Web UI sign-in now supports OIDC (
1b5569a)
The pnpr web UI can now start and complete OIDC sign-in without exposing tokens or codes in the URL. The flow uses cookies and redirects back into the UI, which makes browser sign-in work safely even behind a path prefix.
pnpm now normalizes the npm registry HTTPS alias (efabb94)
https://registry.npmjs.com/ is treated as the same registry as https://registry.npmjs.org/, including auth, TLS, and trusted-publishing lookups. That removes a long-standing alias mismatch that could cause credentials or requests to miss the canonical registry.
pnpm dlx can run Rust tools from a requested release (1e6f43b)
pnpx --package=rust@<channel> <tool> now provisions a Rust toolchain release and runs the requested tool from it, instead of only supporting npm-style packages and runtimes. This gives scripts a first-class way to pick a Rust channel without relying on rustup-style shell syntax.
enableModulesDir: false now still fetches store packages (133a756)
The Rust install path no longer treats enableModulesDir: false as a lockfile-only install. It now resolves normally, skips writing node_modules, and still fetches packages into the store so external mount-based workflows do not pay the cost on first access.
Reused lockfile packages are fetched with enableModulesDir: false too (584a2d9)
The install path now fetches packages reused from an existing lockfile, not just newly resolved ones, when the modules dir is disabled. That restores the pnpm v10 behavior where the store ends up containing everything the lockfile refers to.
allowBuilds denials now override dangerouslyAllowAllBuilds (8160810)
Build policy checks now honor explicit deny rules even when the all-builds flag is enabled. This fixes the “allow everything except these packages” case, which previously could not be expressed correctly.
--workspace-concurrency Infinity is accepted again (
955191d)
The CLI now parses Infinity for workspace concurrency and maps it to the maximum integer value. That restores the documented unbounded-concurrency behavior instead of rejecting the flag as invalid.
pnpr web UI updated to a working sign-in build (c9938ac)
The UI dependency was bumped to @pnpm/pnpr.apps.pnpr-web@0.2.7, which matches the newer OIDC handoff behavior. This fixes browser sign-in for the web UI build shipped in this repo.
Shared checkout shims no longer fail chmod (
bb74d81)
pnpm install now skips unnecessary chmods when an existing shim is already executable and not world-writable. That avoids ERR_PNPM_CMD_SHIM_CHMOD in shared node_modules/.bin checkouts across multiple users.
Ignore files are excluded from pack tarballs again (
1ea2ca4)
.npmignore and .gitignore files are no longer packaged at any depth. This brings the Rust packlist behavior back in line with npm-packlist and prevents accidental publishing of ignore files.
pnpm install keeps going when the pinned running version is unpublished (
63a1a44)
If the current pnpm version is the one pinned in packageManager but the registry has not published it yet, pnpm now warns instead of failing the command. That makes pinned projects resilient to registry lag and mirror delay.
Staged publish failures now say they failed to stage (d37ad39)
When pnpm stage publish is rejected by the registry, the error message now names the staging step instead of generic publish. It is a wording fix, but it materially improves diagnosis in release workflows.
Package-manager release notes were curated for pnpr and pacquet (ee1519b, ddcd8de, 4ef3ce0)
Several release/changelog updates were landed for pnpr and pacquet, including version bumps and note curation. These are mostly release-management changes rather than product behavior changes.
Other misc changes
- CI/build updates, including restoring dylint as a pnpm pipeline and exposing staged publication diagnostics (52fd8d8, fdcf882)
- Resolver/internal refactors around
reuseand update scope ownership (4ffd591, 65e89b3) - Documentation, lockfile, and dependency bumps, plus small release-note edits (4e76f22,
0c9e6fc, 8778146, 5cfea5f)