| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: pnpm-bash-completion | Distribution: openSUSE Tumbleweed |
| Version: 11.9.0 | Vendor: openSUSE |
| Release: 1.1 | Build date: Sun Jun 28 16:58:33 2026 |
| Group: System/Shells | Build host: reproducible |
| Size: 963 | Source RPM: pnpm-11.9.0-1.1.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://pnpm.io/ | |
| Summary: Bash completion for pnpm | |
Bash command line completion support for pnpm.
MIT
* Sun Jun 28 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 11.9.0:
* Minor Changes
- bae694f: Some registries generate tarballs on-demand and
cannot provide an integrity checksum in their package
metadata. In that case pnpm now computes the integrity from
the downloaded tarball and stores it in the lockfile, so the
entry is verifiable on subsequent installs instead of being
written without an integrity (which would fail the next
install). This also applies to --lockfile-only: the tarball
is downloaded so its integrity can be computed. A lockfile
entry that is still missing its integrity is rejected as a
ERR_PNPM_MISSING_TARBALL_INTEGRITY lockfile verification
violation (the install fails closed) rather than being
silently re-fetched.
- 6c35a43: Added --exclude-peers to pnpm sbom. With
auto-install-peers (the default), peer dependencies resolve
into the lockfile and are otherwise indistinguishable from
the package's own dependencies. The flag drops peer
dependencies (and any transitive subtree reachable only
through them) from the SBOM. CycloneDX 1.7 has no scope or
relationship that expresses "consumer-provided peer", so
omission is the only spec-clean handling. The flag name
matches pnpm list --exclude-peers; note the SBOM flag prunes
a peer's exclusive subtree, which is stricter than pnpm list
(which only hides leaf peers).
* Patch Changes
- 25a829e: pnpm audit --fix now writes a single combined
minimumReleaseAgeExclude entry per package (e.g. axios@0.18.1
|| 0.21.1) instead of one entry per version, matching the
format documented for the setting. Existing per-version
entries in pnpm-workspace.yaml are merged into the combined
form rather than left as duplicates. Installs that
auto-collect immature versions into minimumReleaseAgeExclude
now report the same combined entries, so the "Added N
entries" message matches what is written to the manifest
[#12534].
- 1cbb5f2: Fixed non-deterministic peer resolution that could
add or remove an optional transitive peer — for example
@babel/core, reached through styled-jsx — from a package's
peer-dependency suffix across otherwise identical installs,
churning the lockfile and causing intermittent pnpm dedupe
- -check failures in CI. When a package's children are
resolved by one occurrence (the "owner") and reused by a
deeper consumer, whether that consumer inherited the owner's
missing peers depended on whether the owner's resolution had
finished yet — a race under concurrent resolution. The
decision is now a function of the dependency graph's
structure rather than resolution-completion order.
- d577eea: Fixed a Windows flakiness in pnpm dlx where a failed
install could surface a spurious EBUSY: resource busy or
locked error. The cleanup of a partially-populated dlx cache
is now best-effort with retries and no longer masks the
original error.
- ec7cf70: Shortened the pnpm dlx cache path so deep dependency
trees no longer overflow Windows' MAX_PATH, which could make
a dependency's lifecycle script fail with spawn cmd.exe
ENOENT.
- 05b95ab: Fixed pnpm hanging (and crashing with an unhandled
promise rejection) when a non-retryable network error such as
SELF_SIGNED_CERT_IN_CHAIN occurs while fetching from a
registry. The error is now rejected through the returned
promise instead of being thrown inside the detached retry
callback.
- d3f68e2: Fix a pnpm audit performance regression on lockfiles
that contain dependency cycles. The reachable-vulnerability
pruning added in pnpm 11.5.1 only memoized acyclic subtrees,
so any node whose subtree touched a cycle — together with all
of its ancestors — was recomputed on every query, making the
path walk quadratic. Reachability is now computed once per
node using Tarjan's strongly-connected-components algorithm,
so cyclic graphs are handled in linear time #12212.
- The audit path walk also no longer recurses, so a deeply
nested dependency graph can no longer overflow the call
stack, and the install path to each finding is tracked
without per-node copying, keeping memory linear in the graph
depth.
- 322f88f: Fix failed optional dependency updates so they don't
rewrite unrelated dependency specs #11267.
- 1488db1: When enableGlobalVirtualStore is toggled on for a
project that was previously installed without it, stale
hoisted symlinks under node_modules/.pnpm/node_modules are
now replaced instead of being left pointing at the old
per-project virtual store location #9739.
- 6545793: Fixed pnpm install --ignore-workspace overwriting
the allowBuilds map in pnpm-workspace.yaml. The ignored
builds of a package with a build script were auto-populated
into allowBuilds even though --ignore-workspace was passed,
clobbering committed true/false values with the set this to
true or false placeholder #12469.
- fbdc0eb: Fixed minimumReleaseAgeExclude and
trustPolicyExclude so multiple exact-version entries for the
same package behave the same as a single || disjunction
entry. Previously only the first matching rule's versions
were honored, so a config like [form-data@4.0.6,
form-data@2.5.6] could still flag form-data@2.5.6 as
violating minimumReleaseAge, while [form-data@4.0.6 || 2.5.6]
worked as expected #12463.
- fa7004b: The in-memory package metadata cache is now
populated on the exact-version disk fast path, so repeated
resolutions of the same package within one install no longer
re-read and re-parse the on-disk metadata. In large monorepos
this brings the time for adding a new package down from
minutes to seconds. The in-memory cache key now also includes
the registry, so a package of the same name served by two
different registries in a single install can no longer share
a cache slot and resolve the wrong tarball.
- 0a154b1: Fixed pnpm patch dropping the package name (and
leaking internal option fields) when the patched dependency
resolves to a single git-hosted version.
- 4d3fe4b: The pnpr resolver endpoints moved under the reserved
/-/pnpr namespace: POST /v1/resolve is now POST
/-/pnpr/v0/resolve and POST /v1/verify-lockfile is now POST
/-/pnpr/v0/verify-lockfile. The capability handshake at GET
/-/pnpr advertises protocol version 0 to match. This keeps
every pnpr-proprietary route in npm's reserved namespace, so
it can never collide with a package path.
- 0ec878d: Removing a runtime dependency now removes the
matching devEngines.runtime or engines.runtime entry that was
materialized from it. Blank runtime selectors are normalized
to latest.
- 17e7f2c: pnpm sbom now emits a CycloneDX issue-tracker
external reference for components (and the root) whose
package.json declares a bugs URL. Email-only bugs entries are
skipped, since the reference requires a URL.
- a84d2a1: Add @pnpm/resolving.tarball-url, which builds and
recognizes the canonical npm tarball URL of a package. It
vendors getNpmTarballUrl (previously the external
get-npm-tarball-url package) and adds
isCanonicalRegistryTarballUrl, the predicate the lockfile
writer uses to decide whether a tarball URL is derivable from
name+version+registry (and can therefore be omitted from
pnpm-lock.yaml).
- Exposing isCanonicalRegistryTarballUrl lets a custom resolver
(pnpmfile resolvers) fronting a proxy that serves tarballs on
a non-canonical path (e.g. an ephemeral localhost:<port>)
rewrite the resolved tarball to the canonical form, so
nothing host-specific is persisted to the lockfile.
Previously this logic was private to @pnpm/lockfile.utils.
- Two correctness fixes are included while consolidating the
logic: the scoped-package unescape now handles uppercase %2F
as well as %2f (percent-encoding is case-insensitive), and
protocol-insensitive comparison strips only a leading
http(s):// scheme instead of splitting on the first ://
(which could truncate URLs containing a later ://).
- 852d537: Lockfile verification no longer reports a registry
metadata fetch failure (for example a 403/401 on a private
registry, or a network error) as
ERR_PNPM_TARBALL_URL_MISMATCH. When the registry can't be
reached to verify an entry, the install now aborts with the
registry's own fetch error (such as ERR_PNPM_FETCH_403, which
already explains the authentication situation) instead of
mislabeling a transport failure as lockfile tampering.
Registry fetch errors no longer leak basic-auth credentials
embedded in the registry URL (https://user:pass@host/) into
their message.
* Sat Jun 20 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 11.8.0:
* Minor Changes
- c112b61: Added a --dry-run option to pnpm install. It runs a
full dependency resolution and reports what an install would
change, but writes nothing to disk (no lockfile, no
node_modules) and always exits with code 0. This mirrors the
preview semantics of npm install --dry-run #7340.
- 179ebc4: pnpm run --no-bail now exits with a non-zero exit
code when any of the executed scripts fail, while still
running every matched script to completion. This makes the
exit-code behavior of --no-bail consistent between recursive
and non-recursive runs (recursive runs already failed at the
end). Previously, a non-recursive pnpm run --no-bail always
exited with code 0, even when a script failed #8013.
- 0474a9c: Added support for generating Node.js package maps at
node_modules/.package-map.json during isolated and hoisted
installs. Added the node-experimental-package-map setting to
inject the generated map into pnpm-managed Node.js script
environments, and the node-package-map-type setting to choose
between standard and loose package maps.
- dcededc: pnpm sbom now marks components reachable only
through devDependencies with CycloneDX scope: "excluded" and
the cdx:npm:package:development property. The excluded scope
documents "component usage for test and other non-runtime
purposes", which matches the semantics of a devDependency;
the property is the CycloneDX npm-taxonomy marker emitted by
@cyclonedx/cyclonedx-npm, so both modern (scope) and existing
(property) consumers are covered. Components reachable at
runtime (including installed optionalDependencies) omit scope
and default to required.
- 1495cb0: Added per-package SBOM generation with --out and
- -split flags. Use --out out/%s.cdx.json to write one SBOM
per workspace package to individual files, or --split for
NDJSON output to stdout. When --filter selects a single
package, the SBOM root component now uses that package's
metadata. Workspace inter-dependencies (workspace: protocol)
and their transitive dependencies are included. Author,
repository, and license fall back to the root manifest when
the package doesn't define them.
- 293921a: feat(view): support searching project manifest
upward when package name is omitted When running pnpm view
without a package name, the command now searches upward for
the nearest project manifest (package.json, package.yaml, or
package.json5) and uses its name field. If the manifest
exists but lacks a name field, an error is thrown. This
change also replaces the find-up dependency with empathic for
improved performance and consistency across workspace tools.
* Patch Changes
- 29ab905: Fixed pnpm update overriding the version range
policy of a named catalog whose name parses as a version
(e.g. catalog:express4-21). The catalog: reference carries no
pinning of its own, so the prefix from the catalog entry
(such as ~) is now preserved instead of being widened to ^
[#10321].
- bee4bf4: Security: validate config dependency names and
versions from the env lockfile (pnpm-lock.yaml) before using
them to build filesystem paths. A committed lockfile with a
traversal-shaped configDependencies name (such as
../../PWNED) or version (such as ../../../PWNED) could
previously cause pnpm install to create symlinks or write
package files outside node_modules/.pnpm-config and the
store. Names must now be valid npm package names and versions
must be exact semver versions; the same validation is applied
to optional subdependencies of config dependencies, and to
the legacy workspace-manifest format before any lockfile is
written. See GHSA-qrv3-253h-g69c.
- 96bdd57: Fix link: workspace protocol switching to file:
after pnpm rm is run from inside a workspace package whose
target workspace dependency has its own dependencies, when
injectWorkspacePackages: true is set. Follow-up to #10575,
which fixed the same symptom for workspace packages without
dependencies.
- 302a2f7: No longer warn about using both packageManager and
devEngines.packageManager when the two fields pin the same
package manager at the same version with the same integrity
hash (e.g. both pnpm@11.5.1+sha512.…). Previously the hash
was stripped from the legacy packageManager field but not
from devEngines.packageManager, so even identical
specifications looked like a mismatch #12028.
The warning still fires on any genuine divergence, and
several cases now state the specific reason instead of a
single generic message: a different package manager, a
different version, or contradictory integrity hashes for the
same version.
- 3f0fb21: Fixed the progress line showing leftover characters
from external processes that write to the terminal between
progress updates (e.g. an SSH passphrase prompt would leave a
fragment like added 0sa':). The interactive reporter now
redraws each frame in place, erasing to the end of the
display before reprinting, so any such remnants are cleared
[#12350].
- 564619f: Fixed pnpm approve-builds reporting "no packages
awaiting approval" when a build-script dependency whose
approval was revoked (e.g. after git stash drops the
allowBuilds from pnpm-workspace.yaml) is re-added. The
revoked packages are now correctly recorded in .modules.yaml
so approve-builds can find them. #12221
- 3d1fd20: Skip the redundant "target bin directory already
contains an exe called node" warning on Windows when the
existing node.exe already matches the target (same hard link
or identical content) pnpm/pnpm#12203.
- 1b02b47: Fix macOS Gatekeeper blocking native binaries
(.node, .dylib, .so) by removing the com.apple.quarantine
extended attribute after importing them from the store.
When pnpm imports files from its content-addressable store
into node_modules, macOS preserves extended attributes,
including com.apple.quarantine. If this xattr is present on a
store blob (e.g. it was first written under a
Gatekeeper-enabled app such as a Git client), it propagates
to node_modules, and Gatekeeper blocks the native binary from
loading even though pnpm already verified the file's
integrity against the lockfile.
After importing a package, pnpm now strips
com.apple.quarantine from its native binaries, matching
Homebrew's behaviour of dropping quarantine from verified
downloads. The cleanup is macOS-only, runs in a single
batched xattr call per package, is restricted to native
binaries (other files are untouched), and is non-fatal (it
logs a warning on unexpected errors).
