Changelog

pnpm/pnpm · · 40 commits

Big Rust engine feature drop

pnpm landed multiple engine features and several important fixes, including branch lockfiles, lockfileDir, hook/config env support, and install correctness fixes.

zkochan Ayush442842q arthur-fontaine lazerg btea m2na7 jsk1004ha joemckie luantaraschi sharmila-oai dylanpulver fu050409 yoominho91 Stanzilla hamodywe

Per-branch lockfiles land in the Rust engine (zkochan36e5ae6)

pnpm now supports gitBranchLockfile, mergeGitBranchLockfiles, and mergeGitBranchLockfilesBranchPattern, plus matching install flags. That lets branches keep separate lockfiles and merge them back cleanly, which is a major workflow feature for monorepos and long-lived branches.

Lockfile placement is now configurable (zkochan150bb37)

The Rust CLI now honors lockfileDir across install-family commands, re-anchoring the lockfile, virtual store, and related state under a chosen directory. This matters for shared-lockfile setups and any workspace that wants the lockfile decoupled from the repo root.

Config and hooks got broader environment support (zkochan11a60a4, zkochan20483f8, zkochan9d89dea)

ignore-pnpmfile and materialization settings like virtualStoreOnly / enableModulesDir can now be read from PNPM_CONFIG_* env and config sources, and globalPnpmfile is now supported as a user-level hook. Together these changes make pnpm’s Rust path line up much better with the existing config surface.

Installer correctness fixes for real-world edge cases (zkochan4178c98, jsk1004haa6d9ee7, arthur-fontaine08c5d80, joemckiedfa6a43, zkochan97c571d, arthur-fontaine45a7c42, zkochan5df4a82, zkochanbf46078, lazerga3bc1c1, Ayush442842qe277604)

The day also delivered a cluster of high-impact bug fixes: outdated/update now respect minimum release age, settings-only workspaces stay root-scoped, hoisted repeat installs and filtered no-op installs short-circuit correctly, pinned recursive updates stay on the right version line, and frozen installs no longer silently rewrite packageManagerDependencies. There are also important deploy and node_modules-state fixes, including avoiding purge-on-unreadable .modules.yaml and dropping excluded deps from shared-lockfile deploys.

Package integrity, trust, and fetch behavior are tightened (sharmila-oai6d64ef4, dylanpulver9e17b1b, hamodywecfb5b05, m2na7288cfe6, zkochanb1f6d37)

Custom fetchers can no longer swap out locked archive integrity, native custom-fetcher callbacks are supported, and pnpmfiles are loaded earlier in the Rust flow. Resolver trust checks now honor minimumReleaseAgeIgnoreMissingTime correctly, can read publish times from abbreviated metadata, and git-dependency build errors now point users at the right allowBuilds entry or missing pnpmfile path.

Other misc changes

  • Global --loglevel support restored.
  • set-script no longer gets shadowed by a not-implemented stub.
  • Windows bin-shim cleanup and store-path normalization fixes.
  • sbom filtering and --fail-if-no-match support.
  • pkg property paths now accept hyphens.
  • Empty bin strings, stale PowerShell shims, and a few other edge cases fixed.
  • Minor chores/refactors and test-only updates across the repo.