What pnpm/pnpm shipped
Written by FoxPlug from the repository's own releases; not affiliated with pnpm. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/pnpm/pnpm; pnpm did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Build output can now be shared between machines through a single remoteCache setting, covering dependency side effects and pipeline task results over a pnpr server or a Turborepo Remote Cache API server. Pull request #16812
- Pnpm v12 now accepts the tool: protocol anywhere it accepts runtime:, with runtime: kept as an alias in the Node.js, Bun, Deno and Yarn resolvers, pnpm add, and elsewhere. Pull request #16838
- Config dependencies now follow the same save and update rules as project dependencies, so pnpm add --config @latest and updates pick up newer published versions instead of keeping a lockfile entry. Pull request #16816
- A new addMissingPeerTypes setting makes every peer X of a dependency also an optional peer @types/X unless the package already declares it, fixing TypeScript failing to find peer types. Pull request #16810
- Pnpm dist-tag add, rm and ls support OIDC login, so trusted CI jobs can manage npm tags such as latest and next without storing an npm token. Pull request #16840
- Packages denied in allowBuilds no longer run their build scripts under dangerouslyAllowAllBuilds, restoring a way to build everything except listed packages. Pull request #16813
- A backend.libsql config makes pnpr connect over TLS instead of crashing at startup with the tls feature disabled. Pull request #16835
- A rebuild with skipIfHasSideEffectsCache skips a cached build again when the side-effects cache holds an empty row for a package whose build changed nothing. Pull request #16843
- Pnpm setup resolves the pnpm executable through symlinks, so an npm install no longer leaves a symlink directory as the installed package. Pull request #16857
- Atomic writes fall back to fsync when F_FULLFSYNC is unsupported, fixing lockfile write failures on virtiofs and SMB shares on Apple platforms. Pull request #16858
Why it matters
This week pnpm gained a way to share build output and task results between machines through a remote cache, a tool: protocol for provisioned tools, and config dependencies that save and update like project dependencies. It also fixed builds being blocked by allowBuilds, OIDC authentication for dist-tag, and writes failing on some macOS and network shares.
Changelog entry
- Share build output between machines through a remoteCache setting over pnpr or a Turborepo Remote Cache API server. Pull request #16812
- Accept the tool: protocol for provisioned tools, with runtime: kept as an alias. Pull request #16838
- Add the addMissingPeerTypes setting so peers also bring optional @types/X peers. Pull request #16810
- Config dependencies now follow the save and update rules of project dependencies. Pull request #16816
- Support OIDC authentication in pnpm dist-tag add, rm and ls. Pull request #16840
- AllowBuilds denials now outrank dangerouslyAllowAllBuilds. Pull request #16813
- Connect the pnpr libsql backend over TLS instead of crashing at startup. Pull request #16835
- Leave ignore files out of the staged runtime dependencies for the wasm package. Pull request #16805
- Reuse the lockfile when injected projects come from memory through the Node-API binding. Pull request #16815
- Fall back to npm's signature metadata for mirrored pnpm engines. Pull request #16833
- Update dependencies, Node.js, pnpm and GitHub Actions. Pull request #16819
- Release pnpm 12.12.0 with remote cache sharing, addMissingPeerTypes and config dependency management. Release
Build output can now be shared between machines through one remoteCache setting, tool: works wherever runtime: does, and config dependencies save and update like project dependencies. Plus fixes for allowBuilds, dist-tag OIDC and lockfile writes on virtiofs and SMB shares.
This week pnpm added a single remoteCache setting that shares both dependency side effects and pipeline task results between machines, over a pnpr server or a Turborepo Remote Cache API server. The tool: protocol is now accepted anywhere runtime: is, config dependencies save and update like project dependencies, and a new addMissingPeerTypes setting adds @types/X as an optional peer. Fixes include allowBuilds denials outranking dangerouslyAllowAllBuilds, OIDC authentication for pnpm dist-tag, setup resolving the executable through symlinks, and atomic writes falling back to fsync on shares that reject F_FULLFSYNC.
Week of September 28, 2026
What shipped
- Pnpm 12.9.1 moves the WebContainer build into a separate @pnpm/wasm package, shrinking the pnpm package back to about 4 MB, and fixes pnpm publish with provenance from GitLab CI. Release
- Pnpm 11.28.4 fixes two ways credentials could leak, makes pnpm install --frozen-lockfile accept several lockfiles it rejected, warns when an optional dependency cannot be fetched, and stops pnpm self-update from installing a second pnpm next to a Homebrew one. Release
- Pnpm run and pnpm exec now forward config flags to child installs started by verifyDepsBeforeRun when dependencies are out of date. Pull request #16558
- With optimisticRepeatInstall: false, a repeat pnpm install now runs project lifecycle scripts instead of skipping them. Pull request #16566
- Switching to a project's pinned pnpm now spawns the pinned native binary directly instead of its POSIX bin shim, dropping startup time from 42.9 ms to 30.0 ms on macOS. Pull request #16503
- On macOS, relinking direct dependencies of 1,000 workspace projects whose links already exist drops from 116 ms to 45 ms by reusing up-to-date links. Pull request #16500
- Linux release CLI builds with -C force-unwind-tables=no to reduce binary size since the CLI never unwinds. Pull request #16565
- Pnpm run no longer reports lifecycle failure when a script ends with Ctrl+C. Pull request #16582
- Pnpm install --frozen-lockfile now accepts lockfiles with injected catalog peer dependencies. Pull request #16559
- Pnpm.io release pages are now generated from releases instead of being written by hand. Pull request #16529
Why it matters
Two patch releases shipped this week fixing credential leaks and lifecycle script behavior while improving install performance. A major refactoring separated WebContainer runtime into its own package, reducing download size by 47 MB for users who don't need it. Multiple performance improvements cut startup time and link reuse latency.
