Ir al contenido
verdict:

pnpm 11.28.9

digest

Notas de la versión

note: la síntesis y las notas de la versión están en inglés

note: sin síntesis para esta release digest

Las releases digest se listan sin síntesis. Las notas de la versión originales de esta versión están aquí abajo.

release-notesgithub.com/pnpm/pnpm · 200 líneas
  1. This release fixes a crash on registry responses with too many content encodings ([GHSA-xjj6-f33q-929c](https://github.com/advisories/GHSA-xjj6-f33q-929c)) and sizes the install worker pool by the container's CPU quota. A repeat `pnpm install` now acts on more setting changes.
  3. ### Patch Changes
  5. #### Crashes and security
  7. * A registry response with too many content encodings can no longer crash pnpm. pnpm now uses undici 7.30.1, which fixes [GHSA-xjj6-f33q-929c](https://github.com/advisories/GHSA-xjj6-f33q-929c).
  9. * `pnpm install` now sizes its worker pool by the CPU quota of the container it runs in, such as a Kubernetes CPU limit, when that quota is smaller than the number of CPUs the container may run on. The default `workspaceConcurrency` respects the quota the same way. On a CI runner with a 4-CPU quota and hundreds of host CPUs, pnpm started hundreds of workers and ran out of memory [#17382](https://github.com/pnpm/pnpm/issues/17382).
  11. #### Repeat installs and changed settings
  13. * A repeat `pnpm install` now acts on a change to these settings. Before, it reported "Already up to date".
  15. * `storeDir` or `virtualStoreDir`: it recreates `node_modules`.
  16. * `virtualStoreDirMaxLength`: it renames the virtual store directories.
  17. * `dangerouslyAllowAllBuilds` turned on: it runs the builds it skipped.
  18. * `trustLockfile` turned off: it verifies the lockfile.
  20. * `pnpm add`, `pnpm remove`, and `pnpm update` now fail when the `node-linker` setting differs from the one recorded in `node_modules`. A `pnpm install` of the whole workspace recreates `node_modules` with the new `node-linker`, and an install filtered to some projects fails [pnpm/tasks#203](https://github.com/pnpm/tasks/issues/203).
  22. * An install filtered to some workspace projects now fails if `node_modules` was installed with a different `nodeLinker`, `hoistPattern`, `publicHoistPattern`, store, or virtual store. Before, it recreated `node_modules` and left the projects it skipped without their dependencies. A `pnpm install` of the whole workspace still recreates `node_modules` [pnpm/tasks#217](https://github.com/pnpm/tasks/issues/217).
  24. * `pnpm install` now takes its fast path in a workspace with `patchedDependencies` when the previous install ran with another major version of pnpm.
  26. * `pnpm install` now relinks the bins of a workspace package when its `bin` field changes, including with `--frozen-lockfile` and an unchanged lockfile. A filtered install relinks them in the selected projects, and the next install that covers the remaining projects relinks them there [#17324](https://github.com/pnpm/pnpm/issues/17324).
  28. * `pnpm install` now removes command shims from `node_modules/.bin` when a workspace dependency renames or removes an entry from its `bin` field [pnpm/tasks#211](https://github.com/pnpm/tasks/issues/211).
  30. * With `nodeLinker: hoisted`, an install that stops partway no longer leaves the next install trusting the packages it was replacing. Before, reverting the change that started the stopped install, such as a patch edit, kept the half-replaced package in `node_modules`.
  32. * `pnpm run` and `pnpm exec` no longer report the dependencies as out of date after a lockfile change when `dedupePeers` is `true` [#17322](https://github.com/pnpm/pnpm/issues/17322).
  34. #### Resolving dependencies and the lockfile
  36. * A package that a plain range and a `<prefix>:` specifier both resolve from one registry is now recorded once in `pnpm-lock.yaml` and installed once. The lockfile key names the registry a package resolved from. When that registry declares a prefix, through `prefix` in `registries` or through `namedRegistries`, the package is keyed `<name>@<prefix>:<version>` however its dependency was written: with the prefix, as a plain range its scope routes to that registry, or through the default registry. Before, the plain range was keyed `<name>@<version>`, so one tarball was installed twice and `instanceof` checks and module singletons broke between the two copies. The same name and version served by two registries still get separate entries. When several prefixes declare one registry, its packages are keyed by the lexicographically smallest prefix.
  38. If a scope you route reaches a registry that also declares a prefix, your next `pnpm install` re-keys those entries, which shows up as a lockfile diff. Commit it. `pnpm install --frozen-lockfile` installs the lockfile as recorded.
