●Change8

Migrating to pnpm v11.4.0

Version v11.4.0 introduces 1 breaking change. This guide details how to update your code.

Released: 5/27/2026

1
Breaking Changes
2
Migration Steps
3
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

@pnpm/network.auth-headercreateGetAuthHeaderByURIgetAuthHeadersFromCreds

Breaking Changes

●Issue #1

Tarball integrity mismatches against the lockfile now cause `pnpm install` (non-frozen) to fail hard with `ERR_PNPM_TARBALL_INTEGRITY` instead of silently overwriting the lockfile integrity. To refresh locked integrity values, use the new opt-in flag: `pnpm install --update-checksums`.

Migration Steps

  1. 1
    If you rely on unscoped credentials (like `_authToken`) in your configuration files, rewrite them to be URL-scoped (e.g., prefix them with `//registry.example.com/`).
  2. 2
    If you need to refresh locked integrity values without bypassing other integrity checks, use `pnpm install --update-checksums` instead of relying on silent overwrites.

Release Summary

This release significantly hardens security by enforcing tarball integrity checks by default and preventing credential leakage across registries. It also fixes several vulnerabilities related to malicious lockfile entries and patch files.

Need More Details?

View the full release notes and all changes for pnpm v11.4.0.

View Full Changelog