Skip to content
verdict:

pnpm 12.14.0

notable

Release notes

pending: summary queued

Detected 2026-10-16 at 02:31 UTC. Summaries usually land within a few hours; the full release notes are already below.

release-notesgithub.com/pnpm/pnpm · 161 lines
  1. This release adds the `sideEffectsCache.exclude` setting, stops `pnpm install` from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.
  3. ### Minor Changes
  5. - Added the `sideEffectsCache.exclude` setting for packages whose build depends on something pnpm cannot include in the cache key, such as the system libraries a native addon links against. pnpm builds the listed packages in every project and never restores or saves their builds through the side-effects cache, locally or on a `remoteCache` server. Under the global virtual store, each project gets its own copy of these packages and of the packages that depend on them. Entries use the same `name`, `@scope/*`, and `name@version` patterns as `minimumReleaseAgeExclude` [#5271](https://github.com/pnpm/pnpm/issues/5271).
  7. - `pnpm login` now prints the `npm-notice` response header during web-based login. Registries use it to show the verification code that completes the sign-in in the browser.
  9. ### Patch Changes
  11. #### Installing packages
  13. - `pnpm install` and `pnpm add` no longer wait for the daily update check. If the command finishes first, pnpm skips the update notice and checks again next time. On a registry that accepted the connection but never answered, an install that had nothing to do used to take minutes [#16839](https://github.com/pnpm/pnpm/issues/16839).
  15. - `pnpm install`, `pnpm add` and `pnpm update` now reuse `pnpm-lock.yaml` when the workspace configures a catalog entry that no dependency references, such as an unused entry or one whose package an `overrides` entry replaces. Before, every resolution in such a workspace resolved all dependencies again from the registry [#16923](https://github.com/pnpm/pnpm/issues/16923).
  17. - `pnpm install` now looks up a git dependency's branch or tag once per install, even when many workspace projects depend on it. With `linkWorkspacePackages` enabled, it used to run `git ls-remote` once per project [#16899](https://github.com/pnpm/pnpm/issues/16899).
  19. - A filtered install, such as `pnpm install --filter <pkg>`, now keeps the `pnpm-lock.yaml` entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk [#16931](https://github.com/pnpm/pnpm/issues/16931).
  21. - pnpm now decides whether a dependency that a package also declares as an optional peer is linked as a dependency or as a peer from the shallowest path that reaches the package. When an existing lockfile records such a dependency as a regular dependency and a newly added dependency now provides the peer, pnpm records it as a peer, as a fresh install does. The lockfile entry of such a package can change on the next install [#16901](https://github.com/pnpm/pnpm/issues/16901).
  23. - An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store [#16929](https://github.com/pnpm/pnpm/issues/16929).
  25. #### Running commands and scripts
  27. - pnpm no longer aborts with a core dump when the reader of its output has exited, as in `pnpm list | head -1` or `pnpm start 2>&1 | head -1`. The command finishes with its usual exit code, and a failing script's exit code is kept. A write to stdout that fails for another reason, such as a full disk, ends the command with exit code 1 [#16904](https://github.com/pnpm/pnpm/issues/16904) [pnpm/tasks#132](https://github.com/pnpm/tasks/issues/132).
  29. - On Windows, `pnpm exec`, `pnpm run`, and commands such as `pnpm nx` now return when the command they run exits, even if it left a detached process running and pnpm's output is redirected or piped. Previously a shell reading that output waited until the detached process, such as the Nx daemon, exited [#16930](https://github.com/pnpm/pnpm/issues/16930).
  31. - Commands that do not write the project manifest now leave a missing `package.json` absent. This covers queries such as `pnpm why` and `pnpm outdated`, `pnpm fetch`, `pnpm dedupe --check`, and commands that exit with an error, such as `pnpm rt ls`. These commands used to create one from the initialization template. `pnpm sbom` run from a lockfile alone now reports the root component as `unknown` with version `0.0.0` [#16907](https://github.com/pnpm/pnpm/issues/16907).
  33. - `pnpm run` now reports a failed script as a JSON record under `--reporter=ndjson`. It printed a plain `[ELIFECYCLE]` line to stderr.
  35. - `pnpm run` no longer prints `[ELIFECYCLE] Command failed with exit code N.` to stderr when a script fails under `--reporter=silent`, `--silent`, or `--loglevel=silent`.
  37. - `pnpm pipeline --dry-run` no longer writes a run report when no projects are selected. With `--json` it prints `{"tasks": []}` [pnpm/tasks#126](https://github.com/pnpm/tasks/issues/126).
  39. #### Packing and publishing
