●Change8

v11.23.0

Breaking Changes
📦 pnpmView on GitHub →
⚠ 3 breaking✨ 5 features🐛 6 fixes⚡ 2 deprecations🔧 22 symbols

Summary

This release enhances configuration visibility with `pnpm config get` and `pnpm config list`, improves registry handling with new `registries` configuration options, and optimizes metadata fetching for `resolutionMode: time-based`. It also deprecates the `importPackage` pnpmfile hook.

⚠️ Breaking Changes

  • The `importPackage` pnpmfile hook is deprecated and will be removed in the next major version. This may cause installations to become slower if you rely on this hook. Comment on [#14101](https://github.com/pnpm/pnpm/issues/14101) if you rely on this hook.
  • The `node_modules/.modules.yaml` file no longer records registries an install resolved from. This change might affect projects that relied on this information for older lockfile formats or specific registry configurations, as installs will now always use the currently configured registries.
  • The pnpr resolve and verify-lockfile request bodies have changed. pnpr servers and clients must be on matching versions as the protocol is experimental and unversioned.

Migration Steps

  1. If you rely on the `importPackage` pnpmfile hook, comment on [#14101](https://github.com/pnpm/pnpm/issues/14101) to discuss its future.
  2. Update your `pnpm-workspace.yaml` or `.npmrc` to use the new `registries` configuration format if you need to specify `serverType`, `scopes`, or `prefix` for your registries.
  3. Ensure your pnpr server and clients are on matching versions due to changes in the resolve and verify-lockfile request bodies.

✨ New Features

  • `pnpm config get` and `pnpm config list` now show the settings pnpm acts on under their documented names, providing a clearer view of effective configurations for `registries`, `update`, `audit`, and `catalogs`.
  • Settings that no supported pnpm version recognizes now display a warning, including the specific pnpm version that does read them or suggesting the closest real setting name for typos. Unrecognized and non-camelCase keys in `pnpm-workspace.yaml` are also now reported.
  • A registry can now declare that its abbreviated metadata carries the `time` field, allowing `resolutionMode: time-based` to optimize metadata fetching by only requesting full metadata from registries that need it.
  • A pnpr resolve request now carries the client's registries in a more comprehensive format, enabling better routing and resolution of scoped dependencies from the correct registry.
  • The `registries` setting now declares a registry once, keyed by its URL, with detailed configuration including `serverType`, `scopes`, and `prefix`, allowing for more precise control over how pnpm interacts with different registries.

🐛 Bug Fixes

  • `pnpm config get registries` previously printed `undefined` but now correctly shows resolved registries.
  • Previously `pnpm config get <key>` and `pnpm get <key>` printed config-load warnings, which are now suppressed so scripts capturing the value get the value alone.
  • Unrecognized keys in the global config file are no longer reported with incorrect advice to move them to `pnpm-workspace.yaml`; warnings now accurately reflect that the setting is not recognized by the current pnpm version.
  • The `node_modules/.modules.yaml` file no longer records registries, preventing outdated registry information from being used during installs.
  • When `enableGlobalVirtualStore` is on, spawned processes now correctly receive `NODE_PATH` and `NODE_OPTIONS` to support phantom package resolution without needing the `@pnpm/plugin-esm-node-path` config dependency.
  • A pnpr server's allowlist no longer refuses a registry upfront if it's not on the list; the boundary for refusal moves to the fetch itself, preventing unnecessary install failures due to stray configurations.

Affected Symbols

`pnpm config get``pnpm config list``pnpm config get registries``pnpm config get update``pnpm config get audit``pnpmfile` hook `importPackage``node_modules/.modules.yaml``pnpm list``pnpm why``enableGlobalVirtualStore` setting`NODE_PATH` environment variable`NODE_OPTIONS` environment variable`@pnpm/plugin-esm-node-path``pnpm dlx``resolutionMode: time-based``registrySupportsTimeField` settingpnpr resolve requestpnpr verify-lockfile request`registries` setting`serverType` setting`scopes` setting`prefix` setting

⚡ Deprecations

  • The `importPackage` pnpmfile hook is deprecated and will be removed in the next major version. pnpm now prints a warning when a pnpmfile defines it. If you rely on this hook, comment on [#14101](https://github.com/pnpm/pnpm/issues/14101).
  • The deprecated internal spellings (`updateConfig`, `auditConfig`, `auditLevel`) are no longer listed by `pnpm config get update` and `pnpm config get audit`.