Zum Inhalt springen
verdict:

pnpm 11.5.0

notable

Release Notes

note: die Zusammenfassung und die Release Notes sind auf Englisch

note: keine Zusammenfassung für dieses ältere Release

Wir fassen die neueren Releases zusammen. Die originalen Release Notes dieser Version stehen hier unten.

release-notesgithub.com/pnpm/pnpm · 128 Zeilen
  1. ## Minor Changes
  3. * Added a new `hoistingLimits` setting for `nodeLinker: hoisted` installs, mirroring yarn's `nmHoistingLimits`. It accepts `none` (the default — hoist as far as possible), `workspaces` (hoist only as far as each workspace package), or `dependencies` (hoist only up to each workspace package's direct dependencies). Originally proposed in [#6468](https://github.com/pnpm/pnpm/pull/6468), closing [#6457](https://github.com/pnpm/pnpm/issues/6457).
  5. * Replaced `enquirer` with `@inquirer/prompts` for all interactive prompts. Fixes the `update -i` scrolling overflow bug where long choice lists were clipped in the terminal [#6643](https://github.com/pnpm/pnpm/issues/6643).
  7. **User-facing changes:**
  9. * `pnpm update -i` / `pnpm update -i --latest`: Scrolling now works correctly when many packages are available; the new library uses visual-line-aware pagination via `usePagination`
  10. * `pnpm audit --fix -i`: Same scrolling fix for vulnerability selection
  11. * `pnpm approve-builds`: Interactive build approval prompts updated
  12. * `pnpm patch`: Version selection and "apply to all" prompts updated
  13. * `pnpm patch-remove`: Patch removal selection updated
  14. * `pnpm publish`: Branch confirmation prompt updated
  15. * `pnpm login`: Credential prompts updated
  16. * `pnpm run` / `pnpm exec` (with `verifyDepsBeforeRun=prompt`): Confirmation prompt updated
  18. Vim-style `j`/`k` keys still work for up/down navigation in all interactive prompts.
  20. **Internal:** The `OtpEnquirer` and `LoginEnquirer` DI interfaces changed from `{ prompt }` to `{ input }` / `{ input, password }` respectively. Plugins or custom builds that inject their own enquirer mock will need to update.
  22. * Staged publishes are now recognized in the trust scale. When a package version's registry metadata carries an `approver` field, it is treated as the strongest trust evidence (ranked above trusted publishers and provenance attestations), since staged publishes require 2FA publish approvals. This prevents false-positive trust downgrade errors when moving from a staged publish to a lower trust level [#11887](https://github.com/pnpm/pnpm/issues/11887).
  24. ## Patch Changes
  26. * Fix pnpm hanging during peer resolution when an aliased install pulls in transitive packages with mutual peer cycles at different depths in the dependency tree (for example, `pnpm i nuxt@npm:nuxt-nightly@5x`). Cycles whose members hit the `findHit` cache instead of running their own `calculateDepPath` are now short-circuited by sibling resolutions at the level where the cycle is detected, so the cached path promises no longer deadlock. [#11999](https://github.com/pnpm/pnpm/issues/11999).
  27. * Fix `pnpm dist-tag add` and `pnpm dist-tag rm` against npmjs.org failing without `--otp` with `[ERR_PNPM_UNAUTHORIZED] You must be logged in to set dist-tag … "You must provide a one-time pass. Upgrade your client to npm@latest in order to use 2FA."`. pnpm now sends `npm-auth-type: web` on dist-tag writes and surfaces the resulting OTP challenge through the existing browser-based 2FA flow (the same `withOtpHandling` helper used by `pnpm publish`), so the browser opens, the user authenticates, and the dist-tag is set on retry. `--otp=<code>` continues to work via the classic flow.
  28. * Fix `minimumReleaseAgeExclude` handling in npm resolution fast paths so excluded packages do not get pinned to stale versions. Excludes are honored consistently during `publishedBy` metadata selection and cache-mtime shortcuts.
  29. * Fix the `integrity` field being dropped from the lockfile entry of a remote (non-registry) https-tarball dependency when an unrelated package is installed afterwards. URL/tarball resolvers do not return an integrity (it is only known after the tarball is downloaded), so when such a dependency was reused from the lockfile without being re-fetched, its integrity was lost. It is now carried over from the existing resolution. With pnpm's lockfile-integrity hardening, the missing integrity made subsequent `--frozen-lockfile` installs fail with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`. [#12001](https://github.com/pnpm/pnpm/issues/12001).
  30. * Skip dependency re-resolution when `pnpm-lock.yaml` is missing but `node_modules/.pnpm/lock.yaml` exists and still satisfies the manifest. `pnpm install` now reuses the materialized snapshot to regenerate `pnpm-lock.yaml` instead of walking the registry to rebuild it from scratch, turning the cache+node\_modules variation into a near-no-op for users who deleted the lockfile but kept the install [#11993](https://github.com/pnpm/pnpm/issues/11993).
  32. `--frozen-lockfile` still refuses to proceed when `pnpm-lock.yaml` is absent — the regenerated lockfile must be committed, so failing loudly is the correct behavior for CI.
  35. <!-- sponsors -->
  37. ## Platinum Sponsors
  39. <table>
  40. <tbody>
  41. <tr>
  42. <td align="center" valign="middle">
  43. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  44. </td>
  45. </tr>
  46. </tbody>
  47. </table>
  49. ## Gold Sponsors
  51. <table>
  52. <tbody>
  53. <tr>
  54. <td align="center" valign="middle">
  55. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  56. <picture>
  57. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  58. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  59. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  60. </picture>
  61. </a>
  62. </td>
  63. <td align="center" valign="middle">
  64. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  65. <picture>
  66. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  67. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  68. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  69. </picture>
  70. </a>
  71. </td>
  72. <td align="center" valign="middle">
  73. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  74. </td>
  75. </tr>
  76. <tr>
  77. <td align="center" valign="middle">
  78. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  79. <picture>
  80. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  81. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  82. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  83. </picture>
  84. </a>
  85. </td>
  86. <td align="center" valign="middle">
  87. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  88. <picture>
  89. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  90. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  91. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  92. </picture>
  93. </a>
  94. </td>
  95. <td align="center" valign="middle">
  96. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  97. <picture>
  98. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  99. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  100. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  101. </picture>
  102. </a>
  103. </td>
  104. </tr>
  105. <tr>
  106. <td align="center" valign="middle">
  107. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  108. <picture>
  109. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  110. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  111. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  112. </picture>
  113. </a>
  114. </td>
  115. <td align="center" valign="middle">
  116. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  117. <picture>
  118. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  119. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  120. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  121. </picture>
  122. </a>
  123. </td>
  124. </tr>
  125. </tbody>
  126. </table>
  128. <!-- sponsors end -->

auf github ansehenimported 2026-09-28 über npm