Zum Inhalt springen
verdict:

pnpm 11.6.0

notable

Release Notes

note: die Zusammenfassung und die Release Notes sind auf Englisch

note: keine Zusammenfassung für dieses ältere Release

Wir fassen die neueren Releases zusammen. Die originalen Release Notes dieser Version stehen hier unten.

release-notesgithub.com/pnpm/pnpm · 148 Zeilen
  1. ### ⚠️ Security fix — environment variables in a project `.npmrc` (action may be required)
  3. Following [GHSA-3qhv-2rgh-x77r](https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r), pnpm no longer expands `${ENV_VAR}` placeholders that come from a **repository-controlled** config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:
  5. - the project/workspace `.npmrc` — `registry`, `@scope:registry`, proxy URLs, URL-scoped keys (`//host/…`), and credential values (`_authToken`, `_auth`, `_password`, `username`, `tokenHelper`, `cert`, `key`);
  6. - registry URLs in `pnpm-workspace.yaml`.
  8. Environment variables are **still** expanded in trusted config: your user-level `~/.npmrc`, the global config, CLI options, and environment config.
  10. **If your authentication broke after upgrading**, move the token out of the committed `.npmrc`:
  12. ```sh
  13. # Writes to your user/global config, not the repository:
  14. pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN"
  15. ```
  17. Or keep the `${NPM_TOKEN}` line but put it in your user-level `~/.npmrc` instead of the repo. In **GitHub Actions**, `actions/setup-node` with `registry-url` already writes a user-level `.npmrc`, so `NODE_AUTH_TOKEN` keeps working. For other CI where editing each pipeline is hard, set `PNPM_CONFIG_NPMRC_AUTH_FILE=.npmrc` (or `NPM_CONFIG_USERCONFIG=.npmrc`) in the CI environment to declare the project `.npmrc` trusted.
  19. See https://pnpm.io/npmrc for full migration details.
  22. ## Minor Changes
  24. * `pnpm install` completes without re-resolving when `pnpm-lock.yaml` was deleted but `node_modules` is intact: the up-to-date check now treats the current lockfile (`node_modules/.pnpm/lock.yaml`) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restores `pnpm-lock.yaml` from it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the registry.
  26. * 615c669: Added support for configuring URL-scoped registry settings through `npm_config_//…` and `pnpm_config_//…` environment variables, for example:
  28. ```text
  29. npm_config_//registry.npmjs.org/:_authToken=<token>
  30. pnpm_config_//registry.npmjs.org/:_authToken=<token>
  31. ```
  33. This provides a file-free way to supply registry authentication. Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace `.npmrc` but is still overridden by command-line options. When the same key is provided through both prefixes, `pnpm_config_` wins.
  35. * Raised the default network concurrency from `min(64, max(cpuCores * 3, 16))` to `min(96, max(cpuCores * 3, 64))`. Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. The `networkConcurrency` setting still overrides the default.
  37. ## Patch Changes
  39. * Improved the warning printed when a project `.npmrc` uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level `~/.npmrc` or running `pnpm config set "<key>" <value>` — with a link to https://pnpm.io/npmrc. The `pnpm config set` example is only suggested when the key has no `${...}` placeholder, so the snippet is always safe to copy-paste.
  40. * Print a "Lockfile passes supply-chain policies (verified 2h ago)" message when lockfile verification is skipped because a cached verdict for the same lockfile content and policy is reused. Previously the cached short-circuit was completely silent, which made it look like the policy gate never ran [#12324](https://github.com/pnpm/pnpm/issues/12324).
  41. * Platform-specific optional dependencies are now skipped even when their `os`/`cpu`/`libc` fields are missing from the registry metadata or the lockfile. Some registries strip these fields from the package metadata, which made pnpm download and install the binaries of every platform regardless of `supportedArchitectures`. The missing platform fields of an optional dependency are now inferred from its name (e.g. `@nx/nx-win32-arm64-msvc` → `os: win32`, `cpu: arm64`), so foreign-platform binaries are skipped without even downloading them [#11702](https://github.com/pnpm/pnpm/issues/11702).
  44. <!-- sponsors -->
  46. ## Platinum Sponsors
  48. <table>
  49. <tbody>
  50. <tr>
  51. <td align="center" valign="middle">
  52. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  53. </td>
  54. </tr>
  55. <tr>
  56. <td align="center" valign="middle">
  57. <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  58. <picture>
  59. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
  60. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
  61. <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
  62. </picture>
  63. </a>
  64. </td>
  65. </tr>
  66. </tbody>
  67. </table>
  69. ## Gold Sponsors
  71. <table>
  72. <tbody>
  73. <tr>
  74. <td align="center" valign="middle">
  75. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  76. <picture>
  77. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  78. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  79. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  80. </picture>
  81. </a>
  82. </td>
  83. <td align="center" valign="middle">
  84. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  85. <picture>
  86. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  87. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  88. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  89. </picture>
  90. </a>
  91. </td>
  92. <td align="center" valign="middle">
  93. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  94. </td>
  95. </tr>
  96. <tr>
  97. <td align="center" valign="middle">
  98. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  99. <picture>
  100. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  101. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  102. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  103. </picture>
  104. </a>
  105. </td>
  106. <td align="center" valign="middle">
  107. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  108. <picture>
  109. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  110. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  111. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  112. </picture>
  113. </a>
  114. </td>
  115. <td align="center" valign="middle">
  116. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  117. <picture>
  118. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  119. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  120. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  121. </picture>
  122. </a>
  123. </td>
  124. </tr>
  125. <tr>
  126. <td align="center" valign="middle">
  127. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  128. <picture>
  129. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  130. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  131. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  132. </picture>
  133. </a>
  134. </td>
  135. <td align="center" valign="middle">
  136. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  137. <picture>
  138. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  139. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  140. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  141. </picture>
  142. </a>
  143. </td>
  144. </tr>
  145. </tbody>
  146. </table>
  148. <!-- sponsors end -->

auf github ansehenimported 2026-09-28 über npm