Fixes #11056
- 61969fb: Fix pnpm install with optimisticRepeatInstall
incorrectly reporting Already up to date when pnpm-lock.yaml
changed but project manifests did not. This affected
workflows such as checking out or restoring only the lockfile
[#12100].
Also fixes checkDepsStatus to use the correct lockfile path
when useGitBranchLockfile is enabled, so the optimistic
fast-path and lockfile modification detection work with
pnpm-lock.<branch>.yaml files instead of always stat'ing
pnpm-lock.yaml. Merge-conflict detection now reads the
resolved lockfile name as well, and with
mergeGitBranchLockfiles enabled every pnpm-lock.*.yaml is
scanned for modifications and conflicts. The git branch is
now resolved by reading .git/HEAD directly (no process spawn)
and uses the workspace directory rather than process.cwd().
- 5c12968: Fix recursive updates of transitive dependencies
when the update command mixes transitive dependency patterns
with direct dependency selectors. For example, pnpm up -r
"@babel/core" uuid now updates matching transitive
@babel/core dependencies even when uuid is a direct
dependency selector #12103.
- 9d79ba1: Register the pnpm update --no-save flag in the CLI
help and option parser.
- 0474a9c: Fixed pnpm import for Yarn v2 lockfiles when js-yaml
v4 is installed.
- 9e0c375: Fixed pnpm install repeatedly prompting to remove
and reinstall node_modules in a workspace package when
enableGlobalVirtualStore is enabled. The post-install build
step recorded a per-project node_modules/.pnpm virtual store
directory in node_modules/.modules.yaml, overwriting the
global <storeDir>/links value the install step had written.
The next install then detected a virtual-store mismatch
(ERR_PNPM_UNEXPECTED_VIRTUAL_STORE). The build step now
derives the same global virtual store directory as the
install step #12307.
- 223d060: Document the --cpu, --os and --libc flags in the
output of pnpm install --help. These flags were already
supported but were only documented on the website #12359.
- e85aea2: Avoid reading README.md from disk when publishing if
the publish manifest already provides a readme field. The
README is now only read lazily, inside
createExportableManifest, when it is actually needed.
- 3188ae7: Fixed pnpm peers check to accept loose peer
dependency ranges such as >=3.16.0 || >=4.0.0- when the
installed peer version satisfies the range #12149.
- 531f2a3: Fixed pnpm update rewriting a workspace: dependency
that points at a local path (e.g.
workspace:../packages/foo/dist) into a normalized link: or
version-range specifier. Such specifiers are now preserved
verbatim when the workspace protocol is preserved #3902.
- fe66535: Fixed a lockfile non-convergence bug where an
incremental install kept a duplicate transitive dependency
that a fresh install would not produce. When a package is
reused from the lockfile, its child edges are taken verbatim
and bypass the preferred-versions walk, so a transitive
dependency could stay pinned to an older version even after a
direct dependency resolved to a higher version that satisfies
the same range. The resolver now refreshes such a stale pin
to the higher direct-dependency version during resolution —
so the older version is never resolved or fetched, and the
incremental result converges to the fresh one.
- 6d35338: pnpm install detects changes inside local file
dependencies again. The optimistic repeat-install fast path
only tracks manifest and lockfile modification times, so
edits inside a local dependency's directory (or a repacked
local tarball) were reported as "Already up to date".
Projects with local file dependencies (file: and bare local
path or tarball specifiers, declared directly or through
pnpm.overrides) now always run a full install, which
refetches those dependencies, matching pnpm v10 behavior
[#11795].
- 4ca9247: Preserve the existing Node.js runtime version prefix
when resolving node@runtime:<range> to a concrete version.
- 30c7590: Create shorter CAFS temporary package directories to
leave room for lifecycle scripts that create IPC socket paths
under TMPDIR.
- 13815ad: Reporter output (warnings, progress) for pnpm store
and pnpm config subcommands now goes to stderr instead of
stdout. This fixes scripts that capture their stdout (e.g.
PNPM_STORE=$(pnpm store path), pnpm config list --json | jq)
from getting warnings mixed into the result.
- 1c05876: Avoid relinking unchanged child dependencies and
remove stale child links during warm installs.
- 817f99d: Fixed lockfile churn where a package's
transitivePeerDependencies could be dropped (and shift
between packages) when the package participates in a
dependency cycle. A cycle re-entry resolves against truncated
children, so it must not be cached as "pure"; otherwise
sibling occurrences of the same package short-circuit and
lose transitive peers depending on traversal order #5108.
- eba03e0: Fix pnpm install reporting "Already up to date"
after a catalog entry in pnpm-workspace.yaml was reverted to
a previous version. After an update modified a catalog, the
workspace state cache stored the pre-update catalog versions,
so reverting the entry back to its original version was not
detected as an outdated state #12418.
- 3b54d79: pnpm update now keeps lockfile overrides that
resolve through a catalog in sync with the catalog.
Previously, when an override referenced a catalog (e.g.
overrides: { foo: 'catalog:' }) and pnpm update bumped that
catalog entry, the lockfile's catalogs advanced while the
resolved overrides kept the old version. The resulting
lockfile was internally inconsistent, so a later pnpm install
- -frozen-lockfile failed with
ERR_PNPM_LOCKFILE_CONFIG_MISMATCH.
- 9d0a300: Fixed pnpm version --recursive so it honors the
workspace selection. In recursive mode the version bump now
applies to the packages resolved from the workspace filter
(selectedProjectsGraph), matching the behavior of pnpm
publish --recursive, instead of always bumping every
workspace package #11348.
- update to 11.7:
* Minor Changes
- Added a new setting frozenStore (--frozen-store) that lets
pnpm install run against a package store on a read-only
filesystem (e.g. a Nix store, a read-only bind mount, an OCI
layer). When enabled, pnpm opens the store's SQLite index.db
through the immutable=1 URI — bypassing the WAL/-shm sidecar
creation that otherwise fails on a read-only directory — and
suppresses every store-write path (the index.db writer and
the project-registry write). Pair it with --offline
- -frozen-lockfile against a fully-populated store. Under the
global virtual store, package directories live inside the
store, so if the store is missing the build output of a
package whose lifecycle scripts are approved (or that has a
patch), pnpm fails up front with
ERR_PNPM_FROZEN_STORE_NEEDS_BUILD rather than crashing
mid-build on a read-only write — seed the store with those
builds first. Incompatible with --force and with a configured
pnpr server, since both write into the store; the
side-effects cache is likewise not written under frozenStore.
If the store is missing its content directory, the install
fails fast with ERR_PNPM_FROZEN_STORE_INCOMPLETE rather than
attempting to initialize it. The read-only immutable=1 open
requires Node.js >=22.15.0, >=23.11.0, or >=24.0.0; on older
runtimes --frozen-store fails with a clear
ERR_PNPM_FROZEN_STORE_UNSUPPORTED_NODE error. Bin-linking
also tolerates a read-only store: under the global virtual
store a package's bin source lives inside the store, so the
chmod that makes it executable would be refused — with
EPERM/EACCES, or with EROFS on a genuinely read-only
filesystem. That chmod is redundant when the seed already
ships its bins executable with a normalized shebang, so it is
now skipped in that case, while a non-executable bin (or one
still carrying a Windows CRLF shebang) on a read-only store
still errors.
- When pacquet (the Rust port of pnpm) is declared in
configDependencies, pnpm now delegates dependency resolution
to it too — not just materialization — provided the installed
pacquet is new enough to support full resolving installs (>=
0.11.7).
Previously pacquet only ran in frozen-install mode: pnpm
always resolved the dependency graph itself (writing
pnpm-lock.yaml) and handed pacquet a finished lockfile to
fetch / import / link. With pacquet >= 0.11.7, a non-frozen
pnpm install (default isolated nodeLinker, plain install) is
delegated to pacquet end-to-end in a single pass — pacquet
resolves the manifests, writes the lockfile, and materializes
node_modules. pnpm detects the capability from the installed
pacquet's version; older pacquet releases keep the
resolve-then-materialize split, and add / update / remove
still resolve in pnpm (it has to mutate the manifests first).
This remains an opt-in preview of the Rust install engine
[#11723].
- Added a new opt-in --batch flag to pnpm publish --recursive
that sends all selected packages to the registry in a single
PUT /-/pnpm/v1/publish request instead of one request per
package. The target registry has to implement the batch
publish endpoint (pnpr does); registries that don't are
reported with a clear ERR_PNPM_BATCH_PUBLISH_UNSUPPORTED
error. The batch is processed all-or-nothing by pnpr: if any
package in the batch fails validation, none of the packages
are published.
* Patch Changes
- Reject path-traversal and reserved dependency aliases (such
as ../../../escape, .bin, .pnpm, or node_modules) that come
from a lockfile rather than a freshly resolved manifest. A
crafted lockfile alias could otherwise be joined directly
under a hoisted node_modules directory, letting package files
be written outside the intended install root or overwrite
pnpm-owned layout.
The fix adds two layers:
- The nodeLinker: hoisted graph builder now validates each
alias at the directory sink (safeJoinModulesDir), matching
the validation pnpm already performs when resolving aliases
from manifests.
- The lockfile verification gate (verifyLockfileResolutions)
now runs an always-on, policy-independent check that
rejects any importer or snapshot dependency alias that is
not a valid package name, failing the install early —
before any fetch or filesystem work — for every node linker
at once.
- Made shared package child resolution deterministic when the
same package is reached through multiple contexts. pnpm now
chooses the shallowest occurrence, then importer order, then
parent path, instead of letting request timing decide the
child context and missing-peer report pnpm/pnpm#12358.
- Fix garbled summary line after submitting pnpm update -i and
pnpm audit --fix -i. The interactive checkbox prompt
previously printed every selected choice's full table row
(label, current/target versions, workspace, URL) joined by
commas, producing a wall of text after pressing Enter. The
summary now lists only the selected package names (or
vulnerability keys) by setting an explicit short per choice;
the in-progress selection UI is unchanged.
- Prevent pnpm patch-remove from removing files outside the
configured patches directory.
- Fixed pnpm publish ignoring strictSsl: false when publishing
to registries with self-signed certificates. The strictSSL
option is now forwarded to libnpmpublish / npm-registry-fetch
so that strict-ssl=false in .npmrc or strictSsl: false in
pnpm-workspace.yaml is respected during publish, the same way
it is for pnpm install pnpm/pnpm#12012.
- Fixed Cannot destructure property 'manifest' of
'manifestsByPath[rootDir]' as it is undefined regression
introduced in 11.6.0 when running pnpm add <pkg> outside a
workspace on Windows. selectProjectByDir was keying the
resulting ProjectsGraph by opts.dir instead of
project.rootDir, so downstream manifestsByPath lookups missed
when the two paths normalized differently (typically
drive-letter casing). pnpm/pnpm#12379
- Git dependencies that point to a subdirectory of a repository
(repo#commit&path:/sub/dir) keep their path in the lockfile
again. Since the integrity of git-hosted tarballs started
being pinned in the lockfile, any install that actually
downloaded the tarball rebuilt the lockfile resolution as {
integrity, tarball, gitHosted } and dropped the path field,
while installs served from the store kept it — so the field
disappeared seemingly at random. Without path, later installs
from that lockfile silently unpacked the repository root
instead of the subdirectory #12304.
- Fixed nondeterministic lockfile output that made pnpm dedupe
- -check fail intermittently in CI. When a locked peer
provider was pinned for a dependency that has no child
dependencies of its own, the pinned provider leaked into the
shared parent scope, so siblings resolved after it could pick
up an optional peer they should not see. Which siblings were
affected depended on resolution order, which varies with
network timing.
- Sped up pnpm install with a frozen lockfile by running
lockfile verification (the policy revalidation gate added for
minimumReleaseAge/trustPolicy and the tarball-URL anti-tamper
check) concurrently with fetching and linking instead of
blocking the whole install on it. Dependency lifecycle
scripts are still held back until verification succeeds, so
no script runs on an unverified lockfile: if verification
fails the install aborts before any dependency build, and if
linking finishes first the install waits for the verification
verdict before completing.
- User-defined npm_config_* environment variables are now
preserved during lifecycle script execution. Previously, all
npm_-prefixed env vars were stripped, which caused user-set
variables like npm_config_platform_arch to be lost
pnpm/pnpm#12399.
- pnpm can now use different auth tokens for different package
scopes, even when those scopes use the same registry URL.
Previously, auth was selected only by registry URL. If @org-a
and @org-b both used https://npm.pkg.github.com/, they had to
share the same token. This caused problems for registries
that issue tokens per organization or per scope.
Configure a scope-specific token by adding the package scope
after the registry URL in the auth key:
@org-a:registry=https://npm.pkg.github.com/
@org-b:registry=https://npm.pkg.github.com/
//npm.pkg.github.com/:@org-a:_authToken=${ORG_A_TOKEN}
//npm.pkg.github.com/:@org-b:_authToken=${ORG_B_TOKEN}
//npm.pkg.github.com/:_authToken=${FALLBACK_TOKEN}
pnpm login --registry=https://npm.pkg.github.com --scope=@org-a
writes the token to the same scope-specific auth key.
When installing or publishing @org-a/*, pnpm uses
ORG_A_TOKEN. For @org-b/*, pnpm uses ORG_B_TOKEN. Packages
without a matching scope continue to use the registry-wide
fallback token.
