# pm2 v7.0.0

- Product: pm2 (https://whatsnew.fyi/product/pm2)
- Vendor: Unitech
- Date: 2026-05-02
- Version: v7.0.0
- Original notes: https://github.com/Unitech/pm2/releases/tag/v7.0.0
- Permalink: https://whatsnew.fyi/product/pm2/releases/v7.0.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **removed** — Require Node.js >= 18.0.0 and drop Node.js 16 support
- **changed** — Internalize pm2-axon, pm2-axon-rpc, pm2-io-bpm, pm2-io-agent, and fclone as local modules to reduce supply chain surface
- **changed** — Internalize pm2-multimeter and charm into lib/tools/multimeter with zero external dependencies
- **added** — Add Bun runtime support with ProcessContainerBun.js and ProcessContainerForkBun.js
- **changed** — Replace needle with native fetch for CliAuth and TAR publish
- **changed** — Replace enquirer with lightweight built-in prompt for boilerplate selector
- **changed** — Replace promptly with built-in lib/tools/prompt
- **changed** — Replace mkdirp with native fs.mkdirSync({ recursive: true })
- **changed** — Replace source-map-support with native process.setSourceMapsEnabled()
- **changed** — Replace sprintf-js with template literals in Dashboard
- **changed** — Replace url.parse() with native URL constructor in Serve, Utility, and CliAuth
- **removed** — Drop auto source map file detection in Common.prepareAppConf
- **security** — Fix ReDoS vulnerability in Config.js string-to-array split regex (CVE-2025-5891)
- **security** — Update proxy-agent to 6.5.0 and basic-ftp to 5.3.1 (CVE-2026-27699)
- **security** — Fix command injection in WebAuth.js open() by replacing exec() with execFile()
- **security** — Fix command injection in PM2IO.js open() by replacing exec() with execFile() and validating SUDO_USER
- **security** — Fix command injection in lib/tools/open.js by replacing exec() with execFile() and validating SUDO_USER
- **security** — Fix prototype pollution in Configuration.set/unset via __proto__ key traversal
- **fixed** — Fix HttpInterface env stripping never executing with WEB_STRIP_ENV_VARS
- **fixed** — Rewrite TreeKill to use single ps snapshot and in-memory tree build to eliminate race conditions and improve SIGKILL escalation
- **fixed** — Fix [object Object] env vars leaked to fork mode subprocesses

##### 7.0.0

###### Breaking Changes

- Require Node.js >= 18.0.0 (dropped Node.js 16 support)

###### Core Refactor

- Internalize pm2-axon, pm2-axon-rpc, pm2-io-bpm, pm2-io-agent, fclone as local modules (reduced supply chain surface)
- Internalize pm2-multimeter and charm into lib/tools/multimeter (zero external deps)
- Add Bun runtime support (ProcessContainerBun.js, ProcessContainerForkBun.js)
- Replace `needle` with native `fetch` (CliAuth, TAR publish)
- Replace `enquirer` with lightweight built-in prompt (boilerplate selector)
- Replace `promptly` with built-in lib/tools/prompt
- Replace `mkdirp` with native `fs.mkdirSync({ recursive: true })`
- Replace `source-map-support` with native `process.setSourceMapsEnabled()`
- Replace `sprintf-js` with template literals (Dashboard)
- Replace `url.parse()` with native `URL` constructor (Serve, Utility, CliAuth)
- Remove `fclone` npm dep, use internalized module
- Drop auto source map file detection in Common.prepareAppConf

###### Security

- CVE-2025-5891 Fix ReDoS in Config.js string-to-array split regex #6075
- CVE-2026-27699 Update proxy-agent to 6.5.0, basic-ftp to 5.3.1 #6088
- Fix command injection in WebAuth.js open() — replace exec() with execFile() #6089
- Fix command injection in PM2IO.js open() — replace exec() with execFile(), validate SUDO_USER
- Fix command injection in lib/tools/open.js — replace exec() with execFile(), validate SUDO_USER
- Fix prototype pollution in Configuration.set/unset via __proto__ key traversal #6089
- Fix HttpInterface env stripping never executing (WEB_STRIP_ENV_VARS) #6089

###### Bug Fixes

- Rewrite TreeKill: single ps snapshot + in-memory tree build, eliminates race conditions. SIGKILL escalation now targets surviving child processes directly instead of re-walking a dead tree #6084
- Fix [object Object] env vars leaked to fork mode subprocesses #6073
- Fix Windows home path: use os.homedir() instead of HOMEPATH/HOMEDRIVE env vars #6106
- Fix Windows TreeKill callback consistency
- Fix missing BPM monitoring injection in Bun cluster mode (ProcessContainerBun.js)
- Fix ReferenceError crash in Bun cluster console overrides when disable_logs is true
- Fix CliAuth wrong credentials error displaying "undefined" instead of error message

###### Features

- Add `--ftp` option to `pm2 serve` for directory listing (python http.server style)

###### Dependencies

- Add OpenTelemetry tracing as direct dependencies (@opentelemetry/api, sdk-node, auto-instrumentations-node)
- Upgrade OpenTelemetry packages to latest
- Update pidusage from 3.0.2 to 4.0.1
- Upgrade ws to ^8.18.0, eventemitter2 to ^6.4.9
- Remove needle, enquirer, promptly, mkdirp, source-map-support, sprintf-js, fclone from npm dependencies

###### Testing

- Add Docker parallel test runner with Node.js and Bun support
- Add Windows test suite (test/windows.sh)
- Add OpenTelemetry tracing tests
- Add TreeKill unit tests
- Add test scripts for internalized modules (bpm, axon, axon-rpc, io-agent)
- Fix test compatibility for Node.js 22+ and Bun
- CI matrix: Node.js 18, 20 + latest