pnpm fund lands as a new command (
7242501)
pnpm fund now reports dependency funding URLs in the same shape as npm fund, including --json, --recursive, --filter, and --which support. This adds a new user-facing command for discovering and opening funding links across installed packages and workspace projects.
Deploy now approves workspace project builds for file: deps (6d0f24f)
pnpm deploy now treats workspace projects rewritten to file: dependencies as approved for build execution, instead of failing with ignored-builds errors. That closes a deployment gap where workspace projects would work in-repo but break once deployed.
Registry URLs with env placeholders now fail fast (bdbd8ab)
pnpm now rejects ${VAR} placeholders in repository-controlled registry settings instead of silently dropping them and falling back to another registry. This is a security fix: it prevents unintended resolution from a different registry when a private registry URL was misconfigured.
Optional peers are now scoped to the importing project (a9f3612)
With projectScopedOptionalPeers, a missing optional peer is only satisfied from the project’s own dependency graph, not from unrelated workspace projects. That prevents one project’s dev-only packages from leaking into another project’s production resolution.
Platform-specific variants now carry their dependencies in supportedArchitectures installs (fe9b65e)
When supportedArchitectures targets more than the current platform, pnpm now stores the selected variants’ dependencies too, so the alternate platform’s archive is complete on the next install or fetch. This makes cross-platform prefetching and offline reuse behave like a real install rather than a partial cache fill.
Resolver and cache-hit logic got correctness and perf fixes (01558d0, 1e78736, 1970b17)
pnpm now handles no-cache mirrors more intelligently, allowing version-picking shortcuts when the mirror can safely answer without re-downloading full packuments. Related mirror-hit paths were fixed to revalidate misses correctly, and the release-age cutoff is only computed when the mirror entry can actually use it.
Windows mapped-drive paths are preserved (
2966517)
Install destinations, workspace project roots, and lifecycle working directories now keep drive-letter paths after canonicalization on Windows. This avoids path rewriting that could break tooling expecting mapped drives instead of UNC paths.
Shim dispatch no longer recurses into itself during preparation (94176cd)
A shim now avoids dispatching through itself while it is preparing the runtime or package manager it is about to run. That fixes a runaway nested-shim loop that could deadlock and exhaust memory.
Publish provenance signing is pinned to Rekor v1 (7bc0498)
pnpm publish now explicitly signs provenance with Rekor API v1 rather than inheriting whatever highest Rekor version TUF advertises. This avoids an accidental switch to Rekor v2 bundles without a pnpm release.
Other misc changes
- Added an embedded engine-size benchmark and reporting tool.
- crate-layers gained leak tracking plus stricter direct/transitive dependency ratchets.
- Fixed pnpr publish version validation.
- Self-update/docs fixes, install freshness edge cases, and several dependency/CI bumps.