chore(deps): update pnpm to v11 #56
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: julien/apf_portal#56
Reference in New Issue
Block a user
Delete Branch "renovate/pnpm-11.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
10.33.4->11.0.8Release Notes
pnpm/pnpm (pnpm)
v11.0.8Compare Source
Patch Changes
pnpm-lock.yamlwhen they cannot be derived from name+version+registry, even with the defaultlockfileIncludeTarballUrl: false. Without this,pnpm install --frozen-lockfilefrom an empty store fails withERR_PNPM_FETCH_404for packages on registries that serve tarballs from a non-standard path — most notably GitHub Packages (https://npm.pkg.github.com/download/<scope>/<name>/<version>/<hash>) and JSR.lockfileIncludeTarballUrl: truecontinues to force the URL into the lockfile for every package #11276.preversion,version, andpostversionlifecycle scripts forpnpm version.ERR_PNPM_BAD_TARBALL_SIZEwhen a registry serves tarballs with an end-to-endContent-Encoding(e.g.gzip). Tarballs are already compressed, so the fetcher now requests them withAccept-Encoding: identity(matching pnpm v10's effective behavior) and, as defense in depth against misbehaving servers, no longer enforces the strictContent-Lengthcheck when the response declares aContent-Encoding—Content-Lengthin that case refers to the encoded payload, not the decoded bytes the fetch implementation yields #11506.v11.0.7Compare Source
Patch Changes
Restore the execute bit on the
node-gypshims packed inside@pnpm/exe(dist/node-gyp-bin/node-gyp,dist/node-gyp-bin/node-gyp.cmd, anddist/node_modules/node-gyp/bin/node-gyp.js). Without this,pnpm/action-setup's standalone path (used on runners with Node.js < 22.13) failed any install whose lifecycle script invokednode-gyp rebuildwithsh: 1: node-gyp: Permission denied#11483.Fixed the
pn,pnpx, andpnxaliases failing in Git Bash / MSYS2 on Windows when pnpm was installed via@pnpm/exe(or afterpnpm self-update) #11486. Runningpnpx(orpnx) printed the cmd.exe banner and dropped the user into an interactive command prompt instead of runningpnpm dlx. Thebinfield rewrite on Windows was pointing those aliases at.cmdfiles; cmd-shim's Bash shim for a.cmdtarget wraps it inexec cmd /C ..., and MSYS2 mangles/Cinto a Windows path before cmd.exe sees it. The aliases are now.exehardlinks of the SEA binary, which detects which name it was launched as viaprocess.execPathand prependsdlxforpnpx/pnx.Fix
pnpm installrecreatingnode_modulesafterpnpm fetch.pnpm fetchrecords emptyhoistPatternandpublicHoistPatternin.modules.yaml; since v11 removed the explicit-config gate, the follow-up install treated those as a hoist-pattern change and purged the modules directory. The fetch step now flags the modules manifest withvirtualStoreOnly: trueso the next install skips the hoist-pattern comparison and completes the missing post-import linking in place #11488.Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.
A new
gitHosted: truefield is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.Allow user-level preferences in the global
config.yaml. The following settings can now be set in~/.config/pnpm/config.yaml(or viapnpm config set --location global) instead of being restricted topnpm-workspace.yaml:agent,globalVirtualStoreDir,initPackageManager,initType,registrySupportsTimeField,scriptShell,shellEmulator,sideEffectsCache,sideEffectsCacheReadonly,stateDir,strictDepBuilds,trustPolicy,trustPolicyExclude,trustPolicyIgnoreAfter,updateNotifier,useStderr,verifyDepsBeforeRun,verifyStoreIntegrity,virtualStoreDir,virtualStoreDirMaxLength#11474.Make trusted publishing (OIDC) take precedence over a configured static
_authTokeninpnpm publish, mirroring the npm CLI's behavior. When OIDC succeeds, the OIDC-derived token overrides any pre-configured_authToken; when OIDC is not applicable (no CI environment, exchange fails, registry has no trusted publisher configured), the static token is used as a fallback. This applies on every package during recursive publish, so each workspace package independently attempts trusted publishing.Additionally, the
NPM_ID_TOKENenv var is now honored as a CI-agnostic injection point for an OIDC ID token. Previously OIDC was only attempted on GitHub Actions or GitLab; now any CI provider that exposes its own OIDC mechanism (e.g. CircleCI'sCIRCLE_OIDC_TOKEN_V2, Buildkite, etc.) can forward its token viaNPM_ID_TOKENand trusted publishing will work without pnpm needing to recognize the provider explicitly.--pm-on-fail=ignore(and other universal options like--loglevel,--reporter) is now honored when combined with--helpor--version. Previously the CLI argument parser short-circuited those flags before universal options were preserved, sopnpm audit --pm-on-fail=ignore --helpandpnpm --pm-on-fail=ignore --versionreported the strict packageManager mismatch instead of running the requested action #11487.Fix a regression where
pnpm --recursive --filter '!<pkg>' run/exec/test/addwould include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative--filterarguments are provided, matching the documented behavior. To include the root, pass--include-workspace-root#11341.Restore npm-CLI-compatible
--jsonstdout output forpnpm publish(#11476). pnpm 11 reimplemented publish natively (#10591) and inadvertently dropped the per-package JSON object that pnpm 10 emitted transitively via the npm CLI, silently breaking downstream tooling — most notablynx release publish, which parses stdout JSON to confirm success (nrwl/nx#35575). On success, the output is now:pnpm publish --json→ single object{ id, name, version, size, unpackedSize, shasum, integrity, filename, files, entryCount, bundled }, mirroringnpm publish --json.pnpm publish -r --json→ array of those objects, mirroringpnpm pack --json's shape choice.pnpm publish -r --report-summary→ existingpnpm-publish-summary.jsonenvelope{ publishedPackages: [...] }is preserved, but each entry is upgraded to the same per-package shape (additive —nameandversionare still present).pnpm config get @​<scope>:registrynow reports the same URL thatpnpm publishand the resolvers actually use. Previously,config getonly consulted.npmrc, whilepublish/install used the merged map that includespnpm-workspace.yaml'sregistriesblock — so the two could diverge silently and a publish could go to the wrong registry #11492.v11.0.6Compare Source
Patch Changes
pnpm_config_npmrc_auth_fileandpnpm_config_userconfigenv vars not actually loading the custom.npmrc. The env vars were parsed and assigned to the resolved config, but only afterloadNpmrcConfighad already read the default~/.npmrc— so the custom file path was set but never read. The relevant env vars are now consulted before the user-level.npmrcis loaded #11465.pnpm-workspace.yamlwhen updating it. Existing keys keep their position, and new keys are inserted in alphabetical position when the existing keys are already sorted (with a leadingpackageskey allowed) or appended at the end otherwise.pnpm self-updateon installations originally set up by pnpm v10. v10 addedPNPM_HOMEdirectly to PATH and wrote apnpmbootstrap shim there. v11 setup writes shims underPNPM_HOME/bininstead, so when a v10 user upgrades to v11 the legacy shim atPNPM_HOMEkeeps pointing into the old.tools/<version>install —pnpm --versioncontinues to report the pre-update version even though the new version was installed underglobal/v11. Self-update now detects this layout, refreshes the legacy shims so the upgrade actually takes effect, and prints a hint suggestingpnpm setupto migrate PATH to the v11 layout. #11464.nodeLinker,hoistPattern) are present inconfig.yamland silently ignored. Previously these settings were dropped without any feedback, leaving users unsure why their global configuration had no effect. The warning suggests moving those settings to a project-levelpnpm-workspace.yaml, or sharing them across projects via config dependencies.overrideshas an invalid shape or contains a non-string value.readPackagedependency map fields, includingdevDependencies, and reject falsy non-object invalid values instead of silently accepting them.pnpm config,pnpm set, andpnpm getby toleratingconfigDependenciesinstall failures. For these commands, a failure to installconfigDependencies(for example because the registry auth token has not been written yet) is now logged at debug level and the command proceeds. All other commands still surface the install error #10684.allowBuildsas an install-state input and clear previously ignored builds when they are explicitly disallowed.catalog:protocol with thepnpm dlx/pnpxcommand, resulting in a catalog entry not found error.PNPM_CONFIG_*(uppercase) environment variables in addition topnpm_config_*. Previously, only the lowercase form was honored, so env vars renamed per the v11 migration guide (e.g.PNPM_CONFIG_USERCONFIG) silently had no effect on case-sensitive systems like macOS and Linux #11465.v11.0.5Compare Source
Patch Changes
Drop the
darwin-x64artifact from@pnpm/exeand from the GitHub release page. The Node.js SEA mechanismpnpm pack-appuses produces a binary that segfaults at startup on Intel Macs because of an upstream Node.js bug (nodejs/node#62893, tracked alongside #59553; the Node.js team has opted not to fix it on the grounds that x64 macOS is being phased out). Re-signing withcodesignorldiddoesn't help — the corruption is in LIEF's Mach-O surgery, before signing.Intel Mac users should install pnpm via
npm install -g pnpm(uses the system Node.js, no SEA), or stay on pnpm 10.x.@pnpm/exe's preinstall on Intel Mac now exits with a clear error pointing at these alternatives.Closes #11423.