  40. * `pnpm install` now resolves a scope's packages again when the scope is routed to another registry in `registries`. Before, the lockfile kept the versions and integrity resolved from the old registry, so the install failed when the new registry did not serve a locked version or served different content. pnpm records in the workspace state which registry each scope routed to, so a fresh clone without that record installs the lockfile as recorded. Changing the default registry resolves nothing again, and `pnpm install --frozen-lockfile` is unchanged.
  42. * An optional dependency written with a named-registry prefix, such as `work:^1.0.0`, now fails the install when it cannot be resolved but the lockfile already has a matching entry from that registry. Such a dependency was skipped, which removed its entries from the lockfile.
  44. * With `injectWorkspacePackages: true`, a `workspace:` dependency written as a relative path, such as `workspace:../lib-a`, in a workspace package now resolves from that package's directory [#17284](https://github.com/pnpm/pnpm/issues/17284).
  46. * Fixed `pnpm install` failing with `ERR_PNPM_UNSUPPORTED_PROTOCOL` when a workspace package injected through a relative path, such as `workspace:../lib`, has `catalog:` dependencies. Their catalog entries now resolve the way they do for a package injected by name [#17280](https://github.com/pnpm/pnpm/issues/17280).
  48. * `pnpm install` now applies the `serverType` registry setting when it updates the lockfile for an override or catalog change without a full resolution. pnpm wrote the tarball URLs of a declared registry into the lockfile in that case.
  50. * Added the `pnpr` value to the `serverType` registry setting. pnpm leaves the tarball URLs of a pnpr registry out of `pnpm-lock.yaml`.
  52. * A `registries` entry whose `prefix` is `__proto__` is no longer ignored.
  54. * Installs delegated to a pnpr server now resolve every prefix declared for a registry URL. A dependency or lockfile entry that used the second of two prefixes for the same registry, such as `zeta:` next to `work:` in `namedRegistries`, failed on the server [pnpm/tasks#204](https://github.com/pnpm/tasks/issues/204).
  56. #### Registries, proxies, and downloading pnpm
  58. * The proxy settings `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and `noproxy` set in the global `config.yaml`, through `PNPM_CONFIG_HTTPS_PROXY` and the matching variables, or as `--config.httpsProxy` on the command line now apply to `pnpm self-update` and to the download of the pnpm version pinned in `packageManager`. Previously, these requests read the proxy only from `.npmrc` and the `HTTPS_PROXY` family of variables [pnpm/tasks#215](https://github.com/pnpm/tasks/issues/215).
  60. * When `https-proxy` is `false`, pnpm now downloads the pnpm version pinned by `packageManager` through the legacy `proxy` setting, as installs already do. Setting `proxy` to `false` now also stops that download from using the `HTTP_PROXY` environment variable. The signature check of the pinned pnpm now uses the same proxy and TLS settings as its download [pnpm/tasks#193](https://github.com/pnpm/tasks/issues/193).
  62. * `strictSsl` and `localAddress` set in the global `config.yaml`, through `PNPM_CONFIG_STRICT_SSL` and `PNPM_CONFIG_LOCAL_ADDRESS`, or on the command line now apply to `pnpm self-update` and to the download of the pnpm version pinned in `packageManager`. These requests read them from `.npmrc` only before. `--config.localAddress` now reaches them in the camelCase spelling too [pnpm/tasks#201](https://github.com/pnpm/tasks/issues/201).
  64. #### Commands
  66. * `pnpm audit --ignore` and `pnpm audit --ignore-unfixable` now exit with a non-zero code when vulnerabilities at or above the audit level remain after ignoring. Before, these commands always exited with code 0.
  68. * `pnpm audit --fix` and `pnpm audit --interactive` now fail with `ERR_PNPM_AUDIT_FIX_WITH_IGNORE` when combined with `--ignore` or `--ignore-unfixable`. Before, the fix ran and the ignore flags had no effect.
  70. * `pnpm ci --lockfile` and `pnpm ci --config.lockfile=true` no longer delete `pnpm-lock.yaml`. `pnpm ci` now always keeps the lockfile and runs a frozen install from it.
  72. * `pnpm deploy` now keeps a deployed symlink to a directory inside the project even if the directory is not among the deployed files, such as a link into `node_modules` [#17288](https://github.com/pnpm/pnpm/issues/17288).
  74. * `pnpm pack` and `pnpm publish` again include the files of a `publishConfig.directory` that is reached through a symlink, together with its bundled dependencies [#17390](https://github.com/pnpm/pnpm/issues/17390).
  76. * `pnpm -r publish --batch` now sends `PUT /-/pnpr/v0/publish`, the batch publish endpoint that pnpr serves.
