●Change8

v11.0.0-alpha.15

Breaking Changes
📦 pnpmView on GitHub →
⚠ 15 breaking✨ 20 features⚡ 1 deprecations🔧 27 symbols

Summary

This release introduces major architectural changes to the pnpm store, moving to SQLite for indexing and isolating global packages for better stability. Configuration handling has been significantly overhauled, moving away from rc files and standardizing output formats.

⚠️ Breaking Changes

  • The `pnpm config get` command (without `--json`) now outputs JSON for objects/arrays and raw strings for primitives, instead of INI formatted text. Use `pnpm config get --json` if you require JSON output for all types.
  • The `pnpm config list` command now outputs a JSON object instead of INI formatted text.
  • Configuration keys shown by `pnpm config list` and `pnpm config get` (without argument) are now camelCased, except for keys starting with @ or //.
  • pnpm no longer loads non-auth and non-registry settings from rc files. These settings must now be defined in `pnpm-workspace.yaml`.
  • Workspace project specific `.npmrc` files are replaced by the `packageConfigs` field in `pnpm-workspace.yaml`.
  • Deprecated build dependency settings (`onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, `neverBuiltDependencies`, and `ignoredBuiltDependencies`) are removed. Use the `allowBuilds` setting instead.
  • The deprecated `allowNonAppliedPatches` setting is completely removed; use `allowUnusedPatches` instead.
  • The `ignorePatchFailures` setting is removed; all patch application failures will now throw an error.
  • The `pnpm server` command has been removed.
  • Support for `useNodeVersion` and `executionEnv.nodeVersion` fields is removed. Use `devEngines.runtime` and `engines.runtime` instead.
  • Support for `hooks.fetchers` is removed. Use the new API via the `fetchers` field of `pnpmfile`.
  • The default value for the `type` field in projects initialized by `pnpm init` is now `module`.
  • `pnpm link <pkg-name>` no longer resolves packages from the global store; only relative or absolute paths are accepted. Use `pnpm link ./foo` instead of `pnpm link foo`.
  • `pnpm link --global` is removed. Use `pnpm add -g .` to register a local package's bins globally.
  • `pnpm link` (no arguments) is removed. Use `pnpm link <dir>` instead.

Migration Steps

  1. If you relied on the output format of `pnpm config get` (without `--json`), update scripts to handle JSON output or use `pnpm config get --json`.
  2. Review configuration settings in rc files and move non-auth/non-registry settings to `pnpm-workspace.yaml`.
  3. Replace workspace project specific `.npmrc` files with configuration defined in the `packageConfigs` field of `pnpm-workspace.yaml`.
  4. Replace usage of deprecated build dependency settings (`onlyBuiltDependencies`, etc.) with the `allowBuilds` map in configuration.
  5. Remove usage of `allowNonAppliedPatches`; use `allowUnusedPatches` if necessary.
  6. Remove usage of `ignorePatchFailures`; ensure patches are applied correctly or handle resulting errors.
  7. Replace usage of `useNodeVersion` or `executionEnv.nodeVersion` with `devEngines.runtime` or `engines.runtime` in configuration.
  8. Replace usage of `hooks.fetchers` with the new API using the `fetchers` field of `pnpmfile`.
  9. Update scripts that rely on `pnpm link <pkg-name>` to use paths, e.g., `pnpm link ./path/to/pkg`.
  10. Replace `pnpm link --global` with `pnpm add -g .`.
  11. Remove calls to `pnpm link` without arguments; use `pnpm link <dir>` instead.
  12. If using OTP with `pnpm publish`, change environment variable from `NPM_CONFIG_OTP` to `PNPM_CONFIG_OTP`.

✨ New Features

  • Runtime dependencies are always linked from the global virtual store.
  • Optimized index file format in the content-addressable store: stores hash algorithm once per file, and file entries store only the hex digest, improving performance by eliminating base64-to-hex conversion.
  • Store version bumped to v11.
  • Bundled manifest (name, version, bin, engines, scripts, etc.) is now stored directly in the package index file, reducing I/O during resolution/installation.
  • SQLite is used for storing package index in the content-addressable store (`$STORE/index.db`), improving performance and enabling concurrent access.
  • Global installs (`pnpm add -g pkg`) and `pnpm dlx` now use the global virtual store by default (packages stored at `{storeDir}/links`), which can be disabled via `enableGlobalVirtualStore: false`.
  • Global packages are now isolated: each globally installed package (or group) gets its own isolated installation directory to prevent interference.
  • `pnpm config get` (without `--json`) now prints JSON for objects/arrays and raw strings for primitives.
  • `pnpm config get <array>` now prints a JSON array.
  • `pnpm config list` now prints a JSON object.
  • `pnpm config list` and `pnpm config get` (without argument) now hide auth-related settings.
  • Workspace project specific configurations can now be defined using the `packageConfigs` field in `pnpm-workspace.yaml`.
  • The lockfile format for `patchedDependencies` is simplified from `Record<string, { path: string, hash: string }>` to `Record<string, string>` (automatic migration for existing lockfiles).
  • pnpm is now pure ESM.
  • `strictDepBuilds` is `true` by default.
  • `blockExoticSubdeps` is `true` by default.
  • The `allowBuilds` setting replaces deprecated build dependency settings, allowing fine-grained control over which packages can run build scripts.
  • Lowercase aliases for `pnpm add` options are supported: `-d` for `--save-dev`, `-p` for `--save-prod`, `-o`, and `-e`.
  • `pnpm publish` now works without the `npm` CLI.
  • The One-time Password feature for `pnpm publish` now reads from `PNPM_CONFIG_OTP` instead of `NPM_CONFIG_OTP`.

Affected Symbols

`pnpm config get``pnpm config list`rc files configuration loading`.npmrc` in workspace projects`onlyBuiltDependencies``onlyBuiltDependenciesFile``neverBuiltDependencies``ignoredBuiltDependencies``allowBuilds``allowNonAppliedPatches``allowUnusedPatches``ignorePatchFailures``pnpm server``useNodeVersion``executionEnv.nodeVersion``devEngines.runtime``engines.runtime``hooks.fetchers``fetchers` field in `pnpmfile``pnpm init` default type`pnpm link <pkg-name>``pnpm link --global``pnpm link` (no arguments)`pnpm add -d``pnpm add -p``PNPM_CONFIG_OTP``NPM_CONFIG_OTP`

⚡ Deprecations

  • The `pnpm install -g` command (with no arguments) is no longer supported; use `pnpm add -g <pkg>` instead for global installations.