●Change8

v12.0.0-rc.8

Breaking Changes
📦 pnpmView on GitHub →
⚠ 1 breaking✨ 17 features🐛 7 fixes🔧 13 symbols

Summary

This release introduces significant performance improvements in dependency resolution and installation, enhances the accuracy of `pnpm audit` reports, and refines the behavior of `packageImportMethod` and `pnpm init`.

⚠️ Breaking Changes

  • The `packageImportMethod: auto` setting now prioritizes hardlinks over cloning on Linux. This change is only effective with pnpm 12 and later. pnpm 11 deliberately kept clone-first behavior. If your Linux environment relies on cloning behavior for `packageImportMethod: auto`, you may need to switch to `packageImportMethod: clone`.

Migration Steps

  1. If you are using `packageImportMethod: auto` on Linux and rely on cloning behavior, consider switching to `packageImportMethod: clone`.
  2. Review your `pnpm-workspace.yaml` for `onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, `neverBuiltDependencies`, and `ignoredBuiltDependencies` settings, as they are now removed by `pnpm approve-builds` when `allowBuilds` is present.

✨ New Features

  • `pnpm init` now pins the exact pnpm version in `packageManager` and `devEngines.packageManager` fields, aligning with Corepack's requirement for exact versions.
  • `pnpm init` now honors `initType` and its `--init-type` flag in pnpm 12.
  • The `pnpm audit` command now correctly handles patched versions that are unpublished or deprecated, providing more accurate audit reports and preventing incorrect overrides or `minimumReleaseAgeExclude` entries.
  • The `--json` output of `pnpm audit` now returns `patched_versions: null` for advisories with unavailable patches, improving machine readability.
  • pnpm now re-fetches full registry metadata when `minimumReleaseAge` is enabled and abbreviated packuments omit timestamps, preventing mature versions from being filtered out.
  • pnpm now derives tarball URLs from the registry's packument for config dependencies with inline integrity, resolving 404 errors on registries where tarball paths cannot be derived.
  • pnpm now correctly handles files like `license16.json` and does not treat them as package licenses when deciding whether to include the workspace LICENSE file in packed packages.
  • Reduced warm update overhead by limiting virtual-store bin linking and ignored-script build bookkeeping to packages materialized by the current install.
  • The `node-linker=hoisted` setting now produces correct layouts for dependency graphs with version conflicts, addressing issues with transitive dependencies, peer resolution, and shadowing of names.
  • pnpm now reuses cached metadata during dependency resolution when lockfile preferences indicate no uncached version can be chosen, reducing registry metadata requests.
  • Improved install performance by overlapping store-index writer shutdown with lockfile and `.modules.yaml` writes.
  • pnpm now reports unreadable or incorrectly cased settings in the global `config.yaml` instead of ignoring them silently.
  • A forced full re-resolution now preserves locked versions for dependencies whose recorded versions still satisfy their ranges, preventing unnecessary lockfile churn.
  • Improved fresh resolution performance when package metadata is cached.
  • Improved fresh installs by reusing the store index and verified-files cache during dependency materialization.
  • Runtimes installed through `devEngines.runtime` now correctly match the host when `supportedArchitectures` lists multiple platforms, preventing incorrect runtime installations.
  • `pnpm self-update <tag>` no longer downgrades when the tag points to the currently running version and that version is younger than `minimumReleaseAge`.

🐛 Bug Fixes

  • `pnpm approve-builds` now removes deprecated `onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, `neverBuiltDependencies`, and `ignoredBuiltDependencies` settings from `pnpm-workspace.yaml` when writing `allowBuilds`.
  • `pnpm audit --fix` and `pnpm audit --fix update` no longer add a `minimumReleaseAgeExclude` entry when the registry packument shows the minimum patched version was never published.
  • Fixed an issue where a version-conflicted package depended on by several packages kept its conflicting transitive dependencies under only one of the dependents, leading to resolution of the wrong version (e.g., `ERR_IMPORT_ATTRIBUTE_MISSING` on Node.js 22).
  • Fixed an issue where peer-resolution variants of one package version would collapse onto a single copy instead of conflict-nesting, which previously caused performance issues on graphs with many peer variants.
  • Fixed an issue where hoisting would shadow names a subtree resolves through an ancestor directory.
  • `pnpm update --no-save <pkg>@<version>` now correctly keeps the manifest's declared importer specifier in `pnpm-lock.yaml` when the requested version satisfies the range, preventing `--frozen-lockfile` installs from failing.
  • Fixed an issue where a runtime installed through `devEngines.runtime` would install the wrong build for the host when `supportedArchitectures` listed multiple platforms (e.g., Linux arm64 receiving a macOS x64 Node.js).

Affected Symbols

`pnpm approve-builds``pnpm audit``pnpm init``pnpm update``pnpm self-update``packageImportMethod``node-linker=hoisted``devEngines.runtime``supportedArchitectures``pnpm-workspace.yaml``pnpm-lock.yaml``config.yaml`Corepack