Change8

v11.0.0-beta.2

Breaking Changes
📦 pnpmView on GitHub →
19 breaking14 features1 deprecations🔧 10 symbols

Summary

This major release introduces significant architectural changes to the content-addressable store using SQLite and optimizes metadata storage, alongside isolating global package installations for better stability. Many deprecated configuration options and commands have been removed, and pnpm is now pure ESM.

⚠️ Breaking Changes

  • The standalone exe version of pnpm requires at least glibc 2.27.
  • Node.js v18, 19, 20, and 21 support has been discontinued. Upgrade your Node.js version.
  • pnpm config get (without --json) no longer prints INI formatted text; it now prints JSON for objects/arrays and raw strings for primitives. If you relied on INI output, use `pnpm config get --json`.
  • pnpm config list now prints a JSON object instead of INI formatted text. If you relied on INI output, this has changed.
  • pnpm config list and pnpm config get (without argument) now hide auth-related settings.
  • pnpm config list and pnpm config get (without argument) now show top-level keys as camelCase, except for keys starting with @ or //.
  • pnpm config get and pnpm config list no longer load non camelCase options from the workspace manifest (`pnpm-workspace.yaml`).
  • pnpm no longer loads non-auth and non-registry settings from rc files. Other settings must be defined in `pnpm-workspace.yaml`.
  • Workspace project specific `.npmrc` files are replaced by `packageConfigs` in `pnpm-workspace.yaml`. Migrate settings from `.npmrc` to `packageConfigs` in your workspace root.
  • The `patchedDependencies` lockfile format is simplified from `Record<string, { path: string, hash: string }>` to `Record<string, string>`. Existing lockfiles are migrated automatically.
  • The deprecated build dependency settings (`onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, `neverBuiltDependencies`, and `ignoredBuiltDependencies`) are removed. Use the `allowBuilds` setting in configuration instead.
  • The deprecated `allowNonAppliedPatches` is completely removed in favor of `allowUnusedPatches`. Remove `ignorePatchFailures` as all patch application failures now throw an error.
  • The `pnpm server` command has been removed.
  • Support for `useNodeVersion` and `executionEnv.nodeVersion` fields is removed. Use `devEngines.runtime` and `engines.runtime` instead.
  • Support for `hooks.fetchers` is removed. Use the new API via the `fetchers` field of `pnpmfile`.
  • The default value of the `type` field in the `package.json` file initialized by `pnpm init` is changed to `module`.
  • Lowercase options for `pnpm add` have new meanings: `-p` is now an alias for `--save-prod` (was `--parseable`), and `-d` is now an alias for `--save-dev` (was `--loglevel=info`).
  • pnpm publish no longer calls `npm publish` and now reads OTP from `PNPM_CONFIG_OTP` instead of `NPM_CONFIG_OTP`.
  • pnpm no longer reads settings from the `pnpm` field of `package.json`. Settings must be defined in `pnpm-workspace.yaml`.

Migration Steps

  1. If you relied on INI output from `pnpm config get` (without `--json`), switch to using `pnpm config get --json`.
  2. If you relied on INI output from `pnpm config list`, be aware it now outputs
  3. Migrate configuration settings previously defined in project-specific `.npmrc` files into the `packageConfigs` section of your root `pnpm-workspace.yaml`.
  4. Replace usage of deprecated build dependency settings (`onlyBuiltDependencies`, etc.) with the `allowBuilds` map in configuration.
  5. Replace usage of deprecated `allowNonAppliedPatches` with `allowUnusedPatches`.
  6. Update global package management commands: use `pnpm add -g <pkg>` instead of `pnpm install -g` (no args).
  7. If you used `pnpm config get <array>`, ensure consuming scripts handle JSON array output.
  8. If you relied on build dependency settings, migrate them to the `allowBuilds` structure.
  9. If you relied on the old behavior of `-p` or `-d` flags with `pnpm add`, update scripts to use the new aliases or full flags (`--save-prod` or `--save-dev`).
  10. If you relied on OTP for publishing via `NPM_CONFIG_OTP`, switch to using the `PNPM_CONFIG_OTP` environment variable or the `--otp` flag.
  11. If you relied on settings in the `pnpm` field of `package.json`, move them to `pnpm-workspace.yaml`.

✨ New Features

  • Runtime dependencies are always linked from the global virtual store.
  • Optimized index file format in the content-addressable store: stores hash algorithm once per file and uses hex digests instead of full integrity strings, improving performance.
  • Bundled manifest (name, version, bin, engines, scripts, etc.) is stored directly in the package index file, reducing I/O during resolution/installs.
  • Store now uses SQLite for package index metadata storage (`$STORE/index.db`), improving performance and space efficiency.
  • Global installs (`pnpm add -g pkg`) and `pnpm dlx` now use the global virtual store by default, storing packages at `{storeDir}/links`.
  • Global packages are now isolated: each globally installed package (or group) gets its own isolated installation directory with its own lockfile, preventing interference.
  • `optimisticRepeatInstall` default value changed to `true`.
  • `verifyDepsBeforeRun` default value changed to `install`.
  • pnpm is now pure ESM.
  • `strictDepBuilds` is `true` by default.
  • `blockExoticSubdeps` is `true` by default.
  • The `allowBuilds` setting is introduced to control which packages can run build scripts.
  • `pnpm publish` now works without the `npm` CLI and handles OTP via `PNPM_CONFIG_OTP` or prompts directly.
  • Support for lowercase options in `pnpm add`: `-d` for `--save-dev`, `-p` for `--save-prod`, `-o`, and `-e`.

Affected Symbols

⚡ Deprecations

  • The `pnpm install -g` command (with no arguments) is no longer supported; use `pnpm add -g <pkg>` instead for global package management.
pnpm v11.0.0-beta.2 - Change8