- pnpm setup no longer prompts to approve build scripts for
@pnpm/exe when installing the standalone executable. pnpm
links the platform-specific binary itself, so the package's
install scripts are skipped during the global self-install
[#12377].
- Close lockfile reads deterministically before rewriting
lockfiles and keep pacquet's virtual store directory length
aligned with pnpm on Windows.
- A 304 Not Modified answer from the registry now renews the
cached metadata file's mtime, so the minimumReleaseAge
freshness shortcut keeps serving resolutions from the cache.
Previously, once a cached packument grew older than
minimumReleaseAge, every subsequent install re-validated it
against the registry forever, because a 304 never rewrites
the file.
- Updated dependency ranges. Notably:
- @pnpm/logger peer dependency range moved to ^1100.0.0.
- msgpackr 1.11.8 → 2.0.4 (store index files remain
byte-compatible in both directions).
- open ^7.4.2 → ^11.0.0, memoize ^10 → ^11, cli-truncate ^5 →
^6, pidtree ^0.6 → ^1.
- @yarnpkg/core 4.5.0 → 4.8.0, @rushstack/worker-pool 0.7.7 →
0.7.18, @cyclonedx/cyclonedx-library 10.0.0 → 10.1.0,
@pnpm/config.nerf-dart ^1 → ^2, @pnpm/log.group 3.0.2 →
4.0.1, @pnpm/util.lex-comparator ^3 → ^4.
- Updated @zkochan/cmd-shim to v9.0.6.
- Fixed a Windows-only hang where a failed command could take
20–46 seconds to exit. On error, pnpm enumerates descendant
processes (via pidtree) to terminate them, which on Windows
shells out to wmic/PowerShell Get-CimInstance Win32_Process —
a lookup that is extremely slow on some machines. The lookup
is now bounded by a short timeout so it can no longer stall
the process exit.
* Fri Jun 12 2026 Avindra Goolcharan <avindra@opensuse.org>
- Update to 11.6.0:
* pnpm install completes without re-resolving when pnpm-lock.
yaml was deleted but node_modules is intact: the up-to-date
check now treats the current lockfile (node_modules/.pnpm/lock.
yaml) — the record of what the previous install materialized —
as the wanted lockfile, verifies the manifests still match it,
restores pnpm-lock.yaml from it, and reports "Already up to date".
Previously this scenario triggered a full resolution and a re-
verification of every locked package against the registry.
* 615c669: Added support for configuring URL-scoped registry
settings through npm_config_//… and pnpm_config_//…
environment variables, for example:
* Improved the warning printed when a project .npmrc uses an
environment variable in a registry/proxy URL or in registry
credentials. The message now explains why the setting was
ignored and how to migrate it to a trusted source — for example
by moving the line to the user-level ~/.npmrc or running pnpm
config set "<key>" <value> — with a link to https://pnpm.io/npmrc.
The pnpm config set example is only suggested when the key has
no ${...} placeholder, so the snippet is always safe to copy-paste.
* Print a "Lockfile passes supply-chain policies (verified 2h
ago)" message when lockfile verification is skipped because a
cached verdict for the same lockfile content and policy is reused.
Previously the cached short-circuit was completely silent,
which made it look like the policy gate never ran #12324.
* Platform-specific optional dependencies are now skipped even
when their os/cpu/libc fields are missing from the registry
metadata or the lockfile. Some registries strip these fields
from the package metadata, which made pnpm download and install
the binaries of every platform regardless of
supportedArchitectures. The missing platform fields of an
optional dependency are now inferred from its name (e.g. @nx/nx-
win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform
binaries are skipped without even downloading them #11702.
* Thu Jun 11 2026 Avindra Goolcharan <avindra@opensuse.org>
- Update to 11.5.3:
* ⚠️ Security fix — environment variables in a project .npmrc
* Stopped expanding environment variables in repository-
controlled registry/proxy request destinations and registry
credential values from .npmrc, and in workspace registry URLs
from pnpm-workspace.yaml. Move dynamic registry URL and token
configuration to trusted user, global, CLI, or environment config.
* Resolve package-manager bootstrap dependencies with trusted
user or CLI registry and network config, and reject package-
manager env-lockfile records that do not use registry package
paths with integrity-only resolutions before auto-switch execution.
* Avoid writing packageManagerDependencies to pnpm-lock.yaml
when package manager policy is set to onFail: ignore or
pmOnFail: ignore #12228.
* Avoid running dependency-status auto-install when the
dependency status is unavailable without a project manifest.
* Using the $ version reference syntax in overrides (e.g. "react": "$react")
now prints a deprecation warning. The syntax still works, but
catalogs are the recommended way to keep an overridden
version in sync with the rest of the workspace. Reference a
catalog entry with the catalog: protocol instead.
* Fixed pnpm config get globalconfig to return the global config
.yaml path again pnpm/pnpm#11962.
* Fixed bare --color so it does not consume the following CLI
flag, allowing command shorthands like --parallel to expand
correctly and forms like pnpm --color with current <command>
to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.
* Fix pnpm install ignoring enableGlobalVirtualStore toggle by
including it in the workspace state settings check #12142.
* Security: pnpm now verifies the npm registry signature of a
package-manager binary before spawning it, so a cloned
repository cannot make pnpm download and execute an arbitrary native binary.
* Made peer-dependent deduplication deterministic. When a peer-
suffixed package variant was a subset of two or more mutually
incompatible larger variants, the variant it collapsed into
depended on the order importers were resolved in, which
varies between machines. This could resolve the same
workspace to different lockfiles on different platforms and
make pnpm dedupe --check alternate between passing and failing.
* Reject invalid package names and versions from staged tarball
manifests before deriving filenames for pnpm stage download.
* Clarified in CLI help that the pnpm store is trusted shared
state and store integrity checks are corruption detection,
not a tamper boundary for untrusted store writers.
* Reject reserved manifest bin names ("", ".", "..", and scoped
forms such as @scope/..) when resolving a package's bins.
These names previously passed the bin-name guard and, when
joined to the global bin directory during global remove/update
/add operations, could resolve to the global bin directory
itself or its parent and have it recursively deleted.
* Require trusted package identity before package-name
allowBuilds entries can approve lifecycle scripts for git, git
- hosted tarball, direct tarball, and local directory artifacts.
To approve one of those artifacts explicitly, use its peer-
suffix-free lockfile depPath as the allowBuilds key. Lockfile
verification now rejects lockfiles where a registry-style
dependency path (name@semver) is backed by a git, directory,
or git-hosted tarball resolution (
ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path
is a reliable artifact identity by the time scripts can run.
* Security: pnpm now verifies the OpenPGP signature of a
downloaded Node.js runtime's SHASUMS256.txt before trusting
its integrity hashes.
* Fri Jun 05 2026 Avindra Goolcharan <avindra@opensuse.org>
- Update to 11.5.2:
* Find the full changelog and breaking changes at:
https://github.com/pnpm/pnpm/blob/v11.5.2/pnpm/CHANGELOG.md
* Fri May 22 2026 Elisei Roca <eroca@suse.com>
- update to 11.2.2:
* Find the full changelog and breaking changes at:
https://github.com/pnpm/pnpm/blob/v11.2.2/pnpm/CHANGELOG.md
* Automated migration steps:
https://pnpm.io/migration
- cd /path/to/your/project
- pnpx codemod run pnpm-v10-to-v11
* Non-automated steps you might have to do:
https://pnpm.io/migration#manual-follow-ups
* Requires at least Node.js v22.13
* Wed May 06 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.33.4:
* Patch Changes
- Pin the integrity of git-hosted tarballs
(codeload.github.com, gitlab.com, bitbucket.org) in the
lockfile so that subsequent installs detect a tampered or
substituted tarball and refuse to install it. Previously the
lockfile only stored the tarball URL for git dependencies, so
a compromised git host or a man-in-the-middle could serve
arbitrary code on later installs without lockfile changes.
- A new gitHosted: true field is recorded on git-hosted tarball
resolutions in the lockfile, letting every reader/writer
route them by a single typed check instead of
pattern-matching the tarball URL in each call site. Lockfiles
written by older pnpm versions are enriched on load (URL
fallback) so the field can be relied on uniformly across the
codebase.
- Fix a regression where pnpm --recursive --filter '!<pkg>'
run/exec/test/add would include the workspace root in the
matched projects. The workspace root is now correctly
excluded by default when only negative --filter arguments are
provided, matching the documented behavior. To include the
root, pass --include-workspace-root #11341.
- update to 10.33.3:
* Patch Changes
- When self-updating from v10's @pnpm/exe to v11+ on Intel
macOS (darwin-x64), pnpm self-update now transparently
switches to the JS-only pnpm package on npm instead of
installing @pnpm/exe@v11+ (which doesn't ship a working
binary for Intel Macs because of an upstream Node.js SEA bug
— see #11423 and nodejs/node#62893). Without this, the
self-update would silently leave the user with no working
pnpm binary. The new install requires Node.js to be available
on PATH; a warning is printed when the swap happens. All
other host/version combinations are unchanged.
- pnpm self-update (with no version argument) no longer
downgrades pnpm when the registry's latest dist-tag points to
an older release than the currently active version. Run pnpm
self-update latest to force a downgrade #11418.
* Sun Apr 26 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.33.2:
* Patch Changes
- Globally-installed bins no longer fail with
ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND when pnpm was installed
via the standalone @pnpm/exe binary (e.g. curl -fsSL
https://get.pnpm.io/install.sh | sh -) on a system without a
separate Node.js installation. Previously, when which('node')
failed during pnpm add --global, pnpm fell back to
process.execPath, which in @pnpm/exe is the pnpm binary
itself — and that path was baked into the generated bin shim,
causing the shim to invoke pnpm instead of Node #11291,
[#4645].
- Fix an infinite fork-bomb that could happen when pnpm was
installed with one version (e.g. npm install -g pnpm@A) and
run inside a project whose package.json selected a different
pnpm version via the packageManager field (e.g. pnpm@B),
while a pnpm-workspace.yaml also existed at the project root.
- The child's environment is now forced to
manage-package-manager-versions=false (v10) and
pm-on-fail=ignore (v11+), which disables the
package-manager-version handling in whichever pnpm runs as
the child.
- Fixes #11337.
- update to 10.33.1:
* Patch Changes
- When a project's packageManager field selects pnpm v11 or
newer, commands that v10 would have passed through to npm
(version, login, logout, publish, unpublish, deprecate,
dist-tag, docs, ping, search, star, stars, unstar, whoami,
etc.) are now handed over to the wanted pnpm, which
implements them natively. Previously they silently shelled
out to npm — making, for example, pnpm version --help print
npm's help on a project with packageManager: pnpm@11.0.0-rc.3
[#11328].
* Sun Mar 29 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.33:
* Minor Changes
- Added a new dedupePeers setting that reduces peer dependency
duplication. When enabled, peer dependency suffixes use
version-only identifiers (name@version) instead of full dep
paths, eliminating nested suffixes like
(foo@1.0.0(bar@2.0.0)). This dramatically reduces the number
of package instances in projects with many recursive peer
dependencies #11070.
* Patch Changes
- Fail on incompatible lockfiles in CI when frozen lockfile
mode is enabled, while preserving non-frozen CI fallback
behavior.
- When package metadata is malformed or can't be fetched, the
error thrown will now show the originating error.
- Fixed intermittent failures when multiple pnpm dlx calls run
concurrently for the same package. When the global virtual
store is enabled, the importer now verifies file content
before skipping a rename, avoiding destructive swap-renames
that break concurrent processes. Also tolerates EPERM during
bin creation on Windows and properly propagates
enableGlobalVirtualStore through the install pipeline.
- Fixed handling of non-string version selectors in hoistPeers,
preventing invalid peer dependency specifiers.
- Improve the non-interactive modules purge error hint to
include the confirmModulesPurge=false workaround.
- When pnpm needs to recreate node_modules but no TTY is
available, the error now suggests either setting CI=true or
disabling the purge confirmation prompt via
confirmModulesPurge=false.
- Adds a regression test for the non-TTY flow.
- Fixed false "Command not found" errors on Windows when a
command exists in PATH but exits with a non-zero code. Also
fixed path resolution for --filter contexts where the command
runs in a different package directory.
- When a pnpm-lock.yaml contains two documents, ignore the
first one. pnpm v11 will write two lockfile documents into
pnpm-lock.yaml in order to store pnpm version integrities and
config dependency resolutions.
- Fixed a bug preventing the clearCache function returned by
createNpmResolver from properly clearing metadata cache.
* Sun Mar 15 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.32.1:
* Patch Changes
- Fix a regression where pnpm-workspace.yaml without a packages
field caused all directories to be treated as workspace
projects. This broke projects that use pnpm-workspace.yaml
only for settings (e.g. minimumReleaseAge) without defining
workspace packages #10909.
- update to 10.32.0:
* Minor Changes
- Added --all flag to pnpm approve-builds that approves all
pending builds without interactive prompts #10136.
* Patch Changes
- Reverted change related to setting explicitly the npm config
file path, which caused regressions.
- Reverted fix related to lockfile-include-tarball-url. Fixes
[#10915].
- update to 10.31.0:
* Minor Changes
- When pnpm updates the pnpm-workspace.yaml, comments, string
formatting, and whitespace will be preserved.
* Patch Changes
- Added -F as a short alias for the --filter option in the help
output.
- Handle undefined pkgSnapshot in pnpm why -r #10700.
- Fix headless install not being used when a project has an
injected self-referencing file: dependency that resolves to
link: in the lockfile.
