Summary
pnpm 12 canonicalises known-host Git dependencies to HTTPS identities, makes peer-dependency cycle breaking deterministic and fails or warns on unrecognised workspace settings instead of silently ignoring them. It adds project-aware shims for pinned runtimes, can provision other package managers and introduces an opt-in signed remote side-effects cache.
Why it matters
Deterministic lockfiles and explicit trust boundaries directly affect reproducible CI, supply-chain review and multi-runtime JavaScript monorepos.
Related coverage
- Node.js 26.8 adds crypto, diagnostics and SQLite APIs
- Hono 4.13.5 patches three web-framework security issues
- Codex CLI 0.150 makes cross-task coordination and trust controls first-class