reverse dependency tree, making it much easier to understand why a package is installed.
pnpm 10.29
pnpm 10.29 adds catalog: protocol support to pnpm dlx, allows configuring auditLevel in pnpm-workspace.yaml, supports a bare workspace: specifier, and includes several bug fixes.
pnpm 10.28
pnpm 10.28 introduces a new beforePacking hook to customize package.json at publish time, improves filtered install performance, and includes several bug fixes.
pnpm 10.27
pnpm 10.27 adds a new setting to ignore trust policy checks for older package versions, introduces a project registry for global virtual store pruning, and includes several bug fixes.
pnpm 10.26
pnpm 10.26 introduces stricter security defaults for git-hosted dependencies, adds allowBuilds for granular script permissions, and includes a new setting to block exotic transitive dependencies.
pnpm 10.25
pnpm 10.25 improves certificate handling, adds a bare pnpm init, and ships several quality-of-life fixes.
pnpm 10.24
pnpm now scales network concurrency automatically on high-core machines and ships several reliability fixes.
pnpm 10.23
Added --lockfile-only option to pnpm list and various improvements to pnpm self-update.
pnpm 10.22
Added support for excluding packages from trust policy and overriding the engines field on publish.
pnpm 10.21
Added support for Node.js runtime installation for dependencies and a setting for configuring trust policy.
pnpm 10.20
This release adds a --all flag for the pnpm help command to print all commands.
pnpm 10.19
This release adds version-scoped controls to two settings: [onlyBuiltDependencies] and [minimumReleaseAgeExclude].
pnpm 10.18
Minor Changes#
Added network performance monitoring to pnpm by implementing warnings for slow network requests, including both metadata fetches and tarball downloads.
Added configuration options for warning thresholds: fetchWarnTimeoutMs and fetchMinSpeedKiBps.
Warning messages are displayed when requests exceed time thresholds or fall below speed minimums
Related PR: #10025.
Patch Changes#
- Retry filesystem operations on EAGAIN errors #9959.
- Outdated command respects
minimumReleaseAgeconfiguration #10030. - Correctly apply the
cleanupUnusedCatalogsconfiguration when removing dependent packages. - Don't fail with a meaningless error when
scriptShellis set tofalse#8748. pnpm dlxshould not fail whenminimumReleaseAgeis set #10037.
pnpm 10.17
Minor Changes#
The minimumReleaseAgeExclude setting now supports patterns.
pnpm 10.16
Minor Changes#
New setting for delayed dependency updates#
There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies. In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour.
pnpm 10.15
Minor Changes#
New setting for catalogs#
Added the cleanupUnusedCatalogs configuration. When set to true, pnpm will remove unused catalog entries during installation #9793.
pnpm 10.14
Added support for JavaScript runtime installation#
Declare Node.js, Deno, or Bun in devEngines.runtime (inside package.json) and let pnpm download and pin it automatically.