Zum Inhalt springen
verdict:

pnpm 11.26.0

notable

Release Notes

note: die Zusammenfassung und die Release Notes sind auf Englisch

warning: Eingriff nötig

1 Breaking Change5 Kernpunkte

Catalogs gain workspace protocol support and pnpm change check arrives, alongside many install and config fixes.

Zusammenfassung · nur aus den Release Notes · claude-haiku-5-5 · prompt v7

breaking changesalle zitiert, jeder mit einer Lösung

breaking[1]: Changing publishConfig.linkDirectory now relinks workspace packages, and frozen installs fail until the lockfile is regenerated.

release-notes:31
pnpm install now relinks workspace packages when publishConfig.linkDirectory changes. Frozen installs require the lockfile to be regenerated #14488.

help: Regenerate the lockfile before running frozen installs after changing publishConfig.linkDirectory.

Kernpunkte

release-notesgithub.com/pnpm/pnpm · 177 Zeilen
  1. ## Minor Changes
  3. * Catalogs can now resolve workspace dependencies through the `workspace:` protocol.
  5. * `pnpm remove` and `pnpm update` now accept `--trust-lockfile`, `--no-trust-lockfile`, `--trust-policy`, `--trust-policy-exclude`, and `--trust-policy-ignore-after`. `pnpm remove` checks the whole lockfile against the active policies unless `--trust-lockfile` is set.
  7. * Added `pnpm change check` for CI validation of package versions against the `versioning.epics` bands and `versioning.fixed` groups in `pnpm-workspace.yaml`.
  9. ## Patch Changes
  11. * Fetch and tarball errors and retry logs now hide URL credentials, query strings, and fragments that could expose secrets.
  13. * Fixed a race during config dependency updates that could redirect a lockfile write through a symlink [#14322](https://github.com/pnpm/pnpm/issues/14322).
  15. * `pnpm add --allow-build=!<pkg>` now correctly denies builds, including in global installs. `pnpm approve-builds <pkg>` and `pnpm approve-builds !<pkg>` now save decisions even when the package is not awaiting approval, with a warning [#14067](https://github.com/pnpm/pnpm/issues/14067).
  17. * Fixed `pnpm audit --fix` failing without a value or when followed by another flag. `pnpm audit --fix=override` now respects `saveExact` and `savePrefix` when writing overrides [#13261](https://github.com/pnpm/pnpm/issues/13261), [#11523](https://github.com/pnpm/pnpm/issues/11523).
  19. * `pnpm audit` now excludes ignored advisories from vulnerability totals and severity counts, and reports them separately [#14535](https://github.com/pnpm/pnpm/issues/14535).
  21. * `pnpm deploy` no longer requires `injectWorkspacePackages`. If a workspace dependency's peer has multiple possible versions, deployment reports `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER` with the conflicting versions. Pin the peer with `overrides` to deploy without injection [#9386](https://github.com/pnpm/pnpm/issues/9386).
  23. * Fixed concurrent installs sharing a store occasionally failing with an `ENOENT` error while importing a package file [#14353](https://github.com/pnpm/pnpm/issues/14353).
  25. * Fixed installation failures when a linked local dependency provides a peer dependency also provided by an ancestor, including with `pnpm deploy --legacy`.
  27. * `pnpm install --node-linker=hoisted` no longer downloads skipped optional dependencies when `node_modules` already exists [#14139](https://github.com/pnpm/pnpm/issues/14139).
  29. * Fixed `pnpm install` rejecting a symlinked lockfile when config dependencies are unchanged. Updates to config dependencies also preserve lockfiles with a byte order mark. Writes through symlinked lockfiles remain blocked [#14372](https://github.com/pnpm/pnpm/issues/14372).
  31. * `pnpm install` now relinks workspace packages when `publishConfig.linkDirectory` changes. Frozen installs require the lockfile to be regenerated [#14488](https://github.com/pnpm/pnpm/issues/14488).
  33. * Auto-installed optional peers now satisfy their declared range even when the workspace root uses a version outside that range [#13867](https://github.com/pnpm/pnpm/issues/13867).
  35. * Fixed global virtual store paths for dependency cycles to consistently account for the runtime engine when dependencies have allowed builds [#14341](https://github.com/pnpm/pnpm/issues/14341).
  37. * Standalone installations now preserve the bundled `node-gyp` files needed to build native dependencies.
  39. * Downloaded runtimes are now available to dependency lifecycle scripts during installation.
  41. * Node.js downloads from `nodeDownloadMirrors` now use URL-scoped npm credentials, including bearer tokens, basic auth, and `tokenHelper` [#14334](https://github.com/pnpm/pnpm/issues/14334).
  43. * Fixed `globalDir` and `globalBinDir` handling in global configuration and environment variables, including `~/` expansion. This fixes `pnpm add -g` failing after `pnpm config set -g global-bin-dir` [#14336](https://github.com/pnpm/pnpm/issues/14336).
  45. * The JavaScript pnpm can again switch to the project's pinned pnpm version on hosts without a matching native binary. If the requested version requires an unavailable native binary, the error now identifies the unsupported host [#13622](https://github.com/pnpm/pnpm/issues/13622).
