构建设置

ignoreScripts#

• 默认值： false
• 类型：Boolean

不执行项目 package.json 及其依赖中定义的任何脚本。

childConcurrency#

• 默认值：5
• 类型：Number

同时分配的最大子进程数以构建 node_modules。

sideEffectsCache#

• 默认值：true
• Type: Boolean or Object

使用且缓存 (pre/post)install 钩子的结果。

当安装前/安装后脚本修改包的内容（例如构建输出）时，pnpm 会将修改后的包保存在全局存储中。 On future installs on the same machine, pnpm reuses this cached, prebuilt version, which makes installs faster.

An object says the same thing in more detail, and is the canonical way to declare the remote tier:

sideEffectsCache:
  read: true
  write: true
  remote:
    org: acme
    packages:
      - native-addon

• read: restore a build from the cache when one is present. Default true.
• write: save a package's build output to the cache. Default true.
• remote: reuse builds across machines; see below.

sideEffectsCache: true is the shorthand for reading and writing, and is what the setting meant before it grew a remote tier. Writing without reading (read: false, write: true) populates a cache the run never consumes, which is what a job that warms one for others wants.

Since v11.26.0, the --side-effects-cache and --no-side-effects-cache flags, and PNPM_CONFIG_SIDE_EFFECTS_CACHE, toggle the local cache only. A remote tier declared under sideEffectsCache.remote is left in place, so a run can turn the local cache off without losing the shared one.

sideEffectsCacheReadonly#

• 默认值： false
• 类型：Boolean

仅在存在 side effects cache 时使用，不要为新包创建它。 The older spelling of sideEffectsCache: { read: true, write: false }.

sideEffectsCache.remote#

Added in: v11.25.0

• 默认值：undefined
• Type: Object

Opt in to reusing a dependency's build output across machines, by restoring signed, organization-scoped artifacts through a pnpr server instead of running the package's lifecycle scripts locally. This is a proof of concept: it is off unless configured, it needs a pnpr server started with artifacts.enabled: true, and it restores artifacts on Linux/glibc, macOS, and Windows, on x64 and arm64. Other operating systems and libc families build locally.

A repository declares eligibility and nothing else:

pnprServer: http://127.0.0.1:7677
allowBuilds:
  native-addon: true
sideEffectsCache:
  remote:
    org: acme
    packages:
      - native-addon

Declaring only remote leaves read and write at their defaults, so the local cache keeps working as it did.

packages is an eligibility list, not a permission: a package is only a candidate when it also passes allowBuilds, has requiresBuild: true, and has a verified source integrity. Listing a package here does not review its build scripts for you. Under the default strictDepBuilds an install still fails with ERR_PNPM_IGNORED_BUILDS when it reaches a build nobody has ruled on, and a package denied with allowBuilds: false is never built, from the cache or otherwise.

Everything describing the act of signing (publish, keyId, builderId, imageDigest, architectureBaseline, buildEnv, trustedKeys and privateKey) is refused in pnpm-workspace.yaml with ERR_PNPM_WORKSPACE_REMOTE_SIDE_EFFECTS_TRUST, and is read from the global configuration file or the environment instead. A cloned repository is not a trust root, and must not be able to turn the machine's signing key into a signing oracle.

Any cache failure (an unreachable server, an unverifiable signature, an incompatible platform, a bad blob) falls back to the ordinary local build. See Shared side-effects cache for the full setup, including the server flag, the trust material, and how an artifact is published.

Since v11.25.0, a restored artifact is saved in the shared store together with its signed origin. Before a later install reuses it, pnpm checks the signature again against the machine's current keys and revalidates its owner, package and source identity, platform, policy, and stored files. A bad remote variant is quarantined for that pnpr server and is not selected again.

unsafePerm#

• 默认值：如果以 root 身份运行，则为 false，否则为 true
• 类型：Boolean

When set to false, lifecycle scripts run with TMPDIR set to the package's node_modules/.tmp directory.

