Fix: preserve workspace-provided optional peers (
0f215fe)
pnpm install and pnpm dedupe now keep an optional peer linked to the workspace package when the chosen version matches, instead of falling back to the registry package. This fixes incorrect provider selection for workspace peers and closes a real resolver bug.
Fix: end close-delimited metadata bodies on unclean TLS closes (
5190b00)
The network layer now treats a TLS connection closed without close_notify as a normal end-of-body case for packuments that have no Content-Length or chunked framing. That unblocks pnpm view and dependency resolution behind TLS-intercepting proxies that behave like Node.js, instead of failing with body-read errors.
Fix: keep built and patched slots on repeat installs (736ffe4)
Repeat installs no longer re-import side-effect overlays into slots that already have them, which prevented unnecessary rebuilds and repeated patch application. This is a meaningful installer correctness and performance fix for non-fast-path installs.
Fix: download the native binary from the configured registry (
e02e667)
First-run bootstrap downloads for pnpm now honor the configured registry and credentials from .npmrc and registry env vars, not just registry.npmjs.org. That matters for mirrored or airgapped setups where the bootstrap path previously ignored local registry configuration.
Fix: apply minimum release age to config dependency resolution (
ab1e504)
Config dependencies now resolve with the same minimumReleaseAge policy used during verification, so the version chosen during install will still pass a later frozen install. This closes a consistency gap that could otherwise produce lockfiles that become invalid on the next clean run.
Fix: switch to the pinned pnpm even past unreadable workspace settings (
3de9015)
Pre-command config loading now retries with unreadable workspace settings skipped, allowing pnpm to reach and honor the version pinned in packageManager or devEngines.packageManager. That prevents older global pnpm versions from getting stuck on settings they cannot parse.
Fix: prune catalog entries without breaking frozen installs (
1492180)
catalogPrune now preserves catalog entries that the lockfile still records for missing workspace projects, avoiding later ERR_PNPM_LOCKFILE_CONFIG_MISMATCH failures. The pruning logic still removes entries that are truly unused.
Fix: hardlink store files when only write bits differ (41dbcbc)
The importer now hardlinks store files even when the only mode differences are missing group/other write bits relative to the current umask. This reduces unnecessary copies and fixes installs under common umask/store mode combinations.
Fix: apply removal overrides to meta-only optional peers (
d1e8874)
Removal overrides now also match peers declared only in peerDependenciesMeta with optional: true, which were previously missed by the override matcher. That keeps optional peers from being satisfied unexpectedly by sibling workspace packages.
Fix: sort deployed dependency metadata deterministically (e048892)
Deploy now writes dependency groups and allowBuilds in a stable name order instead of relying on hash iteration order. This makes generated deploy output deterministic and aligns it with v11 behavior.
Fix: avoid removing shared workspace link parents twice (797d717)
Hoist cleanup now removes stale workspace-link parents once, preventing concurrent directory deletions from colliding on Windows. This avoids intermittent install failures caused by EPERM during cleanup.
Fix: preserve colors in streamed script output (f79f863)
pnpm run/pnpm exec now forces color for streamed child output when pnpm itself is colorized, and the reporter sanitization logic was updated accordingly. This is a user-visible CLI improvement plus a reporter correctness fix for colored output.
Fix: read executables via the actual binary path (3140b5e)
detect-libc now opens the current executable using std::env::current_exe() instead of /proc/self/exe, which avoids QEMU user-mode descriptor confusion. That prevents a panic in environments that emulate /proc/self/exe poorly.
Fix: allow installs to continue past unreadable workspace settings (3de9015)
Pre-command loading now falls back to a path that skips unreadable workspace settings, so version switching can still happen when newer pnpm-specific config keys are present. This is a robustness fix for mixed-version workspaces.
Other misc changes
- CLI refactors: package-spec parsing, registry resolution, retry options, URL normalization, and error-body sanitization were centralized across multiple subcommands.
- Network/CLI plumbing refactors for redirect guards, OTP guards, registry clients, and hosted repo URL handling.
- Docs cleanup: code block languages/titles and optional-peer resolution docs.
- Dependency bumps and toolchain/CI updates.
- Test-only additions and refactors across install, resolver, deploy, catalog, and workspace-peer suites.