v8.15.5

Patch Changes

• Correctly detect the active Node.js version during headless installation #7801.
• The npm CLI executed from pnpm should not use Corepack #7747.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v9.0.0-alpha.7

Major Changes

• Node.js v16 support dropped. Use at least Node.js v18.12.

• Lockfile version bumped to v7.

• Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 #7470.

• The dedupe-injected-deps setting is true by default.

• The default value of the link-workspace-packages setting changed from true to false. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol.

• Use the same directories on macOS as on Linux. Don't use directories inside ~/Library on macOS #7321.

• The default value of the hoist-workspace-packages is true.

• pnpm licenses list prints license information of all versions of the same package in case different versions use different licenses. The format of the pnpm licenses list --json output has been changed #7528.

• A new command added for printing completion code to the console: pnpm completion [shell]. The old command that modified the user's shell dotfiles has been removed #3083.

• pnpm will now check the package.json file for a packageManager field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.

• enable-pre-post-scripts is set to true by default. This means that when you run a script like start, prestart and poststart will also run.

• When installing git-hosted dependencies, only pick the files that would be packed with the package #7638.

• Use the same directories on macOS as on Linux. Don't use directories inside ~/Library on macOS #7321.

• Peer dependencies of peer dependencies are now resolved correctly. When peer dependencies have peer dependencies of their own, the peer dependencies are grouped with their own peer dependencies before being linked to their dependents.

  For instance, if card has react in peer dependencies and react has typescript in its peer dependencies, then the same version of react may be linked from different places if there are multiple versions of typescript. For instance:

  project1/package.json
  {
    "dependencies": {
      "card": "1.0.0",
      "react": "16.8.0",
      "typescript": "7.0.0"
    }
  }
  project2/package.json
  {
    "dependencies": {
      "card": "1.0.0",
      "react": "16.8.0",
      "typescript": "8.0.0"
    }
  }
  node_modules
    .pnpm
      card@1.0.0(react@16.8.0(typescript@7.0.0))
        node_modules
          card
          react --> ../../react@16.8.0(typescript@7.0.0)/node_modules/react
      react@16.8.0(typescript@7.0.0)
        node_modules
          react
          typescript --> ../../typescript@7.0.0/node_modules/typescript
      typescript@7.0.0
        node_modules
          typescript
      card@1.0.0(react@16.8.0(typescript@8.0.0))
        node_modules
          card
          react --> ../../react@16.8.0(typescript@8.0.0)/node_modules/react
      react@16.8.0(typescript@8.0.0)
        node_modules
          react
          typescript --> ../../typescript@8.0.0/node_modules/typescript
      typescript@8.0.0
        node_modules
          typescript
  

  In the above example, both projects have card in dependencies but the projects use different versions of typescript. Hence, even though the same version of card is used, card in project1 will reference react from a directory where it is placed with typescript@7.0.0 (because it resolves typescript from the dependencies of project1), while card in project2 will reference react with typescript@8.0.0.

  Related issue: #7444.

  Related PR: #7606.

Minor Changes

• It is now possible to install only a subdirectory from a Git repository.

  For example, pnpm add github:user/repo#path:packages/foo will add a dependency from the packages/foo subdirectory.

  This new parameter may be combined with other supported parameters separated by &. For instance, the next command will install the same package from the dev branch: pnpm add github:user/repo#dev&path:packages/bar.

  Related issue: #4765.
  Related PR: #7487.

• node-gyp updated to version 10.

• PowerShell completion support added #7597.

• Support node-options option inside .npmrc file when running scripts #7596.

• Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported: <registryURL>:certfile, <registryURL>:keyfile, and <registryURL>:ca. For instance:

  //registry.mycomp.com/:certfile=server-cert.pem
  //registry.mycomp.com/:keyfile=server-key.pem
  //registry.mycomp.com/:cafile=client-cert.pem
  

  Related issue: #7427.
  Related PR: #7626.

• Add a field named ignoredOptionalDependencies. This is an array of strings. If an optional dependency has its name included in this array, it will be skipped #7714.

