Hoisted installs now avoid broken layouts on conflict-heavy graphs (
2e7bfd3)
node-linker=hoisted no longer collapses shared nodes in a way that lets one dependent’s transitive deps leak into another’s path. The hoister now decouples shared nodes, collapses peer variants to a single copy, and blocks shadowing rules that previously produced wrong resolutions and combinatorial nesting on real-world graphs.
pnpm audit now reports only real patched versions (
cf1d35b)
Audit patch ranges are validated against the registry packument, so the tool no longer suggests versions that were never published or are deprecated. The fix flow also stops writing minimum-age exclusions for nonexistent releases, and JSON output now uses null when no published patch is actually available.
Fresh resolution reuses cached metadata more aggressively (
9343af3)
The resolver now skips conditional registry requests when lockfile evidence proves a cached winner cannot be displaced. This trims metadata traffic during dependency resolution and keeps the cached packument marked unverified so later ranges are still re-checked.
Platform-specific runtime selection now prefers the host variant (
40221bc)
When multiple supported architectures are listed, resolution now picks the runtime matching the current host instead of blindly taking the first configured OS/CPU pair. That fixes installs that previously fetched the wrong runtime on projects with multiple platform entries.
Self-update no longer downgrades when a dist-tag points at the running version (f28e6cc)
The minimum-release-age path now guards against treating the currently installed pnpm release as an update target just because the tag was repointed to an immature version. This prevents self-update from stepping users back to an older release.
Config dependencies now resolve tarballs via the packument (77d8b41)
Migrated config dependencies no longer derive tarball URLs from registry path templates that may not exist. That closes a 404/redirect trap on registries like GitLab and makes migrated config deps behave more like normal dependency installs.
pnpm approve-builds now clears obsolete build settings (161b821)
Approving builds now removes the old pnpm 10-era build keys from pnpm-workspace.yaml in the same write that records allowBuilds. That prevents migrated workspaces from carrying dead config that looks active but is silently ignored.
pnpm update <pkg>@<version> stays targeted (
cb4a50c)
Versioned selectors no longer cause the matcher to drop its per-package predicate and update unrelated transitive dependencies. The command now keeps the selected package scoped correctly while still allowing the requested version update.
pnpm change paginates pickers to terminal height (868da80)
The interactive package/bump pickers now size their pages from the terminal instead of always showing seven rows. This makes large release lists usable without hiding most entries behind scrolling.
pnpm add --allow-build now merges with existing approvals (8680ece)
Adding approved builds no longer replaces the existing allowBuilds map in workspace config. The file write now preserves previously approved entries instead of dropping them.
Other misc changes
- Performance: scoped post-resolve work to changed packages; overlap store-index teardown with install tail; stream-extract large tarballs during download; speed up cached-meta fresh resolution; reuse store-read context during materialization.
- Fixes: keep pending build approvals after remove; read
node-versionfrom env; accept stringverifyDepsBeforeRunenv values; report ignored global config.yaml keys; preserve no-save lockfile specifiers; pack LICENSE files correctly; fix migrated config-dep tarball selection. - Chores/tests: dependency, Node.js, pnpm, and GitHub Actions updates; pacquet 12.0.0-rc.8 release; several test-only and harness updates.