pnpm dlx(andpnpx/pnx/pnpm create) now runs the same interactiveapprove-buildsprompt aspnpm add -gwhen the package being launched depends on transitive packages with install scripts. Previously, the v11strictDepBuildsdefault made dlx fail withERR_PNPM_IGNORED_BUILDSand required users to re-run with--allow-build=<pkg>for every offending dependency. dlx also now removes the partially-populated cache directory when the install fails, so a subsequent run starts clean instead of reusing a broken install whose builds were silently skipped #11444.72629fc: Fixpnpm -g ls --jsonandpnpm -g ls --parseableso they emit valid JSON and parseable output respectively, matching pnpm 10 behavior. Since the isolated global packages refactor in pnpm 11, the global list command had a custom path that always printed plain text and ignored--json/--parseable, which broke tools likenpm-check-updatesthat parse the JSON output #11440.pnpm -g ls --depth=<n>(with n > 0) now errors when more than one isolated global install would be involved, since each install has its own lockfile and merging their transitive trees would be incoherent. When the request can be narrowed to a single install group, the regularlistflow is used and the full dependency tree is shown.Fixed
pnpm publishto honorpublishConfig.registryfrompackage.jsonwhen publishing a single package. The native publish flow introduced in v11 was reading the registry from.npmrconly, ignoring the per-package override #11419.When
strictPeerDependenciesistrue, theERR_PNPM_PEER_DEP_ISSUESerror once again renders the peer dependency issues inline using the same format aspnpm peers check, so users (and CI tools like Renovate) can see what failed without runningpnpm peers checkseparately #11439.The
WARNand error code labels in pnpm's output now wrap in brackets ([WARN],[ERR_PNPM_FOO]). Previously the labels relied entirely on a colored background to stand out, which meant they blended into the surrounding text in terminals without color (e.g. whenNO_COLORis set or output is piped). The brackets are painted in the same color as the badge background, so they appear as ordinary padding in color-capable terminals — only the no-color rendering changes.v11.0.4Compare Source
Patch Changes
pnpm cinot reinstalling workspace packagenode_modulesdirectories after the clean step #11427.pnpm ciperforms a fresh install after the clean step.pnpm-lock.yamlduringpnpm cleanwhenlockfile: trueis configured inpnpm-workspace.yaml. The lockfile is only removed when the--lockfileoption is passed topnpm clean.pnpm self-update(with no version argument) no longer downgrades pnpm when the registry'slatestdist-tag points to an older release than the currently active version. Runpnpm self-update latestto force a downgrade #11418.minimumReleaseAgeStrictnow defaults totruewhenever the user explicitly setsminimumReleaseAge(viapnpm-workspace.yaml, the globalconfig.yaml, the CLI, orpnpm_config_*env vars).v11.0.3Compare Source
Patch Changes
node_modules/.bin#11412.ERR_PNPM_FETCH_404when installing a project whose lockfile depends on afile:tarball. The previous behavior dropped thetarballfield fromfile:and git-hosted resolutions whenlockfile-include-tarball-url=false(the default), even though those URLs cannot be reconstructed from the package name, version, and registry #11407.v11.0.2Compare Source
Patch Changes
ENOENTsymlink failure whenpnpm add -gtriggers the approve-builds prompt. The global add flow used to forward an absolutemodulesDir(<installDir>/node_modules) into the install run byapprove-builds. The install layer treatedmodulesDiras a path relative tolockfileDirand joined it again, producing a doubled path on Windows becausepath.joindoes not collapse an embedded absolute path. The hoist step then tried tomkdirand symlink under<installDir>\<installDir>\node_modules\.pnpm\node_modules\...and failed withENOENT#11403.packageManagerDependenciesgoing stale when pnpm is invoked through corepack. The lockfile sync (and thedevEngines.packageManagerversion check) previously ran only when pnpm was invoked directly; under corepack the entire block was skipped, so a stale entry would persist even after the running pnpm version changed. The lockfile sync now runs regardless of how pnpm was invoked, while the pnpm-managed version switch (onFail: 'download') remains skipped under corepack so it doesn't fight corepack's own version selection #11397.publishConfig.directorywhen packages publish from a generated directory #11239.os/cpuentries (e.g.["!win32"]) being incorrectly rejected whensupportedArchitecturesexpands to multiple platforms #11375.v11.0.1Compare Source
