Ir al contenido
verdict:

pnpm 11.5.2

digest

Notas de la versión

note: la síntesis y las notas de la versión están en inglés

note: sin síntesis para esta release digest

Las releases digest se listan sin síntesis. Las notas de la versión originales de esta versión están aquí abajo.

release-notesgithub.com/pnpm/pnpm · 117 líneas
  1. ## Patch Changes
  3. * Peer dependency resolution now reuses the peer contexts already recorded in the lockfile when those providers are still present in the dependency graph and still satisfy the peer ranges. This avoids unnecessary peer-context rewrites during lockfile regeneration. Current manifest choices remain authoritative: a newly added, explicitly updated, or aliased direct provider, a changed nested provider, or a locked version that no longer satisfies the range still takes precedence.
  5. * The lockfile verifier now checks that a registry entry pinning an explicit `tarball` URL points at the artifact the registry's own metadata lists for that `name@version`. Previously a tampered lockfile could pair a trusted `name@version` with an attacker-chosen tarball URL (and a matching integrity for those bytes), so the install fetched the attacker's bytes. A mismatch — or any entry that can't be confirmed against the registry — is rejected with `ERR_PNPM_TARBALL_URL_MISMATCH`. Non-registry resolutions (`file:`, git-hosted, etc.) and registry entries without an explicit tarball URL (the URL is reconstructed from name+version+registry, so it is inherently bound) are unaffected; non-standard registry tarball URLs (npm Enterprise, GitHub Packages) still pass because they match the metadata.
  7. * Fix `pnpm update --recursive --lockfile-only <pkg>@<version>` crashing with `Invalid Version` when the catalog entry for `<pkg>` is a version range (e.g. `^21.2.10`) and `catalogMode` is `strict` or `prefer`. The catalog–version comparison now skips the equality check when either side is a range rather than passing a range to `semver.eq()`, so range specifiers fall through to the existing mismatch handling instead of throwing [#11570](https://github.com/pnpm/pnpm/issues/11570).
  9. * Avoided a Node.js crash when pnpm exits after network requests on Windows.
  11. * Fixed packages being materialized into the virtual store without their root-level files (`package.json`, `LICENSE`, README, root entrypoints) when multiple `pnpm install` processes ran against the same store/workspace concurrently. The fast import path used to destructively empty the shared target directory, so a concurrent importer could wipe files another importer had already written; if the surviving files included the `package.json` completion marker, every later install treated the broken directory as complete and never repaired it. The fast path now imports directly only when it can create the target directory exclusively, and otherwise builds the package in a private temp directory and atomically renames it into place [#12197](https://github.com/pnpm/pnpm/issues/12197).
  13. * Fix dependency build scripts not running under the global virtual store (`enableGlobalVirtualStore`).
  15. In a workspace install, dependency build scripts are deferred to a single `rebuild` pass (`buildProjects`). That pass resolved each package's location from the classic `node_modules/.pnpm/<depPathToFilename>` layout, which does not exist under the global virtual store — so native dependencies (e.g. packages using `node-gyp` / `prebuild-install`) were never built and failed to load at runtime (`Cannot find module .../build/Release/*.node`).
  17. `buildProjects` now resolves the global-virtual-store projection directory (`<storeDir>/links/<hash>`, computed with the same graph hash the installer uses) when `enableGlobalVirtualStore` is set, and serializes concurrent builds of the same shared projection so parallel workspace projects don't race on the same directory.
  19. * Don't promote a `runtime:` dependency (such as the Node.js version from `devEngines.runtime` or `pnpm runtime set`) into a catalog when `catalogMode` is `strict` or `prefer`. A `runtime:` dependency round-trips to `devEngines.runtime`, which only recognizes the `runtime:` protocol; cataloging it rewrote the manifest entry to `catalog:`, which broke that round-trip, stranded it in `devDependencies`, and left `devEngines.runtime` untouched.
  21. * Skip lockfile `minimumReleaseAge`/`trustPolicy` verification for non-registry tarball protocols (for example `file:`), so local tarball dependencies are not incorrectly checked against npm registry metadata.
  24. <!-- sponsors -->
  26. ## Platinum Sponsors
  28. <table>
  29. <tbody>
  30. <tr>
  31. <td align="center" valign="middle">
  32. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  33. </td>
  34. </tr>
  35. </tbody>
  36. </table>
  38. ## Gold Sponsors
  40. <table>
  41. <tbody>
  42. <tr>
  43. <td align="center" valign="middle">
  44. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  45. <picture>
  46. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  47. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  48. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  49. </picture>
  50. </a>
  51. </td>
  52. <td align="center" valign="middle">
  53. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  54. <picture>
  55. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  56. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  57. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  58. </picture>
  59. </a>
  60. </td>
  61. <td align="center" valign="middle">
  62. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  63. </td>
  64. </tr>
  65. <tr>
  66. <td align="center" valign="middle">
  67. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  68. <picture>
  69. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  70. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  71. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  72. </picture>
  73. </a>
  74. </td>
  75. <td align="center" valign="middle">
  76. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  77. <picture>
  78. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  79. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  80. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  81. </picture>
  82. </a>
  83. </td>
  84. <td align="center" valign="middle">
  85. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  86. <picture>
  87. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  88. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  89. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  90. </picture>
  91. </a>
  92. </td>
  93. </tr>
  94. <tr>
  95. <td align="center" valign="middle">
  96. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  97. <picture>
  98. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  99. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  100. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  101. </picture>
  102. </a>
  103. </td>
  104. <td align="center" valign="middle">
  105. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  106. <picture>
  107. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  108. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  109. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  110. </picture>
  111. </a>
  112. </td>
  113. </tr>
  114. </tbody>
  115. </table>
  117. <!-- sponsors end -->

ver en githubimported 2026-09-28 vía npm