Changelog entry
- Pnpm 11.28.4: Fixed credential leaks in pnpm login, improved pnpm install --frozen-lockfile compatibility, added warnings for unfetchable optional dependencies, and prevented pnpm self-update from installing alongside Homebrew installations Release
- Pnpm 12.9.1: Separated WebContainer runtime into @pnpm/wasm package, reduced main package size to 4 MB, fixed pnpm publish provenance for GitLab CI Release
- Pnpm run and pnpm exec now forward --config.* flags to child installs triggered by verifyDepsBeforeRun Pull request #16558
- With optimisticRepeatInstall: false, repeat pnpm install executes project lifecycle scripts instead of skipping them Pull request #16566
- Pinned pnpm now spawns native binary directly, reducing startup from 42.9 ms to 30.0 ms on macOS Pull request #16503
- Workspace link reuse optimization reduces relinking time from 116 ms to 45 ms for 1,000 projects Pull request #16500
- Pnpm run no longer reports lifecycle failure when script ends with Ctrl+C Pull request #16582
- Pnpm install --frozen-lockfile now accepts lockfiles with injected catalog peer dependencies Pull request #16559
- Hoisted required peers now follow their provider when dependencies move to older versions Pull request #16474
- Optional dependencies whose subtrees cannot be resolved are now omitted instead of failing Pull request #16527
Pnpm 11.28.4 and 12.9.1 shipped with security fixes, better lifecycle script handling, and 47 MB smaller packages. Native binary startup is now faster, and --frozen-lockfile accepts more valid lockfiles.
Two pnpm releases this week address security, performance, and package size. 11.28.4 fixes credential leaks and improves frozen lockfile handling. 12.9.1 moves WebContainer runtime to @pnpm/wasm, cutting package size by 47 MB. Performance improvements include faster native startup (42.9→30ms on macOS) and smarter link reuse for workspace projects.
Week of September 21, 2026
What shipped
- Pnpm can now prepare lockfile-less pnpm workspaces as git-hosted dependencies by detecting pnpm-workspace.yaml. Pull request #16301
- Fixed linking of file: dependencies that point to directories inside their own package. Pull request #16296
- Package publish now waits at least 5 minutes for the registry to accept uploads instead of timing out after 1 minute. Pull request #15863
- Fixed --config command-line tokens being silently ignored when they did not match a hand-written table of settings. Pull request #16280
- Filtered pnpm run and pnpm exec now install only the projects the filter selected instead of potentially running without their dependencies. Pull request #16211
- Pnpm install in workspaces with sharedWorkspaceLockfile: false now runs projects concurrently instead of sequentially. Pull request #16263
- Workspace discovery no longer descends into hidden directories like.cache that the glob pattern excludes. Pull request #16252
- Windows pnpm binaries now statically link the C runtime so they run on clean Windows installs without the Visual C++ Redistributable. Pull request #15853
- Offline installs now resolve to store-held versions instead of failing when the newest cached version lacks a tarball. Pull request #15860
- Pnpm pack and pnpm publish now ship files that the files field names even when it also excludes their parent directory. Pull request #16243
Why it matters
This week brings fixes for publish reliability, workspace handling, offline installs, and Windows compatibility. Several fixes address edge cases where pnpm would silently drop settings or dependencies, or fail entirely in valid scenarios. These improvements make pnpm more robust across different platforms and configurations.
Changelog entry
- Fix(prepare-package): detect pnpm workspaces by pnpm-workspace.yaml when lockfile is missing Pull request #16301
- Fix: link file: dependencies that point inside their package Pull request #16296
- Fix(publish): wait at least 5 minutes for registry to accept uploads Pull request #15863
- Fix(cli): apply all --config token overrides instead of silently dropping them Pull request #16280
- Fix(exec): install only projects selected by filter instead of entire workspace Pull request #16211
- Perf(install): run dedicated-lockfile projects concurrently Pull request #16263
- Fix(workspace): skip hidden directories during workspace discovery Pull request #16252
- Fix: statically link C runtime on Windows to remove Visual C++ Redistributable dependency Pull request #15853
- Fix(resolver): resolve offline installs to store-held versions Pull request #15860
- Fix(pack): include files named in files field despite directory exclusions Pull request #16243
- Fix: preserve shared store ownership and group-write permissions Pull request #15882
- Fix(config): reject invalid base64 _password values with error Pull request #16279
Pnpm 12 and 11 updates: publish now waits 5 minutes for registries, filtered commands install only selected projects, workspaces run concurrently, Windows no longer needs Visual C++ Redistributable, and offline installs resolve correctly.
This week's pnpm releases fix critical issues across publishing, workspace management, and platform compatibility. Publish operations now wait 5 minutes for registry acceptance instead of timing out. Filtered pnpm run and exec commands install only required dependencies. Workspaces with independent lockfiles now install projects concurrently. Windows binaries now statically link the C runtime, removing the Visual C++ Redistributable requirement. Offline installs correctly resolve to cached versions, and workspace discovery no longer scans hidden directories.