- Fixed a race condition when multiple worker threads import
the same package to the global virtual store concurrently.
The rename operation now tolerates ENOTEMPTY/EEXIST errors if
another thread already completed the import.
- When lockfile-include-tarball-url is set to false, tarball
URLs are now always excluded from the lockfile. Previously,
tarball URLs could still appear for packages hosted under
non-standard URLs, making the behavior flaky and inconsistent
[#6667].
- Fixed optimisticRepeatInstall skipping install when
overrides, packageExtensions, ignoredOptionalDependencies,
patchedDependencies, or peersSuffixMaxLength changed.
- Fixed pnpm patch-commit failing with "unable to access
'/.config/git/attributes': Permission denied" error in
environments where HOME is unset or non-standard (Docker
containers, CI systems).
- The issue occurred because pnpm was setting HOME and the
Windows user profile env var to empty strings to suppress
user git configuration when running git diff. This caused git
to resolve the home directory (~) as root (/), leading to
permission errors when attempting to access
/.config/git/attributes.
- Now uses GIT_CONFIG_GLOBAL: os.devNull instead, which is
git's proper mechanism for bypassing user-level configuration
without corrupting the home directory path resolution.
- Fixes #6537
- Fix pnpm why -r --parseable missing dependents when multiple
workspace packages share the same dependency #8100.
- Fix link-workspace-packages=true incorrectly linking
workspace packages when the requested version doesn't match
the workspace package's version. Previously, on fresh
installs the version constraint is overridden to * in the
fallback resolution paths, causing any workspace package with
a matching name to be linked regardless of version #10173.
- Fixed pnpm update --interactive table breaking with long
version strings (e.g., prerelease versions like
7.0.0-dev.20251209.1) by dynamically calculating column
widths instead of using hardcoded values #10316.
- Explicitly tell npm the path to the global rc config file.
- The parameter set by the --allow-build flag is written to
allowBuilds.
- Fix a bug in which specifying filter on pnpm-workspace.yaml
would cause pnpm to not detect any projects.
- Print help message on running pnpm dlx without arguments and
exit.
* Mon Mar 02 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.30.3:
* Patch Changes
- Fixed version switching via packageManager field failing when
pnpm is installed as a standalone executable in environments
without a system Node.js #10687.
- update to 10.30.2:
* Patch Changes
- Fix auto-installed peer dependencies ignoring overrides when
a stale version exists in the lockfile.
- Fixed "input line too long" error on Windows when running
lifecycle scripts with the global virtual store enabled
[#10673].
- Update @zkochan/js-yaml to fix moderate vulnerability.
- update to 10.30.1:
* Patch Changes
- Use the /-/npm/v1/security/audits/quick endpoint as the
primary audit endpoint, falling back to
/-/npm/v1/security/audits when it fails #10649.
- update to 10.30.0:
* Minor Changes
- pnpm why now shows a reverse dependency tree. The searched
package appears at the root with its dependents as branches,
walking back to workspace roots. This replaces the previous
forward-tree output which was noisy and hard to read for
deeply nested dependencies.
* Patch Changes
- Revert pnpm why dependency pruning to prefer correctness over
memory consumption. Reverted PR: #7122.
- Optimize pnpm why and pnpm list performance in workspaces
with many importers by sharing the dependency graph and
materialization cache across all importers instead of
rebuilding them independently for each one #10596.
- update to 10.29.3:
* Patch Changes
- Fixed an out-of-memory error in pnpm list (and pnpm why) on
large dependency graphs by replacing the recursive tree
builder with a two-phase approach: a BFS dependency graph
followed by cached tree materialization. Duplicate subtrees
are now deduplicated in the output, shown as "deduped (N deps
hidden)" #10586.
- Fixed allowBuilds not working when set via .pnpmfile.cjs
[#10516].
- When the enableGlobalVirtualStore option is set, the pnpm
deploy command would incorrectly create symlinks to the
global virtual store. To keep the deploy directory
self-contained, pnpm deploy now ignores this setting and
always creates a localized virtual store within the deploy
directory.
- Fixed minimumReleaseAgeExclude not being respected by pnpm
dlx #10338.
- update to 10.29.2:
* Patch Changes
- Reverted a fix shipped in v10.29.1, which caused another
issue #10571.
- Reverted fix: Fixed pnpm run -r failing with "No projects
matched the filters" when an empty pnpm-workspace.yaml exists
[#10497].
- update to 10.29.1 (10.29.0 was not released):
* Minor Changes
- The pnpm dlx / pnpx command now supports the catalog:
protocol. Example: pnpm dlx shx@catalog:.
- Support configuring auditLevel in the pnpm-workspace.yaml
file #10540.
- Support bare workspace: protocol without version specifier.
It is now treated as workspace:* and resolves to the concrete
version during publish #10436.
* Patch Changes
- Fixed pnpm list --json returning incorrect paths when using
global virtual store #10187.
- Fix pnpm store path and pnpm store status using workspace
root for path resolution when storeDir is relative #10290.
- Fixed pnpm run -r failing with "No projects matched the
filters" when an empty pnpm-workspace.yaml exists #10497.
- Fixed a bug where catalogMode: strict would write the literal
string "catalog:" to pnpm-workspace.yaml instead of the
resolved version specifier when re-adding an existing catalog
dependency #10176.
- Fixed the documentation URL shown in pnpm completion --help
to point to the correct page at https://pnpm.io/completion
[#10281].
- Skip local file: protocol dependencies during pnpm fetch.
This fixes an issue where pnpm fetch would fail in Docker
builds when local directory dependencies were not available
[#10460].
- Fixed pnpm audit --json to respect the --audit-level setting
for both exit code and output filtering #10540.
- update tar to version 7.5.7 to fix security issue
- Updating the version of dependency tar to 7.5.7 because the
previous one have a security vulnerability reported here:
CVE-2026-24842
- Fix pnpm audit --fix replacing reference overrides (e.g.
$foo) with concrete versions #10325.
- Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not
being converted to publicHoistPattern #10271.
- pnpm help should correctly report if the currently running
pnpm CLI is bundled with Node.js #10561.
- Add a warning when the current directory contains the PATH
delimiter character. On macOS, folder names containing
forward slashes (/) appear as colons (:) at the Unix layer.
Since colons are PATH separators in POSIX systems, this
breaks PATH injection for node_modules/.bin, causing binaries
to not be found when running commands like pnpm exec #10457.
* Tue Jan 27 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.28.2:
* Patch Changes
- Security fix: prevent path traversal in directories.bin
field.
- When pnpm installs a file: or git: dependency, it now
validates that symlinks point within the package directory.
Symlinks to paths outside the package root are skipped to
prevent local data from being leaked into node_modules.
This fixes a security issue where a malicious package could
create symlinks to sensitive files (e.g., /etc/passwd,
~/.ssh/id_rsa) and have their contents copied when the
package is installed.
Note: This only affects file: and git: dependencies. Registry
packages (npm) have symlinks stripped during publish and are
not affected.
- Fixed optional dependencies to request full metadata from the
registry to get the libc field, which is required for proper
platform compatibility checks #9950.
- update to 10.28.1:
* Patch Changes
- Fixed installation of config dependencies from private
registries.
Added support for object type in configDependencies when the
tarball URL returned from package metadata differs from the
computed URL #10431.
- Fix path traversal vulnerability in binary fetcher ZIP
extraction
- Validate ZIP entry paths before extraction to prevent
writing files outside target directory
- Validate BinaryResolution.prefix (basename) to prevent
directory escape via crafted prefix
- Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error
- Support plain http:// and https:// URLs ending with .git as
git repository dependencies.
Previously, URLs like
https://gitea.example.org/user/repo.git#commit were not
recognized as git repositories because they lacked the git+
prefix (e.g., git+https://). This caused issues when
installing dependencies from self-hosted git servers like
Gitea or Forgejo that don't provide tarball downloads.
Changes:
- The git resolver now runs before the tarball resolver,
ensuring git URLs are handled by the correct resolver
- The git resolver now recognizes plain http:// and https://
URLs ending in .git as git repositories
- Removed the isRepository check from the tarball resolver
since it's no longer needed with the new resolver order
Fixes #10468
- pnpm run -r and pnpm run --filter now fail with a non-zero
exit code when no packages have the specified script.
Previously, this only failed when all packages were selected.
Use --if-present to suppress this error #6844.
- Fixed a path traversal vulnerability in tarball extraction on
Windows. The path normalization was only checking for ./ but
not .\. Since backslashes are directory separators on
Windows, malicious packages could use paths like
foo\..\..\.npmrc to write files outside the package
directory.
- When running "pnpm exec" from a subdirectory of a project,
don't change the current working directory to the root of the
project #5759.
- Fixed a path traversal vulnerability in pnpm's bin linking.
Bin names starting with @ bypassed validation, and after
scope normalization, path traversal sequences like ../../
remained intact.
- Revert Try to avoid making network calls with preferOffline
[#10334].
- Fix --save-peer to write valid semver ranges to
peerDependencies for protocol-based installs (e.g. jsr:) by
deriving from resolved versions when available and falling
back to * if none is available #10417.
- Do not exclude the root workspace project, when it is
explicitly selected via a filter #10465.
* Mon Jan 19 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.28.0:
* Minor Changes
- Add support for a hook called beforePacking that can be used
to customize the package.json contents at publish time #3816.
- In some cases, a filtered install (i.e. pnpm install --filter
...) was slower than running pnpm install without any filter
arguments. This performance regression is now fixed. Filtered
installs should be as fast or faster than a full install
[#10408].
* Patch Changes
- Do not add a symlink to the project into the store's project
registry if the store is in a subdirectory of the project
[#10411].
- It should be possible to declare the requiredScripts setting
in pnpm-workspace.yaml #10261.
- update to 10.27.0:
* Minor Changes
- Adding trustPolicyIgnoreAfter allows you to ignore trust
policy checks for packages published more than a specified
time ago#10352.
- Added project registry for global virtual store prune
support.
- Projects using the store are now registered via symlinks in
{storeDir}/v10/projects/. This enables pnpm store prune to
track which packages are still in use by active projects and
safely remove unused packages from the global virtual store.
- Semi-breaking. Changed the location of unscoped packages in
the virtual global store. They will now be stored under a
directory named @ to maintain a uniform 4-level directory
depth.
- Added mark-and-sweep garbage collection for global virtual
store.
- pnpm store prune now removes unused packages from the global
virtual store's links/ directory. The algorithm:
- Scans all registered projects for symlinks pointing to the
store
- Walks transitive dependencies to mark reachable packages
- Removes any package directories not marked as reachable
- This includes support for workspace monorepos - all
node_modules directories within a project (including those in
workspace packages) are scanned.
* Patch Changes
- Throw an error if the value of the tokenHelper or
<url>:tokenHelper setting contains an environment variable.
- Git dependencies with build scripts should respect the
dangerouslyAllowAllBuilds settings #10376.
- Skip the package manager check when running with --global and
a project packageManager is configured, and warn that the
check is skipped.
- pnpm store prune should not fail if the dlx cache directory
has files, not only directories #10384
- Fixed a bug (#9759) where pnpm add would incorrectly modify a
catalog entry in pnpm-workspace.yaml to its exact version.
- update to 10.26.2:
* Patch Changes
- Improve error message when a package version exists but does
not meet the minimumReleaseAge constraint. The error now
clearly states that the version exists and shows a
human-readable time since release (e.g., "released 6 hours
ago") #10307.
- Fix installation of Git dependencies using annotated tags
[#10335].
- Previously, pnpm would store the annotated tag object's SHA
in the lockfile instead of the actual commit SHA. This caused
ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out
commit hash didn't match the stored tag object hash.
- Binaries of runtime engines (Node.js, Deno, Bun) are written
to node_modules/.bin before lifecycle scripts (install,
postinstall, prepare) are executed #10244.
- Try to avoid making network calls with preferOffline #10334.
- update to 10.26.1:
* Patch Changes
- Don't fail on pnpm add, when blockExoticSubdeps is set to
true #10324.
- Always resolve git references to full commits and ensure HEAD
points to the commit after checkout #10310.
* Mon Dec 15 2025 Avindra Goolcharan <avindra@opensuse.org>
- update to 10.26.0
* Minor Changes
- Semi-breaking. Block git-hosted dependencies from running
prepare scripts unless explicitly allowed in onlyBuiltDependencies #10288.
- Semi-breaking. Compute integrity hash for HTTP tarball
dependencies when fetching, storing it in the lockfile to
prevent servers from serving altered content on subsequent installs #10287.
- Added a new setting blockExoticSubdeps that prevents the
resolution of exotic protocols in transitive dependencies.
- Added support for allowBuilds, which is a new field that
can be used instead of onlyBuiltDependencies and
ignoredBuiltDependencies. The new allowBuilds field in your
pnpm-workspace.yaml uses a map of package matchers to
explicitly allow (true) or disallow (false) script execution.
This allows for a single, easy-to-manage source of truth for
your build permissions.
* Patch Changes
- Show deprecation in table/list formats when latest version
is deprecated #8658.
- Remove the injectWorkspacePackages setting from the
lockfile on the deploy command #10294.
- Normalize the tarball URLs before saving them to the
lockfile. URLs should not contain default ports, like :80 for
http and :443 for https #10273.
- When a dependency is installed via a direct URL that
redirects to another URL and is immutable, the original URL
is normalized and saved to package.json #10197.
