# pnpm: what changed from 11 to 12

- Product: pnpm (https://whatsnew.fyi/product/pnpm)
- Vendor: pnpm
- Range: changelog entries numbered after v11.25.0 up to and including v12.3.4, stable releases only
- Entries below: 9 releases (newest first)
- Resolved: 11 is v11.25.0 and 12 is v12.3.4, the newest stable release of each major we track
- Carrying security changes: 0 · CVEs mentioned: 0 · Mentioning breaking changes: 0 · Removing or deprecating something: 0
- Page: https://whatsnew.fyi/product/pnpm/compare/11...12

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (96 changes, grouped by kind)

### Added

#### v12.3.4 (2026-09-04)

- pnpm remove now accepts --unsafe-perm flag

#### v12.3.2 (2026-09-04)

- pnpm update now accepts --ignore-scripts and skips lifecycle scripts during the update

#### v12.3.0 (2026-09-02)

- Context-aware global commands (node, deno, bun, and shims created with pnpm shim add) are now native executables on every platform, allowing environment variables with non-shell-identifier names to reach these commands
- pnpm remove and pnpm update now accept --trust-lockfile, --no-trust-lockfile, --trust-policy, --trust-policy-exclude, and --trust-policy-ignore-after flags
- pnpm now honors --config.trust-lockfile=<value> and accepts bare --trust-lockfile / --no-trust-lockfile spelling on commands that previously took the setting from config file alone
- pnpm config now accepts -g/--global, --location, and --json before its subcommand

#### v12.2.0 (2026-09-01)

- Catalogs can now resolve workspace dependencies through the `workspace:` protocol

#### v12.1.0 (2026-08-29)

- Persist completed recursive tasks so --resume-from skips exactly the work that passed during a matching interrupted or failed pnpm -r run or pnpm -r exec invocation
- Added per-task concurrency limits to workspace task orchestration via tasks.<name>.concurrency in pnpm-workspace.yaml
- A cache can now be declared write-only to populate one the run does not read
- A dependency cycle among the tasks of a run is now an error naming the participating tasks instead of silently running in an arbitrary order
- Setting ignoreWorkspaceCycles: true downgrades task cycle errors to warnings
- pnpm -r run --dry-run <script> prints the task graph that would execute without running anything
- Added macOS and Windows x64 and arm64 support to remote shared build artifacts

### Changed

#### v12.3.3 (2026-09-04)

- Speed up writing the lockfile in large workspaces
- Speed up dependency resolution in large workspaces (also in v12.3.4)

#### v12.3.2 (2026-09-04)

- Sped up installs that have no lockfile by linking packages whose dependency subtree has no peer dependencies into the virtual store while resolution is still running
- pnpm import now keeps the versions recorded in package-lock.json, npm-shrinkwrap.json, or yarn.lock when it generates pnpm-lock.yaml
- pnpm import in a workspace now imports every workspace project into the shared lockfile
- pnpm import now fails with ERR_PNPM_LOCKFILE_NOT_FOUND when none of the three source lockfiles is present and fails with ERR_PNPM_YARN_LOCKFILE_PARSE_FAILED when it cannot parse yarn.lock
- pnpm import always resolves locally and warns when --pnpr-server or the pnpr-server setting is given
- Sped up installs in large workspaces by optimizing workspace project discovery to no longer enumerate every matched directory
- Sped up installs in large workspaces by reducing memory allocation in the resolver and peer pass for every dependency edge
- Sped up installs in large workspaces by making lockfile saving faster and finishing without waiting for memory cleanup
- Sped up dependency resolution when there is no lockfile and for dependencies a lockfile does not cover
- Sped up installs in large workspaces by deriving workspace link: targets and importer ids from the paths' suffixes under the workspace root
- Sped up installs that restore a deleted node_modules from a warm global virtual store by no longer re-linking packages that are already fully present in the global virtual store

#### v12.3.1 (2026-09-03)

- Global commands now launch normally, and their first launch migrates the global bin directory to native shims
- Sped up installs in large workspaces by deriving the anchor for re-rendering workspace link: targets once per project instead of once per dependency edge
- Sped up installs in large workspaces by hashing project ordering paths by their raw bytes
- Sped up installs in large workspaces by running lockfile verification checks for each project in parallel

#### v12.3.0 (2026-09-02)

- On Windows, <name>.exe replaces the .cmd and .ps1 shims for context-aware global commands
- pnpm remove verifies the lockfile against active policies the way pnpm install does
- Sped up installs in large workspaces by reading pnpm-lock.yaml while workspace projects are being discovered
- Sped up installs in large workspaces by improving the lockfile update check to no longer compare every project against every lockfile entry
- Sped up dependency resolution in large workspaces that use link: dependencies
- Sped up dependency resolution in large workspaces by having the resolver build fewer lookup keys for each dependency
- Improved peer dependency resolution performance when many packages reuse the same peer ranges
- pnpm outdated and pnpm update now follow local actions and reusable workflows referenced with GitHub's self-repository syntax (uses: $/.github/actions/setup) when looking for outdated GitHub Actions
- On Linux, pnpm now resolves registry hostnames through the system resolver (getaddrinfo) instead of the bundled pure-Rust resolver

