📦🚀 Fast, disk space efficient package manager

Minor Changes

• The pnpm list and pnpm why commands will now look through transitive dependencies of workspace: packages. A new --only-projects flag is available to only print workspace: packages.
• pnpm exec and pnpm run command support --resume-from option. When used, the command will executed from given package #4690.
• Expose the npm_command environment variable to lifecycle hooks & scripts.

Patch Changes

• Fix a situation where pnpm list and pnpm why may not respect the --depth argument.
• Report to the console when a git-hosted dependency is built #5847.
• Throw an accurate error message when trying to install a package that has no versions, or all of its versions are unpublished #5849.
• replace dependency is-ci by ci-info (is-ci is just a simple wrapper around ci-info).
• Only run prepublish scripts of git-hosted dependencies, if the dependency doesn't have a main file. In this case we can assume that the dependencies has to be built.
• Print more contextual information when a git-hosted package fails to be prepared for installation #5847.

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

• The pnpm dlx command supports the --shell-mode (or -c) option. When used, the script is executed by a shell #5679.

Patch Changes

• The config command should work with the --location=global CLI option #5841.
• Only the pnpm add --global <pkg> command should fail if there is no global pnpm bin directory in the system PATH #5841.

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

• pnpm gets its own implementation of the following commands:

  • pnpm config get
  • pnpm config set
  • pnpm config delete
  • pnpm config list

  In previous versions these commands were passing through to npm CLI.

  PR: #5829 Related issue: #5621

• Add show alias to pnpm view #5835.

• pnpm reads settings from its own global configuration file at $XDG_CONFIG_HOME/pnpm/rc #5829.

• Add the 'description'-field to the licenses output #5836.

Patch Changes

• pnpm rebuild should not fail if node_modules was created by pnpm version 7.18 or older #5815.
• pnpm env should print help.
• Run the prepublish scripts of packages installed from Git #5826.
• pnpm rebuild should print a better error message when a hoisted dependency is not found #5815.

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

• New setting supported in the package.json that is in the root of the workspace: pnpm.requiredScripts. Scripts listed in this array will be required in each project of the worksapce. Otherwise, pnpm -r run <script name> will fail #5569.
• When the hoisted node linker is used, preserve node_modules directories when linking new dependencies. This improves performance, when installing in a project that already has a node_modules directory #5795.
• When the hoisted node linker is used, pnpm should not build the same package multiple times during installation. If a package is present at multipe locations because hoisting could not hoist them to a single directory, then the package should only built in one of the locations and copied to the rest #5814.

Patch Changes

• pnpm rebuild should work in projects that use the hoisted node linker #5560.
• pnpm patch should print instructions about how to commit the changes #5809.
• Allow the -S flag in command shims pnpm/cmd-shim#42.
• Don't relink injected directories if they were not built #5792.

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• Added --json to the pnpm publish --help output #5773.
• pnpm update should not replace workspace:*, workspace:~, and workspace:^ with workspace:<version> #5764.
• The fatal error should be printed in JSON format, when running a pnpm command with the --json option #5710.
• Throw an error while missing script start or file server.js #5782.
• pnpm license list should not fail if a license file is an executable #5740.

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• The update notifier should suggest using the standalone script, when pnpm was installed using a standalone script #5750.
• Vulnerabilities that don't have CVEs codes should not be skipped by pnpm audit if an ignoreCves list is declared in package.json #5756.
• It should be possible to use overrides with absolute file paths #5754.
• pnpm audit --json should ignore vulnerabilities listed in auditConfig.ignoreCves #5734.
• pnpm licenses should print help, not just an error message #5745.

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

• Overrides may be defined as a reference to a spec for a direct dependency by prefixing the name of the package you wish the version to match with a `# pnpm.

