●Change8

v11.0.0-alpha.11

Breaking Changes
📦 pnpmView on GitHub →
⚠ 20 breaking✨ 17 features🐛 3 fixes🔧 20 symbols

Summary

This release introduces major performance improvements across the store by switching to MessagePack and optimizing index formats, alongside significant changes to configuration loading, moving away from INI/rc files towards YAML for pnpm-specific settings. Many deprecated configuration options and commands have been removed, and the package is now pure ESM.

⚠️ Breaking Changes

  • The `pnpm config get` command (without `--json`) no longer outputs INI formatted text; it now outputs JSON for objects/arrays and raw strings for primitives. Use `pnpm config get --json` if you require JSON output for all types.
  • `pnpm config get <array>` now prints a JSON array instead of INI format.
  • `pnpm config list` now prints a JSON object instead of INI formatted text.
  • Auth-related settings are hidden by default from `pnpm config list` and `pnpm config get` (without arguments).
  • `pnpm config list` and `pnpm config get` (without argument) now show top-level keys as camelCase, except for keys starting with @ or //.
  • `pnpm config get` and `pnpm config list` no longer load non camelCase options from the workspace manifest (`pnpm-workspace.yaml`).
  • pnpm no longer loads non-auth and non-registry settings from rc files. These settings must now be defined in `pnpm-workspace.yaml`.
  • Workspace project specific `.npmrc` files are replaced by the `packageConfigs` field in `pnpm-workspace.yaml`.
  • The package is now pure ESM; CommonJS usage will break.
  • Support for Node.js v18, v19, v20, and v21 has been discontinued. Upgrade your Node.js version.
  • The standalone exe version requires at least glibc 2.27.
  • Deprecated build dependency settings (`onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, `neverBuiltDependencies`, and `ignoredBuiltDependencies`) have been removed. Use the `allowBuilds` setting instead.
  • The deprecated `allowNonAppliedPatches` option has been completely removed in favor of `allowUnusedPatches`.
  • The `ignorePatchFailures` option has been removed; all patch application failures will now throw an error.
  • The `pnpm server` command has been removed.
  • Support for `useNodeVersion` and `executionEnv.nodeVersion` fields has been removed. Use `devEngines.runtime` and `engines.runtime` instead.
  • Support for `hooks.fetchers` has been removed. Use the new API via the `fetchers` field of `pnpmfile`.
  • The default value for the `type` field in `package.json` initialized by `pnpm init` is now `module`.
  • When using `pnpm add`: `-p` is now an alias for `--save-prod` (was `--parseable`), and `-d` is now an alias for `--save-dev` (was `--loglevel=info`).
  • The One-time Password feature for `pnpm publish` now reads from `PNPM_CONFIG_OTP` instead of `NPM_CONFIG_OTP`.

Migration Steps

  1. If you relied on the output format of `pnpm config get` (without `--json`), update scripts to handle JSON output or use `pnpm config get --json`.
  2. If you used workspace project specific `.npmrc` files, migrate configuration settings to the `packageConfigs` field in `pnpm-workspace.yaml`.
  3. If you used deprecated build dependency settings (`onlyBuiltDependencies`, etc.), replace them with the `allowBuilds` map in your configuration.
  4. Replace usage of deprecated `allowNonAppliedPatches` with `allowUnusedPatches`.
  5. Remove usage of `ignorePatchFailures` as all patch failures now throw errors.
  6. Replace usage of `useNodeVersion` or `executionEnv.nodeVersion` with `devEngines.runtime` or `engines.runtime`.
  7. Replace usage of `hooks.fetchers` with the new API using the `fetchers` field in `pnpmfile`.
  8. Update scripts that rely on the OTP feature for `pnpm publish` to use the `PNPM_CONFIG_OTP` environment variable instead of `NPM_CONFIG_OTP`.
  9. If you rely on features of `pnpm publish` that used `npm publish` internally, consider using the workaround `pnpm pack && npm publish *.tgz`.

✨ New Features

  • Runtime dependencies are always linked from the global virtual store.
  • Store index file format optimized to store the hash algorithm once per file, using hex digests instead of full integrity strings for performance.
  • Internal store and cache files switched from JSON to MessagePack format for faster serialization/deserialization and smaller sizes.
  • Bundled manifest (name, version, bin, engines, scripts, etc.) is now stored directly in the package index file, speeding up repeat installs.
  • Store version bumped to v11.
  • `pnpm config get <array>` now prints a JSON array.
  • `pnpm config list` now prints a JSON object.
  • Environment variables starting with `pnpm_config_` are loaded into config, overriding workspace settings but not CLI arguments.
  • Support for reading `allowBuilds` from `pnpm-workspace.yaml` in the global package directory for global installs.
  • Added support for a global YAML config file named `config.yaml` for pnpm-specific settings.
  • Added support for pnpmfiles written in ESM (`.mjs` extension, e.g., `.pnpmfile.mjs`).
  • `pnpm why` now shows a reverse dependency tree.
  • A new `--yes` flag can be passed to `pnpm` to automatically confirm prompts.
  • When updating `pnpm-workspace.yaml`, comments, string formatting, and whitespace will be preserved.
  • The parameter set by the `--allow-build` flag is written to `allowBuilds`.
  • Support lowercase options in `pnpm add`: `-d`, `-p`, `-o`, `-e`.
  • `pnpm publish` now works without the `npm` CLI.

🐛 Bug Fixes

  • Fix YAML formatting preservation in `pnpm-workspace.yaml` when running commands like `pnpm update` (quotes and formatting were previously lost).
  • Check if a package is installable for non npm-hosted packages (e.g., git or tarball dependencies) after the manifest has been fetched.
  • Explicitly tell `npm` the path to the global `rc` config file.

Affected Symbols

`pnpm config get``pnpm config list`rc files configuration loadingworkspace manifest configuration loading`.npmrc` in workspace projects`onlyBuiltDependencies``onlyBuiltDependenciesFile``neverBuiltDependencies``ignoredBuiltDependencies``allowNonAppliedPatches``ignorePatchFailures``pnpm server``useNodeVersion``executionEnv.nodeVersion``hooks.fetchers``pnpm init` default type`pnpm add` aliases (-p, -d)`pnpm publish` OTP reading`pnpm why` output formatpnpmfile loading (ESM support)