●Change8

v11.0.0-alpha.4

Breaking Changes
📦 pnpmView on GitHub →
⚠ 19 breaking✨ 21 features🐛 3 fixes🔧 26 symbols

Summary

This major release introduces significant performance improvements by switching internal store formats to MessagePack and optimizing index storage. Configuration handling has been overhauled, moving project-specific settings out of .npmrc files into pnpm-workspace.yaml and changing CLI output formats.

⚠️ Breaking Changes

  • pnpm config get (without --json) no longer prints INI formatted text; it now prints JSON for objects/arrays and raw strings for primitives. Use --json if you relied on previous JSON output.
  • pnpm config list now prints a JSON object instead of INI formatted text.
  • pnpm config get <array> now prints a JSON array instead of INI format.
  • pnpm config list and pnpm config get (without argument) now show top-level keys as camelCase (unless they start with @ or //).
  • pnpm config get and pnpm config list no longer load non camelCase options from the workspace manifest (pnpm-workspace.yaml).
  • pnpm no longer loads non-auth and non-registry settings from rc files. Other settings must be defined in pnpm-workspace.yaml.
  • Workspace project specific .npmrc files are replaced by the packageConfigs field in pnpm-workspace.yaml. You must migrate configurations from .npmrc files into packageConfigs in pnpm-workspace.yaml.
  • The package is now pure ESM. If you were importing it using require(), you must switch to import syntax.
  • Node.js v18, v19, v20, and v21 support is discontinued. Upgrade your Node.js version.
  • The standalone exe version of pnpm requires at least glibc 2.27.
  • Deprecated build dependency settings (onlyBuiltDependencies, onlyBuiltDependenciesFile, neverBuiltDependencies, ignoredBuiltDependencies) are removed. Use the allowBuilds setting instead.
  • The deprecated allowNonAppliedPatches is completely removed in favor of allowUnusedPatches.
  • ignorePatchFailures is removed; all patch application failures will now throw an error.
  • The pnpm server command is removed.
  • Support for useNodeVersion and executionEnv.nodeVersion fields is removed. Use devEngines.runtime and engines.runtime instead.
  • Support for hooks.fetchers is removed. Use the fetchers field of pnpmfile for custom fetchers and resolvers.
  • The default value for the type field in package.json initialized by pnpm init is now module.
  • pnpm add command aliases changed: -p is now --save-prod (was --parseable), and -d is now --save-dev (was --loglevel=info).
  • pnpm publish no longer calls npm CLI. The OTP feature now reads from PNPM_CONFIG_OTP instead of NPM_CONFIG_OTP.

Migration Steps

  1. If you relied on the specific output format of `pnpm config get` (without --json), adjust scripts to handle the new JSON/raw string output, or use `--json` if you need consistent
  2. If you used project-specific .npmrc files in workspaces, migrate those configurations into the packageConfigs section of your pnpm-workspace.yaml.
  3. Update any code that imports pnpm using require() to use ES Module import syntax, as the package is now pure ESM.
  4. Ensure your Node.js version is 22 or higher, as support for v18, v19, v20, and v21 has been dropped.
  5. Replace usage of deprecated build dependency settings (onlyBuiltDependencies, etc.) with the new allowBuilds map in configuration files.
  6. Remove usage of allowNonAppliedPatches; use allowUnusedPatches instead.
  7. Remove usage of ignorePatchFailures; patch failures will now halt execution.
  8. Remove any usage of the pnpm server command.
  9. Replace use of useNodeVersion and executionEnv.nodeVersion fields with devEngines.runtime or engines.runtime.
  10. Replace usage of hooks.fetchers in pnpmfile with the fetchers field.
  11. If relying on OTP for publishing, update scripts to export PNPM_CONFIG_OTP instead of NPM_CONFIG_OTP.
  12. If you relied on undocumented features of `pnpm publish` that called `npm publish`, consider using the workaround `pnpm pack && npm publish *.tgz`.

✨ New Features

  • Runtime dependencies are always linked from the global virtual store.
  • Optimized index file format in the store: integrity strings are replaced by hex digests, improving performance by eliminating base64-to-hex conversion.
  • Internal store and cache files switched from JSON to MessagePack format for faster serialization/deserialization and smaller sizes.
  • Bundled manifest (name, version, bin, engines, scripts, etc.) is stored directly in the package index file, reducing I/O during resolution/installation.
  • pnpm config get (without --json) now outputs JSON for objects/arrays and raw strings for primitives.
  • pnpm config list now outputs a JSON object.
  • Auth-related settings are hidden from pnpm config list and pnpm config get (without argument).
  • Top-level keys in pnpm config list/get (without argument) are shown as camelCase (unless starting with @ or //).
  • pnpm no longer loads non-auth/non-registry settings from rc files; these must be in pnpm-workspace.yaml.
  • Introduced packageConfigs in pnpm-workspace.yaml to configure project-specific settings, replacing workspace project .npmrc files.
  • strictDepBuilds is true by default.
  • blockExoticSubdeps is true by default.
  • The allowBuilds setting replaces deprecated build dependency settings, allowing granular control over which packages can run build scripts.
  • pnpm add supports lowercase options: -d (--save-dev), -p (--save-prod), -o, and -e.
  • pnpm publish works without the npm CLI.
  • Environment variables starting with pnpm_config_ are loaded into config, overriding pnpm-workspace.yaml but not CLI arguments.
  • Support for reading allowBuilds from pnpm-workspace.yaml in the global package directory for global installs.
  • Added support for a global YAML config file named config.yaml for pnpm-specific settings.
  • Support for pnpmfiles written in ESM (.mjs extension) added.
  • pnpm why now shows a reverse dependency tree.
  • A new --yes flag can be passed to pnpm to automatically confirm prompts.

🐛 Bug Fixes

  • Fix YAML formatting preservation in pnpm-workspace.yaml when running commands like pnpm update (quotes and whitespace preserved).
  • The parameter set by the --allow-build flag is now correctly written to allowBuilds.
  • Fixed a bug where specifying filter on pnpm-workspace.yaml would cause issues.

Affected Symbols

pnpm config getpnpm config listpnpm-workspace.yaml.npmrconlyBuiltDependenciesonlyBuiltDependenciesFileneverBuiltDependenciesignoredBuiltDependenciesallowBuildsallowNonAppliedPatchesallowUnusedPatchesignorePatchFailurespnpm serveruseNodeVersionexecutionEnv.nodeVersiondevEngines.runtimeengines.runtimehooks.fetchersfetcherspnpmfilepnpm initpnpm addpnpm publishPNPM_CONFIG_OTPNPM_CONFIG_OTPpnpm why