  78. * `pnpm store prune` now keeps the packages that a project still uses when pnpm copied or cloned them into `node_modules`. These include patched packages, built packages, and every package installed with `packageImportMethod: copy`. Before, the prune removed them, and the next install downloaded them again [#7192](https://github.com/pnpm/pnpm/issues/7192).
  80. * `pnpm store prune` now keeps the packages of a project that was installed with a different symlinked spelling of the store path. Previously, prune dropped such a project from its list and removed the packages only that project used from the global virtual store.
  82. #### Speed and output
  84. * Sped up installs of projects whose local directory dependencies share transitive local directory dependencies. pnpm no longer checks a shared directory again for each direct dependency that reaches it [#17374](https://github.com/pnpm/pnpm/issues/17374).
  86. * Output that fills the terminal, such as `pnpm run --stream` script output, is now written once. Before, every new line also rewrote all the lines already on screen [#17387](https://github.com/pnpm/pnpm/issues/17387).
  88. * The warning about unrecognized settings now marks `symlinkedLockfileTargetDirs` as a setting of a newer pnpm version.
  90. <!-- sponsors -->
  92. ## Platinum Sponsors
  94. <table>
  95. <tbody>
  96. <tr>
  97. <td align="center" valign="middle">
  98. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  99. </td>
  100. <td align="center" valign="middle">
  101. <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  102. <picture>
  103. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
  104. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
  105. <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
  106. </picture>
  107. </a>
  108. </td>
  109. <td align="center" valign="middle">
  110. <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
  111. </td>
  112. </tr>
  113. <tr>
  114. <td align="center" valign="middle">
  115. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  116. <picture>
  117. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  118. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  119. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  120. </picture>
  121. </a>
  122. </td>
  123. </tr>
  124. </tbody>
  125. </table>
  127. ## Gold Sponsors
  129. <table>
  130. <tbody>
  131. <tr>
  132. <td align="center" valign="middle">
  133. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  134. <picture>
  135. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  136. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  137. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  138. </picture>
  139. </a>
  140. </td>
  141. <td align="center" valign="middle">
  142. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  143. <picture>
  144. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  145. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  146. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  147. </picture>
  148. </a>
  149. </td>
  150. <td align="center" valign="middle">
  151. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  152. </td>
  153. </tr>
  154. <tr>
  155. <td align="center" valign="middle">
  156. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  157. <picture>
  158. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  159. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  160. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  161. </picture>
  162. </a>
  163. </td>
  164. <td align="center" valign="middle">
  165. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  166. <picture>
  167. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  168. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  169. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  170. </picture>
  171. </a>
  172. </td>
  173. <td align="center" valign="middle">
  174. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  175. <picture>
  176. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  177. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  178. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  179. </picture>
  180. </a>
  181. </td>
  182. </tr>
  183. <tr>
  184. <td align="center" valign="middle">
  185. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  186. <picture>
  187. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  188. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  189. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  190. </picture>
  191. </a>
  192. </td>
  193. <td align="center" valign="middle">
  194. <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a>
  195. </td>
  196. </tr>
  197. </tbody>
  198. </table>
  200. <!-- sponsors end -->

ver en githubdetected 2026-10-27 vía npm