  {
    "dependencies": {
      "foo": "^1.0.0"
    },
    "overrides": {
      // the override is defined as a reference to the dependency
      "foo": "$foo",
      // the referenced package does not need to match the overridden one
      "bar": "$foo"
    }
  }
  

  Issue: #5703

Patch Changes

• pnpm audit should work when the project's package.json has no version field #5728
• Dependencies specified via * should be updated to semver ranges by pnpm update #5681.
• It should be possible to override a dependency with a local package using relative path from the workspace root directory #5493.
• Exit with non-zero exit code when child process exits with a non-zero exit clode #5525.
• pnpm add should prefer local projects from the workspace, even if they use prerelease versions #5316

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• pnpm set-script and pnpm pkg are passed through to npm #5683.
• pnpm publish <tarball path> should exit with non-0 exit code when publish fails #5396.
• readPackage hooks should not modify the package.json files in a workspace #5670.
• Comments in package.json5 are preserver #2008.
• pnpm setup should create PNPM_HOME as a non-expandable env variable on Windows #4658.
• Fix the CLI help of the pnpm licenses command.

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

• Added a new command pnpm licenses list, which displays the licenses of the packages #2825

Patch Changes

• pnpm update --latest !foo should not update anything if the only dependency in the project is the ignored one #5643.
• pnpm audit should send the versions of workspace projects for audit.
• Hoisting with symlinks should not override external symlinks and directories in the root of node_modules.
• The pnpm.updateConfig.ignoreDependencies setting should work with multiple dependencies in the array #5639.

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• Sync all injected dependencies when hoisted node linker is used #5630

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

• Support pnpm env list to list global or remote Node.js versions #5546.

Patch Changes

• Replace environment variable placeholders with their values, when reading .npmrc files in subdirectories inside a workspace #2570.
• Fix an error that sometimes happen on projects with linked local dependencies #5327.

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• Replace environment variable placeholders with their values, when reading .npmrc files in subdirectories inside a workspace #2570.
• Don't fail if cannot override the name field of the error object #5572.

Minor Changes

• Support --format=json option to output outdated packages in JSON format with outdated command #2705.

  pnpm outdated --format=json
  #or
  pnpm outdated --json
  

• A new setting supported for ignoring vulnerabilities by their CVEs. The ignored CVEs may be listed in the pnpm.auditConfig.ignoreCves field of package.json. For instance:

  {
    "pnpm": {
      "auditConfig": {
        "ignoreCves": [
          "CVE-2019-10742",
          "CVE-2020-28168",
          "CVE-2021-3749",
          "CVE-2020-7598"
        ]
      }
    }
  }
  

Patch Changes

• The reporter should not crash when the CLI process is kill during lifecycle scripts execution #5588.
• Installation shouldn't fail when the injected dependency has broken symlinks. The broken symlinks should be just skipped #5598.

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• Don't fail if cannot override the name field of the error object #5572.
• Don't fail on rename across devices.

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• pnpm list --long --json should print licenses and authors of packages #5533.
• Don't crash on lockfile with no packages field #5553.
• Version overrider should have higher priority then custom read package hook from .pnpmfile.cjs.
• Don't print context information when running install for the pnpm dlx command.
• Print a warning if a package.json has a workspaces field but there is no pnpm-workspace.yaml file #5363.
• It should be possible to set a custom home directory for pnpm by changing the PNPM_HOME environment variable.

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

• Add pnpm doctor command to do checks for known common issues

Patch Changes

• Ignore the always-auth setting.

  pnpm will never reuse the registry auth token for requesting the package tarball, if the package tarball is hosted on a different domain.

  So, for example, if your registry is at https://company.registry.com/ but the tarballs are hosted at https://tarballs.com/, then you will have to configure the auth token for both domains in your .npmrc:

  @my-company:registry=https://company.registry.com/
  //company.registry.com/=SOME_AUTH_TOKEN
  //tarballs.com/=SOME_AUTH_TOKEN
  

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• Installing a package with bin that points to an .exe file on Windows #5159.

• Ignore the always-auth setting.

  pnpm will never reuse the registry auth token for requesting the package tarball, if the package tarball is hosted on a different domain.

  So, for example, if your registry is at https://company.registry.com/ but the tarballs are hosted at https://tarballs.com/, then you will have to configure the auth token for both domains in your .npmrc:

  @my-company:registry=https://company.registry.com/
  //company.registry.com/=SOME_AUTH_TOKEN
  //tarballs.com/=SOME_AUTH_TOKEN
  

• When an error happens during installation of a subdependency, print some context information in order to be able to locate that subdependency. Print the exact chain of packages that led to the problematic dependency.

