●Change8

Migrating to pnpm v11.0.0-rc.1

Version v11.0.0-rc.1 introduces 3 breaking changes. This guide details how to update your code.

Released: 4/15/2026

3
Breaking Changes
2
Migration Steps
4
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

`pnpm audit``auditConfig.ignoreCves``auditConfig.ignoreGhsas``pnpm store prune`

Breaking Changes

●Issue #1

The registry retired legacy audit endpoints, causing `pnpm audit` to switch to the bulk endpoint (`/-/npm/v1/security/advisories/bulk`).

●Issue #2

CVE-based filtering for audits is no longer supported; it has been replaced by GitHub advisory ID (GHSA) filtering.

●Issue #3

The configuration key `auditConfig.ignoreCves` is no longer recognized and must be replaced with `auditConfig.ignoreGhsas`.

Migration Steps

  1. 1
    Replace all `CVE-YYYY-NNNNN` entries in your `auditConfig.ignoreCves` with the corresponding `GHSA-xxxx-xxxx-xxxx` value found in the 'More info' column of `pnpm audit` output.
  2. 2
    Move the new GHSA entries under the `auditConfig.ignoreGhsas` key in your configuration.

Release Summary

This release updates `pnpm audit` to use the modern registry bulk endpoint, replacing CVE filtering with GHSA filtering, and introduces several new native CLI commands like `pnpm docs`, `pnpm ping`, and `pnpm search`.

Need More Details?

View the full release notes and all changes for pnpm v11.0.0-rc.1.

View Full Changelog