●Change8

v11.0.0-alpha.12

Breaking Changes
📦 pnpmView on GitHub →
⚠ 15 breaking✨ 12 features🐛 1 fixes⚡ 1 deprecations🔧 27 symbols

Summary

This release introduces major architectural changes focused on performance and isolation, including switching internal store formats to MessagePack, isolating global packages, and updating configuration handling. Several deprecated features and configuration options related to build dependencies and linking have been removed.

⚠️ Breaking Changes

  • The `pnpm config get` command (without `--json`) now outputs JSON for objects/arrays and raw values for strings/numbers/booleans/nulls, instead of INI format. If you relied on INI output, you must now use `pnpm config get --json` or adjust parsing logic.
  • The `pnpm config list` command now outputs a JSON object instead of INI formatted text. If you relied on INI output, you must now use `--json` or adjust parsing logic.
  • pnpm no longer loads non-auth and non-registry settings from rc files. These settings must now be defined in `pnpm-workspace.yaml`.
  • Workspace project specific `.npmrc` files are replaced by the `packageConfigs` field in `pnpm-workspace.yaml`. You must migrate configuration settings from `.npmrc` files to `packageConfigs` in the workspace manifest.
  • Deprecated build dependency settings (`onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, `neverBuiltDependencies`, and `ignoredBuiltDependencies`) are removed. Use the `allowBuilds` setting instead, which is a map defining which packages can run build scripts.
  • The deprecated `allowNonAppliedPatches` setting is completely removed in favor of `allowUnusedPatches`. Remove all usages of `allowNonAppliedPatches`.
  • The `ignorePatchFailures` setting is removed; all patch application failures will now throw an error.
  • The `pnpm server` command has been removed.
  • Support for `useNodeVersion` and `executionEnv.nodeVersion` fields in configuration is removed. Use `devEngines.runtime` and `engines.runtime` instead.
  • `pnpm link <pkg-name>` no longer resolves packages from the global store; only relative or absolute paths are accepted (e.g., use `pnpm link ./foo`).
  • `pnpm link --global` is removed. Use `pnpm add -g .` to register a local package's bins globally.
  • `pnpm link` (no arguments) is removed. Use `pnpm link <dir>` with an explicit path instead.
  • The default value for the `type` field in `package.json` initialized by `pnpm init` is now `module`.
  • For `pnpm add` command only: `-p` is now an alias for `--save-prod` (was `--parseable`), and `-d` is now an alias for `--save-dev` (was `--loglevel=info`).
  • The One-time Password feature for `pnpm publish` now reads from `PNPM_CONFIG_OTP` instead of `NPM_CONFIG_OTP`.

Migration Steps

  1. If you relied on INI output from `pnpm config get` or `pnpm config list`, update scripts to use `--json` or handle JSON output.
  2. Migrate configuration settings from project-specific `.npmrc` files to the `packageConfigs` section in `pnpm-workspace.yaml`.
  3. Replace usages of deprecated build dependency settings (`onlyBuiltDependencies`, etc.) with the `allowBuilds` map in configuration.
  4. Replace usages of `allowNonAppliedPatches` with `allowUnusedPatches`.
  5. Remove usages of `ignorePatchFailures` as patch failures now always throw.
  6. Replace usages of `useNodeVersion` or `executionEnv.nodeVersion` with `devEngines.runtime` or `engines.runtime`.
  7. When linking packages locally, use explicit paths: change `pnpm link foo` to `pnpm link ./foo`.
  8. To register a local package's bins globally, use `pnpm add -g .` instead of the removed `pnpm link --global`.
  9. Use `pnpm link <dir>` with an explicit path instead of `pnpm link` without arguments.
  10. If relying on OTP during publish, export `PNPM_CONFIG_OTP` instead of `NPM_CONFIG_OTP`.

✨ New Features

  • Runtime dependencies are always linked from the global virtual store.
  • Optimized index file format in the store: integrity strings are replaced by hex digests, improving performance by eliminating base64-to-hex conversion during path lookups.
  • Internal store and cache files switched from JSON to MessagePack format for faster serialization/deserialization and smaller file sizes.
  • The bundled manifest (name, version, bin, engines, scripts, etc.) is now stored directly in the package index file, reducing I/O during resolution and installation.
  • Global installs (`pnpm add -g pkg`) and `pnpm dlx` now use the global virtual store by default (can be disabled via `enableGlobalVirtualStore: false`).
  • Global packages are now isolated: each globally installed package (or group) gets its own installation directory with its own `package.json`, `node_modules/`, and lockfile to prevent interference.
  • `pnpm config get <array>` now prints a JSON array.
  • Top-level keys in output from `pnpm config list` and `pnpm config get` (without argument) are now shown as camelCase (except keys starting with @ or //).
  • Environment variables starting with `pnpm_config_` are loaded into configuration, overriding `pnpm-workspace.yaml` settings but not CLI arguments.
  • The `allowBuilds` setting is introduced to control which packages can run build scripts.
  • Support for lowercase aliases in `pnpm add`: `-d` for `--save-dev`, `-p` for `--save-prod`, `-o`, and `-e`.
  • `pnpm publish` now works without calling the `npm` CLI.

🐛 Bug Fixes

  • The root workspace project is no longer excluded when explicitly selected via a filter.

Affected Symbols

`pnpm config get``pnpm config list``.npmrc` (workspace specific)`packageConfigs` (in `pnpm-workspace.yaml`)`onlyBuiltDependencies``onlyBuiltDependenciesFile``neverBuiltDependencies``ignoredBuiltDependencies``allowBuilds``allowNonAppliedPatches``allowUnusedPatches``ignorePatchFailures``pnpm server``useNodeVersion``executionEnv.nodeVersion``devEngines.runtime``engines.runtime``hooks.fetchers``fetchers` (in `pnpmfile`)`pnpm init` (default type)`pnpm add` aliases (-d, -p, -o, -e)`pnpm publish``PNPM_CONFIG_OTP``NPM_CONFIG_OTP``pnpm link``pnpm add -g``pnpm dlx`

⚡ Deprecations

  • The `pnpm install -g` command (with no arguments) is no longer supported; use `pnpm add -g <pkg>` instead for global package installation.