v12.0.0-beta.4
Breaking Changes📦 pnpmView on GitHub →
⚠ 2 breaking✨ 2 features🐛 12 fixes🔧 10 symbols
Summary
This release addresses a critical security vulnerability in named registries and significantly improves performance for large and complex workspaces. It also introduces a new `npmjs:` alias for better control over registry resolution.
⚠️ Breaking Changes
- Projects using `namedRegistries` on pnpm 11.1.0–11.19.x are semi-breaking. The lockfile no longer records tarball URLs for named-registry packages; these are now recomputed from the `namedRegistries` setting on demand. To fix, commit the lockfile diff generated by a non-frozen install, which will re-key entries with registry-qualified names (e.g., `foo@work:1.0.0`). Ensure all collaborators are on this version or newer before updating the lockfile to prevent lockfile flipping.
- Named registry aliases that shadow reserved dependency specifier prefixes (e.g., `file`, `link`, `workspace`, `runtime`, `npm`, `jsr`) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed. To fix, rename your named registry alias to avoid conflicts with reserved prefixes.
Migration Steps
- If you use named registries, commit the lockfile diff generated by a non-frozen install to update entries to registry-qualified keys.
- If you use named registries and have aliases that shadow reserved dependency specifier prefixes, rename your named registry aliases to avoid conflicts.
✨ New Features
- Introduced a new built-in `npmjs:` alias that resolves to `https://registry.npmjs.org/` by default, allowing dependencies to be pinned to the public registry even when the main `registry` setting points elsewhere. This alias can be overridden by configuring `namedRegistries` to point to an internal mirror.
- The `pnpm licenses` and `pnpm sbom` commands now distinguish between artifacts from different registries by including the registry alias in license records and the `repository_url` qualifier in SBOM components.
🐛 Bug Fixes
- Fixed a security vulnerability in `namedRegistries` where packages could be substituted from unintended registries due to the lockfile not properly distinguishing between registries for packages of the same name and version.
- Fixed non-deterministic resolution on multi-project workspaces, ensuring that consecutive installs of the same inputs result in the same `pnpm-lock.yaml` by consistently binding peer-suffixed packages.
- Fixed an issue where an empty `http-proxy`, `https-proxy`, `proxy`, or `no-proxy` value would fail the install with `ERR_PNPM_INVALID_PROXY`. Empty settings are now correctly interpreted as unset.
- Fixed `proxy=false` and `proxy: false` in `.npmrc` or `pnpm-workspace.yaml` from being read as a proxy host named `false`. These now correctly turn proxying off.
- Fixed `false` and `null` on `https-proxy`, `http-proxy`, and `no-proxy` from being read as unset when they should be ordinary host names on the command line.
- Fixed the env lockfile from pinning `@pnpm/exe` alongside `pnpm` when the wanted pnpm version is 12 or newer, as `@pnpm/exe` is no longer published for newer versions.
- Fixed `pnpm install` from crashing on machines with an empty or absent system certificate store by falling back to Mozilla root certificates bundled into the binary.
- Fixed nondeterministic peer bindings in large multi-project workspaces.
- Resolved an issue where installing a workspace whose projects auto-install peer dependencies was substantially slower due to inefficient scanning of the workspace.
- Resolved an issue where installing a dependency chain with peer dependencies could exhaust memory due to exponential expansion with depth.
- Resolved an issue where resolving a workspace with deep dependency chains was slow because deciding which missing peer dependencies were covered by another project's resolution was done inefficiently.
- Resolved an issue where peer resolution on large workspaces was slow because each hoist round re-read every resolved package instead of refreshing its view from what the round changed.