17/ 🧬 `dedupePeers` setting Peer-dep suffixes use `name@version` instead of nested full paths like `(foo@1.0.0(bar@2.0.0))`. Projects with heavy recursive peer deps get dramatically fewer package instances.

16/ 🪝 ESM pnpmfiles `.pnpmfile.mjs` is now supported and takes priority over `.pnpmfile.cjs`. New `fetchers` field on pnpmfile replaces the removed `hooks.fetchers` API.

15/ 🔒 `pnpm audit` leveled up - New bulk advisories endpoint (GHSA-based, not CVE) - `pnpm audit --fix=update` fixes vulns in the lockfile instead of adding overrides - `--fix` auto-adds patched versions to `minimumReleaseAgeExclude` so fixes install immediately Migrate: `auditConfig.ignoreCves` → `auditConfig.ignoreGhsas`.

14/ 🔐 `devEngines.packageManager` with ranges Unlike the `packageManager` field, `devEngines.packageManager` supports semver ranges. The resolved version is stored in `pnpm-lock.yaml` and reused if it still satisfies the range. `pnpm init` now writes `devEngines.packageManager` instead of `packageManager`.

13/ 🏢 `packageConfigs` replaces per-project `.npmrc` Configure individual workspace projects right from `pnpm-workspace.yaml`: ```yaml packageConfigs: "project-1": saveExact: true "project-2": savePrefix: "~" ``` Also: new `registries` map and `nodeDownloadMirrors` setting live here too.

12/ ⚙️ `.npmrc` is auth/registry only All other settings move to `pnpm-workspace.yaml` or the new global `~/.config/pnpm/config.yaml`. Env vars use the `pnpm_config_*` prefix. pnpm no longer reads `npm_config_*` env vars or the `pnpm` field in `package.json`. A clean break from npm's ini soup.

11/ 🎛️ New `pmOnFail` setting Overrides the `onFail` behavior of `packageManager` and `devEngines.packageManager`. Values: `download`, `error`, `warn`, `ignore`. Replaces the removed `managePackageManagerVersions`, `packageManagerStrict`, and `packageManagerStrictVersion`. `COREPACK_ENABLE_STRICT` is no longer honored. Same idea for runtimes: new `runtimeOnFail` setting.

10/ 🔀 `pnpm with <version>` Run a one-shot pnpm at any version — bypassing `packageManager` pins. Cached in the global virtual store for reuse. ``` pnpm with current install pnpm with 11.0.0-rc.1 install pnpm with next install ```

9/ ✨ A LOT of new commands - `pnpm ci` — clean + frozen install - `pnpm sbom` — CycloneDX 1.7 & SPDX 2.3 - `pnpm clean` — nuke node_modules across the workspace - `pnpm peers check` — inspect peer issues on demand - `pnpm runtime set` — replaces `pnpm env use` - `pnpm docs` / `home`, `pnpm ping`, `pnpm search` - `pnpm star` / `unstar` / `stars` / `whoami`

8/ 📦 Native publish flow `publish`, `view`, `login`, `logout`, `deprecate`, `unpublish`, `dist-tag`, `version` — all reimplemented natively. No more shelling out to the npm CLI. - OTP via `PNPM_CONFIG_OTP` - Web-auth with scannable QR codes - Full workspace + `workspace:` protocol support in `version`

7/ 🔗 Global virtual store by default All runtime dependencies are linked from a single global virtual store at `{storeDir}/links/`. Config dependencies too. Shared across projects sharing a store — no redundant fetches or imports. And ~95% of packages survive Node.js upgrades without re-import (engine-name excluded from hashes for non-building packages).

6/ 🌍 Global installs, rebuilt Every `pnpm add -g <pkg>` gets its own isolated dir under `{pnpmHomeDir}/global/v11/{hash}/` — its own `package.json`, `node_modules/`, and lockfile. No more peer conflicts between global tools. Global binaries now live in `PNPM_HOME/bin` so internal dirs don't pollute your shell's autocomplete.

5/ 🗄️ Brand new store (v11) - Package index is now backed by **SQLite** with MessagePack values — no more thousands of tiny JSON files - Bundled manifests live directly in the index — no more reading `package.json` from CAS during resolution - Hex digests in index entries (no base64→hex conversion on every lookup)

4/ 🏗️ `allowBuilds` replaces the old mess One map to rule `onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, `neverBuiltDependencies`, `ignoredBuiltDependencies`, and `ignoreDepScripts`: ```yaml allowBuilds: electron: true core-js: false ``` Unbuilt packages are auto-added to the workspace file for you to review.

3/ 🎛️ Other new defaults - `optimisticRepeatInstall: true` — skip work when the lockfile is up to date - `verifyDepsBeforeRun: install` — `pnpm run` auto-syncs `node_modules` before running scripts Install and run, fewer surprises.

2/ 🛡️ Supply-chain protection, on by default - `minimumReleaseAge` defaults to 1 day — newly published packages aren't resolved for 24h, giving the community time to catch bad actors - `blockExoticSubdeps` defaults to `true` — exotic protocols (git, tarball, etc.) are no longer resolved for transitive deps - `strictDepBuilds` defaults to `true` — unapproved postinstall scripts fail the install instead of being silently ignored

1/ 🚀 pnpm v11 is almost here — and it's the biggest release in years. Supply-chain protection by default, a SQLite-backed store, native publish flow, an overhauled config model, and a pile of new commands. Here's what's shipping 🧵

"pnpm audit" in v10 stopped working because the npm registry has deprecated the audit endpoint that we (and Yarn) use. You can upgrade to pnpm v11.0.0-rc.1, which uses a new working endpoint. You can also use some workarounds to run just audit from pnpm v11: github.com/pnpm/pnpm/issues/…

pnpm 11 RC 0 is out! github.com/pnpm/pnpm/release…

Should pnpm delay installation of package versions released less than a day or week ago?