* Sat Dec 13 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.25.0:
* Minor Changes
- Allow loading certificates from cert, ca, and key for
specific registry URLs. E.g.,
//registry.example.com/:ca=-----BEGIN CERTIFICATE-----....
Previously this was only working via certfile, cafile, and
keyfile.
These properties are supported in .npmrc, but were ignored by
pnpm, this will make pnpm read and use them as well.
Related PR: #10230.
- Added a new flag called --bare to pnpm init for creating a
package.json with the bare minimum of required fields #10226.
* Patch Changes
- Improved reporting of ignored dependency scripts #10276.
- pnpm install should build any dependencies that were added to
onlyBuiltDependencies and were not built yet #10256.
- pnpm publish -r --force should allow to run publish over
already existing versions in the registry #10272.
- Don't fail with a ERR_PNPM_MISSING_TIME error if a package
that is excluded from trust policy checks is missing the time
field in the metadata.
* Sat Dec 13 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.24.0:
* Minor Changes
- Increased network concurrency on machines with many CPU
cores. pnpm now automatically selects a network concurrency
between 16 and 64, based on the number of pnpm workers
(calculated as workers × 3). This improves performance on
high-core systems #10068.
* Patch Changes
- trustPolicy should ignore the trust evidences of prerelease
versions, when installing a non-prerelease version.
- Handle ENOENT errors thrown by fs.linkSync(), which can occur
in containerized environments (OverlayFS) instead of EXDEV.
The operation now gracefully falls back to fs.copyFileSync()
in these cases #10217.
- Reverted: pnpm self-update should download pnpm from the
configured npm registry #10205.
- Packages that don't have a package.json file (like Node.js)
should not be reimported from the store on every install.
Another file from the package should be checked in order to
verify its presence in node_modules.
- Correctly read auth tokens for URLs that contain underscores
[#17].
* Sun Nov 23 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.23.0:
* Minor Changes
- Added --lockfile-only option to pnpm list #10020.
* Patch Changes
- pnpm self-update should download pnpm from the configured npm
registry #10205.
- pnpm self-update should always install the non-executable
pnpm package (pnpm in the registry) and never the @pnpm/exe
package, when installing v11 or newer. We currently cannot
ship @pnpm/exe as pkg doesn't work with ESM #10190.
- Node.js runtime is not added to "dependencies" on pnpm add,
if there's a engines.runtime setting declared in package.json
[#10209].
- The installation should fail if an optional dependency cannot
be installed due to a trust policy check failure #10208.
- pnpm list and pnpm why now display npm: protocol for aliased
packages (e.g., foo npm:is-odd@3.0.1) #8660.
- Don't add an extra slash to the Node.js mirror URL #10204.
- pnpm store prune should not fail if the store contains
Node.js packages #10131.
* Tue Nov 18 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.22.0:
* Minor Changes
- Added support for trustPolicyExclude #10164.
You can now list one or more specific packages or versions
that pnpm should allow to install, even if those packages
don't satisfy the trust policy requirement. For example:
trustPolicy: no-downgrade
trustPolicyExclude:
- chokidar@4.0.3
- webpack@4.47.0 || 5.102.1
- Allow to override the engines field on publish by the
publishConfig.engines field.
* Patch Changes
- Don't crash when two processes of pnpm are hardlinking the
contents of a directory to the same destination
simultaneously #10179.
* Tue Nov 18 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.21.0:
* Minor Changes
- Node.js Runtime Installation for Dependencies. Added support
for automatic Node.js runtime installation for dependencies.
pnpm will now install the Node.js version required by a
dependency if that dependency declares a Node.js runtime in
the "engines" field. For example:
{
"engines": {
"runtime": {
"name": "node",
"version": "^24.11.0",
"onFail": "download"
}
}
}
If the package with the Node.js runtime dependency is a CLI
app, pnpm will bind the CLI app to the required Node.js
version. This ensures that, regardless of the globally
installed Node.js instance, the CLI will use the compatible
version of Node.js.
If the package has a postinstall script, that script will be
executed using the specified Node.js version.
Related PR: #10141
- Added a new setting: trustPolicy.
When set to no-downgrade, pnpm will fail installation if a
package’s trust level has decreased compared to previous
releases — for example, if it was previously published by a
trusted publisher but now only has provenance or no trust
evidence.
This helps prevent installing potentially compromised
versions of a package.
Related issue: #8889.
- Added support for pnpm config get globalconfig to retrieve
the global config file path #9977.
* Patch Changes
- When a user runs pnpm update on a dependency that is not
directly listed in package.json, none of the direct
dependencies should be updated #10155.
- Don't crash when two processes of pnpm are hardlinking the
contents of a directory to the same destination
simultaneously #10160.
- Setting gitBranchLockfile and related settings via
pnpm-workspace.yaml should work #9651.
* Sat Nov 01 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.20.0:
* Minor Changes
- Support --all option in pnpm --help to list all commands
[#8628].
* Patch Changes
- When the latest version doesn't satisfy the maturity
requirement configured by minimumReleaseAge, pick the highest
version that is mature enough, even if it has a different
major version #10100.
- create command should not verify patch info.
- Set managePackageManagerVersions to false, when switching to
a different version of pnpm CLI, in order to avoid subsequent
switches #10063.
- update to 10.19.0:
* Minor Changes
- You can now allow specific versions of dependencies to run
postinstall scripts. onlyBuiltDependencies now accepts
package names with lists of trusted versions. For example:
Related PR: #10104.
onlyBuiltDependencies:
- nx@21.6.4 || 21.6.5
- esbuild@0.25.1
- Added support for exact versions in minimumReleaseAgeExclude
[#9985].
You can now list one or more specific versions that pnpm
should allow to install, even if those versions don’t satisfy
the maturity requirement set by minimumReleaseAge. For
example:
minimumReleaseAge: 1440
minimumReleaseAgeExclude:
- nx@21.6.5
- webpack@4.47.0 || 5.102.1
- update to 10.18.3:
* Patch Changes
- Fix a bug where pnpm would infinitely recurse when using
verifyDepsBeforeInstall: install and pre/post install scripts
that called other pnpm scripts #10060.
- Fixed scoped registry keys (e.g., @scope:registry) being
parsed as property paths in pnpm config get when
- -location=project is used #9362.
- Remove pnpm-specific CLI options before passing to npm
publish to prevent "Unknown cli config" warnings #9646.
- Fixed EISDIR error when bin field points to a directory
[#9441].
- Preserve version and hasBin for variations packages #10022.
- Fixed pnpm config set --location=project incorrectly handling
keys with slashes (auth tokens, registry settings) #9884.
- When both pnpm-workspace.yaml and .npmrc exist, pnpm config
set --location=project now writes to pnpm-workspace.yaml
(matching read priority) #10072.
- Prevent a table width error in pnpm outdated --long #10040.
- Sync bin links after injected dependencies are updated by
build scripts. This ensures that binaries created during
build processes are properly linked and accessible to
consuming projects #10057.
- update to 10.18.2:
* Patch Changes
- pnpm outdated --long should work #10040.
- Replace ndjson with split2. Reduce the bundle size of pnpm
CLI #10054.
- pnpm dlx should request the full metadata of packages, when
minimumReleaseAge is set #9963.
- pnpm version switching should work when the pnpm home
directory is in a symlinked directory #9715.
- Fix EPIPE errors when piping output to other commands #10027.
- update to 10.18.1:
* Patch Changes
- Don't print a warning, when --lockfile-only is used #8320.
- pnpm setup creates a command shim to the pnpm executable.
This is needed to be able to run pnpm self-update on Windows
[#5700].
- When using pnpm catalogs and running a normal pnpm install,
pnpm produced false positive warnings for "skip adding to the
default catalog because it already exists". This warning now
only prints when using pnpm add --save-catalog as originally
intended.
- update to 10.18.0:
* Minor Changes
- Added network performance monitoring to pnpm by implementing
warnings for slow network requests, including both metadata
fetches and tarball downloads.
Added configuration options for warning thresholds:
fetchWarnTimeoutMs and fetchMinSpeedKiBps.
Warning messages are displayed when requests exceed time
thresholds or fall below speed minimums
Related PR: #10025.
* Patch Changes
- Retry filesystem operations on EAGAIN errors #9959.
- Outdated command respects minimumReleaseAge configuration
[#10030].
- Correctly apply the cleanupUnusedCatalogs configuration when
removing dependent packages.
- Don't fail with a meaningless error when scriptShell is set
to false #8748.
- pnpm dlx should not fail when minimumReleaseAge is set
[#10037].
* Tue Sep 23 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.17.1:
* Patch Changes
- When a version specifier cannot be resolved because the versions
don't satisfy the minimumReleaseAge setting, print this
information out in the error message #9974.
- Fix state.json creation path when executing pnpm patch in a
workspace project #9733.
- When minimumReleaseAge is set and the latest tag is not mature
enough, prefer a non-deprecated version as the new latest #9987.
* Fri Sep 19 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.17:
* Minor Changes
- The minimumReleaseAgeExclude setting now supports patterns.
For instance:
minimumReleaseAge: 1440
minimumReleaseAgeExclude:
- "@eslint/*"
* Patch Changes
- Don't ignore the minimumReleaseAge check, when the package is
requested by exact version and the packument is loaded from
cache #9978.
- When minimumReleaseAge is set and the active version under a
dist-tag is not mature enough, do not downgrade to a
prerelease version in case the original version wasn't a
prerelease one #9979.
- update to 10.16.1:
* Patch Changes
- The full metadata cache should be stored not at the same
location as the abbreviated metadata. This fixes a bug where
pnpm was loading the abbreviated metadata from cache and
couldn't find the "time" field as a result #9963.
- Forcibly disable ANSI color codes when generating patch diff
[#9914].
- update to 10.16:
* Minor Changes
- There have been several incidents recently where popular
packages were successfully attacked. To reduce the risk of
installing a compromised version, we are introducing a new
setting that delays the installation of newly released
dependencies. In most cases, such attacks are discovered
quickly and the malicious versions are removed from the
registry within an hour.
- The new setting is called minimumReleaseAge. It specifies the
number of minutes that must pass after a version is published
before pnpm will install it. For example, setting
minimumReleaseAge: 1440 ensures that only packages released
at least one day ago can be installed.
- If you set minimumReleaseAge but need to disable this
restriction for certain dependencies, you can list them under
the minimumReleaseAgeExclude setting. For instance, with the
following configuration pnpm will always install the latest
version of webpack, regardless of its release time:
minimumReleaseAgeExclude:
- webpack
- Added support for finders #9946.
In the past, pnpm list and pnpm why could only search for
dependencies by name (and optionally version). For example:
pnpm why minimist
prints the chain of dependencies to any installed instance of
minimist:
verdaccio 5.20.1
├─┬ handlebars 4.7.7
│ └── minimist 1.2.8
└─┬ mv 2.1.1
└─┬ mkdirp 0.5.6
└── minimist 1.2.8
What if we want to search by other properties of a
dependency, not just its name? For instance, find all
packages that have react@17 in their peer dependencies?
This is now possible with "finder functions". Finder
functions can be declared in .pnpmfile.cjs and invoked with
the --find-by=<function name> flag when running pnpm list or
pnpm why.
Let's say we want to find any dependencies that have React 17
in peer dependencies. We can add this finder to our
.pnpmfile.cjs:
module.exports = {
finders: {
react17: (ctx) => {
return ctx.readManifest().peerDependencies?.react === "^17.0.0";
},
},
};
Now we can use this finder function by running:
pnpm why --find-by=react17
pnpm will find all dependencies that have this React in peer
dependencies and print their exact locations in the
dependency graph.
@apollo/client 4.0.4
├── @graphql-typed-document-node/core 3.2.0
└── graphql-tag 2.12.6
It is also possible to print out some additional information
in the output by returning a string from the finder. For
example, with the following finder:
module.exports = {
finders: {
react17: (ctx) => {
const manifest = ctx.readManifest();
if (manifest.peerDependencies?.react === "^17.0.0") {
return `license: ${manifest.license}`;
}
return false;
},
},
};
Every matched package will also print out the license from
its package.json:
@apollo/client 4.0.4
├── @graphql-typed-document-node/core 3.2.0
│ license: MIT
└── graphql-tag 2.12.6
license: MIT
* Patch Changes
- Fix deprecation warning printed when executing pnpm with
Node.js 24 #9529.
- Throw an error if nodeVersion is not set to an exact semver
version #9934.
- pnpm publish should be able to publish a .tar.gz file #9927.
- Canceling a running process with Ctrl-C should make pnpm run
return a non-zero exit code #9626.
- update to 10.15.1:
* Patch Changes
- Fix .pnp.cjs crash when importing subpath #9904.
- When resolving peer dependencies, pnpm looks whether the peer
dependency is present in the root workspace project's
dependencies. This change makes it so that the peer
dependency is correctly resolved even from aliased npm-hosted
dependencies or other types of dependencies #9913.
* Wed Aug 20 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.15.0:
* Minor Changes
- Added the cleanupUnusedCatalogs configuration. When set to
true, pnpm will remove unused catalog entries during
installation #9793.
- Automatically load pnpmfiles from config dependencies that
are named @*/pnpm-plugin-* #9780.
- pnpm config get now prints an INI string for an object value
[#9797].
- pnpm config get now accepts property paths (e.g. pnpm config
get catalog.react, pnpm config get .catalog.react, pnpm
config get
'packageExtensions["@babel/parser"].peerDependencies["@babel/types"]'),
and pnpm config set now accepts dot-leading or subscripted
keys (e.g. pnpm config set .ignoreScripts true).
- pnpm config get --json now prints a JSON serialization of
config value, and pnpm config set --json now parses the input
value as JSON.
* Patch Changes
- Semi-breaking. When automatically installing missing peer
dependencies, prefer versions that are already present in the
direct dependencies of the root workspace package #9835.
- When executing the pnpm create command, must verify whether
the node version is supported even if a cache already exists
[#9775].
- When making requests for the non-abbreviated packument, add
* /* to the Accept header to avoid getting a 406 error on AWS
CodeArtifact #9862.
- The standalone exe version of pnpm works with glibc 2.26
again #9734.
- Fix a regression in which pnpm dlx pkg --help doesn't pass
- -help to pkg #9823.
* Fri Aug 01 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.14.0:
* Minor Changes
- Added support for JavaScript runtime installation
(Related PR: #9755.)
Declare Node.js, Deno, or Bun in devEngines.runtime (inside
package.json) and let pnpm download and pin it automatically.
Usage example:
{
"devEngines": {
"runtime": {
"name": "node",
"version": "^24.4.0",
"onFail": "download" // we only support the "download" value for now
}
}
}
How it works:
- pnpm install resolves your specified range to the latest
matching runtime version.
- The exact version (and checksum) is saved in the lockfile.
- Scripts use the local runtime, ensuring consistency across
environments.
Why this is better:
- This new setting supports also Deno and Bun (vs. our
Node-only settings useNodeVersion and
executionEnv.nodeVersion)
- Supports version ranges (not just a fixed version).
- The resolved version is stored in the pnpm lockfile, along
with an integrity checksum for future validation of the
Node.js content's validity.
- It can be used on any workspace project (like
executionEnv.nodeVersion). So, different projects in a
workspace can use different runtimes.
- For now devEngines.runtime setting will install the runtime
locally, which we will improve in future versions of pnpm
by using a shared location on the computer.
- Add --cpu, --libc, and --os to pnpm install, pnpm add, and
pnpm dlx to customize supportedArchitectures via the CLI
[#7510].
* Patch Changes
- Fix a bug in which pnpm add downloads packages whose libc
differ from pnpm.supportedArchitectures.libc.
- The integrities of the downloaded Node.js artifacts are
verified #9750.
- Allow dlx to parse CLI flags and options between the dlx
command and the command to run or between the dlx command and
- - #9719.
- pnpm install --prod should removing hoisted dev dependencies
[#9782].
- Fix an edge case bug causing local tarballs to not re-link
into the virtual store. This bug would happen when changing
the contents of the tarball without renaming the file and
running a filtered install.
- Fix a bug causing pnpm install to incorrectly assume the
lockfile is up to date after changing a local tarball that
has peers dependencies.
* Wed Jul 09 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.13.1:
* Patch Changes
- Run user defined pnpmfiles after pnpmfiles of plugins.
- update to 10.13.0:
* Minor Changes
- Added the possibility to load multiple pnpmfiles. The pnpmfile
setting can now accept a list of pnpmfile locations #9702.
- pnpm will now automatically load the pnpmfile.cjs file from any
config dependency named @pnpm/plugin-* or pnpm-plugin-* #9729.
- The order in which config dependencies are initialized should
not matter — they are initialized in alphabetical order. If a
specific order is needed, the paths to the pnpmfile.cjs files in
the config dependencies can be explicitly listed using the
pnpmfile setting in pnpm-workspace.yaml.
* Patch Changes
- When patching dependencies installed via pkg.pr.new, treat them
as Git tarball URLs #9694.
- Prevent conflicts between local projects' config and the global
config in dangerouslyAllowAllBuilds, onlyBuiltDependencies,
onlyBuiltDependenciesFile, and neverBuiltDependencies #9628.
- Sort keys in pnpm-workspace.yaml with deep #9701.
- The pnpm rebuild command should not add pkgs included in
ignoredBuiltDependencies to ignoredBuilds in
node_modules/.modules.yaml #9338.
- Replaced shell-quote with shlex for quoting command arguments
[#9381].
* Mon Jun 30 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.12.4:
* Patch Changes
- Fix pnpm licenses command for local dependencies #9583.
- Fix a bug in which pnpm ls --filter=not-exist --json prints
nothing instead of an empty array #9672.
- Fix a deadlock that sometimes happens during peer dependency
resolution #9673.
- Running pnpm install after pnpm fetch should hoist all
dependencies that need to be hoisted.
- Fixes a regression introduced in v10.12.2 by #9648; resolves
[#9689].
* Tue Jun 24 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.12.3:
* Patch Changes
- Restore hoisting of optional peer dependencies when installing
with an outdated lockfile. Regression introduced in v10.12.2 by
[#9648]; resolves #9685.
* Mon Jun 23 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.12.2:
* Patch Changes
- Fixed hoisting with enableGlobalVirtualStore set to true #9648.
- Fix the --help and -h flags not working as expected for the pnpm
create command.
- The dependency package path output by the pnpm licenses list
- -json command is incorrect.
- Fix a bug in which pnpm deploy fails due to overridden
dependencies having peer dependencies causing
ERR_PNPM_OUTDATED_LOCKFILE #9595.
* Sun Jun 08 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.12.1 (10.2.0 was yanked):
* Minor Changes
- Experimental. Added support for global virtual stores. When
enabled, node_modules contains only symlinks to a central
virtual store, rather to node_modules/.pnpm. By default, this
central store is located at <store-path>/links (you can find
the store path by running pnpm store path).
In the central virtual store, each package is hard linked
into a directory whose name is the hash of its dependency
graph. This allows multiple projects on the system to symlink
shared dependencies from this central location, significantly
improving installation speed when a warm cache is available.
This is conceptually similar to how NixOS manages packages,
using dependency graph hashes to create isolated and
reusable package directories.
To enable the global virtual store, set
enableGlobalVirtualStore: true in your root
pnpm-workspace.yaml, or globally via:
pnpm config -g set enable-global-virtual-store true
NOTE: In CI environments, where caches are typically cold,
this setting may slow down installation. pnpm automatically
disables the global virtual store when running in CI.
Related PR: #8190
- The pnpm update command now supports updating catalog:
protocol dependencies and writes new specifiers to
pnpm-workspace.yaml.
- A new catalogMode setting is available for controlling if and
how dependencies are added to the default catalog. It can be
configured to several modes:
- strict: Only allows dependency versions from the catalog.
Adding a dependency outside the catalog's version range
will cause an error.
- prefer: Prefers catalog versions, but will fall back to
direct dependencies if no compatible version is found.
- manual (default): Does not automatically add dependencies
to the catalog.
- Added two new CLI options (--save-catalog and
- -save-catalog-name=<name>) to pnpm add to save new
dependencies as catalog entries. catalog: or catalog:<name>
will be added to package.json and the package specifier will
be added to the catalogs or catalog[<name>] object in
pnpm-workspace.yaml #9425.
- Semi-breaking. The keys used for side-effects caches have
changed. If you have a side-effects cache generated by a
previous version of pnpm, the new version will not use it and
will create a new cache instead #9605.
- Added a new setting called ci for explicitly telling pnpm if
the current environment is a CI or not.
* Patch Changes
- Sort versions printed by pnpm patch using semantic versioning
rules.
- Improve the way the error message displays mismatched
specifiers. Show differences instead of 2 whole objects
[#9598].
- Revert #9574 to fix a regression #9596.
* Mon Jun 02 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.11.1:
* Patch Changes
- Fix an issue in which pnpm deploy --legacy creates unexpected
directories when the root package.json has a workspace
package as a peer dependency #9550.
- Dependencies specified via a URL that redirects will only be
locked to the target if it is immutable, fixing a regression
when installing from GitHub releases. (#9531)
- Installation should not exit with an error if
strictPeerDependencies is true but all issues are ignored by
peerDependencyRules #9505.
- Use pnpm_config_ env variables instead of npm_config_ #9571.
- Fix a regression (in v10.9.0) causing the --lockfile-only
flag on pnpm update to produce a different pnpm-lock.yaml
than an update without the flag.
- Let pnpm deploy work in repos with overrides when
inject-workspace-packages=true #9283.
- Fixed the problem of path loss caused by parsing URL address.
Fixes a regression shipped in pnpm v10.11 via #9502.
- pnpm -r --silent run should not print out section #9563.
* Tue May 20 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- add Requires for nodejs(abi) >= 18
* Wed May 14 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.11.0:
* Minor Changes
- A new setting added for pnpm init to create a package.json
with type=module, when init-type is module. Works as a flag
for the init command too #9463.
- Added support for Nushell to pnpm setup #6476.
- Added two new flags to the pnpm audit command, --ignore and
- -ignore-unfixable #8474.
Ignore all vulnerabilities that have no solution:
> pnpm audit --ignore-unfixable
Provide a list of CVE's to ignore those specifically, even if
they have a resolution.
> pnpm audit --ignore=CVE-2021-1234 --ignore=CVE-2021-5678
- Added support for recursively running pack in every project
of a workspace #4351.
Now you can run pnpm -r pack to pack all packages in the
workspace.
* Patch Changes
- pnpm version management should work, when
dangerouslyAllowAllBuilds is set to true #9472.
- pnpm link should work from inside a workspace #9506.
- Set the default workspaceConcurrency to
Math.min(os.availableParallelism(), 4) #9493.
- Installation should not exit with an error if
strictPeerDependencies is true but all issues are ignored by
peerDependencyRules #9505.
- Read updateConfig from pnpm-workspace.yaml #9500.
- Add support for recursive pack
- Remove url.parse usage to fix warning on Node.js 24 #9492.
- pnpm run should be able to run commands from the workspace
root, if ignoreScripts is set tot true #4858.
* Sun May 11 2025 Avindra Goolcharan <avindra@opensuse.org>
- update to 10.10.0:
* Allow loading the preResolution, importPackage, and fetchers
hooks from local pnpmfile.
* Fix cd command, when shellEmulator is true #7838.
* Sort keys in pnpm-workspace.yaml #9453.
* Pass the npm_package_json environment variable to the
executed scripts #9452.
* Fixed a mistake in the description of the --reporter=silent
option.
* Mon Apr 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.9.0:
* Minor Changes
- Added support for installing JSR packages. You can now
install JSR packages using the following syntax:
add jsr:<pkg_name>
or with a version range:
pnpm add jsr:<pkg_name>@<range>
For example, running:
pnpm add jsr:@foo/bar
will add the following entry to your package.json:
{
"dependencies": {
"@foo/bar": "jsr:^0.1.2"
}
}
When publishing, this entry will be transformed into a format
compatible with npm, older versions of Yarn, and previous
pnpm versions:
{
"dependencies": {
"@foo/bar": "npm:@jsr/foo__bar@^0.1.2"
}
}
Related issue: #8941.
Note: The @jsr scope defaults to https://npm.jsr.io/ if the
@jsr:registry setting is not defined.
- Added a new setting, dangerouslyAllowAllBuilds, for
automatically running any scripts of dependencies without the
need to approve any builds. It was already possible to allow
all builds by adding this to pnpm-workspace.yaml:
neverBuiltDependencies: []
dangerouslyAllowAllBuilds has the same effect but also allows
to be set globally via:
pnpm config set dangerouslyAllowAllBuilds true
It can also be set when running a command:
pnpm install --dangerously-allow-all-builds
* Patch Changes
- Fix a false negative in verifyDepsBeforeRun when nodeLinker
is hoisted and there is a workspace package without
dependencies and node_modules directory #9424.
- Explicitly drop verifyDepsBeforeRun support for nodeLinker:
pnp. Combining verifyDepsBeforeRun and nodeLinker: pnp will
now print a warning.
* Mon Apr 14 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- udate to 10.8.1:
* Patch Changes
- Removed bright white highlighting, which didn't look good on
some light themes #9389.
- If there is no pnpm related configuration in package.json,
onlyBuiltDependencies will be written to pnpm-workspace.yaml
file #9404.
- The patch file path saved by the pnpm patch-commit and
patch-remove commands should be a relative path #9403.
* Tue Apr 08 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.8:
* Minor Changes
Experimental. A new hook is supported for updating
configuration settings. The hook can be provided via
.pnpmfile.cjs. For example:
module.exports = {
hooks: {
updateConfig: (config) => ({
...config,
nodeLinker: "hoisted",
}),
},
};
Now you can use the pnpm add command with the --config flag
to install new configurational dependencies #9377.
* Patch Changes
- Do not hang indefinitely, when there is a glob that starts
with !/ in pnpm-workspace.yaml. This fixes a regression
introduced by #9169.
- pnpm audit --fix should update the overrides in
pnpm-workspace.yaml.
- pnpm link should update overrides in pnpm-workspace.yaml, not
in package.json #9365.
* Tue Apr 01 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.7.1:
* Patch Changes
- pnpm config set should convert the settings to their correct
type before adding them to pnpm-workspace.yaml #9355.
- pnpm config get should read auth related settings via npm CLI
[#9345].
- Replace leading ~/ in a path in .npmrc with the home directory
[#9217].
* Wed Mar 26 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.7:
* Minor Changes
- pnpm config get and list also show settings set in
pnpm-workspace.yaml files #9316.
- It should be possible to use env variables in
pnpm-workspace.yaml setting names and value.
- Add an ability to patch dependencies by version ranges. Exact
versions override version ranges, which in turn override
name-only patches. Version range * is the same as name-only,
except that patch application failure will not be ignored.