#### v12.2.0 (2026-09-01)

- Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with URL-scoped npm registry credentials, including bearer tokens, basic auth, and `tokenHelper`
- Sped up installs in large workspaces by resolving each named `workspace:` dependency once and reusing it across every project that declares it
- Load pnpmfile `updateConfig` hooks before packing so hook-provided catalogs resolve in `pnpm pack`, `pnpm publish`, and `pnpm stage publish`
- `pnpm deploy` no longer requires `injectWorkspacePackages` to be enabled and now reports `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER` when a peer resolves to more than one version
- `globalDir` and `globalBinDir` are honored wherever they are set and the global `config.yaml` is read again with environment variables and tilde expansion support
- Speed up workspace discovery for literal directories and conventional trailing-star patterns with wildcard no longer matching dot-prefixed directories

#### v12.1.0 (2026-08-29)

- pnpm login and pnpm adduser now record the granted token in the global config.yaml under the _auth setting, with --scope's scope routed to that registry under registries
- pnpm logout removes tokens from the global config.yaml and still removes them from auth.ini written by earlier versions
- A scope set in a project's pnpm-workspace.yaml is now ignored with a warning
- Verified remote build artifacts are persisted in the shared store with their signed origin metadata and reverified against current trust, policy, platform, and source before reuse
- Workspace install, rebuild, pack, publish, stage, and lifecycle work now starts as soon as its dependencies finish instead of waiting for an unrelated topological group
- sideEffectsCache now declares the whole of how a package's build output is reused with read, write, and remote tier settings
- sideEffectsCacheReadonly: true now blocks writing to the cache
- Setting sideEffectsCacheReadonly alongside sideEffectsCache: false gives a read-only view rather than switching the cache off
- pnpm -r run and pnpm -r exec now schedule per task instead of in topological chunks using a new tasks section in pnpm-workspace.yaml
- --resume-from now skips exactly the transitive dependencies of the anchor package
- Under --no-bail, tasks whose dependencies failed are reported as skipped instead of failed
- Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject

#### v12.0.0 (2026-08-26)

- Git dependencies on known hosts are now treated as identities rather than transport choices, resolving through the host's canonical HTTPS URL and never recording SSH URLs in the lockfile
- Unrecognized settings in pnpm-workspace.yaml are now reported as errors when the project pins a pnpm version, with warnings elsewhere
- Dependency cycles are now broken canonically during peer resolution, producing byte-identical lockfiles regardless of importer or resolution order
- packageImportMethod: auto now tries hardlinks before cloning on Linux for faster node_modules materialization
- Under engineStrict, installs now fail when an incompatible package is reached through a regular dependencies edge of an installable package, even when that subtree hangs off optionalDependencies

### Fixed

#### v12.3.3 (2026-09-04)

- Fix concurrent installs sharing a store occasionally failing with an ENOENT error while importing a package file
- pnpm now runs through Node.js when it was installed by a tool that skips build scripts, such as Vercel's packageManager provisioning, Bun, Deno, or npm install --ignore-scripts

#### v12.3.4 (2026-09-04)

- Accept boolean settings as command-line flags on every command that takes them, such as --unsafe-perm, --offline, and --dangerously-allow-all-builds

#### v12.3.2 (2026-09-04)

- pnpm audit --fix update no longer aborts when a vulnerable package has no safe version inside its declared range and instead updates every package it can and lists the rest as remaining
- pnpm install no longer reruns root lifecycle scripts when the global virtual store contains an unfinished-build marker in a package slot that the current lockfile does not use
- pnpm run and pnpm exec now start without reinstalling on filesystems that keep sub-millisecond mtimes, such as NTFS
- pnpm self-update, pnpm with, and automatic package-manager version switching no longer wait through registry retry delays when a configured registry has no signatures and registry.npmjs.org is unavailable
- pnpm install now relinks workspace packages when publishConfig.linkDirectory changes
- The pnpm npm wrapper keeps its placeholder shebang-less so pnpm 11 can install pnpm 12 through the version store
- pnpm install now reports Already up to date when local tarball dependencies have not changed

#### v12.3.1 (2026-09-03)

- Fixed global commands such as node, npm, and yarn failing with unexpected argument '--shim' found after self-update from pnpm 12.2 to 12.3

#### v12.3.0 (2026-09-02)

- pnpm add <local directory>, pnpm add <local tarball>, pnpm add file:<path>, and pnpm add <tarball URL> work again
- Fixed pnpm deploy --legacy ignoring allowUnusedPatches supplied through --config.allow-unused-patches or the PNPM_CONFIG_ALLOW_UNUSED_PATCHES environment variable
- Fixed pnpm install --lockfile-only writing a lockfile that referenced a missing peer-suffixed snapshot when an npm-aliased dependency participated in a cyclic peer dependency graph
- Fixed pnpm dedupe to converge in one pass when re-resolving a lockfile created by pnpm 11
- Fixed detached child processes being terminated on Windows when another program launches pnpm directly without a shell
- Fixed pnpm docs <package>@<version> ignoring the requested version
- Fixed filtered and recursive pnpm run and pnpm exec hanging when a script reads from the terminal
- Fixed false unmet peer errors for auto-installed peers in linked workspace packages

