Ir al contenido
verdict:

pnpm 11.0.0-rc.3

preview

Notas de la versión

note: la síntesis y las notas de la versión están en inglés

note: sin síntesis para esta release más antigua

Sintetizamos las releases recientes. Las notas de la versión originales de esta versión están aquí abajo.

release-notesgithub.com/pnpm/pnpm · 139 líneas
  1. ## Minor Changes
  3. * Added a new `pnpm pack-app` command that packs a CommonJS entry file into a standalone executable for one or more target platforms, using the [Node.js Single Executable Applications](https://nodejs.org/api/single-executable-applications.html) API under the hood. Targets are specified as `<os>-<arch>[-<libc>]` (e.g. `linux-x64`, `linux-x64-musl`, `macos-arm64`, `win-x64`) and each produces an executable under `dist-app/<target>/` by default. Requires Node.js v25.5+ to perform the injection; an older host downloads Node.js v25 automatically.
  5. * `pnpm audit --fix` now respects the `auditLevel` setting and supports a new interactive mode via `--interactive`/`-i`. Previously, `pnpm audit --fix` would fix all vulnerabilities regardless of the configured `auditLevel`, while `pnpm audit` (without `--fix`) correctly filtered by severity. Now both commands consistently filter advisories by the `auditLevel` setting, and you can use `pnpm audit --fix -i` to review and select which vulnerabilities to fix interactively.
  7. Overrides emitted by `pnpm audit --fix` now use a caret range (`^X.Y.Z`) instead of an open-ended `>=X.Y.Z`, so applying a security fix can no longer silently promote a dependency across a major version boundary.
  9. * Added a new setting `minimumReleaseAgeIgnoreMissingTime`, which is `true` by default. When enabled, pnpm skips the `minimumReleaseAge` maturity check if the registry metadata does not include the `time` field. Set to `false` to fail resolution instead.
  11. * Fixed and expanded `pnpm version` to match npm behavior:
  13. * Accept an explicit semver version (e.g. `pnpm version 1.2.3`) in addition to bump types.
  14. * Recognize `--no-commit-hooks`, `--no-git-tag-version`, `--sign-git-tag`, and `--message`.
  15. * Fix `--no-git-checks` which was previously parsed incorrectly.
  16. * Create a git commit and annotated tag for the version bump when running inside a git repository (unless `--no-git-tag-version` is used). `--message` supports `%s` replacement with the new version, and `--tag-version-prefix` controls the tag prefix (defaults to `v`). Git commits and tags are always skipped in recursive mode since multiple packages may be bumped to different versions in a single run [#11271](https://github.com/pnpm/pnpm/issues/11271).
  18. * Renamed the platform-specific optional dependencies of `@pnpm/exe` to the new `@pnpm/exe.<platform>-<arch>[-<libc>]` scheme, using `process.platform` values (`linux`, `darwin`, `win32`) for the OS segment. The umbrella package `@pnpm/exe` itself is unchanged so existing `npm i -g @pnpm/exe` and `pnpm self-update` flows keep working.
  20. | before | after |
  21. | ------------------------- | ---------------------------- |
  22. | `@pnpm/linux-x64` | `@pnpm/exe.linux-x64` |
  23. | `@pnpm/linux-arm64` | `@pnpm/exe.linux-arm64` |
  24. | `@pnpm/linuxstatic-x64` | `@pnpm/exe.linux-x64-musl` |
  25. | `@pnpm/linuxstatic-arm64` | `@pnpm/exe.linux-arm64-musl` |
  26. | `@pnpm/macos-x64` | `@pnpm/exe.darwin-x64` |
  27. | `@pnpm/macos-arm64` | `@pnpm/exe.darwin-arm64` |
  28. | `@pnpm/win-x64` | `@pnpm/exe.win32-x64` |
  29. | `@pnpm/win-arm64` | `@pnpm/exe.win32-arm64` |
  31. GitHub release asset filenames follow the same scheme — `pnpm-linuxstatic-x64.tar.gz` becomes `pnpm-linux-x64-musl.tar.gz`, `pnpm-macos-*` becomes `pnpm-darwin-*`, `pnpm-win-*` becomes `pnpm-win32-*`. Anyone downloading releases directly needs to use the new filenames; `get.pnpm.io/install.sh` and `install.ps1` will be updated in lockstep to accept both schemes based on the requested version.
  33. Resolves [#11314](https://github.com/pnpm/pnpm/issues/11314).
  35. ## Patch Changes
  37. * Do not print the `Cannot use both "packageManager" and "devEngines.packageManager" in package.json. "packageManager" will be ignored` warning when the two fields specify the exact same package manager name and version string. This lets projects keep both fields during the migration from `packageManager` to `devEngines.packageManager` without a noisy warning [#11301](https://github.com/pnpm/pnpm/issues/11301).
  38. * Fix installing a directory dependency (`file:<dir>`) from an absolute path on a different drive on Windows. The directory fetcher was joining the stored directory onto `lockfileDir`, which on Windows concatenates an absolute cross-drive path literally (`path.join('D:\\...', 'C:\\Users\\...')` → `'D:\\...\\C:\\Users\\...'`). Use `path.resolve` so absolute paths are respected. This surfaced as an ENOENT during `pnpm setup` in CI when `PNPM_HOME` and the OS temp directory were on different drives.
