●Change8

Migrating to pnpm v11.6.0

Version v11.6.0 introduces 1 breaking change. This guide details how to update your code.

Released: 6/11/2026

1
Breaking Changes
3
Migration Steps
10
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

project/workspace `.npmrc``registry` key`@scope:registry` keyproxy URLsURL-scoped keys (`//host/…`)credential values (`_authToken`, `_auth`, `_password`, `username`, `tokenHelper`, `cert`, `key`)`pnpm-workspace.yaml` registry URLs`node_modules/.pnpm/lock.yaml``npm_config_//…` environment variables`pnpm_config_//…` environment variables

Breaking Changes

●Issue #1

pnpm no longer expands `${ENV_VAR}` placeholders from repository-controlled project/workspace `.npmrc` files for sensitive configuration keys (like `registry`, authentication tokens, proxy URLs). This is a security fix to prevent environment secret leakage. If authentication breaks, move tokens out of the committed `.npmrc` and use `pnpm config set "<key>" "$NPM_TOKEN"` or place the configuration in your user-level `~/.npmrc`.

Migration Steps

  1. 1
    If authentication broke after upgrading, move tokens configured in your project/workspace `.npmrc` to your user-level `~/.npmrc` or use `pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN"` (adjusting the key as necessary).
  2. 2
    If using GitHub Actions with `actions/setup-node` and `registry-url`, no action is required as it already writes to a user-level `.npmrc`.
  3. 3
    For other CI environments where editing pipelines is difficult, set the environment variable `PNPM_CONFIG_NPMRC_AUTH_FILE=.npmrc` (or `NPM_CONFIG_USERCONFIG=.npmrc`) to declare the project `.npmrc` as trusted.

Release Summary

This release introduces a critical security fix preventing environment variable leakage from project `.npmrc` files, requiring users to move sensitive configuration to trusted sources. It also enhances installation speed when lockfiles are missing and adds new ways to configure registry settings via environment variables.

Need More Details?

View the full release notes and all changes for pnpm v11.6.0.

View Full Changelog