pnpm release notes, breaking changes, and upgrade notes.
Fast, disk space efficient package manager StackPulse turns upstream changelogs into scannable summaries with risky changes, deprecations, migration notes, and source links.
This release improves TLS certificate verification by failing immediately on invalid certificates and enhances macOS compatibility by using bundled certificate roots when system SSL policies fail. It also fixes peer dependency installation issues when `autoInstallPeers` is enabled.
affected
Users on macOS or those with TLS certificate verification issues may experience improved reliability and performance.
action
Update to this version to benefit from improved TLS certificate handling and macOS compatibility fixes.
release_signals
!Requests to registries or tarball servers with invalid TLS certificates now fail immediately instead of retrying.
!Improved SSL policy handling on macOS to prevent crashes during registry requests.
+pnpr config file now supports `${VAR?}` placeholders for environment variables.
+Installing through a pnpr server now correctly handles peer dependencies when `autoInstallPeers` is enabled.
This release introduces the `forceIgnoresPlatform` setting and `pnpm update --peer`, while addressing numerous bugs in `pnpm deploy`, `--filter`, `nodeLinker: hoisted`, and custom `modulesDir` setups. It also includes critical security fixes for shell completion, bin shims on Nix, lifecycle scripts inside custom `modulesDir`, and `userAgent` placeholders in `pnpm-workspace.yaml`.
affected
Users relying on custom `modulesDir`, shell completion, or environment variables in `pnpm-workspace.yaml` are affected by security fixes.
action
Update to pnpm 11.28.0 to benefit from security fixes and new features.
release_signals
!Fixed environment variable expansion in `userAgent` within `pnpm-workspace.yaml` to prevent sending sensitive data to registries.
!Prevented lifecycle scripts from running in custom `modulesDir` without `allowBuilds` approval.
v12.7.0highfeaturesecuritySep 25, 2026
pnpm 12.7
pnpm 12.7.0 introduces support for `.nvmrc` and `.node-version` in the global `node` shim, adds new features like `--allow-build` and `--publish-wait-timeout`, and includes several security fixes for bin shims and lifecycle scripts.
affected
Users of pnpm with security-sensitive environments or those relying on specific Node.js version management will benefit from the security fixes and new features.
action
Update to pnpm 12.7.0 to benefit from new features and security fixes.
release_signals
!Fixed environment variable expansion in `userAgent` set in `pnpm-workspace.yaml`.
!Secured bin shims on Nix to prevent redirection of system utilities.
!Prevented lifecycle scripts of packages in `storeDir` from running without `allowBuilds` approval.
v12.6.0highfeaturesecuritySep 22, 2026
pnpm 12.6
This release introduces automatic dependency deduplication, relocatable node_modules, and support for saving TypeScript types alongside dependencies. It also includes several security fixes and improvements to package installation and dependency resolution.
affected
Users who rely on dependency deduplication, TypeScript types, or relocatable `node_modules` directories will benefit from this release.
action
Update to pnpm 12.6.0 to take advantage of new features and security improvements.
release_signals
!POSIX bin shims now take `cygpath` and `wslpath` from the system default path on Cygwin, MSYS2, and WSL2
!`pnpm install` warnings no longer carry the text of a package's deprecation notice
!Commands now warn when environment variables in project `.npmrc` credentials are ignored
v11.27.1mediumdeprecationfeatureSep 20, 2026
pnpm 11.27.1
This patch release primarily focuses on bug fixes and behavior improvements, including better handling of deprecation warnings, `pnpm deploy` optimizations, and fixes for `pnpm exec` and `pnpm dlx` command behavior.
affected
Users relying on specific behaviors of `pn`, `pnpx`, `pnx`, `pnpm deploy`, or deprecation notice formats may need to adjust their workflows.
action
Update to v11.27.1 to benefit from bug fixes and improved behavior, especially if using `pnpm deploy`, `pnpm exec`, or deprecation warnings.
release_signals
!Deprecation warnings now show the newest non-deprecated version instead of the full deprecation notice.
!The `@zkochan/cmd-shim` package is now available as `@pnpm/bins.cmd-shim`.
!
v12.5.1mediumfeatureSep 18, 2026
pnpm 12.5.1
This release improves handling of workspaces and Python package resolution, fixes issues with symbolic links in Cargo configurations, and optimizes installation performance for large lockfiles.
affected
Users with large lockfiles or symlinked Cargo configurations may see improved performance and reliability.
action
Update to pnpm 12.5.1 to benefit from improved handling of workspaces and Python package resolution.
release_signals
+pnpm now reports unknown task settings in `pnpm-workspace.yaml` instead of refusing to start.
+Python interpreter installation now retries historical release metadata requests and caches the release list.