  39. * Fixed `pnpm sbom` and `pnpm licenses` failing to resolve license information for git-sourced dependencies (`git+https://`, `git+ssh://`, `github:` shorthand). These commands now correctly read the package manifest from the content-addressable store for `type: 'git'` resolutions [#11260](https://github.com/pnpm/pnpm/issues/11260).
  40. * Fix `ERR_PNPM_OUTDATED_LOCKFILE` when approving builds during a global install. The `approve-builds` flow called by `pnpm add -g` passed the global packages directory to the subsequent install as `workspaceDir`, which caused sibling install directories (such as those left behind by `pnpm self-update`) to be picked up as workspace projects and fail the frozen-lockfile check.
  41. * Restore the peer suffix encoding used by pnpm 10 for linked dependency paths. A `filenamify` upgrade changed how leading `./` and `../` segments were normalized, producing peer suffixes like `(b@+packages+b)` instead of `(b@packages+b)` for linked packages outside the workspace root, causing lockfile churn [#11272](https://github.com/pnpm/pnpm/issues/11272).
  42. * Fix: different platform variants of the same runtime (e.g. `node@runtime:25.9.0` glibc vs. musl) no longer share a single global-virtual-store entry. The virtual store path now incorporates the selected variant's integrity, so installs with different `--os`/`--cpu`/`--libc` end up in separate directories and `pnpm add --libc=musl node@runtime:<v>` reliably fetches the musl binary even when the glibc variant is already cached.
  43. * `pnpm sbom` now detects licenses declared via the deprecated `licenses` array in `package.json` (e.g. `busboy`, `streamsearch`, `limiter`) and falls back to scanning on-disk `LICENSE` files — mirroring the resolution logic of `pnpm licenses`. Previously these packages were reported as `NOASSERTION`. Shared license resolution (manifest parsing + LICENSE-file fallback) lives in the new `@pnpm/deps.compliance.license-resolver` package. When a manifest sets both `license` and `licenses`, the modern `license` field now takes precedence for both commands (previously `pnpm licenses` preferred `licenses`) [#11248](https://github.com/pnpm/pnpm/issues/11248).
  46. <!-- sponsors -->
  48. ## Platinum Sponsors
  50. <table>
  51. <tbody>
  52. <tr>
  53. <td align="center" valign="middle">
  54. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  55. </td>
  56. </tr>
  57. </tbody>
  58. </table>
  60. ## Gold Sponsors
  62. <table>
  63. <tbody>
  64. <tr>
  65. <td align="center" valign="middle">
  66. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  67. <picture>
  68. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  69. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  70. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  71. </picture>
  72. </a>
  73. </td>
  74. <td align="center" valign="middle">
  75. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  76. <picture>
  77. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  78. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  79. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  80. </picture>
  81. </a>
  82. </td>
  83. <td align="center" valign="middle">
  84. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  85. </td>
  86. </tr>
  87. <tr>
  88. <td align="center" valign="middle">
  89. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  90. <picture>
  91. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  92. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  93. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  94. </picture>
  95. </a>
  96. </td>
  97. <td align="center" valign="middle">
  98. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  99. <picture>
  100. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  101. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  102. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  103. </picture>
  104. </a>
  105. </td>
  106. <td align="center" valign="middle">
  107. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  108. <picture>
  109. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  110. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  111. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  112. </picture>
  113. </a>
  114. </td>
  115. </tr>
  116. <tr>
  117. <td align="center" valign="middle">
  118. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  119. <picture>
  120. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  121. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  122. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  123. </picture>
  124. </a>
  125. </td>
  126. <td align="center" valign="middle">
  127. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  128. <picture>
  129. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  130. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  131. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  132. </picture>
  133. </a>
  134. </td>
  135. </tr>
  136. </tbody>
  137. </table>
  139. <!-- sponsors end -->

ver en githubimported 2026-09-28 vía npm