#### v12.2.1 (2026-09-01)

- Restore the pnpm executable target without a file extension so pnpm 12.1 and earlier can upgrade to newer pnpm 12 releases on POSIX systems

#### v12.2.0 (2026-09-01)

- Fixed `pnpm audit --fix` failing with `ERR_PNPM_INVALID_FIX_OPTION` when used without a value, including when another flag follows it
- Fixed `pnpm audit --fix=override` ignoring the `saveExact` and `savePrefix` settings when writing vulnerability overrides
- Fixed detached child processes being terminated after successful commands on Windows
- Fixed `pnpm install --fix-lockfile` to derive its repair and filtered-merge views from one lockfile snapshot
- Fixed global virtual store hashes for dependency cycles so every package that transitively depends on an allowed build includes the engine in its store path
- Fixed `ERR_PNPM_CMD_SHIM_CHMOD` when several installs run at once against a shared global virtual store
- Fixed the PowerShell shim generated by `npm install -g pnpm` on Windows so it invokes the native `pnpm.exe` binary
- Fixed context-aware global shims on WSL2 so native Linux installations dispatch through the project runtime
- `pnpm install` no longer writes global `minimumReleaseAgeExclude` entries to the project's `pnpm-workspace.yaml`
- Fixed `catalog:` ranges in workspace package peer dependencies being reported as unmet
- Fixed the install progress line reporting `added 0` under `nodeLinker: hoisted`, even when packages were linked into `node_modules`
- An auto-installed optional peer is now resolved to a version its declared peer range accepts, even when the workspace root depends on that package at a version outside the range
- Fixed `pnpm run "/pattern/"` running matching scripts one at a time and now runs them concurrently up to `workspaceConcurrency`

## Release notes

### v12.3.3 — pnpm 12.3.3

- Date: 2026-09-04
- Version: v12.3.3
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.3
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v12.3.3

- **fixed** — Fix concurrent installs sharing a store occasionally failing with an ENOENT error while importing a package file
- **changed** — Speed up writing the lockfile in large workspaces
- **changed** — Speed up dependency resolution in large workspaces
- **fixed** — pnpm now runs through Node.js when it was installed by a tool that skips build scripts, such as Vercel's packageManager provisioning, Bun, Deno, or npm install --ignore-scripts

##### Patch Changes

- Fixed concurrent installs sharing a store occasionally failing with an ENOENT error while importing a package file [#14353](https://github.com/pnpm/pnpm/issues/14353).

- Sped up writing the lockfile in large workspaces [#14352](https://github.com/pnpm/pnpm/issues/14352).

- Sped up dependency resolution in large workspaces [#14352](https://github.com/pnpm/pnpm/issues/14352).

- pnpm now runs through Node.js when it was installed by a tool that skips build scripts, such as Vercel's `packageManager` provisioning, Bun, Deno, or `npm install --ignore-scripts`. Those installs previously failed with `syntax error near unexpected token ')'`. They still cannot run pnpm on Windows. On macOS only a shell can start it [#14346](https://github.com/pnpm/pnpm/issues/14346).

<!-- sponsors -->

##### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
        <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
            <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/notion.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/notion_light.svg" />
            <img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

##### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
            <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
            <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
        <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.3]_

### v12.3.4 — pnpm 12.3.4

- Date: 2026-09-04
- Version: v12.3.4
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.4
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v12.3.4

- **changed** — Speed up dependency resolution in large workspaces
- **fixed** — Accept boolean settings as command-line flags on every command that takes them, such as --unsafe-perm, --offline, and --dangerously-allow-all-builds
- **added** — pnpm remove now accepts --unsafe-perm flag

##### Patch Changes

- Sped up dependency resolution in large workspaces [#14352](https://github.com/pnpm/pnpm/issues/14352).

- pnpm 12 now accepts the boolean settings as command-line flags on every command that takes them in pnpm 11, for example `pnpm install --unsafe-perm`, `pnpm add foo --offline`, and `pnpm install --dangerously-allow-all-builds`. pnpm 12 rejected them with `unexpected argument`, which failed every install on Vercel, whose build runs `pnpm install --unsafe-perm` [#14346](https://github.com/pnpm/pnpm/issues/14346).

  `pnpm remove` now accepts `--unsafe-perm`, the same flag `pnpm install`, `pnpm add`, and `pnpm update` take.

<!-- sponsors -->

##### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
        <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
            <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/notion.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/notion_light.svg" />
            <img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

##### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
            <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
            <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
        <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
            <img src="https://pnpm.io

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.4]_

### v12.3.2 — pnpm 12.3.2

- Date: 2026-09-04
- Version: v12.3.2
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.2
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v12.3.2

- **fixed** — pnpm audit --fix update no longer aborts when a vulnerable package has no safe version inside its declared range and instead updates every package it can and lists the rest as remaining
- **fixed** — pnpm install no longer reruns root lifecycle scripts when the global virtual store contains an unfinished-build marker in a package slot that the current lockfile does not use
- **changed** — