●Change8

v11.0.0-alpha.14

Breaking Changes
📦 pnpmView on GitHub →
⚠ 15 breaking✨ 15 features🔧 26 symbols

Summary

This release introduces major architectural changes to the content-addressable store using SQLite and optimizes metadata storage, alongside isolating global package installations for better stability. Configuration handling has been significantly overhauled, moving settings out of rc files and standardizing output formats.

⚠️ Breaking Changes

  • The `pnpm config get` command (without `--json`) now outputs JSON for objects/arrays and raw strings for primitives, instead of INI formatted text. Use `pnpm config get --json` if you require explicit JSON output for all types.
  • The `pnpm config list` command now outputs a JSON object instead of INI formatted text.
  • pnpm no longer loads non-auth and non-registry settings from rc files. These settings must now be defined in `pnpm-workspace.yaml`.
  • Workspace project specific `.npmrc` files are replaced by the `packageConfigs` field in `pnpm-workspace.yaml`.
  • Deprecated build dependency settings (`onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, `neverBuiltDependencies`, and `ignoredBuiltDependencies`) are removed. Use the `allowBuilds` setting instead.
  • The deprecated `allowNonAppliedPatches` is completely removed in favor of `allowUnusedPatches`.
  • The `ignorePatchFailures` setting is removed; all patch application failures will now throw an error.
  • The `pnpm server` command has been removed.
  • Support for `useNodeVersion` and `executionEnv.nodeVersion` fields in configuration is removed. Use `devEngines.runtime` and `engines.runtime` instead.
  • Support for `hooks.fetchers` is removed. Use the new `fetchers` field in `pnpmfile` for custom fetchers and resolvers.
  • The default value for the `type` field in `package.json` initialized by `pnpm init` is changed to `module`.
  • `pnpm link <pkg-name>` no longer resolves packages from the global store; only relative or absolute paths are accepted (e.g., use `pnpm link ./foo`).
  • `pnpm link --global` is removed. Use `pnpm add -g .` to register a local package's bins globally.
  • `pnpm link` (no arguments) is removed. Use `pnpm link <dir>` instead.
  • The One-time Password feature for `pnpm publish` now reads from `PNPM_CONFIG_OTP` instead of `NPM_CONFIG_OTP`.

Migration Steps

  1. If you relied on `pnpm config get` outputting INI format for non-JSON output, update scripts to use `pnpm config get --json` or handle JSON output.
  2. Migrate configuration settings from project-specific `.npmrc` files into the `packageConfigs` section of `pnpm-workspace.yaml`.
  3. Replace usage of deprecated build dependency settings (`onlyBuiltDependencies`, etc.) with the `allowBuilds` map in configuration.
  4. Replace usage of `allowNonAppliedPatches` with `allowUnusedPatches`.
  5. Update scripts that relied on `pnpm link <pkg-name>` resolving packages from the global store to use path-based linking (e.g., `pnpm link ./foo`).
  6. Replace usage of `pnpm link --global` with `pnpm add -g .`.
  7. If using global packages, note that `pnpm install -g` (no arguments) is no longer supported; use `pnpm add -g <pkg>` instead.
  8. If relying on the OTP feature for publishing, update environment variables from `NPM_CONFIG_OTP` to `PNPM_CONFIG_OTP`.
  9. If using configuration fields related to Node versioning, migrate from `useNodeVersion` or `executionEnv.nodeVersion` to `devEngines.runtime` or `engines.runtime`.

✨ New Features

  • Runtime dependencies are always linked from the global virtual store.
  • Optimized index file format in the content-addressable store: stores hash algorithm once per file, and file entries store only hex digests instead of full integrity strings, improving performance.
  • Bundled manifest (package.json contents) is stored directly in the package index file, reducing I/O during resolution and installation.
  • Content-addressable store now uses SQLite for package index storage (`$STORE/index.db`) instead of individual JSON files, improving performance and space efficiency.
  • Global installs (`pnpm add -g pkg`) and `pnpm dlx` now use the global virtual store by default (can be disabled via `enableGlobalVirtualStore: false`).
  • Global packages are now isolated: each globally installed package (or group) gets its own installation directory with its own `package.json`, `node_modules/`, and lockfile to prevent interference.
  • Global package management updates: `pnpm add -g <pkg>` creates isolated installs in `{pnpmHomeDir}/global/v11/{hash}/`; `pnpm remove -g <pkg>` removes the entire installation group; `pnpm update -g [pkg]` re-installs packages in new isolated directories.
  • `pnpm config get <array>` now prints a JSON array.
  • Top-level keys in `pnpm config list` and `pnpm config get` (without argument) are shown as camelCase (except keys starting with @ or //).
  • Lockfile `patchedDependencies` format simplified from `{ selector: { path: string, hash: string } }` to `{ selector: string }` (selector to hash); old formats are auto-migrated.
  • `strictDepBuilds` is now `true` by default.
  • `blockExoticSubdeps` is now `true` by default.
  • The `allowBuilds` setting replaces deprecated build dependency settings, allowing fine-grained control over which packages can run build scripts.
  • Lowercase aliases for `pnpm add` options are supported: `-d` for `--save-dev`, `-p` for `--save-prod`, `-o`, and `-e`.
  • `pnpm publish` now works without the `npm` CLI.

Affected Symbols

`pnpm config get``pnpm config list`rc files configuration loading`.npmrc` in workspace projects`onlyBuiltDependencies``onlyBuiltDependenciesFile``neverBuiltDependencies``ignoredBuiltDependencies``allowBuilds``allowNonAppliedPatches``allowUnusedPatches``ignorePatchFailures``pnpm server``useNodeVersion``executionEnv.nodeVersion``devEngines.runtime``engines.runtime``hooks.fetchers``fetchers` field in `pnpmfile``pnpm init` default type`pnpm add` options (-d, -p, -o, -e)`pnpm publish` OTP reading`pnpm link <pkg-name>``pnpm link --global``pnpm link` (no arguments)`patchedDependencies` lockfile format