●Change8

v11.0.0-alpha.13

Breaking Changes
📦 pnpmView on GitHub →
⚠ 22 breaking✨ 14 features⚡ 1 deprecations🔧 31 symbols

Summary

This release introduces major architectural changes to the pnpm store, moving to SQLite for metadata indexing and isolating global package installations for improved stability. Configuration handling has been significantly overhauled, favoring JSON output and consolidating workspace settings into `pnpm-workspace.yaml`.

⚠️ Breaking Changes

  • The package is now pure ESM. If you rely on CommonJS imports, you must update your code to use ESM syntax.
  • Node.js v18, 19, 20, and 21 support is discontinued. Upgrade to a supported Node.js version.
  • The standalone exe version of pnpm requires at least glibc 2.27.
  • `pnpm config get` (without `--json`) no longer prints INI formatted text; it now prints JSON for objects/arrays and raw values for primitives. If you were parsing INI output, update your scripts to expect
  • `pnpm config list` now prints a JSON object instead of INI formatted text. Update parsing scripts accordingly.
  • `pnpm config get <array>` now prints a JSON array instead of INI formatted text.
  • `pnpm config get` and `pnpm config list` (without argument) now hide auth-related settings and show top-level keys as camelCase (unless starting with @ or //).
  • `pnpm config get` and `pnpm config list` no longer load non camelCase options from the workspace manifest (`pnpm-workspace.yaml`).
  • pnpm no longer loads non-auth and non-registry settings from rc files. Other settings must be defined in `pnpm-workspace.yaml`.
  • Workspace project specific `.npmrc` files are replaced by the `packageConfigs` field in `pnpm-workspace.yaml`. Migrate configuration settings from `.npmrc` to `packageConfigs` in `pnpm-workspace.yaml`.
  • Deprecated build dependency settings (`onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, `neverBuiltDependencies`, and `ignoredBuiltDependencies`) are removed. Use the `allowBuilds` setting instead.
  • The deprecated `allowNonAppliedPatches` is completely removed in favor of `allowUnusedPatches`. Remove usage of `allowNonAppliedPatches`.
  • The `ignorePatchFailures` setting is removed. All patch application failures will now throw an error.
  • The `pnpm server` command is removed.
  • Support for `useNodeVersion` and `executionEnv.nodeVersion` fields is removed. Use `devEngines.runtime` and `engines.runtime` instead.
  • Support for `hooks.fetchers` is removed. Use the new API via the `fetchers` field of `pnpmfile`.
  • The default value for the `type` field in `package.json` initialized by `pnpm init` is now `module`.
  • Lowercase aliases for `pnpm add` options have changed: `-p` is now `--save-prod` (was `--parseable`), and `-d` is now `--save-dev` (was `--loglevel=info`).
  • `pnpm publish` no longer calls `npm publish`. The OTP feature now reads from `PNPM_CONFIG_OTP` instead of `NPM_CONFIG_OTP`. If you relied on undocumented features of `npm publish`, you may need a workaround like `pnpm pack && npm publish *.tgz`.
  • `pnpm link <pkg-name>` no longer resolves packages from the global store; only relative or absolute paths are accepted. Use `pnpm link ./foo` instead of `pnpm link foo`.
  • `pnpm link --global` is removed. Use `pnpm add -g .` to register local package bins globally.
  • `pnpm link` (no arguments) is removed. Use `pnpm link <dir>` with an explicit path instead.

Migration Steps

  1. If you relied on INI output from `pnpm config get` (without `--json`) or `pnpm config list`, update your scripts to parse JSON output.
  2. If you used deprecated build dependency settings (`onlyBuiltDependencies`, etc.), replace them with the `allowBuilds` map in your configuration.
  3. Remove usage of the removed `allowNonAppliedPatches` setting and use `allowUnusedPatches` instead.
  4. Remove usage of the removed `ignorePatchFailures` setting; ensure your environment handles patch failures by throwing errors.
  5. Replace usage of `useNodeVersion` or `executionEnv.nodeVersion` with `devEngines.runtime` or `engines.runtime` in configuration.
  6. If you used `hooks.fetchers` in `pnpmfile`, migrate to using the `fetchers` field.
  7. If you used `pnpm link <pkg-name>` where `<pkg-name>` was a global package name, change it to use a path, e.g., `pnpm link ./foo`.
  8. If you used `pnpm link --global`, use `pnpm add -g .` instead.
  9. If you used `pnpm link` without arguments, use `pnpm link <dir>` with an explicit path.
  10. If you relied on OTP configuration via `NPM_CONFIG_OTP`, switch to using the `PNPM_CONFIG_OTP` environment variable when publishing.

✨ New Features

  • Runtime dependencies are always linked from the global virtual store.
  • Optimized index file format in the content-addressable store: integrity strings are replaced by hex digests, and the hash algorithm is stored once per file, improving performance by eliminating base64-to-hex conversion.
  • Store version bumped to v11.
  • Package manifest (name, version, bin, engines, scripts, etc.) is now stored directly in the package index file, speeding up repeat installs by avoiding reading `package.json` from the store.
  • Package index in the content-addressable store now uses SQLite (`$STORE/index.db`) instead of individual JSON files, improving I/O, space efficiency, and enabling concurrent access.
  • Global installs (`pnpm add -g pkg`) and `pnpm dlx` now use the global virtual store by default, storing packages at `{storeDir}/links`. This can be disabled via `enableGlobalVirtualStore: false`.
  • Global packages are now isolated: each globally installed package (or group) gets its own installation directory with its own `package.json`, `node_modules/`, and lockfile to prevent interference.
  • `pnpm config get` now prints JSON for objects/arrays and raw values for primitives when run without `--json`.
  • `pnpm config list` now prints a JSON object.
  • Top-level keys in `pnpm config list` and `pnpm config get` (without argument) are shown as camelCase (except keys starting with @ or //).
  • The `allowBuilds` setting replaces deprecated build dependency settings, allowing fine-grained control over which packages can run build scripts.
  • Lowercase aliases for `pnpm add` are supported: `-d` for `--save-dev`, `-p` for `--save-prod`, `-o`, and `-e`.
  • `pnpm publish` now works without the `npm` CLI.
  • The root workspace project is no longer excluded when explicitly selected via a filter.

Affected Symbols

`pnpm config get``pnpm config list``pnpm add -g``pnpm dlx``pnpm remove -g``pnpm update -g``pnpm list -g``pnpm install -g``onlyBuiltDependencies``onlyBuiltDependenciesFile``neverBuiltDependencies``ignoredBuiltDependencies``allowBuilds``allowNonAppliedPatches``allowUnusedPatches``ignorePatchFailures``pnpm server``useNodeVersion``executionEnv.nodeVersion``devEngines.runtime``engines.runtime``hooks.fetchers``fetchers` (in pnpmfile)`pnpm init``type` (in package.json)`pnpm add -p``pnpm add -d``pnpm publish``NPM_CONFIG_OTP``PNPM_CONFIG_OTP``pnpm link`

⚡ Deprecations

  • The `pnpm install -g` command (with no arguments) is no longer supported for global packages; use `pnpm add -g <pkg>` instead.