pnpm release notes, breaking changes, and upgrade notes

stack.pulse

#stacks/

loading releases…

releases

breaking

security

deprecated

migrations

# latest_releases

source-backed

# latest_releases

source-backed

all breaking deprecation migration security

v12.0.0-rc.1highbreakingmigrationfeatureprereleaseAug 7, 2026

pnpm 12 RC 1

pnpm 12 RC 1 introduces significant changes to how Git dependencies are handled, treating them as identities rather than transport choices, and adds new features like interactive group selection for updates. It also includes various performance improvements and bug fixes.

affected

Users relying on SSH URLs for Git dependencies from known hosts (GitHub, GitLab, Bitbucket) will need to configure global Git URL rewriting if they require SSH access.

action

Configure global Git URL rewriting if SSH access to private repositories is required.

release_signals

-Git dependencies on known hosts (GitHub, GitLab, Bitbucket) are now treated as identities rather than transport choices. SSH URLs for these hosts are no longer recorded in the lockfile, resolving to the host's canonical HTTPS URL instead. To use SSH for private repositories, configure git's URL rewriting globally.

+Interactive group selection added to `pnpm update --global --interactive`.

+`pnpm root -g` and `pnpm bin -g` now print warnings to stderr instead of stdout, keeping stdout clean for machine-readable paths.

+Support for `pnpm root -g` and `pnpm prefix -g` added, which previously failed with errors.

migration_steps1 steps

01For private repositories requiring SSH access, configure Git's URL rewriting globally using `git config --global url."git@github.com:".insteadOf https://github.com/`.

view source on github->

v11.20.0criticalbreakingdeprecationmigrationfeaturesecurityAug 3, 2026

pnpm 11.20

This release addresses a critical security vulnerability in projects using `namedRegistries` by introducing registry-qualified keys in the lockfile. It also adds a built-in `npmjs:` alias and improves dependency resolution performance.

affected

Projects using `namedRegistries` are affected by the security fix and lockfile format change.

action

Upgrade to pnpm v11.20.0 immediately if using `namedRegistries` to mitigate package substitution risks.

release_signals

-Lockfile format change for projects using `namedRegistries`: packages are now recorded under registry-qualified keys (e.g., `foo@work:1.0.0`) to prevent package substitution risks. This is a semi-breaking change for affected projects.

v12.0.0-beta.4criticalbreakingmigrationfeaturesecurityprereleaseAug 3, 2026

pnpm 12 Beta 4

This release introduces a critical security fix for projects using `namedRegistries` in pnpm 11.1.0–11.19.x, addressing a package-substitution vulnerability. It also includes performance improvements for workspace installations and peer dependency resolution.

affected

Projects using `namedRegistries` in pnpm 11.1.0–11.19.x are affected by the security fix and must upgrade.

action

Upgrade to pnpm 12 Beta 4 and perform a non-frozen install to re-key lockfile entries.

release_signals

-Projects using `namedRegistries` must upgrade to avoid package-substitution risks. Lockfile entries are re-keyed, requiring a non-frozen install and review.

# latest_releases

pnpm release notes, breaking changes, and upgrade notes.

pnpm releases from GitHub

Breaking changes and deprecations

Source-backed next steps

# latest_releases

pnpm 12 RC 1

pnpm 11.20

pnpm 12 Beta 4