Releases: pnpm/pnpm
v9.0.6
v9.0.5
Patch Changes
- Lockfiles with local or git-hosted dependencies are now successfully converted to the new lockfile format #7955.
- Resolve peer dependencies correctly, when they have prerelease versions #7977.
- Fix aliased dependencies resolution on repeat install with existing lockfile, when the aliased dependency doesn't specify a version or range #7957.
- The lockfile should be saved in the new format even if it is up-to-date.
Platinum Sponsors
Gold Sponsors
|
|
|
|
|
|
Our Silver Sponsors
|
|
|
|
|
|
|
v9.0.4
v9.0.3
Patch Changes
- If the
script-shell
option is configured to a.bat
/.cmd
file on Windows, pnpm will now error withERR_PNPM_INVALID_SCRIPT_SHELL_WINDOWS
. Newer versions of Node.js released in April 2024 do not support executing these files directly without behavior differences. If thescript-shell
option is necessary for your use-case, please set a.exe
file instead. - Print a hint about the
package-manager-strict
setting, when pnpm doesn't match the version specified in thepackageManager
field inpackage.json
. pnpm completion
command should work in the standalone version of pnpm #7948.
Platinum Sponsors
Gold Sponsors
|
|
|
|
|
|
Our Silver Sponsors
|
|
|
|
|
|
|
v9.0.2
v9.0.1
v9.0.0
Major Changes
-
Node.js v16 and 17 support discontinued
If you still require Node.js 16 or 17, don't worry. We ship pnpm bundled with Node.js. This means that regardless of which Node.js version you've installed, pnpm will operate using the necessary Node.js runtime. For this to work you need to install pnpm either using the standalone script or install the
@pnpm/exe
package. -
Corepack compatiblity:
pnpm will now check the
package.json
file for apackageManager
field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.NOTE: If you want to make this check less strict, set the
package-manager-strict
setting tofalse
or theCOREPACK_ENABLE_STRICT
env variable to0
. -
Configuration updates:
dedupe-injected-deps
: enabled by default.link-workspace-packages
: disabled by default. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol.hoist-workspace-packages
: enabled by default.enable-pre-post-scripts
: enabled by default.- Use the same directory for state files on macOS as on Linux (
~/.local/state/pnpm
).
-
Lockfile changes:
- Lockfile v9 is adopted. This new format has changes for better readability, and better resistence to Git conflicts.
- Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 #7470.
-
Dependency resolution changes:
-
pnpm licenses list
prints license information of all versions of the same package in case different versions use different licenses. The format of thepnpm licenses list --json
output has been changed #7528. -
A new command added for printing completion code to the console:
pnpm completion [shell]
. The old command that modified the user's shell dotfiles has been removed #3083. -
When installing git-hosted dependencies, only pick the files that would be packed with the package #7638.
Minor Changes
-
It is now possible to install only a subdirectory from a Git repository.
For example,
pnpm add github:user/repo#path:packages/foo
will add a dependency from thepackages/foo
subdirectory.This new parameter may be combined with other supported parameters separated by
&
. For instance, the next command will install the same package from thedev
branch:pnpm add github:user/repo#dev&path:packages/bar
. -
node-gyp
updated to version 10. -
PowerShell completion support added #7597.
-
Support
node-options
option inside.npmrc
file when running scripts #7596. -
Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported:
<registryURL>:certfile
,<registryURL>:keyfile
, and<registryURL>:ca
. For instance://registry.mycomp.com/:certfile=server-cert.pem //registry.mycomp.com/:keyfile=server-key.pem //registry.mycomp.com/:cafile=client-cert.pem
-
Add a field named
ignoredOptionalDependencies
. This is an array of strings. If an optional dependency has its name included in this array, it will be skipped #7714. -
The checksum of the
.pnpmfile.cjs
is saved into the lockfile. If the pnpmfile gets modified, the lockfile is reanalyzed to apply the changes #7662. -
Added cache for
pnpm dlx
#5277.