• The checksum of the .pnpmfile.cjs is saved into the lockfile. If the pnpmfile gets modified, the lockfile is reanalyzed to apply the changes #7662.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v8.15.4

Patch Changes

• Print the right error code when a package fails to be added to the store #7679.
• Don't fail on a tarball that appears to be not a USTAR or GNU TAR archive. Still try to unpack the tarball #7120.
• Always add a name and version field to the index files in the store #7115.
• Deleting a dependencies field via a readPackage hook should work #7704.
• Symlinks should be resolved and uploaded to the side-effects cache #7691.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v9.0.0-alpha.5

Major Changes

• Node.js v16 support dropped. Use at least Node.js v18.12.

• Lockfile version bumped to v7.

• Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 #7470.

• The dedupe-injected-deps setting is true by default.

• The default value of the link-workspace-packages setting changed from true to false. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol.

• Use the same directories on macOS as on Linux. Don't use directories inside ~/Library on macOS #7321.

• The default value of the hoist-workspace-packages is true.

• pnpm licenses list prints license information of all versions of the same package in case different versions use different licenses. The format of the pnpm licenses list --json output has been changed #7528.

• A new command added for printing completion code to the console: pnpm completion [shell]. The old command that modified the user's shell dotfiles has been removed #3083.

• pnpm will now check the package.json file for a packageManager field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.

• enable-pre-post-scripts is set to true by default. This means that when you run a script like start, prestart and poststart will also run.

• When installing git-hosted dependencies, only pick the files that would be packed with the package #7638.

• Use the same directories on macOS as on Linux. Don't use directories inside ~/Library on macOS #7321.

• Peer dependencies of peer dependencies are now resolved correctly. When peer dependencies have peer dependencies of their own, the peer dependencies are grouped with their own peer dependencies before being linked to their dependents.

  For instance, if card has react in peer dependencies and react has typescript in its peer dependencies, then the same version of react may be linked from different places if there are multiple versions of typescript. For instance:

  project1/package.json
  {
    "dependencies": {
      "card": "1.0.0",
      "react": "16.8.0",
      "typescript": "7.0.0"
    }
  }
  project2/package.json
  {
    "dependencies": {
      "card": "1.0.0",
      "react": "16.8.0",
      "typescript": "8.0.0"
    }
  }
  node_modules
    .pnpm
      card@1.0.0(react@16.8.0(typescript@7.0.0))
        node_modules
          card
          react --> ../../react@16.8.0(typescript@7.0.0)/node_modules/react
      react@16.8.0(typescript@7.0.0)
        node_modules
          react
          typescript --> ../../typescript@7.0.0/node_modules/typescript
      typescript@7.0.0
        node_modules
          typescript
      card@1.0.0(react@16.8.0(typescript@8.0.0))
        node_modules
          card
          react --> ../../react@16.8.0(typescript@8.0.0)/node_modules/react
      react@16.8.0(typescript@8.0.0)
        node_modules
          react
          typescript --> ../../typescript@8.0.0/node_modules/typescript
      typescript@8.0.0
        node_modules
          typescript
  

  In the above example, both projects have card in dependencies but the projects use different versions of typescript. Hence, even though the same version of card is used, card in project1 will reference react from a directory where it is placed with typescript@7.0.0 (because it resolves typescript from the dependencies of project1), while card in project2 will reference react with typescript@8.0.0.

  Related issue: #7444.

  Related PR: #7606.

Minor Changes

• It is now possible to install only a subdirectory from a Git repository.

  For example, pnpm add github:user/repo#path:packages/foo will add a dependency from the packages/foo subdirectory.

  This new parameter may be combined with other supported parameters separated by &. For instance, the next command will install the same package from the dev branch: pnpm add github:user/repo#dev&path:packages/bar.

  Related issue: #4765.
  Related PR: #7487.

• node-gyp updated to version 10.

• PowerShell completion support added #7597.

• Support node-options option inside .npmrc file when running scripts #7596.

• Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported: <registryURL>:certfile, <registryURL>:keyfile, and <registryURL>:ca. For instance:

  //registry.mycomp.com/:certfile=server-cert.pem
  //registry.mycomp.com/:keyfile=server-key.pem
  //registry.mycomp.com/:cafile=client-cert.pem
  

  Related issue: #7427.
  Related PR: #7626.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

...

v8.15.3

Patch Changes

• Remove vulnerable "ip" package from the dependencies #7652.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v7.33.7

Patch Changes

• Remove vulnerable "ip" package from the dependencies #7652.

v8.15.2

Patch Changes

• When purging multiple node_modules directories, pnpm will no longer print multiple prompts simultaneously.
• Don't print an unnecessary warning when adding new dependencies to a project that uses hoisted node_modules.
• Linking globally the command of a package that has no name in package.json #4761.
• Installation should work with lockfile created by pnpm v9.0.0-alpha.4

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v9.0.0-alpha.4

Major Changes

• Node.js v16 support dropped. Use at least Node.js v18.12.

• Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 #7470.

• The dedupe-injected-deps setting is true by default.

• The default value of the link-workspace-packages setting changed from true to false. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol.

• Use the same directories on macOS as on Linux. Don't use directories inside ~/Library on macOS #7321.

• The default value of the hoist-workspace-packages is true.

• pnpm licenses list prints license information of all versions of the same package in case different versions use different licenses. The format of the pnpm licenses list --json output has been changed #7528.

• A new command added for printing completion code to the console: pnpm completion [shell]. The old command that modified the user's shell dotfiles has been removed #3083.

• Use the same directories on macOS as on Linux. Don't use directories inside ~/Library on macOS #7321.

• Peer dependencies of peer dependencies are now resolved correctly. When peer dependencies have peer dependencies of their own, the peer dependencies are grouped with their own peer dependencies before being linked to their dependents.

  For instance, if card has react in peer dependencies and react has typescript in its peer dependencies, then the same version of react may be linked from different places if there are multiple versions of typescript. For instance:

  project1/package.json
  {
    "dependencies": {
      "card": "1.0.0",
      "react": "16.8.0",
      "typescript": "7.0.0"
    }
  }
  project2/package.json
  {
    "dependencies": {
      "card": "1.0.0",
      "react": "16.8.0",
      "typescript": "8.0.0"
    }
  }
  node_modules
    .pnpm
      card@1.0.0(react@16.8.0(typescript@7.0.0))
        node_modules
          card
          react --> ../../react@16.8.0(typescript@7.0.0)/node_modules/react
      react@16.8.0(typescript@7.0.0)
        node_modules
          react
          typescript --> ../../typescript@7.0.0/node_modules/typescript
      typescript@7.0.0
        node_modules
          typescript
      card@1.0.0(react@16.8.0(typescript@8.0.0))
        node_modules
          card
          react --> ../../react@16.8.0(typescript@8.0.0)/node_modules/react
      react@16.8.0(typescript@8.0.0)
        node_modules
          react
          typescript --> ../../typescript@8.0.0/node_modules/typescript
      typescript@8.0.0
        node_modules
          typescript
  

  In the above example, both projects have card in dependencies but the projects use different versions of typescript. Hence, even though the same version of card is used, card in project1 will reference react from a directory where it is placed with typescript@7.0.0 (because it resolves typescript from the dependencies of project1), while card in project2 will reference react with typescript@8.0.0.

  Related issue: #7444.

  Related PR: #7606.

Minor Changes

• It is now possible to install only a subdirectory from a Git repository.

  For example, pnpm add github:user/repo#path:packages/foo will add a dependency from the packages/foo subdirectory.

  This new parameter may be combined with other supported parameters separated by &. For instance, the next command will install the same package from the dev branch: pnpm add github:user/repo#dev&path:packages/bar.

  Related issue: #4765.
  Related PR: #7487.

• node-gyp updated to version 10.

• PowerShell completion support added #7597.

• Support node-options option inside .npmrc file when running scripts #7596

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v8.15.1

Patch Changes

• Use the object-hash library instead of node-object-hash for hashing keys of side-effects cache #7591.
• bundledDependencies should never be added to the lockfile with false as the value #7576.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v8.15.0

Upgrade to v8.15.1 or newer

Minor Changes

• When the license field does not exist in package.json but a license file exists, try to match and extract the license name #7530.

Patch Changes

• Running pnpm update -r --latest will no longer downgrade prerelease dependencies #7436.
• --aggregate-output should work on scripts executed from the same project #7556.
• Prefer hard links over reflinks on Windows as they perform better #7564.
• Reduce the length of the side-effects cache key. Instead of saving a stringified object composed from the dependency versions of the package, use the hash calculated from the said object #7563.
• Throw an error if pnpm update --latest runs with arguments containing versions specs. For instance, pnpm update --latest foo@next is not allowed #7567.
• Don't fail in Windows CoW if the file already exists #7554.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors