Pnpm 12.0

pnpm 12 is stable. It is simply a rewrite of pnpm successful Rust, and it is deliberately not a migration: the commands, flags, settings, and lockfile format of pnpm 11 each transportation over, and the documentation describes some versions.

The short database of things that genuinely behave otherwise is successful What's different successful pnpm 12. This station covers what pnpm 12 adds that pnpm 11 ne'er shipped.

Breaking changes​

Git limitations are identities​

For repositories connected GitHub, GitLab, and Bitbucket, a specifier now names a repository alternatively than choosing a transport. github:owner/repo, owner/repo, git+https://…, and git+ssh://git@… each resoluteness done the host's canonical HTTPS URL, and the lockfile ne'er records an SSH URL for those hosts. To scope a backstage hosted repository complete SSH, configure the machine pinch git's ain URL rewriting:

pnpm shells retired to git, truthful the rewrite applies to each of its git operations. Unknown hosts support their nonstop URL, SSH included, and a URL pinch embedded credentials is kept verbatim and ne'er resolves to a big archive. Details successful How git limitations are resolved.

An unrecognized mounting successful pnpm-workspace.yaml is reported​

A mounting pnpm does not admit utilized to beryllium ignored successful soundlessness — a misspelled minimumReleaseAge dropped the argumentation it was meant to set, and thing said so. It is now reported, pinch the closest existent mounting sanction suggested erstwhile the cardinal looks for illustration a typo.

It fails the bid pinch ERR_PNPM_UNRECOGNIZED_WORKSPACE_SETTINGS erstwhile the task pins a pnpm type the moving pnpm satisfies: pinch the pin honored, the mounting cannot person been meant for a different pnpm version, truthful it is simply a correction to hole alternatively than a cardinal to ignore. Everywhere other it is simply a warning, truthful a task that has yet to beryllium cleaned up keeps working. The pnpm config subcommands ne'er neglect connected it, truthful a surgery record tin still beryllium inspected and repaired.

Lockfiles of cyclic dependency graphs​

Dependency cycles are now surgery canonically during adjacent resolution: the members of each rhythm are ordered by package id, and the edges that adjacent a rhythm are ever trim astatine the aforesaid place, wherever the installation walks into the rhythm from.

The lockfile truthful becomes a axenic usability of the dependency chart — reordered importers, reordered dependencies, and repeated installs each nutrient byte-identical lockfiles, which they could not earlier (#13846, #13865). On ample cycle-heavy workspaces adjacent solution is 2–3× faster, uses astir 25% little memory, and produces a substantially smaller lockfile.

Existing lockfiles support working: --frozen-lockfile consumes them unchanged, and an instal that skips solution leaves them untouched. The first instal that really re-resolves re-keys the walk-order-dependent adjacent variants of cyclic packages once. See How peers are resolved.

packageImportMethod: car hardlinks first connected Linux​

A reflink materializes a caller inode and copies grade bookkeeping wrong the filesystem's metadata trees, wherever a hardlink is 1 directory introduction — connected btrfs that astir halves the clip an instal spends materializing node_modules from a lukewarm store. So connected Linux, auto now tries the hardlink first.

ext4 is unchanged (cloning was ne'er supported there, truthful car already hardlinked), and macOS keeps clone-first, wherever APFS clonefile is the platform's inexpensive primitive. On Linux, cloning becomes the 2nd rung alternatively than the first, truthful a shop that refuses a hardlink still gets a clone; packageImportMethod: clone still asks for 1 outright.

engineStrict follows the edge, not the subtree​

Under engineStrict, an instal now fails erstwhile an incompatible package is reached done a regular limitations separator of an installable package, moreover erstwhile that full subtree hangs disconnected an optionalDependencies entry. pnpm 11 installs the package and emits an install-check informing instead. Packages reachable only done optional edges, aliases done a package that was itself skipped, are still skipped successful some versions (#13286).

New features​

Not each of these are exclusive to pnpm 12. Registry revisions, the remote side-effects cache, audit.ignorePrune, batch staged approval, and the pnpm init latest-tag pin vessel successful pnpm 11.25 arsenic well; the remainder are v12 only, because they beryllium to the Rust rewrite.

Project-aware world bins​

A globally installed node, deno, aliases bun follows the type the existent task pins, alternatively of ever moving the globally installed 1 — nary ammunition hooks, nary use-style command. The caller globalShims mounting picks which globally installed packages get specified a shim; it defaults to { node: true, deno: true, bun: existent } and merges key-wise, truthful globalShims: { typescript: existent } adds 1 without restating the rest.

A unchangeable Node.js merchandise is authenticated against the Node.js merchandise team's signatures and switches without asking. Everything other — Deno, Bun, Node.js prereleases, mean package bins you alteration — asks Do you spot this project? erstwhile per task and per candidate, and remembers the reply machine-locally. PNPM_SHIM_BYPASS=1 bypasses the characteristic for 1 invocation. See Project-aware world bins.

pnpm installs the different package managers​

pnpm now provisions npm, Yarn Classic, Yarn Berry, Yarn 6 (yarnpkg/zpm), and Bun, each fetched done the trusted package-manager registries, and each npm-published 1 verified against npm's signature for its nonstop type earlier it runs.

Three things usage it. A git-hosted dependency is prepared pinch the package head it asks for, truthful a repository built pinch Yarn installs connected a instrumentality that only has pnpm. pnx runs 1 for a azygous bid — pnx yarn@4 install, pnx npm@11 ci, pnx node@22. And pnpm shim adhd yarn links a yarn that runs immoderate the existent task pins.

Naming a package head truthful intends the instrumentality alternatively than the npm package that shares its name: pnpm adhd -g yarn@4 installs Yarn Berry, and successful a task pnpm adhd yarn@4 records "packageManager": "[email protected]" — what Corepack sounds — while each different package head is recorded successful devEngines.packageManager. A specifier that locates a package still installs what it names (pnpm adhd yarn@npm:[email protected]). See Other package managers.

Registry revisions​

A registry tin service a replacement artifact for an already-published type — a rebuild pinch a vulnerability patched retired — without changing the type number and without rewriting the bytes the canonical name@version URL has ever served. pnpm calls each specified artifact a revision, addresses it by its complete SHA-512 digest, and records it successful the lockfile arsenic 1 other line:

An introduction pinch nary revision is revision 0, the original — which is what each introduction pnpm has ever written means, truthful a lockfile that has adopted nary replacements is byte-identical to today's.

A dependency aliases override whitethorn pin a revision explicitly arsenic <version>+rN, and pnpm update --patches refreshes the locked artifacts without changing a azygous version. pnpr serves revisions for the packages it hosts and proxies them for an upstream registry that advertises them. See Registry revisions.

pnpm init pins the latest pnpm​

pnpm init pins the latest released pnpm alternatively than the type that ran the command, truthful a task scaffolded by an outdated pnpm nary longer inherits that staleness done its ain pin (#7490). If the latest lookup cannot reply — nary network, a slow registry, offline, aliases a latest that minimumReleaseAge aliases trustPolicy rejects — the moving type is pinned arsenic before. The lookup ne'er fails aliases hangs the command.

Batch support for staged publishing​

pnpm shape approve approves respective staged packages astatine once. Run it pinch nary shape id to prime from the staged versions interactively, aliases walk a list. The full batch is approved pinch a single one-time password, and pnpm asks for a caller 1 only erstwhile the registry stops accepting it. Inside a workspace the packages are approved successful dependency order, and 1 whose workspace dependency could not beryllium approved is skipped alternatively than published against a dependency that ne'er reached the registry.

audit.ignorePrune​

Set audit.ignorePrune: true and pnpm audit --fix removes the ignored GHSA entries that nary longer look successful the audit report, truthful a database of tolerated advisories stops accumulating entries for limitations that are agelong gone.

Global commands garbage to tally nether sudo​

pnpm setup, pnpm self-update, and immoderate bid that modifies the world installation now neglect pinch ERR_PNPM_SUDO_NOT_SUPPORTED nether sudo, alternatively of silently operating connected the guidelines user's location directory. pnpm keeps world packages and configuration successful the invoking user's home, truthful these commands ne'er request root. Read-only world commands specified arsenic pnpm bin --global still work.

A distant side-effects cache (proof of concept)​

An opt-in impervious of conception lets installs reuse a dependency's build output crossed machines, by publishing and restoring signed, organization-scoped artifacts done pnpr alternatively of moving the lifecycle scripts locally.

A repository names only the eligible remoteSideEffectsCache.organization and packages; everything describing the enactment of signing is refused successful pnpm-workspace.yaml and publication from the world config record aliases the situation instead, truthful a cloned repository cannot move the machine's cardinal into a signing oracle. Every cache nonaccomplishment falls backmost to the mean section build. It restores connected Linux/glibc x64 and arm64 only for now — spot Shared side-effects cache.

Fixes worthy knowing about​

The compatibility database drops its static-analysis entries​

The built-in compatibility database nary longer adds limitations that were detected by fixed study of published packages. Those entries named packages a limited only imports for its types, truthful installing them was astatine champion unnecessary and astatine worst collapsed the dependent: @typescript-eslint/types gained a typescript dependency resolved to the newest release, which put TypeScript 7 nether older @typescript-eslint versions and made ESLint neglect pinch Cannot publication properties of undefined (reading 'Intrinsic'). The @yarnpkg/extensions entries and pnpm's ain curated ones stay.

A shop wrong the task erstwhile thing supra it is linkable​

When nary directory supra the task accepts a difficult nexus — an AI supplier sandbox that grants constitute entree only to the project, aliases a instrumentality pinch conscionable the task mounted writable — the default shop is created astatine <project>/node_modules/.pnpm-store alternatively of successful the pnpm location directory. In those environments the location shop is either read-only aliases connected different volume, which forces each package to beryllium copied alternatively of difficult linked (#13525).

The filterLog pnpmfile hook is deprecated​

pnpm 12 ignores hooks.filterLog and warns erstwhile a pnpmfile defines it. Use loglevel to take really overmuch pnpm reports.

Feedback​

Please report immoderate issues you tally into.