Aller au contenu
verdict:

pnpm 11.28.6

digest

Notes de version

note: la synthèse et les notes de version sont en anglais

note: pas de synthèse pour cette release digest

Les releases digest sont listées sans synthèse. Les notes de version originales de cette version sont ci-dessous.

release-notesgithub.com/pnpm/pnpm · 191 lignes
  1. This release stops `pnpm publish` from sending a CI identity token to a registry it was not issued for. It also fixes installs that dropped a dependency also declared as an optional peer, and accepts empty `httpProxy` and `httpsProxy` settings again.
  3. ### Patch Changes
  5. #### Security
  7. * `pnpm publish` now uses an `NPM_ID_TOKEN` only if its `aud` claim matches the selected registry, such as `npm:registry.npmjs.org`. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.
  9. * The warning about renamed package files with invalid names no longer prints control characters from those file names.
  11. #### Configuration
  13. * pnpm again accepts `httpProxy` and `httpsProxy` set to `null` or written with no value in `pnpm-workspace.yaml` and the global config file, and treats them as unset. Since 11.28.5 these values failed with `ERR_PNPM_INVALID_SETTING`.
  15. * pnpm now switches to the pnpm version a project pins even when it cannot read its configuration. Previously, a setting it rejected in the global config file, an `.npmrc` file, `_auth`, or `pnpm-workspace.yaml` stopped every command, `pnpm --version` included.
  17. * A key under a registry URL in the `_auth` setting that does not start with `@` is now skipped with a warning, so a field a later pnpm version adds there no longer breaks this one. A key that holds an `authToken` object but lacks its `@`, such as `org` for `@org`, is still an error.
  19. #### Resolving dependencies
  21. * pnpm no longer drops a dependency that a package also declares as an optional peer dependency, for example `ajv` of `ajv-formats`. Since 11.28.0, in some dependency graphs the package got the dependency neither as a dependency nor as a peer, and failed to import it [#16901](https://github.com/pnpm/pnpm/issues/16901).
  23. * `pnpm install` no longer fails with `ERR_PNPM_NO_MATCHING_VERSION` after a change to `overrides` when the lockfile resolves an optional peer dependency to an npm alias of another package [#16654](https://github.com/pnpm/pnpm/issues/16654).
  25. * `pnpm install` and `pnpm dedupe` now link an optional peer to the workspace package that the workspace root depends on when the picked version matches it. Previously they installed the registry package with the same name and version [#16706](https://github.com/pnpm/pnpm/issues/16706).
  27. * Removal overrides such as `"debug>supports-color": "-"` now also apply to an optional peer that a package declares only in `peerDependenciesMeta` [#16681](https://github.com/pnpm/pnpm/issues/16681).
  29. * `pnpm dedupe` now preserves a hoisted workspace package when another package uses a separately installed peer with the same name [#16935](https://github.com/pnpm/pnpm/issues/16935).
  31. * `pnpm install` and `pnpm add --config` now apply `minimumReleaseAge` when they resolve a config dependency. A config dependency range resolves to the newest version that is old enough, so a later clean `pnpm install --frozen-lockfile` accepts the lockfile [#16660](https://github.com/pnpm/pnpm/issues/16660).
  33. * `pnpm install --fix-lockfile` no longer removes the `deprecated` and `hasBin` fields from lockfile entries [#6600](https://github.com/pnpm/pnpm/issues/6600).
  35. #### Workspaces and catalogs
  37. * A filtered install, such as `pnpm install --filter <pkg>`, now keeps the `pnpm-lock.yaml` entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk [#16931](https://github.com/pnpm/pnpm/issues/16931).
  39. * `catalogPrune` no longer removes catalog entries that `pnpm-lock.yaml` still records for workspace projects missing from disk. This affected `pnpm remove` and installs that leave the lockfile unchanged, such as frozen installs. Before, a following frozen install failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` [#16679](https://github.com/pnpm/pnpm/issues/16679).
  41. * Sped up workspace discovery with subtree exclusions such as `!generated/**`.
  43. #### Linking node_modules
  45. * `pnpm install` no longer fails on Windows with `EPERM` on `rmdir node_modules/@scope` when several workspace packages under one scope are hoisted, for example with `nodeLinker: hoisted` [#16690](https://github.com/pnpm/pnpm/issues/16690).
  47. * `pnpm install` hardlinks files from a group-writable or world-writable store again. Before this fix, pnpm copied every file from such a store into `node_modules` [#16677](https://github.com/pnpm/pnpm/issues/16677).
  49. * With `enableGlobalVirtualStore`, an install that updates `node_modules` now restores the dependency links of a package in the global virtual store that an interrupted install left without them. Before, such an install kept the incomplete package if the project's `node_modules` already recorded it [#16642](https://github.com/pnpm/pnpm/issues/16642).
  51. * Removing a `link:` dependency now also removes its symlink from `node_modules` when `nodeLinker` is `hoisted` [#16884](https://github.com/pnpm/pnpm/issues/16884).
  53. * An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store [#16929](https://github.com/pnpm/pnpm/issues/16929).
  55. #### Injected workspace packages
  57. * With `sharedWorkspaceLockfile: false`, an injected workspace package installed in the same run as its dependent now holds only the files its `files` field selects. The copy used to also hold other files of the project, such as `tsconfig.json` [#16683](https://github.com/pnpm/pnpm/issues/16683).