Patch Changes

• Downgrade @pnpm/npm-conf to remove annoying builtin warning #5518.
• pnpm link --global <pkg> should not change the type of the dependency #5478.
• When the pnpm outdated command fails, print in which directory it failed.

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• Print a warning when cannot read the built-in npm configuration.
• Also include missing deeply linked workspace packages at headless installation #5034.
• pnpm outdated should work when the package tarballs are hosted on a domain that differs from the registry's domain #5492.
• strict-peer-dependencies is set to false by default.

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• pnpm link <pkg> --global should work when a custom target directory is specified with the --dir CLI option #5473.
• It should be possible to override dependencies with local packages using overrides #5443.

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• Don't crash when auto-install-peers is set to true and installation is done on a workspace with that has the same dependencies in multiple projects #5454.
• Add global option in pnpm link --help #5461.
• Show execution time on install, update, add, and remove #1021.
• Fix the return path of pnpm pack, when a custom destination directory is used #5471.

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• When linking commands to a directory, remove any .exe files that are already present in that target directory by the same name.

  This fixes an issue with pnpm global update on Windows. If pnpm was installed with the standalone script and then updated with pnpm using pnpm add --global pnpm, the exe file initially created by the standalone script should be removed.

• When a direct dependency fails to resolve, print the path to the project directory in the error message.

• pnpm patch-commit should work when the patch directory is specified with a trailing slash #5449.

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

• pnpm update --interactive should not list dependencies ignored via the pnpm.updateConfig.ignoreDependencies setting.

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

• Ignore packages listed in package.json > pnpm.updateConfig.ignoreDependencies fields on update/outdated command #5358

  For instance, if you don't want webpack automatically to be updated when you run pnpm update --latest, put this to your package.json:

  {
    "pnpm": {
      "updateConfig": {
        "ignoreDependencies": ["webpack"]
      }
    }
  }
  

  Patterns are also supported, so you may ignore for instance any packages from a scope: @babel/*.

• It is possible now to update all dependencies except the listed ones using !. For instance, update all dependencies, except lodash:

    pnpm update !lodash
  

  It also works with pattends, for instance:

    pnpm update !@babel/*
  

  And it may be combined with other patterns:

    pnpm update @babel/* !@babel/core
  

Patch Changes

• Hooks should be applied on pnpm deploy #5306.

• Stop --filter-prod option to run command on all the projects when used on workspace. --filter-prod option now only filter from dependencies and omit devDependencies instead of including all the packages when used on workspace. So what was happening is that if you use --filter-prod on workspace root like this:

  pnpm --filter-prod ...build-modules exec node -e 'console.log(require(`./package.json`).name)'
  

  it was printing all the package of workspace, where it should only print the package name of itself and packages where it has been added as dependency (not as devDependencies)

• Don't override the root dependency when auto installing peer dependencies #5412.

Our Gold Sponsors

Our Silver Sponsors

What's Changed

• GitHub Workflows security hardening by @sashashura in https://github.com/pnpm/pnpm/pull/5405
• feat: merge readPackage hook from opts and pnpmfile by @AGrzes in https://github.com/pnpm/pnpm/pull/5403
• feat: excluding deps from update by @zkochan in https://github.com/pnpm/pnpm/pull/5432
• fix: dir path repeated join in link global by @lvqq in https://github.com/pnpm/pnpm/pull/5434
• fix: filter-prod flag including all workspace pkgs by @noorulh06 in https://github.com/pnpm/pnpm/pull/5437
• Feature: ignore packages listed in package.json > pnpm.updateConfig.ignoreDependencies on update/outdated commands by @Shinyaigeek in https://github.com/pnpm/pnpm/pull/5408
• fix: don't override root deps when auto installing peers by @zkochan in https://github.com/pnpm/pnpm/pull/5442

New Contributors

• @sashashura made their first contribution in https://github.com/pnpm/pnpm/pull/5405
• @AGrzes made their first contribution in https://github.com/pnpm/pnpm/pull/5403
• @noorulh06 made their first contribution in https://github.com/pnpm/pnpm/pull/5437

Full Changelog: https://github.com/pnpm/pnpm/compare/v7.12.2...v7.13.0

Patch Changes

• Don't crash when auto-install-peers is true and the project has many complex circular dependencies #5394.
• pnpm link --global should work with the --dir=<path> option #5371.