Patch Changes
pnpm runscripts.nullnamed catalogs in workspace manifests withInvalidWorkspaceManifestErrorinstead of crashing with a rawTypeError.pnpm sbomemittedNOASSERTION(SPDX) and omitted the distribution reference (CycloneDX) for git dependencies. Now emits the git URL with commit hash, e.g.git+https://github.com/user/repo.git#commit.pnpm self-updatenow keepspackage.json'spackageManageranddevEngines.packageManagerin sync. When the legacypackageManagerfield pins pnpm, both fields are rewritten to the new exact pnpm version on update —packageManagertopnpm@<version>(without an integrity hash), anddevEngines.packageManager.versionto the same exact<version>(dropping any range operator). When onlydevEngines.packageManageris declared, the existing range-preserving behavior is unchanged #11388.pnpm audit --fixso that the log output order matches the order written topnpm-workspace.yaml.packageManagerDependenciesentry whendevEngines.packageManagerdeclares a pnpm version that the lockfile no longer satisfies. Previously, the stale entry was kept even though the running pnpm matched the declared version, silently breaking the integrity record #11387.v11.0.0Compare Source
Highlights
Major
minimumReleaseAgedefaults to 1 day (newly published packages are not resolved for 24h) andblockExoticSubdepsdefaults totrue.allowBuildsreplaces the old build-dependency settings —onlyBuiltDependencies,onlyBuiltDependenciesFile,neverBuiltDependencies,ignoredBuiltDependencies, andignoreDepScriptshave been removed.pnpm add -ggets its own directory with its ownpackage.json,node_modules, and lockfile.pnpm publish,login,logout,view,deprecate,unpublish,dist-tag, andversionno longer delegate to the npm CLI, and the remaining npm passthrough commands now throw "not implemented".pnpm audituses npm's bulk advisories endpoint — the legacy/security/auditsendpoints are gone. CVE-based filtering has been replaced with GHSA-based filtering: migrateauditConfig.ignoreCvesentries toauditConfig.ignoreGhsas..npmrcis auth/registry only — all other settings must live inpnpm-workspace.yamlor the new globalconfig.yaml, and environment variables use thepnpm_config_*prefix.node@runtime:<version>no longer extracts the bundlednpm,npx, andcorepack, roughly halving the files pnpm has to hash, write, and link.Minor
pnpm ci,pnpm sbom,pnpm clean,pnpm peers check,pnpm runtime set,pnpm docs/home,pnpm ping,pnpm search,pnpm star/unstar/stars,pnpm whoami,pnpm with, andpnpm pack-app, pluspn/pnxshort aliases..pnpmfile.mjs, which takes priority over.pnpmfile.cjswhen present.pnpm audit --fix=updatefixes vulnerabilities by updating packages in the lockfile instead of adding overrides, andpnpm audit --fix --interactivelets you select which advisories to fix.pnpm pack-apppacks a CommonJS entry into a standalone executable for one or more target platforms using Node.js Single Executable Applications.Major Changes
Requirements
Security & Build Defaults
Changed default values:
optimisticRepeatInstallis nowtrue,verifyDepsBeforeRunis nowinstall,minimumReleaseAgeis now1440(1 day), andminimumReleaseAgeStrictisfalse. Newly published packages will not be resolved until they are at least 1 day old. This protects against supply chain attacks by giving the community time to detect and remove compromised versions. To opt out, setminimumReleaseAge: 0inpnpm-workspace.yaml#11158.strictDepBuildsistrueby default.blockExoticSubdepsistrueby default.Removed deprecated build dependency settings:
onlyBuiltDependencies,onlyBuiltDependenciesFile,neverBuiltDependencies,ignoredBuiltDependencies, andignoreDepScripts#11220.Use the
allowBuildssetting instead. It is a map where keys are package name patterns and values are booleans:truemeans the package is allowed to run build scriptsfalsemeans the package is explicitly denied from running build scriptsSame as before, by default, none of the packages in the dependencies are allowed to run scripts. If a package has postinstall scripts and it isn't declared in
allowBuilds, an error is printed.Before:
After:
Removed
allowNonAppliedPatchesin favor ofallowUnusedPatches.Removed
ignorePatchFailures; patch application failures now throw an error.Store