+Python `registries` entries now route packages by exact names or trailing-prefix patterns in `packages`.
v12.5.0highbreakingfeatureSep 18, 2026
pnpm 12.5
pnpm 12.5.0 introduces Python as a first-class ecosystem, adds Package URL support in `pnpm add`, and enhances platform architecture and task concurrency configurations. It also fixes a tarball reuse issue during installation.
affected
Users leveraging `pkg` as a registry name or needing multi-ecosystem package management are affected.
action
Update `pnpm-workspace.yaml` and registry configurations to utilize new ecosystem and concurrency features.
release_signals
-`pkg` is now a reserved specifier prefix in `pnpm add`, meaning registries can no longer be named `pkg` in any case.
+Package URL support in `pnpm add` for npm, cargo, and pypi packages.
+Multi-ecosystem registry support (npm, cargo, pypi) with `ecosystem` field in registries.
This alpha release of pnpm improves handling of Python and Cargo dependencies, with better error tolerance for unreadable metadata and improved search functionality. It also fixes several edge cases in dependency resolution.
affected
Users of pnpm with Python or Cargo dependencies may experience improved resolution behavior and fewer failures.
action
Update to this version for improved compatibility with Python and Cargo dependencies.
release_signals
+`pnpm search` and `npm search` now handle broad search terms without failing
+Improved Python resolution for releases with unreadable metadata
+Better handling of Python index files with unreadable requirements
v12.4.2highfeaturesecuritySep 15, 2026
pnpm 12.4.2
pnpm 12.4.2 includes security fixes for executable shims and GitHub Actions links, improves reliability of installs, and speeds up peer dependency checks in workspaces. It also enhances Python lockfiles to work across compatible targets.
affected
Users on FreeBSD, Windows, and macOS may experience improved reliability and security, particularly those using executable shims or GitHub Actions.
action
Reinstall dependencies to replace existing shims for security fixes.
release_signals
!Dependency executables can no longer take over another package's POSIX bin shim through its shell helpers.
!GitHub Actions homepage links no longer expose server credentials; GitHub server URLs now require HTTPS.
+
v11.27.0mediumfeaturesecuritySep 12, 2026
pnpm 11.27
This release introduces global configuration for Node.js download mirrors and a new workspace trust policy setting. It also includes several bug fixes and security improvements.
affected
Users who need to configure Node.js download mirrors or manage workspace trust policies are affected.
action
Update to pnpm v11.27.0 to benefit from new features and fixes.
release_signals
!Fixed a security issue where a downloaded runtime archive was unpacked into a predictable path, now uses a randomly named directory inside the store (GHSA-vwc7-r8mq-g2x9).
+`nodeDownloadMirrors` can now be set in the global config file (`config.yaml`) and through the `PNPM_CONFIG_NODE_DOWNLOAD_MIRRORS` environment variable.
This release primarily fixes installation issues on filesystems that refuse hard links or clones, such as Android, EdenFS, and rootless containers. It also improves performance for repeat installs and adds support for more flexible directory selectors.
affected
Users on filesystems that refuse hard links or clones (like Android, EdenFS, or rootless containers) and those using `nodeLinker: hoisted` are affected by the fixes in this release.
action
Update to pnpm 12.4.1 to benefit from the fixes and performance improvements, especially if you encounter filesystem-related installation issues.
release_signals
!pnpm now uses bundled CA certificates on Android to prevent registry request crashes due to missing system CA certificates.
+pnpm install now falls back to copying when hard links or clones are refused by the filesystem.
pnpr now supports Cargo, Python, and container registries alongside npm, enabling multi-ecosystem publishing and OIDC authentication. This release introduces significant enhancements for registry management, dependency resolution, and CI/CD integration.
affected
Developers and organizations using pnpr for multi-ecosystem package management and CI/CD workflows will benefit from the new features.
action
Update to pnpr 0.1.0-alpha.11 to leverage multi-ecosystem publishing and OIDC authentication.
release_signals
+pnpr serves Cargo and Python registries alongside npm, supporting `cargo publish`, `pip install`, and `twine upload`.
+Container registry support for Docker, Podman, and Skopeo, with OCI image management and caching.
v12.4.0highfeatureSep 8, 2026
pnpm 12.4
pnpm 12.4 introduces multi-language workspace support for Python and Rust, adds a new pipeline command for task execution, and expands platform compatibility. It also includes various performance improvements and bug fixes.
affected
Users managing multi-language projects (JavaScript, Python, Rust) or needing cross-platform support are most affected by these changes.
action
Update to v12.4.0 to take advantage of multi-language dependency management and new platform support.
release_signals
+Added support for managing Python and Cargo dependencies alongside npm in the same workspace.
+Introduced `pnpm pipeline [name]` for running workspace tasks with caching and failure handling.