Our Gold Sponsors

Our Silver Sponsors

What's Changed

• fix: error in pnpm --dir link --global by @lvqq in https://github.com/pnpm/pnpm/pull/5371
• fix: cli crash with auto-install-peers=true by @zkochan in https://github.com/pnpm/pnpm/pull/5394

New Contributors

• @lvqq made their first contribution in https://github.com/pnpm/pnpm/pull/5371

Full Changelog: https://github.com/pnpm/pnpm/compare/v7.12.1...v7.12.2

Patch Changes

• Deduplicate peer dependencies when automatically installing them #5373.

Our Gold Sponsors

Our Silver Sponsors

What's Changed

• fix: deduplicate peer deps by @zkochan in https://github.com/pnpm/pnpm/pull/5377

Full Changelog: https://github.com/pnpm/pnpm/compare/v7.12.0...v7.12.1

Minor Changes

• A new setting supported in the pnpm section of the package.json file: allowNonAppliedPatches. When it is set to true, non-applied patches will not cause an error, just a warning will be printed. For example:

  {
    "name": "foo",
    "version": "1.0.0",
    "pnpm": {
      "patchedDependencies": {
        "[email protected]": "patches/[email protected]"
      },
      "allowNonAppliedPatches": true
    }
  }
  

• Now it is possible to exclude packages from hoisting by prepending a ! to the pattern. This works with both the hoist-pattern and public-hoist-pattern settings. For instance:

  public-hoist-pattern[]='*types*'
  public-hoist-pattern[]='!@types/react'
  
  hoist-pattern[]='*eslint*'
  hoist-pattern[]='!*eslint-plugin*'
  

  Ref #5272

Patch Changes

• When the same dependency with missing peers is used in multiple workspace projects, install the missing peers in each workspace project #4820.
• pnpm patch should work on files that don't have an end of line #5320.
• Fix pnpm patch using a custom --edit-dir.

Our Gold Sponsors

Our Silver Sponsors

What's Changed

• fix(patch): allow to edit a package in any directory by @zkochan in https://github.com/pnpm/pnpm/pull/5331
• feat(matcher): ignore patterns by @LuciNyan in https://github.com/pnpm/pnpm/pull/5336
• fix(patch): ignore No newline at end of file by @await-ovo in https://github.com/pnpm/pnpm/pull/5321
• feat(patch): allow non-applied patches by @larrybahr-ocelot in https://github.com/pnpm/pnpm/pull/5354
• chore: update @pnpm/meta-updater by @ibezkrovnyi in https://github.com/pnpm/pnpm/pull/5360
• fix: auto-install-peers in a workspace by @zkochan in https://github.com/pnpm/pnpm/pull/5359

New Contributors

• @await-ovo made their first contribution in https://github.com/pnpm/pnpm/pull/5321
• @larrybahr-ocelot made their first contribution in https://github.com/pnpm/pnpm/pull/5354

Full Changelog: https://github.com/pnpm/pnpm/compare/v7.11.0...v7.12.0

Minor Changes

• A new setting supported in the pnpm section of the package.json file: allowNonAppliedPatches. When it is set to true, non-applied patches will not cause an error, just a warning will be printed. For example:

  {
    "name": "foo",
    "version": "1.0.0",
    "pnpm": {
      "patchedDependencies": {
        "[email protected]": "patches/[email protected]"
      },
      "allowNonAppliedPatches": true
    }
  }
  

• Now it is possible to exclude packages from hoisting by prepending a ! to the pattern. This works with both the hoist-pattern and public-hoist-pattern settings. For instance:

  public-hoist-pattern[]='*types*'
  public-hoist-pattern[]='!@types/react'
  
  hoist-pattern[]='*eslint*'
  hoist-pattern[]='!*eslint-plugin*'
  

  Ref #5272

Patch Changes

• pnpm patch should work on files that don't have an end of line #5320.
• Fix pnpm patch using a custom --edit-dir.