  41. - `pnpm pack` and `pnpm publish` now ship the whole gitignored directory that `main`, `browser`, or `bin` points into, as npm does. Previously only the `main` and `bin` files themselves were packed, and a gitignored `browser` file was left out [#16908](https://github.com/pnpm/pnpm/issues/16908).
  43. - `pnpm pack` and `pnpm publish` now honor a `.npmignore` or `.gitignore` inside a subdirectory when `package.json` has a `files` field. The package root's ignore files and those inherited from the workspace are still skipped [#16909](https://github.com/pnpm/pnpm/issues/16909).
  45. #### Setting up pnpm and toolchains
  47. - `--registry`, `--https-proxy`, `--http-proxy`, and `--no-proxy` now apply when pnpm resolves and downloads the pnpm version a project pins in `packageManager`. Before, these lookups went to `https://registry.npmjs.org/`, which a firewall that only allows a private registry blocks [#16911](https://github.com/pnpm/pnpm/discussions/16911).
  49. - On Windows, `pnpm install` now installs the Rust toolchain for rustup's default host, so a machine set up with `rustup set default-host x86_64-pc-windows-gnu` gets the MinGW toolchain. Without a default host, pnpm installs the MSVC toolchain for the machine's architecture, as rustup does. This includes a pnpm built for MinGW, such as the MSYS2 package, which has installed the MinGW toolchain since 12.13.0. An x64 pnpm on ARM64 Windows now installs the ARM64 toolchain [#16854](https://github.com/pnpm/pnpm/issues/16854).
  51. <!-- sponsors -->
  53. ## Platinum Sponsors
  55. <table>
  56. <tbody>
  57. <tr>
  58. <td align="center" valign="middle">
  59. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  60. </td>
  61. <td align="center" valign="middle">
  62. <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  63. <picture>
  64. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
  65. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
  66. <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
  67. </picture>
  68. </a>
  69. </td>
  70. <td align="center" valign="middle">
  71. <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
  72. </td>
  73. </tr>
  74. <tr>
  75. <td align="center" valign="middle">
  76. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  77. <picture>
  78. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  79. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  80. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  81. </picture>
  82. </a>
  83. </td>
  84. </tr>
  85. </tbody>
  86. </table>
  88. ## Gold Sponsors
  90. <table>
  91. <tbody>
  92. <tr>
  93. <td align="center" valign="middle">
  94. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  95. <picture>
  96. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  97. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  98. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  99. </picture>
  100. </a>
  101. </td>
  102. <td align="center" valign="middle">
  103. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  104. <picture>
  105. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  106. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  107. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  108. </picture>
  109. </a>
  110. </td>
  111. <td align="center" valign="middle">
  112. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  113. </td>
  114. </tr>
  115. <tr>
  116. <td align="center" valign="middle">
  117. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  118. <picture>
  119. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  120. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  121. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  122. </picture>
  123. </a>
  124. </td>
  125. <td align="center" valign="middle">
  126. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  127. <picture>
  128. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  129. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  130. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  131. </picture>
  132. </a>
  133. </td>
  134. <td align="center" valign="middle">
  135. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  136. <picture>
  137. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  138. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  139. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  140. </picture>
  141. </a>
  142. </td>
  143. </tr>
  144. <tr>
  145. <td align="center" valign="middle">
  146. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  147. <picture>
  148. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  149. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  150. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  151. </picture>
  152. </a>
  153. </td>
  154. <td align="center" valign="middle">
  155. <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a>
  156. </td>
  157. </tr>
  158. </tbody>
  159. </table>
  161. <!-- sponsors end -->

view on githubdetected 2026-10-16 via npm