+Added support for new platforms: Android (arm64, x64), FreeBSD (x64), Linux (ppc64le, s390x, RISC-V).
v11.26.0mediumfeaturesecuritySep 6, 2026
pnpm 11.26
This release introduces new features like workspace dependency resolution via the `workspace:` protocol and CI validation with `pnpm change check`. It also includes several security and bug fixes, such as hiding sensitive data in logs and improving audit functionality.
affected
Users leveraging workspace dependencies, CI validation, or security-sensitive operations will benefit from the new features and fixes.
action
Update to pnpm v11.26.0 to take advantage of new features and fixes.
release_signals
!Fetch and tarball errors and retry logs now hide URL credentials, query strings, and fragments that could expose secrets.
!`pnpm audit` now excludes ignored advisories from vulnerability totals and severity counts, and reports them separately.
v12.3.3mediumfeatureSep 4, 2026
pnpm 12.3.3
This release focuses on performance improvements and bug fixes, particularly for large workspaces and edge-case installation scenarios. It addresses issues with concurrent installs, lockfile writing speed, and dependency resolution.
affected
Users with large workspaces or those using tools like Vercel, Bun, or Deno for installation will benefit from these improvements.
action
Upgrade to version 12.3.3 to benefit from performance improvements and bug fixes.
release_signals
+Improved handling of concurrent installs to prevent ENOENT errors
+Sped up lockfile writing in large workspaces
+Enhanced dependency resolution speed in large workspaces
+Added support for running pnpm through Node.js in environments that skip build scripts
v12.3.4mediumfeatureSep 4, 2026
pnpm 12.3.4
This release focuses on performance improvements and bug fixes, particularly addressing dependency resolution speed in large workspaces and restoring compatibility with boolean command-line flags.
affected
Users with large workspaces or those relying on boolean command-line flags in CI/CD pipelines (e.g., Vercel) are affected.
action
Update to pnpm 12.3.4 to benefit from performance improvements and restored functionality.
release_signals
+Sped up dependency resolution in large workspaces.
+Restored support for boolean command-line flags (e.g., `--unsafe-perm`, `--offline`, `--dangerously-allow-all-builds`) on all relevant commands.
+Added `--unsafe-perm` flag support to `pnpm remove`.
This release focuses on performance improvements, especially for large workspaces, and bug fixes in various commands like `pnpm audit`, `pnpm import`, and `pnpm update`. It also introduces better handling of lifecycle scripts and filesystem-specific behaviors.
affected
Users of pnpm, especially those with large workspaces or specific filesystem configurations, will benefit from performance improvements and bug fixes.
action
Update to pnpm v12.3.2 to benefit from performance improvements and bug fixes.
release_signals
+`pnpm audit --fix update` now updates packages it can and lists the rest as remaining.
+`pnpm import` now keeps versions recorded in source lockfiles and imports all workspace projects into the shared lockfile.
+`pnpm update` now accepts `--ignore-scripts` to skip lifecycle scripts during updates.
v12.3.1mediumfeatureSep 3, 2026
pnpm 12.3.1
This release focuses on performance improvements for large workspaces and fixes issues with global commands after self-updating from pnpm 12.2 to 12.3. Installations are now faster due to optimized workspace link target rendering and parallel project verification against the lockfile.
affected
Users with large workspaces or those who self-updated from pnpm 12.2 to 12.3 are affected.
action
Update to pnpm 12.3.1 to benefit from performance improvements and global command fixes.
release_signals
+Sped up installs in large workspaces by deriving the anchor for re-rendering workspace `link:` targets once per project.
+Improved performance by running project verification against the lockfile in parallel.
pnpm 12.3.0 introduces native executables for global commands, adds supply-chain security flags to `pnpm remove` and `pnpm update`, and includes numerous performance improvements and bug fixes for large workspaces.
affected
Users of pnpm, especially those with large workspaces or using specific commands like `pnpm remove`, `pnpm update`, or `pnpm deploy`, will benefit from performance improvements and bug fixes.
action
Update to pnpm v12.3.0 to benefit from performance improvements and bug fixes.
release_signals
+Native executables for context-aware global commands (`node`, `deno`, `bun`, and shims) on all platforms.
+`pnpm remove` and `pnpm update` now support supply-chain security flags like `--trust-lockfile` and `--trust-policy`.
+Improved handling of local directory and tarball specifications in `pnpm add` commands.
v12.2.1mediumfeatureSep 1, 2026
pnpm 12.2.1
This patch release restores the `pnpm` executable target without a file extension, ensuring compatibility for upgrading from pnpm 12.1 and earlier on POSIX systems.
affected
Users upgrading from pnpm 12.1 or earlier on POSIX systems are affected.
Catalogs can now resolve workspace dependencies through the `workspace:` protocol.
+`pnpm remove` and `pnpm update` now accept `--trust-lockfile`, `--no-trust-lockfile`, `--trust-policy`, `--trust-policy-exclude`, and `--trust-policy-ignore-after`.
+Added `pnpm change check` for CI validation of package versions against the `versioning.epics` bands and `versioning.fixed` groups in `pnpm-workspace.yaml`.