v11.1.2

📅 May 14, 2026📦 pnpmView on GitHub →

🐛 6 fixes

Summary

This patch release addresses several bugs related to metadata handling, upgrade commands, and lockfile resolution, including stripping problematic HTTP headers for better compatibility with Azure DevOps Artifacts.

🐛 Bug Fixes

Strip `sec-fetch-*` headers from outgoing HTTP requests to prevent Azure DevOps Artifacts from returning HTTP 400 for uncached upstream packages.
Fixed `minimumReleaseAge` handling for cached abbreviated metadata: the version-spec cache fast path now correctly falls through to the registry-fetch path when `ERR_PNPM_MISSING_TIME` occurs under `strictPublishedByCheck`.
When using `minimumReleaseAge` and receiving a 304 Not Modified response for abbreviated package metadata, pnpm now re-fetches with `fullMetadata: true` if the package was modified after the cutoff, ensuring maturity checks are accurate.
Fixed `pnpm upgrade --interactive --latest -r` not respecting named catalog groups, preventing incorrect rewriting of `package.json` entries to the default catalog.
Fixed `optimisticRepeatInstall` skipping `pnpm-lock.yaml` merge conflict resolution when the existing `node_modules` state appeared up to date.
Fixed `minimumReleaseAge` / `resolutionMode: time-based` installs failing on lockfiles missing entries in the `time:` block by ensuring `publishedAt` is surfaced from the lockfile for time-based cutoff computation.