●Change8

Migrating to pnpm v11.0.0

Version v11.0.0 introduces 9 breaking changes. This guide details how to update your code.

Released: 4/28/2026

9
Breaking Changes
9
Migration Steps
13
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

pnpm publishpnpm loginpnpm logoutpnpm viewpnpm deprecatepnpm unpublishpnpm dist-tagpnpm versionpnpm auditpnpm add -gpnx.pnpmfile.cjs.pnpmfile.mjs

Breaking Changes

●Issue #1

Support for Node.js v18, 19, 20, and 21 is dropped; pnpm is now pure ESM.

●Issue #2

The standalone executable now requires glibc 2.27.

●Issue #3

`.npmrc` is now restricted to authentication and registry settings; all other configuration must move to `pnpm-workspace.yaml` or the new global `config.yaml`.

●Issue #4

Environment variables for configuration must now use the `pnpm_config_*` prefix.

●Issue #5

Deprecated build dependency settings (`onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, `neverBuiltDependencies`, `ignoredBuiltDependencies`, and `ignoreDepScripts`) have been removed and replaced by the `allowBuilds` setting.

●Issue #6

Removed `allowNonAppliedPatches`; use `allowUnusedPatches` instead.

●Issue #7

Patch application failures now throw an error; `ignorePatchFailures` has been removed.

●Issue #8

npm passthrough commands (other than the newly implemented native flow commands) now throw "not implemented".

●Issue #9

CVE-based filtering in `pnpm audit` is removed; migrate `auditConfig.ignoreCves` entries to use GHSA filtering via `auditConfig.ignoreGhsas`.

Migration Steps

  1. 1
    Review and update configuration: Move settings from `.npmrc` (excluding auth/registry) to `pnpm-workspace.yaml` or the new global `config.yaml`.
  2. 2
    Update environment variables from `pnpm_*` prefix to `pnpm_config_*` prefix.
  3. 3
    Replace deprecated build dependency settings (`onlyBuiltDependencies`, etc.) with the `allowBuilds` map in configuration.
  4. 4
    If using CVE filtering in audits, migrate `auditConfig.ignoreCves` entries to `auditConfig.ignoreGhsas`.
  5. 5
    If relying on patch failures not throwing errors, note that `ignorePatchFailures` is removed and failures now throw.
  6. 6
    If using older Node.js versions (18-21), upgrade to Node.js 22+.
  7. 7
    If using the standalone executable on Linux, ensure glibc version is 2.27 or higher.
  8. 8
    If you need to opt out of the 1-day minimum release age protection, set `minimumReleaseAge: 0` in `pnpm-workspace.yaml`.
  9. 9
    Review global package usage; global installs now use an isolated virtual store by default, which can be disabled via `enableGlobalVirtualStore: false`.

Release Summary

This major release upgrades pnpm to pure ESM, requires Node.js 22+, and introduces significant security enhancements like default supply-chain protection and a new SQLite-backed store index for performance gains. Configuration handling has also been streamlined, restricting `.npmrc` usage and replacing old build dependency settings.

Need More Details?

View the full release notes and all changes for pnpm v11.0.0.

View Full Changelog