pnpm release notes, breaking changes, and upgrade notes.
Fast, disk space efficient package manager StackPulse turns upstream changelogs into scannable summaries with risky changes, deprecations, migration notes, and source links.
This release introduces interactive group selection for global updates and warns about sudo usage for global commands, which will become an error in v12. It also includes various fixes for dependency resolution, Git repository handling, and lockfile verification.
affected
Users running pnpm global commands with sudo will be affected by the upcoming breaking change in v12.
action
Avoid using sudo with pnpm global commands to prevent issues in future versions.
release_signals
-Running `pnpm setup`, `pnpm self-update`, or global modification commands through `sudo` will fail with `ERR_PNPM_SUDO_NOT_SUPPORTED` in pnpm v12.
+Added interactive group selection to `pnpm update --global --interactive`.
pnpm 12 RC 1 introduces significant changes to how Git dependencies are handled, treating them as identities rather than transport choices, and adds new features like interactive group selection for updates. It also includes various performance improvements and bug fixes.
affected
Users relying on SSH URLs for Git dependencies from known hosts (GitHub, GitLab, Bitbucket) will need to configure global Git URL rewriting if they require SSH access.
action
Configure global Git URL rewriting if SSH access to private repositories is required.
release_signals
-Git dependencies on known hosts (GitHub, GitLab, Bitbucket) are now treated as identities rather than transport choices. SSH URLs for these hosts are no longer recorded in the lockfile, resolving to the host's canonical HTTPS URL instead. To use SSH for private repositories, configure git's URL rewriting globally.
v12.0.0-rc.0highbreakingprereleaseAug 5, 2026
pnpm 12 RC 0
This release candidate introduces a breaking change for sudo usage with global commands and fixes several bugs related to file handling, lockfile parsing, and installation behavior.
affected
Users who rely on `sudo` for global pnpm commands will need to adjust their workflows.
action
Avoid using `sudo` with pnpm global commands; they are designed to work without root permissions.
release_signals
-Running `pnpm setup`, `pnpm self-update`, or global modification commands through `sudo` now fails with `ERR_PNPM_SUDO_NOT_SUPPORTED` instead of silently operating on the root user's home directory.
This release addresses a critical security vulnerability in projects using `namedRegistries` by introducing registry-qualified keys in the lockfile. It also adds a built-in `npmjs:` alias and improves dependency resolution performance.
affected
Projects using `namedRegistries` are affected by the security fix and lockfile format change.
action
Upgrade to pnpm v11.20.0 immediately if using `namedRegistries` to mitigate package substitution risks.
release_signals
-Lockfile format change for projects using `namedRegistries`: packages are now recorded under registry-qualified keys (e.g., `foo@work:1.0.0`) to prevent package substitution risks. This is a semi-breaking change for affected projects.
This release introduces a critical security fix for projects using `namedRegistries` in pnpm 11.1.0–11.19.x, addressing a package-substitution vulnerability. It also includes performance improvements for workspace installations and peer dependency resolution.
affected
Projects using `namedRegistries` in pnpm 11.1.0–11.19.x are affected by the security fix and must upgrade.
action
Upgrade to pnpm 12 Beta 4 and perform a non-frozen install to re-key lockfile entries.
release_signals
-Projects using `namedRegistries` must upgrade to avoid package-substitution risks. Lockfile entries are re-keyed, requiring a non-frozen install and review.
This beta release introduces several new features and breaking changes, including enhanced workspace protocol support, improved `self-update` security, and new configuration options for dependency management.
affected
Users relying on project-specific configurations for `pnpm self-update` or workspace protocol behaviors may need to adjust their workflows.
action
Review project configurations and update workflows to accommodate the new `self-update` and workspace protocol behaviors.
release_signals
-`pnpm self-update` no longer takes any instruction from the project it is run in, including registry, auth configuration, or pnpmfile settings.
-`pnpm update --workspace` now fails with `ERR_PNPM_WORKSPACE_PACKAGE_NOT_FOUND` if a dependency is not in the workspace, and combining it with `--latest` fails with `ERR_PNPM_BAD_OPTIONS`.
v11.18.0highbreakingfeatureJul 29, 2026
pnpm 11.18
This release introduces stricter security for `pnpm self-update`, adds support for publishing packages under different names, and improves handling of optional and local dependencies. Several performance optimizations and bug fixes are also included.
affected
Users relying on project-specific configurations for `pnpm self-update` or managing optional dependencies with missing required dependencies are affected.
action
Review project configurations for `pnpm self-update` and ensure optional dependencies have their required dependencies available.
release_signals
-`pnpm self-update` no longer takes any instruction from the project it is run in, including registry, auth configuration, or `.pnpmfile.(c|m)js` settings. This prevents projects from redirecting downloads or weakening security checks.
+
+Interactive group selection added to `pnpm update --global --interactive`.
+`pnpm root -g` and `pnpm bin -g` now print warnings to stderr instead of stdout, keeping stdout clean for machine-readable paths.
+Support for `pnpm root -g` and `pnpm prefix -g` added, which previously failed with errors.
-Named registry aliases that shadow reserved dependency specifier prefixes (e.g., `file`, `link`) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME`.
!Fixed a package substitution vulnerability where dependencies declared against one registry could be satisfied by entries from another registry.
!`pnpm rebuild` now rejects lockfiles with path traversal in package names to prevent execution of malicious lifecycle scripts.
!`@pnpm/util.lex-comparator` and `@pnpm/config.nerf-dart` are deprecated in favor of `@pnpm/text.ordinal-comparator` and `@pnpm/config.registry-auth-key`.
+New built-in `npmjs:` alias resolves to `https://registry.npmjs.org/` by default, allowing dependencies to be pinned to the public registry.
+Improved dependency resolution performance by filtering package metadata once per packument and reusing parsed semver versions.
migration_steps3 steps
01Commit the lockfile diff after a non-frozen install to apply the registry-qualified keys fix.
02Ensure all team members use pnpm v11.20.0 or newer to avoid lockfile flip-flopping.
03Override the built-in `npmjs:` alias if using a mirror or proxy for npmjs.