v12.16.0
This release adds a global --env-file flag, updates to a symlinked pnpm-lock.yaml, and pnpm setup --no-modify-path. It also fixes two security issues, in zstd decompression and in signing.
pnpm
Developer Tools
$
npx @buildinternet/releases get pnpmRecently Shipped9 releases · updated Jun 16, 2026
Read-only store installs landed in 11.7, letting pnpm install run against a Nix store, OCI image layer, or bind mount.
Supply-chain hardening deepened across the 11.x cycle. Tarball-integrity mismatches became a hard install failure in 11.4, closing a silent hole where a compromised registry could substitute attacker-controlled content even with a committed lockfile. pnpm audit signatures (11.1) verifies ECDSA registry signatures against published keys. A separate security fix in 11.5.3 stopped expanding ${ENV_VAR} placeholders in repository-controlled .npmrc files — previously, a malicious cloned repo could exfiltrate secrets from the local environment before any lifecycle script ran.
Auth and credential handling grew more flexible. 11.6 added file-free registry auth via npm_config_//… and pnpm_config_//… environment variables, eliminating the need for a .npmrc file in CI. 11.7 added scope-specific auth tokens. Named registries with a built-in gh: alias for GitHub Packages landed in 11.1.
Publishing workflow expanded. 11.3 added pnpm stage, bringing npm's staged-publishing workflow to pnpm. 11.7 added --batch to publish an entire workspace in one registry request. Native pnpm pkg, pnpm repo, and pnpm set-script commands replaced npm CLI delegation.
Install behavior and the Rust backend improved. 11.5 added hoistingLimits for controlling hoist depth in nodeLinker: hoisted installs. 11.6 raised default network concurrency and skips full re-resolution when only the lockfile is missing. 11.2 introduced pacquet (the Rust port) as an opt-in install backend; 11.7 extended it to handle full resolving installs.
Version 11 raised the baseline. Node.js 22 is required; pnpm ships as pure ESM. The store index moved from JSON files to SQLite. Global installs got isolated directories with their own lockfiles.
v12.16.1
This release fixes pnpm install hanging on a cold store in workspaces that install Cargo crates, and pnpm pack shipping a file that files excludes by name.
v11.28.9
This release fixes a crash on registry responses with too many content encodings (GHSA-xjj6-f33q-929c) and sizes the install worker pool by the container's CPU quota. A repeat pnpm install now acts on more setting changes.
v12.15.0
This release lets pnpm-workspace.yaml delegate settings to other files and config dependencies with include, adds lockfile.integrityTarget: tar and tar-registry support, accepts zstd-compressed registry responses, and honors SOURCE_DATE_EPOCH in pnpm deploy and `pnpm…
v12.14.0
This release adds the sideEffectsCache.exclude setting, stops pnpm install from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.
v11.28.6
This release stops pnpm publish from sending a CI identity token to a registry it was not issued for. It also fixes installs that dropped a dependency also declared as an optional peer, and accepts empty httpProxy and httpsProxy settings again.
v12.13.0
This release adds the pnpm profile and pnpm token commands, the storeIndexFormat: files setting for stores shared over a network filesystem, and faster Python dependency resolution.
v12.12.1
This release adds OIDC authentication to pnpm dist-tag and the tool: protocol. pnpm publish now checks which registry an NPM_ID_TOKEN was issued for before using it.
v12.12.0
This release shares task results and dependency builds through a remote cache, adds the addMissingPeerTypes setting, and lets pnpm add --config and pnpm update manage configuration dependencies. It also fixes dangerouslyAllowAllBuilds running the build scripts of…
v12.11.1
This release fixes two ways pnpm install could fail, runs tools of any Rust release through pnx, and treats registry.npmjs.com as an alias of the npm registry.
v12.11.0
This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the permissions setting, and keeps the colors of streamed script output.
v12.11.2
This release fixes --workspace-concurrency=Infinity, filters set by an updateConfig hook, and store fetches with enable-modules-dir=false.
v11.28.5
This release reads cached registry metadata faster and makes pnpm config get --global ignore project settings. It also carries several security fixes for package archives, git dependencies, and config dependencies.
v12.10.0
This release adds an experimental loaded node linker, lets pnpm-lock.yaml record resolution settings, and reads cached registry metadata faster. It also carries several security fixes, including one that stops a dependency version from writing files outside the global…
v12.10.1
This release fixes pnpm install failures after an overrides change and on a filtered frozen install with catalogPrune. It also fixes several bugs in the experimental nodeLinker.type: loaded, which now keeps its generated files in node_modules.
v11.28.4
pnpm 11.28.4 fixes two ways credentials could leak, makes pnpm install --frozen-lockfile accept several lockfiles it rejected, warns when an optional dependency cannot be fetched, and stops pnpm self-update from installing a second pnpm next to a Homebrew one.
v12.9.1
This release moves the WebContainer build into a separate @pnpm/wasm package, shrinks the pnpm package back to about 4 MB, and fixes pnpm publish with provenance from GitLab CI.
v12.9.0
This release runs pnpm in StackBlitz WebContainers, adds a per-registry networkConcurrency setting, and records every installed project in the store. It also carries a security fix for pnpm login.
v12.8.2
pnpm 12.8.2 fixes a startup crash on Linux ppc64le and UnknownIssuer errors on systems without CA certificates. pnpm run no longer installs before every script on CI when autoDedupe is enabled, and resolution and hoisted installs on macOS are faster.