Patch Changes
- Package tarballs are not downloaded during
--lockfile-only
installation #1328. - Peer dependency rules should only affect reporting, not data in the lockfile #7758.
- Link overrides should be able to use absolute path #7749.
pnpm dlx
should not read settings from the current working directory #7916.
Platinum Sponsors
Gold Sponsors
|
|
|
|
|
|
Our Silver Sponsors
|
|
v9.0.0-rc.2
Installation instructions: https://pnpm.io/9.x/installation
Major Changes
-
Node.js v16 support discontinued
If you still require Node.js 16, don't worry. We ship pnpm bundled with Node.js. This means that regardless of which Node.js version you've installed, pnpm will operate using the necessary Node.js runtime. For this to work you need to install pnpm either using the standalone script or install the
@pnpm/exe
package. -
Configuration updates:
dedupe-injected-deps
: enabled by default.link-workspace-packages
: disabled by default. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol.hoist-workspace-packages
: enabled by default.enable-pre-post-scripts
: enabled by default.- Use the same directory for state files on macOS as on Linux (
~/.local/state/pnpm
). - pnpm will now check the
package.json
file for apackageManager
field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.
-
Lockfile changes:
- Lockfile v9 is adopted. This new format has changes for better readability, and better resistence to Git conflicts.
- Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 #7470.
-
Dependency resolution changes:
-
pnpm licenses list
prints license information of all versions of the same package in case different versions use different licenses. The format of thepnpm licenses list --json
output has been changed #7528. -
A new command added for printing completion code to the console:
pnpm completion [shell]
. The old command that modified the user's shell dotfiles has been removed #3083. -
When installing git-hosted dependencies, only pick the files that would be packed with the package #7638.
Minor Changes
-
It is now possible to install only a subdirectory from a Git repository.
For example,
pnpm add github:user/repo#path:packages/foo
will add a dependency from thepackages/foo
subdirectory.This new parameter may be combined with other supported parameters separated by
&
. For instance, the next command will install the same package from thedev
branch:pnpm add github:user/repo#dev&path:packages/bar
. -
node-gyp
updated to version 10. -
PowerShell completion support added #7597.
-
Support
node-options
option inside.npmrc
file when running scripts #7596. -
Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported:
<registryURL>:certfile
,<registryURL>:keyfile
, and<registryURL>:ca
. For instance://registry.mycomp.com/:certfile=server-cert.pem //registry.mycomp.com/:keyfile=server-key.pem //registry.mycomp.com/:cafile=client-cert.pem
-
Add a field named
ignoredOptionalDependencies
. This is an array of strings. If an optional dependency has its name included in this array, it will be skipped #7714. -
The checksum of the
.pnpmfile.cjs
is saved into the lockfile. If the pnpmfile gets modified, the lockfile is reanalyzed to apply the changes #7662. -
Added cache for
pnpm dlx
#5277.
Patch Changes
- Package tarballs are not downloaded during
--lockfile-only
installation #1328. - Peer dependency rules should only affect reporting, not data in the lockfile #7758.
- Link overrides should be able to use absolute path #7749.
pnpm dlx
should not read settings from the current working directory #7916.
Platinum Sponsors
Gold Sponsors
|
|
|
|
|
|
Our Silver Sponsors
|
|
|
v8.15.7
Patch Changes
pnpm config get
prints a comma-separated list for an array value instead of nothing.- It should be possible to publish a tarball with custom dist-tag #7845.
- Print the list of packages that were not built because they are ignored by configuration settings.
Platinum Sponsors
Gold Sponsors
|
|
|
|
|
|
Our Silver Sponsors
|
|
|
|
|
|
|
v9.0.0-rc.0
Installation instructions: https://pnpm.io/9.x/installation
Major Changes
-
Node.js v16 support dropped. Use at least Node.js v18.12.
-
Lockfile version bumped to v9.
-
Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 #7470.
