●Change8

v12.0.0-rc.4

📦 pnpmView on GitHub →
✨ 3 features🐛 19 fixes🔧 21 symbols

Summary

This release introduces new settings for pruning lockfile entries and synchronizing injected dependencies, alongside numerous bug fixes for improved performance and reliability in dependency management, especially in CI environments and complex workspace setups.

Migration Steps

  1. Rename `cleanupUnusedCatalogs` to `catalogPrune` in `pnpm-workspace.yaml` for consistent vocabulary.
  2. For git dependencies using SSH remotes, consider updating the lockfile entry over HTTPS with `pnpm update <package>` if you encounter SSH key issues.

✨ New Features

  • Added `minimumReleaseAgeExcludePrune` setting to prune `minimumReleaseAgeExclude` entries in `pnpm-workspace.yaml` that are no longer resolved by the lockfile.
  • Added `syncInjectedDepsAfterScripts` setting to ensure injected package copies are in sync with their source after scripts run.
  • Global installs now switch over atomically by using stable per-package links, preventing missing commands during installs and ensuring the previous version remains on failure.

🐛 Bug Fixes

  • `pnpm add` no longer re-resolves the dependency graph unnecessarily when `pnpm-lock.yaml` already satisfies the request.
  • `pnpm audit --fix` and `pnpm audit --fix update` no longer add `minimumReleaseAgeExclude` entries for patched versions published before the `minimumReleaseAge` cutoff.
  • Bounded the number of requests in flight to the `.pnpmfile.cjs` worker process to prevent timeouts and excessive memory usage.
  • `pnpm add <pkg>@<version>` and `pnpm update <pkg>@<version>` under `catalogMode: strict` no longer fail when the catalog entry is a range that the wanted version satisfies.
  • `pnpm install` in CI now defaults to frozen lockfile mode when an existing `pnpm-lock.yaml` is non-empty.
  • A changed `catalogs` or `pnpm.overrides` block no longer forces a full re-resolution of the dependency graph for `pnpm install` to update the lockfile in place.
  • Fixed lockfile corruption when an in-place override update involved a package that was also a catalog entry.
  • `pnpm install` now updates the lockfile in place even with multiple types of changes (e.g., dependency edits, patch changes, settings changes).
  • Resolving peer dependencies in workspaces with many peer-dependency cycles is now faster and uses less memory due to caching.
  • `pnpm install` and `pnpm dedupe` no longer consume excessive memory when resolving graphs with many packages declaring the same missing peer dependency.
  • Redundant symlinks created by `dedupeDirectDeps` are now removed on the next install.
  • `pnpm deploy` now injects workspace dependencies to make the deploy directory self-contained.
  • `pnpm deploy --no-optional` no longer writes a lockfile referencing optional dependencies that were excluded.
  • `pnpm --filter . deploy` now deploys the project in the current directory instead of nested projects.
  • `pnpm deploy --legacy` no longer rewrites the source workspace's `pnpm-lock.yaml`.
  • Fixed `pnpm install` from writing different `pnpm-lock.yaml` files for unchanged projects due to resolution order.
  • Removing the last dependency referencing a catalog entry no longer leaves a stale catalog entry in `pnpm-lock.yaml`.
  • `--frozen-lockfile` no longer rejects a newly generated lockfile when `packageExtensions` adds a peer dependency.
  • Git dependencies that fail to clone or fetch now report the package name and redact credentials, with improved error messages for SSH remotes.

Affected Symbols

`pnpm add``pnpm update``pnpm remove``pnpm audit --fix``pnpm audit --fix update``pnpm install``pnpm dedupe``pnpm deploy``pnpm --filter . deploy``pnpm deploy --legacy``minimumReleaseAgeExclude``minimumReleaseAgeExcludePrune``cleanupUnusedCatalogs``catalogPrune``syncInjectedDepsAfterScripts``pnpm-lock.yaml``pnpm-workspace.yaml``packageExtensions``ERR_PNPM_PNPMFILE_FAIL``ERR_PNPM_CATALOG_VERSION_MISMATCH``ERR_PNPM_GIT_FETCH_FAILED`