Skip to content
verdict:

pnpm 11.2.0

notable

Release notes

note: no summary for this older release

We summarize recent releases. The original release notes for this version are below.

release-notesgithub.com/pnpm/pnpm · 137 lines
  1. > See full [v11.0.0 changelog](https://github.com/pnpm/pnpm/releases/tag/v11.0.0)
  2. > Migration guide: [Migrating from v10 to v11](https://pnpm.io/11.x/migration)
  4. ## Minor Changes
  6. * **Experimental:** Adding [`@pnpm/pacquet`](https://npmx.dev/package/@pnpm/pacquet) (the Rust port of pnpm) to `configDependencies` in `pnpm-workspace.yaml` now delegates the materialization phase of `pnpm install` to the pacquet binary. pnpm still owns dependency resolution; pacquet only fetches and imports from the freshly-written lockfile. This is an opt-in preview of the Rust install engine [#11723](https://github.com/pnpm/pnpm/issues/11723).
  8. To configure pacquet in a project, run:
  10. ```
  11. pnpm add @pnpm/pacquet --config
  12. ```
  14. You'll see changes in `pnpm-workspace.yaml` and `pnpm-lock.yaml` that should be committed. If you experience any issues with pacquet, please let us know by mentioning this in the GitHub issue you create.
  16. * `configDependencies` now resolve and install one level of `optionalDependencies` declared by the config dependency, with `os`/`cpu`/`libc` platform filtering applied at install time. This unlocks the esbuild/swc-style pattern where a package ships platform-specific binaries via `optionalDependencies` — a config dependency can now do the same and have the matching binary symlinked next to it in the global virtual store, so `require('pkg-platform-arch')` from inside the config dependency resolves correctly.
  18. The env lockfile records all platform variants regardless of host platform, so it remains portable across machines. Each entry in a config dependency's `optionalDependencies` must declare an exact version — ranges and tags are rejected to keep installs reproducible.
  20. * Implement the documented `pnpm login --scope <scope>` flag. The scope is normalized (a leading `@` is added if missing; blank values are ignored) and an `@<scope>:registry=<registry>` mapping is written to the pnpm auth file alongside the auth token. Subsequent installs of `@<scope>/*` packages then route to the chosen registry. Previously `pnpm login --scope foo` errored with `Unknown option: 'scope'` despite the flag being listed in the online documentation [#11716](https://github.com/pnpm/pnpm/issues/11716).
  22. * `pnpm outdated` and `pnpm update --interactive` now report Node.js, Deno, and Bun runtimes installed as project dependencies (`runtime:` specifiers). Previously these were silently skipped.
  24. ## Patch Changes
  26. * Fix `cafile=<relative-path>` in `.npmrc` being read from the wrong directory when pnpm is invoked from a different cwd (e.g. `pnpm --dir <project> install` from a CI wrapper or monorepo script). The path is now resolved against the directory of the `.npmrc` that declared it, not `process.cwd()`. Before this fix the CA file silently failed to load — the install proceeded without the configured CA and the user only saw TLS errors against a private registry, with no log line tying back to the wrongly resolved path [#11624](https://github.com/pnpm/pnpm/issues/11624).
  28. * Fix `config.registry` getting a trailing slash appended when `registry` is set in `.npmrc` and no `registries.default` is provided by `pnpm-workspace.yaml`. The sync from `registries.default` to `config.registry` introduced in #11744 now only fires when the workspace manifest actually contributes a different default.
  30. * Fix global add/update to handle minimumReleaseAge policy violations instead of surfacing an internal resolver guardrail error.
  32. * Fix two crashes with `injectWorkspacePackages: true` when the lockfile has been pruned (e.g. by `turbo prune --docker`):
  34. * `Cannot use 'in' operator to search for 'directory' in undefined`: a peer-dependency-variant injected snapshot inherits its `resolution` from the base `packages:` entry; when a pruner drops that base entry the readers crash. `convertToLockfileObject` now reconstructs the directory resolution from the `file:` depPath at load time — a single normalization point, so every reader sees a fully-formed snapshot.
  35. * `ERR_PNPM_ENOENT` on `node_modules/.bin/<tool>`: after `prepare`/`postinstall`, `runLifecycleHooksConcurrently` re-imported each injected workspace package; the `scanDir`-into-`filesMap` workaround fed target-internal paths to the importer, which the `makeEmptyDir` fast path (#11088) then wiped. Drop the workaround and pass `keepModulesDir: true` so the importer preserves the target's existing `node_modules` (bin links + transitive deps) and source files keep their hardlinks.
  37. * Fixed `pnpm login` and `pnpm logout` ignoring `registries.default` from `pnpm-workspace.yaml` [#10099](https://github.com/pnpm/pnpm/issues/10099).
  39. * Fix the `minimumReleaseAge` (publishedBy) maturity shortcut to be inclusive at the cutoff. Previously, abbreviated metadata whose `modified` field equalled the cutoff fell off the fast path and triggered a full-metadata re-fetch (or a `MISSING_TIME` error when full metadata wasn't permitted). Since `modified` is an upper bound on every version's publish time, `modified == publishedBy` already implies every version passes the per-version `<=` filter in `filterPkgMetadataByPublishDate`, so the shortcut now accepts the boundary case directly. Strictly `>` (was `>=`) at the rejection branch.
  41. * Honor `publishConfig.access` when publishing packages.
  44. <!-- sponsors -->
  46. ## Platinum Sponsors
  48. <table>
  49. <tbody>
  50. <tr>
  51. <td align="center" valign="middle">
  52. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  53. </td>
  54. </tr>
  55. </tbody>
  56. </table>
  58. ## Gold Sponsors
  60. <table>
  61. <tbody>
  62. <tr>
  63. <td align="center" valign="middle">
  64. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  65. <picture>
  66. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  67. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  68. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  69. </picture>
  70. </a>
  71. </td>
  72. <td align="center" valign="middle">
  73. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  74. <picture>
  75. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  76. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  77. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  78. </picture>
  79. </a>
  80. </td>
  81. <td align="center" valign="middle">
  82. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  83. </td>
  84. </tr>
  85. <tr>
  86. <td align="center" valign="middle">
  87. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  88. <picture>
  89. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  90. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  91. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  92. </picture>
  93. </a>
  94. </td>
  95. <td align="center" valign="middle">
  96. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  97. <picture>
  98. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  99. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  100. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  101. </picture>
  102. </a>
  103. </td>
  104. <td align="center" valign="middle">
  105. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  106. <picture>
  107. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  108. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  109. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  110. </picture>
  111. </a>
  112. </td>
  113. </tr>
  114. <tr>
  115. <td align="center" valign="middle">
  116. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  117. <picture>
  118. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  119. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  120. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  121. </picture>
  122. </a>
  123. </td>
  124. <td align="center" valign="middle">
  125. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank">
  126. <picture>
  127. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  128. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  129. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  130. </picture>
  131. </a>
  132. </td>
  133. </tr>
  134. </tbody>
  135. </table>
  137. <!-- sponsors end -->

view on githubimported 2026-09-28 via npm