●Change8

Migrating to pnpm v10.34.2

Version v10.34.2 introduces 2 breaking changes. This guide details how to update your code.

Released: 6/10/2026

2
Breaking Changes
2
Migration Steps
4
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

packageManager fieldpnpm self-updatelifecycle scripts approvalbin resolution

Breaking Changes

●Issue #1

Repository-controlled configuration files (.npmrc, pnpm-workspace.yaml) can no longer expand environment variables (${...}) in registry/proxy request destinations, URL-scoped keys, or registry credential values. This prevents secret exfiltration. Trusted config sources (CLI options, env config, user/global .npmrc) retain full environment variable expansion.

●Issue #2

When pnpm downloads a new pnpm version via `packageManager` field or `pnpm self-update`, the registry used for the download now comes exclusively from trusted config sources (CLI options, env config, user/global .npmrc), ignoring repository project/workspace settings. If verification fails, the version switch is refused.

Migration Steps

  1. 1
    If you rely on environment variable expansion within registry URLs or authentication credentials defined in project or workspace `.npmrc` or `pnpm-workspace.yaml`, move those definitions to global `.npmrc`, user `.npmrc`, CLI configuration, or environment variables.
  2. 2
    If you explicitly approved lifecycle scripts for git, tarball, or directory artifacts using `onlyBuiltDependencies` or `allowBuilds` with a registry-style dependency path, update the key to use the peer-suffix-free lockfile depPath instead.

Release Summary

This patch significantly enhances security by enforcing trust boundaries for package manager bootstrapping and environment variable expansion in configuration. It also introduces cryptographic verification for downloaded pnpm binaries and Node.js release hashes.

Need More Details?

View the full release notes and all changes for pnpm v10.34.2.

View Full Changelog