<algo>-<digest>). Using hex format improves performance since file paths in the content-addressable store use hex representation, eliminating base64-to-hex conversion during path lookups.package.jsonfrom the content-addressable store during resolution and installation. This reduces I/O and speeds up repeat installs #10473.$STORE/index/, package metadata is stored in a single SQLite database at$STORE/index.dbwith MessagePack-encoded values. This reduces filesystem syscall overhead, improves space efficiency for small metadata entries, and enables concurrent access via SQLite's WAL mode. Packages missing from the new index are re-fetched on demand #10500 #10826.Global Packages
Global installs (
pnpm add -g pkg) andpnxnow use the global virtual store by default. Packages are stored at{storeDir}/linksinstead of per-project.pnpmdirectories. This can be disabled by settingenableGlobalVirtualStore: false#10694.Isolated global packages. Each globally installed package (or group of packages installed together) now gets its own isolated installation directory with its own
package.json,node_modules/, and lockfile. This prevents global packages from interfering with each other through peer dependency conflicts, hoisting changes, or version resolution shifts.Key changes:
pnpm add -g <pkg>creates an isolated installation in{pnpmHomeDir}/global/v11/{hash}/pnpm remove -g <pkg>removes the entire installation group containing the packagepnpm update -g [pkg]re-installs packages in new isolated directoriespnpm list -gscans isolated directories to show all installed global packagespnpm install -g(no args) is no longer supported; usepnpm add -g <pkg>insteadGlobally installed binaries are now stored in a
binsubdirectory ofPNPM_HOMEinstead of directly inPNPM_HOME. This prevents internal directories likeglobal/andstore/from polluting shell autocompletion whenPNPM_HOMEis on PATH #10986. After upgrading, runpnpm setupto update your shell configuration.Breaking changes to
pnpm link:pnpm link <pkg-name>no longer resolves packages from the global store. Only relative or absolute paths are accepted. For example, usepnpm link ./fooinstead ofpnpm link foo.pnpm link --globalis removed. Usepnpm add -g .to register a local package's bins globally.pnpm link(no arguments) is removed. Usepnpm link <dir>with an explicit path instead.Configuration
pnpm no longer reads all settings from
.npmrc. Only auth and registry settings are read from.npmrcfiles. All other settings (likehoistPattern,nodeLinker,shamefullyHoist, etc.) must be configured inpnpm-workspace.yamlor the global~/.config/pnpm/config.yaml#11189.Network settings (
httpProxy,httpsProxy,noProxy,localAddress,strictSsl,gitShallowHosts) are now written toconfig.yaml(global) orpnpm-workspace.yaml(local) instead of.npmrc/auth.ini. They are still readable from.npmrcfor easier migration from the npm CLI #11209.pnpm no longer reads
npm_config_*environment variables. Usepnpm_config_*environment variables instead (e.g.,pnpm_config_registryinstead ofnpm_config_registry).pnpm no longer reads the npm global config at
$PREFIX/etc/npmrc.pnpm loginwrites auth tokens to~/.config/pnpm/auth.ini.New
registriessetting inpnpm-workspace.yaml:Auth tokens in
~/.npmrcstill work — pnpm continues to read~/.npmrcas a fallback for registry authentication. The newnpmrcAuthFilesetting can be used to point to a different file instead of~/.npmrc.Replace workspace project specific
.npmrcwithpackageConfigsinpnpm-workspace.yaml.A workspace manifest with
packageConfigslooks something like this:Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
Closed unmerged: pnpm v11 likely tightens peer-dependency strictness, and our workspace currently carries known peer mismatches via the legacy
nestjs-prisma > @angular-devkit/core@13.xchain (chokidar ^3 vs ^5, typescript ^4||^5 vs 5.9). The fix is the same as for Prisma 7 — drop or replacenestjs-prisma— and is gated behind the future Prisma 7 / wrapper-replacement ADR (see ADR-0006 §"Prisma version pin: 6.x in v1").Re-tick this entry in the Dependency Dashboard once that ADR lands and the wrapper situation is settled.
Renovate Ignore Notification
Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future
11.xreleases. But if you manually upgrade to11.xthen Renovate will re-enableminorandpatchupdates automatically.If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.
Pull request closed