  59. * A script listed in `syncInjectedDepsAfterScripts` no longer fails when it rewrites `package.json` while pnpm is copying its edits into the injected copies. The sync after the script now replaces a half-copied manifest.
  61. * Sped up frozen installs of unchanged injected workspace packages that use hardlinks.
  63. #### Deploying
  65. * `pnpm deploy` without `injectWorkspacePackages` now binds a peer dependency of a linked workspace package to the version its parent provides, as an injected install does. Previously the deploy failed with `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER` whenever other packages in the deployed graph depended on different versions of that peer [#16807](https://github.com/pnpm/pnpm/issues/16807).
  67. * `pnpm deploy` in a workspace with `injectWorkspacePackages` no longer crashes when a linked workspace package declares a peer dependency named after an `Object.prototype` member, such as `constructor`.
  69. #### Setting up pnpm
  71. * pnpm now relinks the bins of a pnpm version it installed earlier for `packageManager` or `pnpm with`. A pnpm 12 version installed by a pnpm release older than 11.28.4 could keep a launcher that ran `node` on the native binary, so every command failed with `SyntaxError: Invalid or unexpected token` [#16646](https://github.com/pnpm/pnpm/issues/16646).
  73. * `pnpm setup` no longer tries to install pnpm globally from npm's `bin` directory when pnpm was installed with npm. It printed `Failed to create bin at <PNPM_HOME>/bin/pnpm` [#16855](https://github.com/pnpm/pnpm/issues/16855).
  75. #### Output
  77. * Escape codes in script output that moved the cursor or cleared the screen garbled pnpm's output. pnpm now drops them and keeps only color codes. Color codes are dropped too when pnpm's own output is not in color.
  79. * When the registry rejects `pnpm stage publish`, the error message now starts with "Failed to stage package".
  81. <!-- sponsors -->
  83. ## Platinum Sponsors
  85. <table>
  86. <tbody>
  87. <tr>
  88. <td align="center" valign="middle">
  89. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  90. </td>
  91. <td align="center" valign="middle">
  92. <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  93. <picture>
  94. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
  95. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
  96. <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
  97. </picture>
  98. </a>
  99. </td>
  100. <td align="center" valign="middle">
  101. <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
  102. </td>
  103. </tr>
  104. <tr>
  105. <td align="center" valign="middle">
  106. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  107. <picture>
  108. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  109. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  110. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  111. </picture>
  112. </a>
  113. </td>
  114. </tr>
  115. </tbody>
  116. </table>
  118. ## Gold Sponsors
  120. <table>
  121. <tbody>
  122. <tr>
  123. <td align="center" valign="middle">
  124. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  125. <picture>
  126. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  127. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  128. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  129. </picture>
  130. </a>
  131. </td>
  132. <td align="center" valign="middle">
  133. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  134. <picture>
  135. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  136. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  137. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  138. </picture>
  139. </a>
  140. </td>
  141. <td align="center" valign="middle">
  142. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  143. </td>
  144. </tr>
  145. <tr>
  146. <td align="center" valign="middle">
  147. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  148. <picture>
  149. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  150. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  151. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  152. </picture>
  153. </a>
  154. </td>
  155. <td align="center" valign="middle">
  156. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  157. <picture>
  158. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  159. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  160. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  161. </picture>
  162. </a>
  163. </td>
  164. <td align="center" valign="middle">
  165. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  166. <picture>
  167. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  168. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  169. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  170. </picture>
  171. </a>
  172. </td>
  173. </tr>
  174. <tr>
  175. <td align="center" valign="middle">
  176. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  177. <picture>
  178. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  179. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  180. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  181. </picture>
  182. </a>
  183. </td>
  184. <td align="center" valign="middle">
  185. <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a>
  186. </td>
  187. </tr>
  188. </tbody>
  189. </table>
  191. <!-- sponsors end -->

voir sur githubdetected 2026-10-16 via npm