TAG
#package-management
Stories connected through a shared idea, actor, technology or theme.
pnpm adds registry profile and token management commandsThe release adds pnpm profile and pnpm token commands for viewing, creating and revoking registry credentials. It also introduces a files-based store index for network filesystems and faster Python dependency resolution.→pnpm 12.8.1 fixes reproducibility and CI installation edge casesVersion 12.8.1 stops frozen-lockfile installs rejecting injected workspace packages with peer dependencies and makes pnpm dedupe converge reliably. It also restores executable bits for local dependencies, reduces CPU use on many-core frozen installs and prevents unnecessary reinstalls after filtered installs.→pnpm 12.8 warns about accidental environment-file publicationPackage packing and publishing now flag `.env` and `.env.*` files that are not explicitly listed in package metadata. The release also records pnpmfile checksums in pnpr lockfiles and avoids running unapproved build scripts while preparing certain git dependencies.→pnpm 12.4.2 patches executable-shim and GitHub Actions security issuesThe release prevents dependency executables from taking over another package’s POSIX bin shim and requires HTTPS for GitHub server URLs except on loopback hosts. It also improves installs, peer-dependency resolution, Python lockfile reuse, workspace performance and several platform-specific behaviours.→