●Change8

v12.0.0-beta.0

Breaking Changes
📦 pnpmView on GitHub →
⚠ 3 breaking✨ 10 features🐛 11 fixes🔧 12 symbols

Summary

This release introduces significant enhancements to the Rust engine, including expanded configuration options for workspace settings and improved handling of workspace protocols. It also refines `pnpm self-update` behavior by removing project-specific overrides for fetching and trust policies, and includes numerous bug fixes for lockfile generation, dependency resolution, and command execution.

⚠️ Breaking Changes

  • The `pnpm self-update` command no longer respects project-specific configurations like `.npmrc`, `pnpm-workspace.yaml`, or `.pnpmfile.(c|m)js` for fetching pnpm. It now uses the same trusted registry and authentication as when switching pnpm versions. To control the download source or credentials, use the global pnpmfile, config dependencies, or the `pnpmfile` setting. Project-specific `.pnpmfile.(c|m)js` files are no longer loaded by `self-update`.
  • The `minimumReleaseAge` setting in `pnpm-workspace.yaml` no longer affects `pnpm self-update`. The cooldown period for `self-update` is now determined by built-in defaults, global config, `PNPM_CONFIG_*` environment variables, or command-line flags. This change prevents projects from waiving the cooldown or staying on outdated versions by manipulating this setting.
  • The `trustPolicy` settings and the `ci` flag in a project's configuration no longer influence `pnpm self-update`. Projects cannot weaken the trust checks for pnpm downloads or re-enable the confirmation prompt suppressed in CI runs. This ensures that `self-update` adheres to the global trust policies and CI behavior.

✨ New Features

  • The Rust engine now reads `frozenLockfile`, `savePrefix`, `savePeer`, and `saveCatalogName` settings from `pnpm-workspace.yaml` and `PNPM_CONFIG_*` environment variables, in addition to CLI flags.
  • The Rust engine supports the `saveWorkspaceProtocol` setting, allowing `pnpm add <pkg>@workspace:…` to write back the same specifier pnpm does. This includes options for rolling updates (`workspace:*`, `workspace:^`, `workspace:~`), saving the resolved version (`workspace:^2.5.0`), or preserving the explicitly typed `workspace:` form.
  • `pnpm update --workspace` is now supported, re-pointing workspace dependencies to local copies using the `workspace:` protocol. The `saveWorkspaceProtocol` setting is honored.
  • `pnpm update --depth <number>` is now applied per dependency, allowing finer control over update depth. `pnpm update --depth 0` updates direct dependencies only.
  • `pnpm run "/^build:(backend|frontend)$/"` allows selecting scripts whose names match a given pattern, applicable to single-project and recursive runs.
  • When `pnpm self-update` refuses a version younger than the cutoff, interactive runs now offer to update anyway. Non-interactive runs will still fail.
  • `pnpm dedupe --check` now reports the potential changes from deduplication, including importer and package snapshot diffs, and issues related to peer dependencies.
  • `pnpm peers check` is now accepted as a valid subcommand.
  • Deprecated packages are now reported once per repository, not once per workspace project.
  • Ignored build scripts are listed with their `(patch_hash=…)` suffix for better distinguishability.

🐛 Bug Fixes

  • An aliased dependency of a protocol that resolves under its own package name (e.g., `jsr:`) is now correctly recorded in the lockfile importer, ensuring commands like `outdated`, `update`, and `licenses` can see it.
  • An `allowBuilds` entry with the placeholder text no longer causes all commands in a workspace to fail with a config-parse error. Undecided entries now default to a deny-by-default build policy.
  • Two `pnpm install` resolution fixes ensure large workspaces like Astro produce the same `pnpm-lock.yaml` as pnpm 11. This includes correctly recording scoped workspace packages via `file:` as `link:` and preventing `bundledDependencies` from being resolved as dependencies of their own.
  • Executables shipped within a package's tarball (`bundledDependencies`) are now correctly linked into the package's `node_modules/.bin` for both isolated and hoisted node linkers. Packages declaring `bundleDependencies: true` are now recorded in `pnpm-lock.yaml` as pnpm 11 does.
  • The ordering of package metadata and license groups in `pnpm licenses list --json` is now aligned with the TypeScript CLI.
  • `pnpm --filter <package> run` now lists the selected package's scripts and root workspace scripts when no script name is specified.
  • Unicode formatting characters have been stripped from registry- and manifest-derived terminal output.
  • Dependency verification no longer rewrites an up-to-date lockfile before scripts execute.
  • Concurrent commands in repositories pinning `packageManager` no longer race when installing the pinned pnpm version on a cold cache, preventing errors like 'failed to remove existing directory… prior to swap'.
  • Config-load warnings, such as those for install settings in `package.json`'s `pnpm` field, are now printed to stderr instead of stdout.
  • `pnpm install --frozen-lockfile` no longer re-imports a varying subset of packages on repeat installs of an unchanged project. The global-virtual-store directory for packages in a dependency cycle is now derived consistently.

Affected Symbols

pnpm-workspace.yamlPNPM_CONFIG_*pnpm installpnpm addpnpm updatepnpm runpnpm self-updatepnpm licenses list --jsonpnpm --filter <package> runpnpm dedupe --checkpnpm peers checkpnpm install --frozen-lockfile