v12.0.0-rc.0
Breaking Changes📦 pnpmView on GitHub →
⚠ 1 breaking🐛 11 fixes🔧 9 symbols
Summary
This release introduces stricter error handling for global installations with sudo and resolves several issues related to file handling, dependency management, and store locations.
⚠️ Breaking Changes
- Running `pnpm setup`, `pnpm self-update`, or commands that modify the global installation (like `pnpm add --global`) with `sudo` will now fail with `ERR_PNPM_SUDO_NOT_SUPPORTED`. Previously, these commands would silently operate on the root user's home directory. To fix this, do not use `sudo` for these commands as they do not require root permissions. Read-only global commands still work with `sudo`.
🐛 Bug Fixes
- Archive entries with `` as a separator are now read correctly, resolving `bin\tool.js` to `bin/tool.js` and rejecting path traversals with backslashes.
- Fixed `file:` dependencies not being re-copied when their source directory changed.
- Write blocked-build approval scaffolding to the discovered workspace manifest when using per-project lockfiles.
- Concurrent installs sharing a global virtual store no longer fail with `failed to remove existing directory ... prior to swap: Directory not empty`.
- Fixed `link:` dependencies under `enableGlobalVirtualStore` so linked children are materialized and slots remain isolated.
- Headless installs (`--frozen-lockfile`) now create command shims for publicly hoisted workspace packages' `bin`.
- `pnpm fetch` and installs with `virtualStoreOnly` no longer write a `.pnp.cjs` loader under `nodeLinker: pnp`.
- Prevented pnpm from removing project files when `modulesDir` resolves to the project root.
- Fixed `pnpm install` ignoring `pnpm-lock.yaml` with a leading env lockfile document when the file has CRLF line endings or a UTF-8 byte order mark.
- When hard links are not possible, the default store is now created at `<project>/node_modules/.pnpm-store` instead of the pnpm home directory.
- A stray non-directory entry in `node_modules` no longer fails an install.