TAG
#pnpm
Stories connected through a shared idea, actor, technology or theme.
pnpm adds registry profile and token management commandsThe release adds pnpm profile and pnpm token commands for viewing, creating and revoking registry credentials. It also introduces a files-based store index for network filesystems and faster Python dependency resolution.→pnpm patches a dependency security advisory and store-corruption failuresThe release ships undici 7.29.1 and addresses failures that occurred when multiple pnpm processes wrote to the same store. It also fixes handling for package, catalog, project and command names that collide with JavaScript built-in object properties.→pnpm 12.8.1 fixes reproducibility and CI installation edge casesVersion 12.8.1 stops frozen-lockfile installs rejecting injected workspace packages with peer dependencies and makes pnpm dedupe converge reliably. It also restores executable bits for local dependencies, reduces CPU use on many-core frozen installs and prevents unnecessary reinstalls after filtered installs.→pnpm 12.8 warns about accidental environment-file publicationPackage packing and publishing now flag `.env` and `.env.*` files that are not explicitly listed in package metadata. The release also records pnpmfile checksums in pnpr lockfiles and avoids running unapproved build scripts while preparing certain git dependencies.→pnpm 12.4.2 patches executable-shim and GitHub Actions security issuesThe release prevents dependency executables from taking over another package’s POSIX bin shim and requires HTTPS for GitHub server URLs except on loopback hosts. It also improves installs, peer-dependency resolution, Python lockfile reuse, workspace performance and several platform-specific behaviours.→pnpm 11.27 adds explicit build approval and trust-policy cleanupThe release asks for approval before running package build scripts and keeps unapproved packages in the ignored-build-scripts state. It also adds trust-policy cleanup, safer global package operations and improved workspace peer dependency handling.→pnpm 12.3 adds trust-policy checks and native global-command shimspnpm 12.3 adds trust-policy flags to pnpm remove and pnpm update, verifying the lockfile against active policies. It also makes context-aware global commands such as node, deno, bun and pnpm-added shims native executables on every platform and improves local and tarball installs.→pnpm 12 makes dependency resolution and runtime selection more deterministicpnpm 12 canonicalises known-host Git dependencies to HTTPS identities, makes peer-dependency cycle breaking deterministic and fails or warns on unrecognised workspace settings instead of silently ignoring them. It adds project-aware shims for pinned runtimes, can provision other package managers and introduces an opt-in signed remote side-effects cache.→