-
The
dedupe-injected-deps
setting istrue
by default. -
The default value of the
link-workspace-packages
setting changed fromtrue
tofalse
. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol. -
The default value of the hoist-workspace-packages is
true
. -
pnpm licenses list
prints license information of all versions of the same package in case different versions use different licenses. The format of thepnpm licenses list --json
output has been changed #7528. -
A new command added for printing completion code to the console:
pnpm completion [shell]
. The old command that modified the user's shell dotfiles has been removed #3083. -
pnpm will now check the
package.json
file for apackageManager
field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires. -
enable-pre-post-scripts
is set totrue
by default. This means that when you run a script likestart
,prestart
andpoststart
will also run. -
When installing git-hosted dependencies, only pick the files that would be packed with the package #7638.
-
Use the same directory for state files on macOS as on Linux (
~/.local/state/pnpm
). -
Peer dependencies of peer dependencies are now resolved correctly. When peer dependencies have peer dependencies of their own, the peer dependencies are grouped with their own peer dependencies before being linked to their dependents.
For instance, if
card
hasreact
in peer dependencies andreact
hastypescript
in its peer dependencies, then the same version ofreact
may be linked from different places if there are multiple versions oftypescript
. For instance:project1/package.json { "dependencies": { "card": "1.0.0", "react": "16.8.0", "typescript": "7.0.0" } } project2/package.json { "dependencies": { "card": "1.0.0", "react": "16.8.0", "typescript": "8.0.0" } } node_modules .pnpm card@1.0.0(react@16.8.0(typescript@7.0.0)) node_modules card react --> ../../react@16.8.0(typescript@7.0.0)/node_modules/react react@16.8.0(typescript@7.0.0) node_modules react typescript --> ../../typescript@7.0.0/node_modules/typescript typescript@7.0.0 node_modules typescript card@1.0.0(react@16.8.0(typescript@8.0.0)) node_modules card react --> ../../react@16.8.0(typescript@8.0.0)/node_modules/react react@16.8.0(typescript@8.0.0) node_modules react typescript --> ../../typescript@8.0.0/node_modules/typescript typescript@8.0.0 node_modules typescript
In the above example, both projects have
card
in dependencies but the projects use different versions oftypescript
. Hence, even though the same version ofcard
is used,card
inproject1
will referencereact
from a directory where it is placed withtypescript@7.0.0
(because it resolvestypescript
from the dependencies ofproject1
), whilecard
inproject2
will referencereact
withtypescript@8.0.0
.Related issue: #7444.
Related PR: #7606.
-
Optional peer dependencies may be resolved from any packages in the dependency graph #7830.
Minor Changes
-
It is now possible to install only a subdirectory from a Git repository.
For example,
pnpm add github:user/repo#path:packages/foo
will add a dependency from thepackages/foo
subdirectory.This new parameter may be combined with other supported parameters separated by
&
. For instance, the next command will install the same package from thedev
branch:pnpm add github:user/repo#dev&path:packages/bar
. -
node-gyp
updated to version 10. -
PowerShell completion support added #7597.
-
Support
node-options
option inside.npmrc
file when running scripts #7596. -
Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported:
<registryURL>:certfile
,<registryURL>:keyfile
, and<registryURL>:ca
. For instance://registry.mycomp.com/:certfile=server-cert.pem //registry.mycomp.com/:keyfile=server-key.pem //registry.mycomp.com/:cafile=client-cert.pem
-
Add a field named
ignoredOptionalDependencies
. This is an array of strings. If an optional dependency has its name included in this array, it will be skipped #7714. -
The checksum of the
.pnpmfile.cjs
is saved into the lockfile. If the pnpmfile gets modified, the lockfile is reanalyzed to apply the changes #7662. -
Added cache for
pnpm dlx
#5277.
Patch Changes
- Package tarballs are not downloaded during
--lockfile-only
installation #1328. - Peer dependency rules should only affect reporting, not data in the lockfile #7758.
- Link overrides should be able to use absolute path #7749.
Platinum Sponsors
Gold Sponsors
|
|
|
|
|