nodeOptions#

• 默认值： NULL
• 类型：字符串

通过 NODE_OPTIONS 环境变量传递给 Node.js 的选项。这不会影响 pnpm 本身的执行方式，但会影响生命周期脚本的调用方式。

为了保留现有的 NODE_OPTIONS，你可以在配置中使用 ${NODE_OPTIONS} 引用现有的环境变量：环境

nodeOptions: "${NODE_OPTIONS:- } --experimental-vm-modules"

verifyDepsBeforeRun#

• 默认: install
• 类型：install、warn、error、prompt、false

此设置允许在运行脚本之前检查依赖项的状态。检查运行于 pnpm run 和 pnpm exec 命令。支持以下属性值:

• install — 如果 node_modules 不是最新的，则自动运行安装。 If that install fails, for example because the store is read-only or there is no network, pnpm prints a warning and runs the command anyway.
• warn - 如果 node_modules 不是最新的，则打印警告。
• prompt - 如果 node_modules 不是最新的，则提示用户提供权限。
• error - 如果 node_modules 不是最新的，则会引发错误。
• false——禁用依赖性检查。

strictDepBuilds#

添加于：v10.3.0

• 默认值：true
• 类型：Boolean

当启用 strictDepBuilds 时，如果任何依赖项具有未审核的构建脚本（又名安装后脚本），则安装将以非零退出代码退出。

allowBuilds#

添加于：v10.26.0

包匹配器映射，用于显式允许（true）或禁止（false）脚本执行。

allowBuilds:
  esbuild: true
  core-js: false
  # 未在下方列出的 nx 版本构建脚本将
  # 在默认情况下失败，并返回 ERR_PNPM_IGNORED_BUILDS 错误
  nx@21.6.4 || 21.6.5: true
  nx@21.6.0: false

Git-hosted packages: a package name on its own never approves builds for a git or tarball dependency, because the name alone does not identify the artifact. 可以通过其精确的解析路径（包含提交）来批准，或者自 v11.11.0 起，通过其仓库 URL 来批准：

allowBuilds:
  # 批准该仓库的任何提交
  'foo@git+ssh://git@example.com/org/foo.git': true
  # 仅批准这个确切的提交
  'bar@git+https://github.com/org/bar.git#abc123': true

仓库形式让受信任的 git 依赖在分支更新后仍能继续运行其构建脚本，而无需为每个新提交重新批准。键由包名、@ 和 git URL 组成，不带 #<ref> 后缀。匹配是精确的，因此同一仓库的 git+ssh:// 和 git+https:// URL 是不同的键。

Since v11.19.0, the repository form also approves git-hosted packages that pnpm downloads as a tarball rather than clones, such as github: dependencies, which are fetched from codeload.github.com. 无论是克隆仓库还是下载 tarball，foo@git+https://github.com/org/foo.git 条目都会批准 foo。 GitLab 和 Bitbucket 的 tarball 下载也按相同方式匹配。通过完整 tarball 依赖路径批准或拒绝某个具体的已解析提交仍然有效。

按包名的拒绝不受此限制：无论 foo 来自注册源还是 git，foo: false 都会阻止它。

默认行为： 未在 allowBuilds 中列出的软件包默认情况下是不允许的，并且将被视为未经审核的软件包。默认情况下会打印错误（strictDepBuilds 默认为 true）。如果将 strictDepBuilds 设置为 false，则会打印一条警告信息。

安装过程中，尚未在 allowBuilds 中列出的、具有被忽略的构建的依赖项会自动添加到 pnpm-workspace.yaml 中，并带有占位符值，因此您可以手动将其设置为 true 或 false。 pnpm add 和 pnpm approve-builds 的 --allow-build 标志也会将其条目写入此处。

onlyBuiltDependencies:
  - electron
neverBuiltDependencies:
  - core-js
ignoredBuiltDependencies:
  - esbuild

allowBuilds:
  electron: true
  core-js: false
  esbuild: false

dangerouslyAllowAllBuilds#

添加于：v10.9.0

• 默认值： false
• 类型：Boolean

如果设置为 true，所有从依赖关系生成的脚本（例如preinstall, install）将自动运行，无需批准。