Vai al contenuto
verdict:

pnpm 11.3.0

notable

Note di rilascio

note: la sintesi e le note di rilascio sono in inglese

note: nessuna sintesi per questa release più vecchia

Sintetizziamo le release recenti. Le note di rilascio originali di questa versione sono qui sotto.

release-notesgithub.com/pnpm/pnpm · 116 righe
  1. > See full [v11.0.0 changelog](https://github.com/pnpm/pnpm/releases/tag/v11.0.0)
  2. > Migration guide: [Migrating from v10 to v11](https://pnpm.io/11.x/migration)
  4. ## Minor Changes
  6. * Added `pnpm stage` with `publish`, `list`, `view`, `approve`, `reject`, and `download` subcommands for npm staged publishing.
  7. * Added a new setting `trustLockfile`. When `true`, `pnpm install` skips the supply-chain verification pass that re-applies `minimumReleaseAge` / `trustPolicy='no-downgrade'` to every entry in the loaded lockfile. The install treats the lockfile as already-trusted — useful for closed-source projects where every commit comes from a trusted author. Defaults to `false`; verification stays on by default. Set in `pnpm-workspace.yaml`.
  9. Also cut the memory footprint of the verification pass itself: the per-(registry, name) trust-meta cache previously retained the full packument — dependency graphs, scripts, README, and per-version manifests — for the entire install. On large workspaces (`~4k` lockfile entries with `minimumReleaseAge` + `trustPolicy: no-downgrade` enabled) this could OOM CI runners with a 2GB heap cap. The cache now stores only the fields the trust check actually reads (`time`, per-version `_npmUser.trustedPublisher`, `dist.attestations.provenance`). The abbreviated-metadata cache is similarly projected to just the package-level `modified` field and the set of currently-listed version names. Fixes [#11860](https://github.com/pnpm/pnpm/issues/11860).
  10. * Implemented `pnpm pkg` command natively, following `npm pkg` standards.
  11. * Implemented `pnpm repo` command natively, following `npm repo` standards.
  12. * Implemented `pnpm set-script` (alias `ss`) natively. Adds or updates an entry in the `scripts` field of the project manifest, supporting `package.json`, `package.json5`, and `package.yaml` formats.
  13. * Add a `skip-manifest-obfuscation` option for `pnpm pack` and `pnpm publish`. When enabled, the original `packageManager` field and publish lifecycle scripts are kept in the packed/published manifest instead of being stripped. The pnpm-specific `pnpm` field continues to be omitted.
  15. ## Patch Changes
  17. * Fixed `pnpm dlx` failing with `ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND` when the installed package's CAS slot is missing its `package.json`. Observed in the wild for `pnpm dlx node@runtime:<version>` when the GVS slot was populated without the synthesized manifest runtime archives need (they don't ship a `package.json` of their own, so the synthesized one is the only way it gets there; an existing slot from an earlier code path that skipped the synthesis stays incomplete). The bin link itself is wired up from the resolution and remains valid, so `dlx` now falls back to the scopeless package name when the slot's manifest is unreadable — for single-bin packages (the dlx common case, including every `runtime:` spec) this matches what `manifest.bin` would have named. Multi-bin packages already require `--package=<spec> <bin>` to disambiguate and don't enter this code path.
  18. * Fixed non-determinism in `pnpm dedupe` and `pnpm install` when a dependency graph contains packages with transitive peer dependencies on each other (e.g. `@aws-sdk/client-sts` and `@aws-sdk/client-sso-oidc`) and `auto-install-peers` is enabled. The lockfile no longer flips between two equally-valid forms across consecutive runs. The root cause was that `resolveDependencies` pushed onto its `pkgAddresses` / `postponedResolutionsQueue` arrays from inside `Promise.all`-spawned callbacks, so completion-order timing leaked into the array order and downstream cyclic-peer suffix assignment. Fixes [#8155](https://github.com/pnpm/pnpm/issues/8155).
  19. * Fixed a regression introduced by [#11711](https://github.com/pnpm/pnpm/pull/11711) where `pnpm add <github-shorthand>` (and any other wanted-dependency whose alias can't be parsed from the user-supplied spec, e.g. tarball URLs or `pnpm/test-git-fetch#sha`) was silently dropped from the manifest update and from `pendingBuilds`. The alias-keyed lookup added in that PR couldn't find a `wantedDependency` whose `alias` was `undefined` at parse time but resolved to a package name only after fetching, so the entry never made it into `specsToUpsert`. Restored the original index-based pairing between `directDependencies` and `wantedDependencies`; the catalog-protocol preservation that PR was originally fixing is unaffected because it's driven by `rdd.catalogLookup.userSpecifiedBareSpecifier`, not by the lookup. Fixes the three `rebuilds dependencies` / `rebuilds specific dependencies` / `rebuild with pending option` failures in `building/commands/test/build/index.ts`.
  20. * Fixed `pnpm add --config` leaving orphan entries in `pnpm-lock.env.yaml` (the optional subdependencies of the previously resolved version of the updated config dependency).
  23. <!-- sponsors -->
  25. ## Platinum Sponsors
  27. <table>
  28. <tbody>
  29. <tr>
  30. <td align="center" valign="middle">
  31. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  32. </td>
  33. </tr>
  34. </tbody>
  35. </table>
  37. ## Gold Sponsors
  39. <table>
  40. <tbody>
  41. <tr>
  42. <td align="center" valign="middle">
  43. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  44. <picture>
  45. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  46. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  47. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  48. </picture>
  49. </a>
  50. </td>
  51. <td align="center" valign="middle">
  52. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  53. <picture>
  54. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  55. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  56. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  57. </picture>
  58. </a>
  59. </td>
  60. <td align="center" valign="middle">
  61. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  62. </td>
  63. </tr>
  64. <tr>
  65. <td align="center" valign="middle">
  66. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  67. <picture>
  68. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  69. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  70. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  71. </picture>
  72. </a>
  73. </td>
  74. <td align="center" valign="middle">
  75. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  76. <picture>
  77. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  78. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  79. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  80. </picture>
  81. </a>
  82. </td>
  83. <td align="center" valign="middle">
  84. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  85. <picture>
  86. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  87. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  88. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  89. </picture>
  90. </a>
  91. </td>
  92. </tr>
  93. <tr>
  94. <td align="center" valign="middle">
  95. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  96. <picture>
  97. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  98. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  99. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  100. </picture>
  101. </a>
  102. </td>
  103. <td align="center" valign="middle">
  104. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  105. <picture>
  106. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  107. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  108. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  109. </picture>
  110. </a>
  111. </td>
  112. </tr>
  113. </tbody>
  114. </table>
  116. <!-- sponsors end -->

vedi su githubimported 2026-09-28 via npm