{"id":"org_y6zPiEKVC6kpDZVPQLa5Z","slug":"pnpm","name":"pnpm","domain":null,"description":null,"category":"developer-tools","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","isHidden":false,"autoGenerateContent":false,"overviewCadenceDays":null,"featured":false,"fetchPaused":false,"discovery":"curated","status":"tracked","tags":[],"sourceCount":1,"releaseCount":56,"releasesLast30Days":13,"avgReleasesPerWeek":1.9,"lastFetchedAt":"2026-10-07T01:23:51.137Z","lastPolledAt":"2026-10-07T01:23:50.555Z","trackingSince":"2025-09-12T00:00:00.000Z","aliases":[],"accounts":[{"platform":"github","handle":"pnpm"},{"platform":"x","handle":"pnpmjs"},{"platform":"youtube","handle":"@pnpmjs"}],"products":[],"sources":[{"id":"src_-Ild8_qYfyhealuypXqIU","slug":"pnpm","name":"pnpm","type":"feed","url":"https://pnpm.io/blog","isPrimary":false,"isHidden":false,"discovery":"curated","fetchPriority":"normal","lastFetchedAt":"2026-10-07T01:23:51.137Z","lastPolledAt":"2026-10-07T01:23:50.555Z","releaseCount":56,"latestVersion":"12.10.1","latestDate":"2026-10-06T00:00:00.000Z","latestAddedAt":"2026-10-06T21:19:21.507Z","productSlug":null,"productName":null,"kind":"tool","metadata":"{\"feedUrl\":\"https://pnpm.io/blog/rss.xml\",\"feedType\":\"unknown\",\"feedDiscoveredAt\":\"2026-05-02T14:36:24.460Z\",\"noFeedFound\":false,\"feedEtag\":\"W/\\\"b29650bafd408359f046845cf5ac6328\\\"\",\"feedLastModified\":\"Tue, 06 Oct 2026 22:26:30 GMT\",\"sourceActor\":{\"nextAlarmAt\":\"2026-10-07T05:19:20.819Z\",\"lastAlarmAt\":\"2026-10-07T01:19:22.217Z\",\"managed\":true}}"}],"overview":{"scope":"org","content":"Read-only store installs landed in `11.7`, letting `pnpm install` run against a Nix store, OCI image layer, or bind mount.\n\n**Supply-chain hardening deepened across the 11.x cycle.** Tarball-integrity mismatches became a hard install failure in `11.4`, closing a silent hole where a compromised registry could substitute attacker-controlled content even with a committed lockfile. `pnpm audit signatures` (`11.1`) verifies ECDSA registry signatures against published keys. A separate security fix in `11.5.3` stopped expanding `${ENV_VAR}` placeholders in repository-controlled `.npmrc` files — previously, a malicious cloned repo could exfiltrate secrets from the local environment before any lifecycle script ran.\n\n**Auth and credential handling grew more flexible.** `11.6` added file-free registry auth via `npm_config_//…` and `pnpm_config_//…` environment variables, eliminating the need for a `.npmrc` file in CI. `11.7` added scope-specific auth tokens. Named registries with a built-in `gh:` alias for GitHub Packages landed in `11.1`.\n\n**Publishing workflow expanded.** `11.3` added `pnpm stage`, bringing npm's staged-publishing workflow to pnpm. `11.7` added `--batch` to publish an entire workspace in one registry request. Native `pnpm pkg`, `pnpm repo`, and `pnpm set-script` commands replaced npm CLI delegation.\n\n**Install behavior and the Rust backend improved.** `11.5` added `hoistingLimits` for controlling hoist depth in `nodeLinker: hoisted` installs. `11.6` raised default network concurrency and skips full re-resolution when only the lockfile is missing. `11.2` introduced pacquet (the Rust port) as an opt-in install backend; `11.7` extended it to handle full resolving installs.\n\n**Version 11 raised the baseline.** Node.js 22 is required; pnpm ships as pure ESM. The store index moved from JSON files to SQLite. Global installs got isolated directories with their own lockfiles.","releaseCount":9,"lastContributingReleaseAt":"2026-06-15T00:00:00.000Z","generatedAt":"2026-05-11T14:36:28.397Z","updatedAt":"2026-06-16T12:42:55.712Z","citations":[{"sourceUrl":"https://pnpm.io/blog/releases/11.7","title":"pnpm 11.7","releaseId":"rel_BnVDo8ysHmnZXEvLhvjoZ","releaseWebUrl":"https://releases.sh/release/rel_BnVDo8ysHmnZXEvLhvjoZ-pnpm-11-7"},{"sourceUrl":"https://pnpm.io/blog/releases/11.4","title":"pnpm 11.4","releaseId":"rel_26KxE7YolLI3obpQM_p3r","releaseWebUrl":"https://releases.sh/release/rel_26KxE7YolLI3obpQM_p3r-pnpm-11-4"},{"sourceUrl":"https://pnpm.io/blog/2026/06/11/env-variables-in-repository-npmrc","title":"Why pnpm no longer expands environment variables in a repository's .npmrc","releaseId":"rel_4DXxB5YU98GhrzxBz7pOz","releaseWebUrl":"https://releases.sh/release/rel_4DXxB5YU98GhrzxBz7pOz-why-pnpm-no-longer-expands-environment-variables-in-a-repository-s-npmrc"},{"sourceUrl":"https://pnpm.io/blog/releases/11.6","title":"pnpm 11.6","releaseId":"rel_1Sv8i__nGjbUFzfbqLaRl","releaseWebUrl":"https://releases.sh/release/rel_1Sv8i__nGjbUFzfbqLaRl-pnpm-11-6"},{"sourceUrl":"https://pnpm.io/blog/releases/11.7","title":"pnpm 11.7","releaseId":"rel_BnVDo8ysHmnZXEvLhvjoZ","releaseWebUrl":"https://releases.sh/release/rel_BnVDo8ysHmnZXEvLhvjoZ-pnpm-11-7"},{"sourceUrl":"https://pnpm.io/blog/releases/11.3","title":"pnpm 11.3","releaseId":"rel_Rzh_lpMGHvawMVoiSTZyK","releaseWebUrl":"https://releases.sh/release/rel_Rzh_lpMGHvawMVoiSTZyK-pnpm-11-3"},{"sourceUrl":"https://pnpm.io/blog/releases/11.7","title":"pnpm 11.7","releaseId":"rel_BnVDo8ysHmnZXEvLhvjoZ","releaseWebUrl":"https://releases.sh/release/rel_BnVDo8ysHmnZXEvLhvjoZ-pnpm-11-7"},{"sourceUrl":"https://pnpm.io/blog/releases/11.5","title":"pnpm 11.5","releaseId":"rel_4y_Om89V_OgJnkB7ywZ3O","releaseWebUrl":"https://releases.sh/release/rel_4y_Om89V_OgJnkB7ywZ3O-pnpm-11-5"},{"sourceUrl":"https://pnpm.io/blog/releases/11.2","title":"pnpm 11.2","releaseId":"rel_E_0RR_Vt1gbZJ3mELySnG","releaseWebUrl":"https://releases.sh/release/rel_E_0RR_Vt1gbZJ3mELySnG-pnpm-11-2"},{"sourceUrl":"https://pnpm.io/blog/releases/11.0","title":"pnpm 11.0","releaseId":"rel_KootKv3hoCoz9qTv4DvKr","releaseWebUrl":"https://releases.sh/release/rel_KootKv3hoCoz9qTv4DvKr-pnpm-11-0"}]},"playbook":null,"notice":null}