For example:
patchedDependencies:
foo: patches/foo-1.patch
foo@^2.0.0: patches/foo-2.patch
foo@2.1.0: patches/foo-3.patch
The above configuration would apply patches/foo-3.patch to
foo@2.1.0, patches/foo-2.patch to all foo versions which
satisfy ^2.0.0 except 2.1.0, and patches/foo-1.patch to the
remaining foo versions.
[!WARNING]
The version ranges should not overlap. If you want to
specialize a sub range, make sure to exclude it from the
other keys. For example:
[#] pnpm-workspace.yaml
patchedDependencies:
[#] the specialized sub range
'foo@2.2.0-2.8.0': patches/foo.2.2.0-2.8.0.patch
[#] the more general patch, excluding the sub range above
'foo@>=2.0.0 <2.2.0 || >2.8.0': 'patches/foo.gte2.patch
In most cases, however, it's sufficient to just define an
exact version to override the range.
- pnpm config set --location=project saves the setting to a
pnpm-workspace.yaml file if no .npmrc file is present in the
directory #9316.
- Rename pnpm.allowNonAppliedPatches to
pnpm.allowUnusedPatches. The old name is still supported but
it would print a deprecation warning message.
- Add pnpm.ignorePatchFailures to manage whether pnpm would
ignore patch application failures.
- If ignorePatchFailures is not set, pnpm would throw an
error when patches with exact versions or version ranges
fail to apply, and it would ignore failures from name-only
patches.
- If ignorePatchFailures is explicitly set to false, pnpm
would throw an error when any type of patch fails to apply.
- If ignorePatchFailures is explicitly set to true, pnpm
would print a warning when any type of patch fails to
apply.
* Patch Changes
- Remove dependency paths from audit output to prevent
out-of-memory errors #9280.
* Wed Mar 19 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.6.5:
* Patch Changes
- Remove warnings after having explicitly approved no builds
[#9296].
- When installing different dependency packages, should retain
the ignoredBuilds field in the .modules.yaml file #9240.
- Fix usages of the catalog: protocol in injected local
workspace packages. This previously errored with
ERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER. #8715
- Setting workspace-concurrency to less than or equal to 0
should work #9297.
* Mon Mar 17 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.6.4:
* Patch Changes
- Fix pnpm dlx with --allow-build flag #9263.
- Invalid Node.js version in use-node-version should not cause
pnpm itself to break #9276.
- The max amount of workers running for linking packages from
the store has been reduced to 4 to achieve optimal results
[#9286]. The workers are performing many file system
operations, so increasing the number of CPUs doesn't help
performance after some point.
* Thu Mar 13 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.6.3:
* Patch Changes
- pnpm install --prod=false should not crash, when executed in
a project with a pnpm-workspace.yaml file #9233. This fixes
regression introduced via #9211.
- Add the missing node-options config to recursive run #9180.
- Removed a branching code path that only executed when
dedupe-peer-dependents=false. We believe this internal
refactor will not result in behavior changes, but we expect
it to make future pnpm versions behave more consistently for
projects that override dedupe-peer-dependents to false. There
should be less unique bugs from turning off
dedupe-peer-dependents.
See details in #9259.
* Mon Mar 10 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.6.2:
* Patch Changes
- pnpm self-update should always update the version in the
packageManager field of package.json.
- Fix running pnpm CLI from pnpm CLI on Windows when the CLI is
bundled to an executable #8971.
- pnpm patch-commit will now use the same filesystem as the
store directory to compare and create patch files.
- Don't show info output when --loglevel=error is used.
- peerDependencyRules should be set in pnpm-workspace.yaml to
take effect.
* Fri Mar 07 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.6.1:
* Patch Changes
- The pnpm CLI process should not stay hanging, when --silent
reporting is used.
- When --loglevel is set to error, don't show installation
summary, execution time, and big tarball download progress.
- Don't ignore pnpm.patchedDependencies from package.json
[#9226].
- When executing the approve-builds command, if package.json
contains onlyBuiltDependencies or ignoredBuiltDependencies,
the selected dependency package will continue to be written
into package.json.
- When a package version cannot be found in the package
metadata, print the registry from which the package was
fetched.
* Thu Mar 06 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.6.0:
* Minor Changes
- pnpm-workspace.yaml can now hold all the settings that .npmrc
accepts. The settings should use camelCase #9211.
pnpm-workspace.yaml example:
verifyDepsBeforeRun: install
optimisticRepeatInstall: true
publicHoistPattern:
- "*types*"
- "!@types/react"
- Projects using a file: dependency on a local tarball file
(i.e. .tgz, .tar.gz, .tar) will see a performance improvement
during installation. Previously, using a file: dependency on
a tarball caused the lockfile resolution step to always run.
The lockfile will now be considered up-to-date if the tarball
is unchanged.
* Patch Changes
- pnpm self-update should not leave a directory with a broken
pnpm installation if the installation fails.
- fast-glob replace with tinyglobby to reduce the size of the
pnpm CLI dependencies #9169.
- pnpm deploy should not remove fields from the deployed
package's package.json file #9215.
- pnpm self-update should not read the pnpm settings from the
package.json file in the current working directory.
- Fix pnpm deploy creating a package.json without the imports
and license field #9193.
- pnpm update -i should list only packages that have newer
versions #9206.
- Fix a bug causing entries in the catalogs section of the
pnpm-lock.yaml file to be removed when
dedupe-peer-dependents=false on a filtered install. #9112
* Thu Feb 27 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.5.2:
* The pnpm config set command should change the global .npmrc
file by default.
This was a regression introduced by #9151 and shipped in pnpm
v10.5.0.
* Wed Feb 26 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 10.5.1:
* Throw an error message if a pnpm-workspaces.yaml or
pnpm-workspaces.yml file is found instead of a
pnpm-workspace.yaml #9170.
* Fix the update of pnpm-workspace.yaml by the pnpm
approve-builds command #9168.
* Normalize generated link paths in package.json #9163
* Specifying overrides in pnpm-workspace.yaml should work.
* pnpm dlx should ignore settings from the package.json file in
the current working directory #9178.
* Tue Feb 25 2025 Avindra Goolcharan <avindra@opensuse.org>
- update to 10.5.0:
* The pnpm.* settings from package.json can now be specified in
the pnpm-workspace.yaml file instead #9121.
* Added support for automatically syncing files of injected
workspace packages after pnpm run #9081. Use the sync-injected
- deps-after-scripts setting to specify which scripts build
the workspace package. This tells pnpm when syncing is needed.
The setting should be defined in a .npmrc file at the root of
the workspace.
* The packages field in pnpm-workspace.yaml became optional.
* pnpm link with no parameters should work as if --global is
specified #9151
* Allow scope registry CLI option without --config. prefix such
as --@scope:registry=https://scope.example.com/npm #9089
* pnpm link <path> should calculate relative path from the root
of the workspace directory #9132
* Fix a bug causing catalog snapshots to be removed from the
pnpm-lock.yaml file when using --fix-lockfile and --filter. #8639
* Fix a bug causing catalog protocol dependencies to not re-
resolve on a filtered install #8638
* Mon Feb 17 2025 Avindra Goolcharan <avindra@opensuse.org>
- update to 10.4.1:
* Throws an error when the value provided by the --allow-build
option overlaps with the pnpm.ignoredBuildDependencies list #9105.
* Print pnpm's version after the execution time at the end of the console output.
* Print warning about ignored builds of dependencies on repeat install #9106.
* Setting init-package-manager should work.
- includes 10.4.0:
* pnpm approve-builds --global works now for allowing
dependencies of globally installed packages to run
postinstall scripts.
* The pnpm add command now supports a new flag, --allow-build,
which allows building the specified dependencies.
* pnpm approve-builds should work after two consecutive pnpm install runs #9083.
* Fix instruction for updating pnpm with corepack #9101.
* The pnpm version specified by packageManager cannot start with v.
* Tue Feb 11 2025 Avindra Goolcharan <avindra@opensuse.org>
- update to 10.3.0:
* Added a new setting called strict-dep-builds. When enabled,
the installation will exit with a non-zero exit code if any
dependencies have unreviewed build scripts (aka postinstall scripts) #9071.
* Fix a false negative of verify-deps-before-run after pnpm
install --production|--no-optional #9019.
* Print the warning about blocked installation scripts at the
end of the installation output and make it more prominent.
* Sat Feb 08 2025 Avindra Goolcharan <avindra@opensuse.org>
- update to 10.2.1:
* Don't read a package from side-effects cache if it isn't
allowed to be built #9042.
* pnpm approve-builds should work, when executed from a
subdirectory of a workspace #9042.
* pnpm deploy --legacy should work without injected dependencies
* Add information about how to deploy without "injected
dependencies" to the "pnpm deploy" error message.
- includes 10.2.0:
* Packages executed via pnpm dlx and pnpm create are allowed to
be built (run postinstall scripts) by default.
* Quote args for scripts with shell-quote to support new lines
(on POSIX only) #8980.
* Fix a bug in which pnpm deploy fails to read the correct
projectId when the deploy source is the same as the workspace directory #9001.
* Proxy settings should be respected, when resolving Git-hosted
dependencies #6530.
* Prevent overrides from adding invalid version ranges to
peerDependencies by keeping the peerDependencies and
overriding them with prod dependencies #8978.
* Sort the package names in the "pnpm.onlyBuiltDependencies"
list saved by pnpm approve-builds.
* Fri Jan 31 2025 Avindra Goolcharan <avindra@opensuse.org>
- update to 10.1.0:
* Added a new command for printing the list of dependencies
with ignored build scripts: pnpm ignored-builds #8963.
* Added a new command for approving dependencies for running
scripts during installation: pnpm approve-builds #8963.
* Added a new setting called optimistic-repeat-install. When
enabled, a fast check will be performed before proceeding to
installation. This way a repeat install or an install on a
project with everything up-to-date becomes a lot faster. But
some edge cases might arise, so we keep it disabled by
default for now #8977.
* Added a new field "pnpm.ignoredBuiltDependencies" for
explicitly listing packages that should not be built. When a
package is in the list, pnpm will not print an info message
about that package not being built #8935.
* Verify that the package name is valid when executing the
publish command.
* When running pnpm install, the preprepare and postprepare
scripts of the project should be executed #8989.
* Allow workspace: and catalog: to be part of wider version
range in peerDependencies.
* pnpm deploy should inherit the pnpm object from the root
package.json #8991.
* Make sure that the deletion of a node_modules in a sub-
project of a monorepo is detected as out-of-date #8959.
* Fix infinite loop caused by lifecycle scripts using pnpm to
execute other scripts during pnpm install with
verify-deps-before-run=install #8954.
* Replace strip-ansi with the built-in util.
stripVTControlCharacters #9009.
* Do not print patched dependencies as ignored dependencies
that require a build #8952.
* Fri Jan 10 2025 Avindra Goolcharan <avindra@opensuse.org>
- update to 10.0.0:
* Lifecycle scripts of dependencies are not executed during
installation by default! This is a breaking change aimed at
increasing security. In order to allow lifecycle scripts of
specific dependencies, they should be listed in the pnpm
onlyBuiltDependencies field of package.json #8897
* The pnpm link command now adds overrides to the root package.json. #8653
* Secure hashing with SHA256
* Configuration updates
* Changes to the global store
* The # character is now escaped in directory names within
node_modules/.pnpm. #8557
* Running pnpm add --global pnpm or pnpm add --global @pnpm/exe
now fails with an error message, directing you to use pnpm
self-update instead. #8728
* Dependencies added via a URL now record the final resolved
URL in the lockfile, ensuring that any redirects are fully
captured. #8833
* The pnpm deploy command now only works in workspaces that
have inject-workspace-packages=true. This limitation is
introduced to allow us to create a proper lockfile for the
deployed project using the workspace lockfile.
* Removed conversion from lockfile v6 to v9. If you need v6-to-
v9 conversion, use pnpm CLI v9.
* pnpm test now passes all parameters after the test keyword
directly to the underlying script. This matches the behavior
of pnpm run test. Previously you needed to use the -- prefix. #8619
* node-gyp updated to version 11.
* pnpm deploy now tries creating a dedicated lockfile from a
shared lockfile for deployment. It will fallback to
deployment without a lockfile if there is no shared lockfile
or force-legacy-deploy is set to true.
* Added support for a new type of dependencies called
"configurational dependencies". These dependencies are
installed before all the other types of dependencies (befor
"dependencies", "devDependencies", "optionalDependencies").
* New verify-deps-before-run setting. This setting controls how
pnpm checks node_modules before running scripts #8836
* On repeated installs, pnpm performs a quick check to ensure
node_modules is up to date. #8838
* pnpm add integrates with default workspace catalog: #8640
* pnpm dlx now resolves packages to their exact versions and
uses these exact versions for cache keys. This ensures pnpm
dlx always installs the latest requested packages #8811
* No node_modules validation on certain commands. Commands that
should not modify node_modules (e.g., pnpm install --lockfile-
only) no longer validate or purge node_modules. #8657
* for full changes, see https://github.com/pnpm/pnpm/releases/tag/v10.0.0
* Mon Jan 06 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 9.15.3:
* Fixed the Regex used to find the package manifest during
packing #8938.
* pnpm update --filter <pattern> --latest <pkg> should only
change the specified package for the specified workspace, when
dedupe-peer-dependents is set to true #8877.
* Exclude .DS_Store file at patch-commit #8922.
* Fix a bug in which pnpm patch is unable to bring back old patch
without specifying @version suffix #8919.
