---
name: pnpm
slug: pnpm
category: developer-tools
sources: 1
total_releases: 56
releases_last_30d: 13
avg_releases_per_week: 1.9
last_updated: 2026-10-07
tracking_since: 2025-09-12
canonical: https://releases.sh/pnpm
overview_url: https://releases.sh/pnpm/overview.md
accounts:
  github: "pnpm"
  x: "pnpmjs"
  youtube: "@pnpmjs"
---

## Overview

Read-only store installs landed in `11.7`, letting `pnpm install` run against a Nix store, OCI image layer, or bind mount.

**Supply-chain hardening deepened across the 11.x cycle.** Tarball-integrity mismatches became a hard install failure in `11.4`, closing a silent hole where a compromised registry could substitute attacker-controlled content even with a committed lockfile. `pnpm audit signatures` (`11.1`) verifies ECDSA registry signatures against published keys. A separate security fix in `11.5.3` stopped expanding `${ENV_VAR}` placeholders in repository-controlled `.npmrc` files — previously, a malicious cloned repo could exfiltrate secrets from the local environment before any lifecycle script ran.

**Auth and credential handling grew more flexible.** `11.6` added file-free registry auth via `npm_config_//…` and `pnpm_config_//…` environment variables, eliminating the need for a `.npmrc` file in CI. `11.7` added scope-specific auth tokens. Named registries with a built-in `gh:` alias for GitHub Packages landed in `11.1`.

**Publishing workflow expanded.** `11.3` added `pnpm stage`, bringing npm's staged-publishing workflow to pnpm. `11.7` added `--batch` to publish an entire workspace in one registry request. Native `pnpm pkg`, `pnpm repo`, and `pnpm set-script` commands replaced npm CLI delegation.

**Install behavior and the Rust backend improved.** `11.5` added `hoistingLimits` for controlling hoist depth in `nodeLinker: hoisted` installs. `11.6` raised default network concurrency and skips full re-resolution when only the lockfile is missing. `11.2` introduced pacquet (the Rust port) as an opt-in install backend; `11.7` extended it to handle full resolving installs.

**Version 11 raised the baseline.** Node.js 22 is required; pnpm ships as pure ESM. The store index moved from JSON files to SQLite. Global installs got isolated directories with their own lockfiles.

<Source name="pnpm" slug="pnpm" type="feed" releases="56" latest-version="12.10.1" latest-date="2026-10-06T00:00:00.000Z" url="https://releases.sh/pnpm/pnpm" />

## Recent Releases

_Summaries below — fetch the release's `canonical` URL for full content, or `url` for the original source._

<Release source="pnpm" version="11.28.5" date="October 6, 2026" published="2026-10-06T00:00:00.000Z" url="https://pnpm.io/blog/releases/11.28.5" canonical="https://releases.sh/release/rel_wpUAyMsvif2t4nzZmZY5G" truncated="true">
### pnpm 11.28.5

This release reads cached registry metadata faster and makes `pnpm config get --global` ignore project settings. It also carries several security fixe...
</Release>

<Release source="pnpm" version="12.10.0" date="October 6, 2026" published="2026-10-06T00:00:00.000Z" url="https://pnpm.io/blog/releases/12.10.0" canonical="https://releases.sh/release/rel_HbZIc7kez9YZmrapsfX-5" truncated="true">
### pnpm 12.10.0

This release adds an experimental `loaded` node linker, lets `pnpm-lock.yaml` record resolution settings, and reads cached registry metadata faster. I...
</Release>

<Release source="pnpm" version="12.10.1" date="October 6, 2026" published="2026-10-06T00:00:00.000Z" url="https://pnpm.io/blog/releases/12.10.1" canonical="https://releases.sh/release/rel_5FfLO2VRZqfCgt70nngCC" truncated="true">
### pnpm 12.10.1

This release fixes `pnpm install` failures after an `overrides` change and on a filtered frozen install with `catalogPrune`. It also fixes several bug...
</Release>

<Release source="pnpm" version="11.28.4" date="October 3, 2026" published="2026-10-03T00:00:00.000Z" url="https://pnpm.io/blog/releases/11.28.4" canonical="https://releases.sh/release/rel_awWhuOKlyACpfhjbySdam" truncated="true">
### pnpm 11.28.4

pnpm 11.28.4 fixes two ways credentials could leak, makes `pnpm install --frozen-lockfile` accept several lockfiles it rejected, warns when an optiona...
</Release>

<Release source="pnpm" version="12.9.1" date="October 3, 2026" published="2026-10-03T00:00:00.000Z" url="https://pnpm.io/blog/releases/12.9.1" canonical="https://releases.sh/release/rel_Wv22uOW10rUJyTo29KeOI" truncated="true">
### pnpm 12.9.1

This release moves the WebContainer build into a separate `@pnpm/wasm` package, shrinks the `pnpm` package back to about 4 MB, and fixes `pnpm publish...
</Release>

<Release source="pnpm" version="12.9.0" date="October 2, 2026" published="2026-10-02T00:00:00.000Z" url="https://pnpm.io/blog/releases/12.9.0" canonical="https://releases.sh/release/rel_jfWio0V6c2olM7MC35UR9" truncated="true">
### pnpm 12.9.0

This release runs pnpm in StackBlitz WebContainers, adds a per-registry `networkConcurrency` setting, and records every installed project in the store...
</Release>

<Release source="pnpm" version="12.8.2" date="September 30, 2026" published="2026-09-30T00:00:00.000Z" url="https://pnpm.io/blog/releases/12.8.2" canonical="https://releases.sh/release/rel_dnzuTPeX2ih3H-56nGGk9" truncated="true">
### pnpm 12.8.2

pnpm 12.8.2 fixes a startup crash on Linux ppc64le and `UnknownIssuer` errors on systems without CA certificates. `pnpm run` no longer installs before...
</Release>

<Release source="pnpm" version="12.8" date="September 28, 2026" published="2026-09-28T00:00:00.000Z" url="https://pnpm.io/blog/releases/12.8" canonical="https://releases.sh/release/rel_tJ0dDBj_tW6JHLQ0fhD86" truncated="true">
### pnpm 12.8

pnpm 12.8 warns when `pnpm pack` or `pnpm publish` would ship a `.env` file, installs `sharedWorkspaceLockfile: false` workspaces concurrently, applie...
</Release>

<Release source="pnpm" version="11.28" date="September 25, 2026" published="2026-09-25T00:00:00.000Z" url="https://pnpm.io/blog/releases/11.28" canonical="https://releases.sh/release/rel_uIwEOa9M7Ez9dJKI02q3D" truncated="true">
### pnpm 11.28

pnpm 11.28 adds the `forceIgnoresPlatform` setting and `pnpm update --peer`, and brings a large batch of fixes from pnpm 12 to the JavaScript CLI: `pn...
</Release>

<Release source="pnpm" version="12.7" date="September 25, 2026" published="2026-09-25T00:00:00.000Z" url="https://pnpm.io/blog/releases/12.7" canonical="https://releases.sh/release/rel_hMdl7RA428vbYn7aQFhYm" truncated="true">
### pnpm 12.7

pnpm 12.7 lets the global `node` shim follow `.nvmrc` and `.node-version`, adds `pnpm install --allow-build` and `pnpm publish --publish-wait-timeout`...
</Release>

## Fetching more

Append `.md` (markdown), `.json` (raw data), or `.atom` (feed) to any URL on this page.

- Per-source history: `https://releases.sh/pnpm/{source-slug}`
- Atom feed: `https://releases.sh/pnpm.atom`
- Individual release: `https://releases.sh/release/{release-id}`