Fast, disk space efficient package manager
script-shell
option is configured to a .bat
/.cmd
file on Windows, pnpm will now error with ERR_PNPM_INVALID_SCRIPT_SHELL_WINDOWS
. Newer versions of Node.js released in April 2024 do not support executing these files directly without behavior differences. If the script-shell
option is necessary for your use-case, please set a .exe
file instead.package-manager-strict
setting, when pnpm doesn't match the version specified in the packageManager
field in package.json
.pnpm completion
command should work in the standalone version of pnpm #7948.node_modules
#7943.pnpm install --frozen-lockfile
should work with lockfiles generated by pnpm v8, if they don't need updates #7934.Node.js v16 and 17 support discontinued
If you still require Node.js 16 or 17, don't worry. We ship pnpm bundled with Node.js. This means that regardless of which Node.js version you've installed, pnpm will operate using the necessary Node.js runtime. For this to work you need to install pnpm either using the standalone script or install the @pnpm/exe
package.
Corepack compatiblity:
pnpm will now check the package.json
file for a packageManager
field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.
NOTE: If you want to make this check less strict, set the package-manager-strict
setting to false
or the COREPACK_ENABLE_STRICT
env variable to 0
.
Configuration updates:
dedupe-injected-deps
: enabled by default.link-workspace-packages
: disabled by default. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol.hoist-workspace-packages
: enabled by default.enable-pre-post-scripts
: enabled by default.~/.local/state/pnpm
).Lockfile changes:
Dependency resolution changes:
pnpm licenses list
prints license information of all versions of the same package in case different versions use different licenses. The format of the pnpm licenses list --json
output has been changed #7528.
A new command added for printing completion code to the console: pnpm completion [shell]
. The old command that modified the user's shell dotfiles has been removed #3083.
When installing git-hosted dependencies, only pick the files that would be packed with the package #7638.
It is now possible to install only a subdirectory from a Git repository.
For example, pnpm add github:user/repo#path:packages/foo
will add a dependency from the packages/foo
subdirectory.
This new parameter may be combined with other supported parameters separated by &
. For instance, the next command will install the same package from the dev
branch: pnpm add github:user/repo#dev&path:packages/bar
.
node-gyp
updated to version 10.
PowerShell completion support added #7597.
Support node-options
option inside .npmrc
file when running scripts #7596.
Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported: <registryURL>:certfile
, <registryURL>:keyfile
, and <registryURL>:ca
. For instance:
//registry.mycomp.com/:certfile=server-cert.pem
//registry.mycomp.com/:keyfile=server-key.pem
//registry.mycomp.com/:cafile=client-cert.pem
Add a field named ignoredOptionalDependencies
. This is an array of strings. If an optional dependency has its name included in this array, it will be skipped #7714.
The checksum of the .pnpmfile.cjs
is saved into the lockfile. If the pnpmfile gets modified, the lockfile is reanalyzed to apply the changes #7662.
Added cache for pnpm dlx
#5277.
--lockfile-only
installation #1328.pnpm dlx
should not read settings from the current working directory #7916.Installation instructions: https://pnpm.io/9.x/installation
Node.js v16 support discontinued
If you still require Node.js 16, don't worry. We ship pnpm bundled with Node.js. This means that regardless of which Node.js version you've installed, pnpm will operate using the necessary Node.js runtime. For this to work you need to install pnpm either using the standalone script or install the @pnpm/exe
package.
Configuration updates:
dedupe-injected-deps
: enabled by default.link-workspace-packages
: disabled by default. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol.hoist-workspace-packages
: enabled by default.enable-pre-post-scripts
: enabled by default.~/.local/state/pnpm
).package.json
file for a packageManager
field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.Lockfile changes:
Dependency resolution changes:
pnpm licenses list
prints license information of all versions of the same package in case different versions use different licenses. The format of the pnpm licenses list --json
output has been changed #7528.
A new command added for printing completion code to the console: pnpm completion [shell]
. The old command that modified the user's shell dotfiles has been removed #3083.
When installing git-hosted dependencies, only pick the files that would be packed with the package #7638.
It is now possible to install only a subdirectory from a Git repository.
For example, pnpm add github:user/repo#path:packages/foo
will add a dependency from the packages/foo
subdirectory.
This new parameter may be combined with other supported parameters separated by &
. For instance, the next command will install the same package from the dev
branch: pnpm add github:user/repo#dev&path:packages/bar
.
node-gyp
updated to version 10.
PowerShell completion support added #7597.
Support node-options
option inside .npmrc
file when running scripts #7596.
Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported: <registryURL>:certfile
, <registryURL>:keyfile
, and <registryURL>:ca
. For instance:
//registry.mycomp.com/:certfile=server-cert.pem
//registry.mycomp.com/:keyfile=server-key.pem
//registry.mycomp.com/:cafile=client-cert.pem
Add a field named ignoredOptionalDependencies
. This is an array of strings. If an optional dependency has its name included in this array, it will be skipped #7714.
The checksum of the .pnpmfile.cjs
is saved into the lockfile. If the pnpmfile gets modified, the lockfile is reanalyzed to apply the changes #7662.
Added cache for pnpm dlx
#5277.
--lockfile-only
installation #1328.pnpm dlx
should not read settings from the current working directory #7916.pnpm config get
prints a comma-separated list for an array value instead of nothing.Installation instructions: https://pnpm.io/9.x/installation
Node.js v16 support dropped. Use at least Node.js v18.12.
Lockfile version bumped to v9.
Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 #7470.
The dedupe-injected-deps
setting is true
by default.
The default value of the link-workspace-packages
setting changed from true
to false
. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol.
The default value of the hoist-workspace-packages is true
.
pnpm licenses list
prints license information of all versions of the same package in case different versions use different licenses. The format of the pnpm licenses list --json
output has been changed #7528.
A new command added for printing completion code to the console: pnpm completion [shell]
. The old command that modified the user's shell dotfiles has been removed #3083.
pnpm will now check the package.json
file for a packageManager
field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.
enable-pre-post-scripts
is set to true
by default. This means that when you run a script like start
, prestart
and poststart
will also run.
When installing git-hosted dependencies, only pick the files that would be packed with the package #7638.
Use the same directory for state files on macOS as on Linux (~/.local/state/pnpm
).
Peer dependencies of peer dependencies are now resolved correctly. When peer dependencies have peer dependencies of their own, the peer dependencies are grouped with their own peer dependencies before being linked to their dependents.
For instance, if card
has react
in peer dependencies and react
has typescript
in its peer dependencies, then the same version of react
may be linked from different places if there are multiple versions of typescript
. For instance:
project1/package.json
{
"dependencies": {
"card": "1.0.0",
"react": "16.8.0",
"typescript": "7.0.0"
}
}
project2/package.json
{
"dependencies": {
"card": "1.0.0",
"react": "16.8.0",
"typescript": "8.0.0"
}
}
node_modules
.pnpm
[email protected]([email protected]([email protected]))
node_modules
card
react --> ../../[email protected]([email protected])/node_modules/react
[email protected]([email protected])
node_modules
react
typescript --> ../../[email protected]/node_modules/typescript
[email protected]
node_modules
typescript
[email protected]([email protected]([email protected]))
node_modules
card
react --> ../../[email protected]([email protected])/node_modules/react
[email protected]([email protected])
node_modules
react
typescript --> ../../[email protected]/node_modules/typescript
[email protected]
node_modules
typescript
In the above example, both projects have card
in dependencies but the projects use different versions of typescript
. Hence, even though the same version of card
is used, card
in project1
will reference react
from a directory where it is placed with [email protected]
(because it resolves typescript
from the dependencies of project1
), while card
in project2
will reference react
with [email protected]
.
Related issue: #7444.
Related PR: #7606.
Optional peer dependencies may be resolved from any packages in the dependency graph #7830.
It is now possible to install only a subdirectory from a Git repository.
For example, pnpm add github:user/repo#path:packages/foo
will add a dependency from the packages/foo
subdirectory.
This new parameter may be combined with other supported parameters separated by &
. For instance, the next command will install the same package from the dev
branch: pnpm add github:user/repo#dev&path:packages/bar
.
node-gyp
updated to version 10.
PowerShell completion support added #7597.
Support node-options
option inside .npmrc
file when running scripts #7596.
Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported: <registryURL>:certfile
, <registryURL>:keyfile
, and <registryURL>:ca
. For instance:
//registry.mycomp.com/:certfile=server-cert.pem
//registry.mycomp.com/:keyfile=server-key.pem
//registry.mycomp.com/:cafile=client-cert.pem
Add a field named ignoredOptionalDependencies
. This is an array of strings. If an optional dependency has its name included in this array, it will be skipped #7714.
The checksum of the .pnpmfile.cjs
is saved into the lockfile. If the pnpmfile gets modified, the lockfile is reanalyzed to apply the changes #7662.
Added cache for pnpm dlx
#5277.
--lockfile-only
installation #1328.