●Change8

v12.0.0-rc.1

Breaking Changes
📦 pnpmView on GitHub →
⚠ 1 breaking✨ 1 features🐛 15 fixes🔧 12 symbols

Summary

This release significantly changes how Git dependencies are handled, resolving them through canonical HTTPS URLs and improving consistency. It also introduces several performance optimizations and bug fixes, including reduced memory usage during dependency resolution and faster installs.

⚠️ Breaking Changes

  • Git dependencies on known hosts (GitHub, GitLab, Bitbucket) are now treated as identities. All representations of the same repository resolve through the host's canonical HTTPS URL. The lockfile will no longer record SSH URLs for these hosts. To reach a private hosted repository over SSH, configure your machine with git's URL rewriting (e.g., `git config --global url."git@github.com:".insteadOf https://github.com/`). This change removes network probing that previously selected transports, potentially causing issues with CI runners lacking SSH keys.

Migration Steps

  1. Configure your machine with git's URL rewriting if you need to access private hosted repositories over SSH (e.g., `git config --global url."git@github.com:".insteadOf https://github.com/`).

✨ New Features

  • Added interactive group selection to `pnpm update --global --interactive`.

🐛 Bug Fixes

  • Fixed `minimumReleaseAge` fallback for custom dist-tags.
  • Removing a dependency from `package.json` and reinstalling no longer re-resolves the dependency graph.
  • Dependencies declared with an empty version range (`"adler-32": ""`) now install correctly.
  • Changing a catalog entry to a different exact version no longer re-resolves the dependency graph.
  • Fixed installs under `enableGlobalVirtualStore` failing with directory errors when peer variants of an injected `file:` dependency hash to the same slot.
  • The held-back-update warning printed by `pnpm update` no longer fires incorrectly when `minimumReleaseAge` is the reason for not picking a newer version.
  • Changing `autoInstallPeers`, `dedupePeers`, `peersSuffixMaxLength`, `excludeLinksFromLockfile`, or `injectWorkspacePackages` no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it.
  • Adding, editing, or removing an entry in `patchedDependencies` no longer re-resolves the dependency graph.
  • `pnpm install` now records immature versions picked under `minimumReleaseAge` (when `minimumReleaseAgeStrict` is off) in `minimumRelease `exclude` in `pnpm-workspace.yaml`.
  • Reduced peak install memory by reading cached registry metadata on demand.
  • Lockfile verification now honors offline mode by using cached registry metadata.
  • POSIX shell shims now follow symbolic links before computing `basedir`, preventing execution failures when a shim is invoked via an external symlink on `PATH`.
  • Speed up installs after adding `ignoredOptionalDependencies` patterns by removing newly ignored optional dependencies and pruning unreachable packages.
  • `pnpm self-update` no longer fails with "the installed pnpm wrapper is missing" when the global packages directory carries a `pnpm-workspace.yaml`.
  • Reduced peak memory usage and allocation churn during peer dependency resolution on workspaces with many peer-dependency issue occurrences.

Affected Symbols

`pnpm root -g``pnpm bin -g``pnpm dlx``pnpm create``pnpm config``pnpm sbom``pnpm with``pnpm store``pnpm prefix``pnpm bin``pnpm update``pnpm self-update`