* Mon Dec 30 2024 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 9.15.2:
* Fixed publish/pack error with workspace dependencies with
relative paths #8904. It was broken in v9.4.0 (398472c).
* Use double quotes in the command suggestion by pnpm patch on
Windows #7546.
* Do not fall back to SSH, when resolving a git-hosted package if
git ls-remote works via HTTPS #8906.
* Improve how packages with blocked lifecycle scripts are
reported during installation. Always print the list of ignored
scripts at the end of the output. Include a hint about how to
allow the execution of those packages.
* Sun Dec 22 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.15.1:
* pnpm remove should not link dependencies from the workspace,
when link-workspace-packages is set to false #7674
* Installation with hoisted node_modules should not fail, when
a dependency has itself in its own peer dependencies #8854
* Sat Dec 07 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.15.0:
* Metadata directory version bumped to force fresh cache after
we shipped a fix to the metadata write function. This change
is backward compatible as install doesn't require a metadata cache
* pnpm update --global should not crash if there are no any
global packages installed #7898
* Fix an exception when running pnpm update --interactive if
catalogs are used.
* Sat Nov 30 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.14.4:
* Don't ever save mutated metadata to the metadata cache
- includes 9.14.3:
* Some commands should ignore the packageManager field check of
package.json #7959
* Wed Nov 20 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.14.2:
pnpm publish --json should work #8788
- includes 9.14.1:
* Added support for pnpm pack --json to print packed tarball
and contents in JSON format #8765
* pnpm exec should print a meaningful error message when no
command is provided #8752
* pnpm setup should remove the CLI from the target location
before moving the new binary #8173
* Fix ERR_PNPM_TARBALL_EXTRACT error while installing a
dependency from GitHub having a slash in branch name #7697
* Don't crash if the use-node-version setting is used and the
system has no Node.js installed #8769
* Convert settings in local .npmrc files to their correct types.
For instance, child-concurrency should be a number, not a string #5075
* pnpm should fail if a project requires a different package
manager even if manage-package-manager-versions is set to true
* pnpm init should respect the --dir option #8768
- includes 9.14.0:
* chore: use verify-deps-before-run
* fix(init): --dir option should be respected (#8768)
* feat: support json format output in pnpm pack (#8765)
* fix: pnpm exec should specify command (#8774)
* fix: proper types of settings in local .npmrc files (#8775)
* fix: ERR_PNPM_TARBALL_EXTRACT when the URL's hash contains a slash
* fix: the CLI should fail if a different package manager is
required by the project
* fix: ETXTBSY error on running setup (#8780)
* feat: add linux-riscv64 build (#8779)
* fix: remove link to X from update notifier (#8773)
* docs: update sponsors
* fix: upgrade cross-sapwn (#8782)
* fix: don't crash when use-node-version is set and there is no node.js
* docs: update changesets
* Sat Nov 16 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.13.2:
* Detection of circular peer dependencies should not crash with
aliased dependencies #8759. Fixes a regression introduced in
the previous version.
* Fix race condition of symlink creations caused by multiple
parallel dlx processes.
* Thu Nov 14 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.13.1:
* Fixed some edge cases where resolving circular peer
dependencies caused a dead lock #8720
* Wed Nov 13 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.13.0:
* The self-update now accepts a version specifier to install a
specific version of pnpm.
* Fix Cannot read properties of undefined (reading 'name') that
is printed while trying to render the missing peer
dependencies warning message #8538
* Fri Nov 08 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.12.3:
* Don't purge node_modules, when typing "n" in the prompt that
asks whether to remove node_modules before installation #8655
* Fix a bug causing pnpm to infinitely spawn itself when manage-
package-manager-versions=true is set and the .tools directory is corrupt
* Use crypto.hash, when available, for improved performance #8629
* Fixed a race condition in temporary file creation in the
store by including worker thread ID in filename. Previously,
multiple worker threads could attempt to use the same
temporary file. Temporary files now include both process ID
and thread ID for uniqueness #8703
* All commands should read settings from the package.json at
the root of the workspace #8667
* When manage-package-manager-versions is set to true, errors
spawning a self-managed version of pnpm will now be shown
(instead of being silent)
* Pass the find command to npm, it is an alias for npm search
- includes 9.12.2:
* When checking whether a file in the store has executable
permissions, the new approach checks if at least one of the
executable bits (owner, group, and others) is set to 1.
Previously, a file was incorrectly considered executable only
when all the executable bits were set to 1. This fix ensures
that files with any executable permission, regardless of the
user class, are now correctly identified as executable #8546
* Tue Oct 08 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.12.1:
* pnpm update --latest should not update the automatically
installed peer dependencies #6657
* pnpm publish should be able to publish from a local tarball #7950
* Prevent EBUSY errors caused by creating symlinks in parallel
dlx processes #8604
* Fix maximum call stack size exceeded error related to
circular workspace dependencies #8599
* Fri Oct 04 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.12.0:
* Fix peer dependency resolution dead lock #8570. This change
might change some of the keys in the snapshots field inside
pnpm-lock.yaml but it should happen very rarely.
* pnpm outdated command supports now a --sort-by=name option
for sorting outdated dependencies by package name #8523
* Added the ability for overrides to remove dependencies by
specifying "-" as the field value #8572
* Fixed an issue where pnpm list --json pkg showed "private":
false for a private package #8519
* Packages with libc that differ from pnpm.
supportedArchitectures.libc are not downloaded #7362
* Prevent ENOENT errors caused by running store prune in parallel #8586
* Add issues alias to pnpm bugs #8596
* Sat Sep 21 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.11.0:
* Experimental: added pnpm cache commands for inspecting the
metadata cache #8512
* Fix a regression in which pnpm deploy with node-linker=hoisted
produces an empty node_modules directory #6682
* pnpm deploy should work in workspace with shared-workspace-lockfile=false #8475
* Don't print a warning when linking packages globally #4761
* Wed Sep 11 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.10.0:
* Support for a new CLI flag, --exclude-peers, added to the
list and why commands. When --exclude-peers is used, peer
dependencies are not printed in the results, but dependencies
of peer dependencies are still scanned #8506.
* Added a new setting to package.json at pnpm.auditConfig.
ignoreGhsas for ignoring vulnerabilities by their GHSA code #6838.
* Throw an exception if pnpm switches to the same version of itself.
* Reduce memory usage during peer dependencies resolution.
* Mon Sep 02 2024 Virinas-code <Virinas-code@opensuse.org>
- update to version 9.9.0:
* https://github.com/pnpm/pnpm/compare/v9.8.0...v9.9.0
* Minor breaking change. We had to optimize how we resolve peer
dependencies in order to fix some infinite loops and
out-of-memory errors during peer dependencies resolution.
* pnpm deploy should write the node_modules/.modules.yaml to the
node_modules directory within the deploy directory #7731
* Don't override a symlink in node_modules if it already points
to the right location pnpm/symlink-dir#54
- changes from 9.8.0:
* https://github.com/pnpm/pnpm/compare/v9.7.1...v9.8.0
* Added a new command for upgrading pnpm itself when it isn't
managed by Corepack: pnpm self-update. This command will work,
when pnpm was installed via the standalone script from the pnpm
installation page #8424
* CLI tools installed in the root of the workspace should be
added to the PATH, when running scripts and use-node-version is
set
* pnpm setup should never switch to another version of pnpm
* Ignore non-string value in the os, cpu, libc fields, which
checking optional dependencies #8431
* Remember the state of edit dir, allow running pnpm patch-commit
the second time without having to re-run pnpm patch
- changes from 9.7.1:
* https://github.com/pnpm/pnpm/compare/v9.7.0...v9.7.1
* Fixed passing public-hoist-pattern and hoist-pattern via env
variables #8339
* pnpm setup no longer creates Batch/Powershell scripts on Linux
and macOS #8418
* When dlx uses cache, use the real directory path not the
symlink to the cache #8421
* pnpm exec now supports executionEnv #8356
* Remove warnings for non-root pnpm field, add warnings for
non-root pnpm subfields that aren't executionEnv #8143
* Replace semver in "peerDependency" with workspace protocol
[#8355]
* Fix a bug in patch-commit in which relative path is rejected
[#8405]
* Update Node.js in @pnpm/exe to v20
- changes from 9.7.0:
* https://github.com/pnpm/pnpm/compare/v9.6.0...v9.7.0
* Added pnpm version management. If the
manage-package-manager-versions setting is set to true, pnpm
will switch to the version specified in the packageManager
field of package.json #8363
* Added the ability to apply patch to all versions #8337
* Change the default edit dir location when running pnpm patch
from a temporary directory to
node_modules/.pnpm_patches/pkg[@version] to allow the code
editor to open the edit dir in the same file tree as the main
project #8379.
* Substitute environment variables in config keys #6679
* pnpm install should run node-gyp rebuild if the project has a
binding.gyp file even if the project doesn't have an install
script #8293
* Print warnings to stderr #8342
* Peer dependencies of optional peer dependencies should be
automatically installed #8323
* Thu Jul 25 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.6.0:
* Support specifying node version (via pnpm.executionEnv.nodeVersion
in package.json) for running lifecycle scripts per each package
in a workspace #6720
* Overrides now support the catalogs: protocol #8303
* The pnpm deploy command now supports the catalog: protocol #8298
* The pnpm outdated command now supports the catalog: protocol #8304
* Correct the error message when trying to run pnpm patch
without node_modules/.modules.yaml #8257
* Silent reporting fixed with the pnpm exec command #7608
* Add registries information to the calculation of dlx cache hash #8299
* Tue Jul 09 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.5.0:
* Added support for catalogs #8122
* Read authentication information from .npmrc in the current
directory when running dlx #7996
* Updated @pnpm/tabtab to v0.5.4, enabling zsh autocomplete
lazy loading #8236
* Installation with filtering will now work, when dedupe-peer-
dependents is set to true #6300
* Fixed dlx not actually using the Node.js version specified by
- -use-node-version.
* Sat Jul 06 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.4.0:
* Some registries allow the exact same content to be published
under different package names and/or versions. This breaks
the validity checks of packages in the store. To avoid errors
when verifying the names and versions of such packages in the
store, you may now set the strict-store-pkg-content-check
setting to false #4724
* Fix package-manager-strict-version missing in config #8195
* If install is performed on a subset of workspace projects,
always create an up-to-date lockfile first. So, a partial
install can be performed only on a fully resolved (non-partial)
lockfile #8165
* Handle workspace protocol with any semver range specifier,
when used in peer dependencies #7578
* Fri Jun 14 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.3.0:
* Semi-breaking. Dependency key names in the lockfile are
shortened if they are longer than 1000 characters. We don't
expect this change to affect many users. Affected users most
probably can't run install successfully at the moment. This
change is required to fix some edge cases in which installation
fails with an out-of-memory error or "Invalid string length
(RangeError: Invalid string length)" error. The max allowed
length of the dependency key can be controlled with the peers-
suffix-max-length setting #8177.
* Set reporter-hide-prefix to true by default for pnpm exec. In
order to show prefix, the user now has to explicitly set reporter
- hide-prefix=false #8174.
- changes from 9.2.0:
* If package-manager-strict-version is set to true, pnpm will
fail if its version doesn't exactly match the version in the
"packageManager" field of package.json.
* Update @yarnpkg/pnp to the latest version, fixing issue with
node: imports #8161.
* Deduplicate bin names to prevent race condition and corrupted
bin scripts #7833.
* pnpm doesn't fail if its version doesn't match the one
specified in the "packageManager" field of package.json #8087.
* exec now also streams prefixed output when --recursive or
- -parallel is specified just as run does #8065.
- changes from 9.1.4:
* Improved the performance of the resolution stage by changing
how missing peer dependencies are detected #8144.
- changes from 9.1.3:
* Fix a bug in which a dependency that is both optional for one
package but non-optional for another is omitted when optional=false #8066.
* Clear resolution cache before starting peer dependencies resolution #8109.
* Reduce memory usage by peer dependencies resolution #8072.
* Tue May 21 2024 draskmont@protonmail.com
- update to version 9.1.2
- require nodejs >= 18
* Sat Apr 27 2024 Avindra Goolcharan <avindra@opensuse.org>
- update to version 9.0.6:
* Lockfiles that have git-hosted dependencies specified should
be correctly converted to the new lockfile format #7990.
* Don't upgrade the lockfile format on pnpm install
- -frozen-lockfile #7991.
- includes version 9.0.5:
* Lockfiles with local or git-hosted dependencies are now
successfully converted to the new lockfile format #7955.
* Resolve peer dependencies correctly, when they have
prerelease versions #7977.
* Fix aliased dependencies resolution on repeat install with
existing lockfile, when the aliased dependency doesn't
specify a version or range #7957.
* The lockfile should be saved in the new format even if it is
up-to-date.
- run spec-cleaner
* Sat Apr 20 2024 draskmont@protonmail.com
- update to version 9.0.4
- Added shell completion subpackages for bash, zsh and fish
- Removed python2 dependency
- Prevent packaging of executable files for other OS.
- Cleaned up specfile:
* Removed some unused tags, macros and redudant requirements
* Added licensing header
* Fixed rpmlint errors and warnings
- Removed unused _service file
- Restored changelog
* Thu Jan 25 2024 Marcel Kuehlhorn <tux93@opensuse.org>
- update to version 8.14.3
* https://github.com/pnpm/pnpm/compare/v8.4.0...v8.14.3
/usr/share/bash-completion /usr/share/bash-completion/completions /usr/share/bash-completion/completions/pnpm
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Aug 2 03:14:27 2026