Our Gold Sponsors

Our Silver Sponsors

What's Changed

• fix(patch): allow to edit a package in any directory by @zkochan in https://github.com/pnpm/pnpm/pull/5331
• feat(matcher): ignore patterns by @LuciNyan in https://github.com/pnpm/pnpm/pull/5336
• fix(patch): ignore No newline at end of file by @await-ovo in https://github.com/pnpm/pnpm/pull/5321
• feat(patch): allow non-applied patches by @larrybahr-ocelot in https://github.com/pnpm/pnpm/pull/5354

New Contributors

• @await-ovo made their first contribution in https://github.com/pnpm/pnpm/pull/5321
• @larrybahr-ocelot made their first contribution in https://github.com/pnpm/pnpm/pull/5354

Full Changelog: https://github.com/pnpm/pnpm/compare/v7.11.0...v7.12.0-0

Minor Changes

• pnpm patch: edit the patched package in a directory specified by the --edit-dir option. E.g., pnpm patch [email protected] --edit-dir=/home/xxx/src/patched-express #5304

Patch Changes

• Auto installing a peer dependency in a workspace that also has it as a dev dependency in another project #5144.
• When an error happens during installation of a subdependency, print some context information in order to be able to locate that subdependency. Print the exact chain of packages that led to the problematic dependency.

Our Gold Sponsors

Our Silver Sponsors

What's Changed

• feat(plugin-command-patching): add path option to patch command by @roseline124 in https://github.com/pnpm/pnpm/pull/5304
• fix: improve dependency installation error message by @zkochan in https://github.com/pnpm/pnpm/pull/5247
• fix: auto installing peer dep in a workspace by @zkochan in https://github.com/pnpm/pnpm/pull/5307

New Contributors

• @roseline124 made their first contribution in https://github.com/pnpm/pnpm/pull/5304

Full Changelog: https://github.com/pnpm/pnpm/compare/v7.10.0...v7.11.0

Minor Changes

• New time-based resolution strategy supported.

  When resolution-mode is set to time-based, pnpm will resolve dependencies the following way:

  1. Direct dependencies will be resolved to their lowest versions. So if there is foo@^1.1.0 in the dependencies, then 1.1.0 will be installed.
  2. Subdependencies will be resolved from versions that were published before the last direct dependency was published.

  With this resolution mode installations with hot cache are faster. It also reduces the chance of subdependency hijacking as subdependencies will be updated only if direct dependencies are updated.

  This resolution mode works only with npm's full metadata. So it is slower in some scenarios. However, if you use Verdaccio v5.15.1 or newer, you may set the registry-supports-time-field setting to true, and it will be really fast.

  Related RFC.

• Enhance pnpm env with the remove command. To remove a Node.js version installed by pnpm, run:

  pnpm env remove --global <node.js version>
  

Patch Changes

• pnpm store prune should remove all cached metadata.
• Don't modify the manifest of the injected workspace project, when it has the same dependency in prod and peer dependencies.

Our Gold Sponsors

Our Silver Sponsors

What's Changed

• test: fix NODE_PATH test on Windows by @zkochan in https://github.com/pnpm/pnpm/pull/5257
• refactor: resolve dependencies by @zkochan in https://github.com/pnpm/pnpm/pull/5267
• feat(env): add remove command to pnpm env by @mark-omarov in https://github.com/pnpm/pnpm/pull/5263
• docs(CONTRIBUTING): correct setup instructions for first-time clone by @gwhitney in https://github.com/pnpm/pnpm/pull/5289
• fix: don't modify the injected project's manifest by @zkochan in https://github.com/pnpm/pnpm/pull/5294
• feat: time-based resolution mode by @zkochan in https://github.com/pnpm/pnpm/pull/5238
• feat: resolve direct deps to lowest version when resolution-mode is time-based by @zkochan in https://github.com/pnpm/pnpm/pull/5298
• fix: add fallback for time-based resolution by @zkochan in https://github.com/pnpm/pnpm/pull/5302

New Contributors

• @mark-omarov made their first contribution in https://github.com/pnpm/pnpm/pull/5263
• @gwhitney made their first contribution in https://github.com/pnpm/pnpm/pull/5289

Full Changelog: https://github.com/pnpm/pnpm/compare/v7.9.5...v7.10.0