v12.0.0-alpha.18

Breaking Changes

📅 Jul 22, 2026📦 pnpmView on GitHub →

⚠ 1 breaking✨ 10 features🐛 1 fixes⚡ 1 deprecations🔧 16 symbols

Summary

This release introduces significant improvements to recursive workspace operations, enhanced versioning capabilities with `pnpm version`, and a new changeset generation feature for `pnpm update`. It also addresses several bugs related to dependency resolution and lockfile management.

⚠️ Breaking Changes

The behavior of the first release of a package has changed. It now publishes the version written in its manifest verbatim, instead of automatically bumping it. This means a package seeded at `1100.0.0` with a `minor` changeset will be published as `1100.0.0` and not `1100.1.0`. This affects how initial versions are handled and may require adjustments in CI/CD pipelines that expect automatic version bumping on first release.

Migration Steps

Update `pnpm-workspace.yaml` to use the new `update` and `audit` sections instead of `updateConfig`, `auditConfig`, and `auditLevel` to avoid deprecation warnings in the future. For example, change `updateConfig.ignoreDependencies` to `update.ignoreDeps` and `auditLevel` to `audit.level`.

✨ New Features

`pnpm version` now supports npm-style bump forms: `pnpm version <major|minor|patch|premajor|preminor|prepatch|prerelease>` and `pnpm version <exact-version>`, with recursive support (`-r`) and various flags like `--preid`, `--allow-same-version`, `--message`, `--no-git-tag-version`, etc. It also runs lifecycle scripts and records the new version as a git commit and tag.
`pnpm outdated` now supports recursive workspace operations by default, matching the TypeScript CLI. `pnpm list` and `pnpm ll` also inspect all workspace projects by default.
Recursive `pnpm rebuild` now honors workspace filters when using shared and dedicated lockfiles.
`pnpm why` and `pnpm peers` are now recursive by default in workspaces. Recursive peer checks respect workspace filters, and recursive `why` can inspect the active project when a workspace uses dedicated lockfiles.
A `--changeset` flag has been added to `pnpm update`. When enabled (via `pnpm-workspace.yaml` or the flag), `pnpm` will generate a `.changeset/pnpm-update-<suffix>.md` file after an update. This file declares a patch bump for workspace packages whose `dependencies` or `optionalDependencies` changed, and a major bump if `peerDependencies` changed. Packages that consume updated catalog entries via the `catalog:` protocol are also included. Private packages, packages without a name, and packages in the `.changeset/config.json` `ignore` array are skipped. If `.changeset/config.json` is missing, no changeset is generated and a warning is printed.
`pnpm outdated` and interactive `pnpm update` now include GitHub Actions dependencies. Non-interactive updates can include them with `--include-github-actions` or by setting `update.githubActions` to `true` in `pnpm-workspace.yaml`. Updated actions are pinned to exact commit hashes with release tags preserved in comments.
`pnpm install`, `pnpm add`, `pnpm update`, and `pnpm remove` now support recursive (`-r`) and filtered (`--filter`) execution in workspaces configured with `sharedWorkspaceLockfile: false` (one lockfile per project). Each selected project is installed independently against its own lockfile, `node_modules`, and virtual store.
Global commands (e.g., `pnpm add -g`) now create a missing global bin directory if it doesn't exist, preventing `ERR_PNPM_PNPM_DIR_NOT_WRITABLE` errors. The universal `--silent` / `-s` shorthands for `--reporter=silent` are also supported again.
`pnpm unlink` now uses a selection-aware install pipeline, honoring `-r` / `--filter`, installing recursively by default in workspaces, and supporting both shared and per-project lockfiles. Previously, it only reinstalled the active project.
New `update` and `audit` settings sections have been added to `pnpm-workspace.yaml` to supersede deprecated settings. `update.ignoreDeps` replaces `updateConfig.ignoreDependencies`, and `audit.level` and `audit.ignore` replace `auditLevel` and `auditConfig.ignoreGhsas` respectively. These new sections are recognized by both the TypeScript CLI and the Rust config surface (pacquet).

🐛 Bug Fixes

Fixed an issue where `pnpm install` would rewrite unrelated `pnpm-lock.yaml` entries after minor manifest changes. This prevented unnecessary re-resolutions of packages, especially those with open-range dependencies like `@types/node: '*'`, which could be bumped to their newest versions. The fix addresses three specific resolution-reuse gaps: direct dependencies using the `catalog:` protocol, auto-installed (hoisted) peer dependencies, and cases where a package landed on an already recorded version but its dependency subtree was still re-resolved instead of reused.

Affected Symbols

pnpm version pnpm outdated pnpm list pnpm ll pnpm rebuild pnpm why pnpm peers pnpm update pnpm install pnpm add pnpm remove pnpm unlink pnpm-workspace.yaml pnpm-lock.yaml catalog: protocol pnpm/pnpm#13193

⚡ Deprecations

The `updateConfig`, `auditConfig`, and `auditLevel` settings in `pnpm-workspace.yaml` are deprecated and will be removed in the next major version. They are superseded by the new `update` and `audit` sections. Existing configurations will continue to work, but new configurations should use the updated sections. When both new and deprecated settings are present, the new settings take precedence and a warning is issued.