  47. * Global `pnpm config` commands now skip project package manager version switching, allowing authentication to be configured before downloading the pinned version [#14463](https://github.com/pnpm/pnpm/issues/14463).
  49. * `pnpm self-update`, `pnpm with`, and automatic version switching no longer wait through registry retries when a configured registry has no signatures and `registry.npmjs.org` is unavailable [#14483](https://github.com/pnpm/pnpm/issues/14483).
  51. * Fixed argument forwarding on Windows with `shellEmulator` enabled. Trailing backslashes, line breaks, and literal shell expressions are preserved [#14548](https://github.com/pnpm/pnpm/issues/14548).
  53. * Relative `scriptShell` paths now resolve from the workspace root. Bare command names such as `bash` still use `PATH` [#14422](https://github.com/pnpm/pnpm/issues/14422).
  55. * `pnpm import` now preserves the project-local lockfile when `lockfileDir` points elsewhere and restores the destination lockfile on failure. Branch lockfile imports leave the shared lockfile unchanged [#14563](https://github.com/pnpm/pnpm/issues/14563).
  57. * `catalogMode` and `--save-catalog` no longer move local paths, tarballs, or `workspace:<path>` specifiers into catalogs [#14437](https://github.com/pnpm/pnpm/issues/14437).
  59. * `--side-effects-cache`, `--no-side-effects-cache`, and `PNPM_CONFIG_SIDE_EFFECTS_CACHE` now toggle only the local cache, preserving any remote cache configured in `sideEffectsCache`.
  61. * `pnpm unpublish` now handles registry two-factor authentication challenges through web authentication or a one-time password prompt [#14464](https://github.com/pnpm/pnpm/issues/14464).
  63. * `pnpm outdated` and `pnpm update` now follow GitHub Actions references using self-repository syntax, such as `uses: $/.github/actions/setup`.
  65. * `pnpm remove` now accepts `--unsafe-perm`.
  67. <!-- sponsors -->
  69. ## Platinum Sponsors
  71. <table>
  72. <tbody>
  73. <tr>
  74. <td align="center" valign="middle">
  75. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  76. </td>
  77. <td align="center" valign="middle">
  78. <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  79. <picture>
  80. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
  81. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
  82. <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
  83. </picture>
  84. </a>
  85. </td>
  86. <td align="center" valign="middle">
  87. <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
  88. </td>
  89. </tr>
  90. <tr>
  91. <td align="center" valign="middle">
  92. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  93. <picture>
  94. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  95. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  96. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  97. </picture>
  98. </a>
  99. </td>
  100. </tr>
  101. </tbody>
  102. </table>
  104. ## Gold Sponsors
  106. <table>
  107. <tbody>
  108. <tr>
  109. <td align="center" valign="middle">
  110. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  111. <picture>
  112. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  113. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  114. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  115. </picture>
  116. </a>
  117. </td>
  118. <td align="center" valign="middle">
  119. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  120. <picture>
  121. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  122. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  123. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  124. </picture>
  125. </a>
  126. </td>
  127. <td align="center" valign="middle">
  128. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  129. </td>
  130. </tr>
  131. <tr>
  132. <td align="center" valign="middle">
  133. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  134. <picture>
  135. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  136. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  137. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  138. </picture>
  139. </a>
  140. </td>
  141. <td align="center" valign="middle">
  142. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  143. <picture>
  144. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  145. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  146. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  147. </picture>
  148. </a>
  149. </td>
  150. <td align="center" valign="middle">
  151. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  152. <picture>
  153. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  154. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  155. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  156. </picture>
  157. </a>
  158. </td>
  159. </tr>
  160. <tr>
  161. <td align="center" valign="middle">
  162. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  163. <picture>
  164. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  165. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  166. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  167. </picture>
  168. </a>
  169. </td>
  170. <td align="center" valign="middle">
  171. <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a>
  172. </td>
  173. </tr>
  174. </tbody>
  175. </table>
  177. <!-- sponsors end -->

auf github ansehenimported 2026-09-28 über npm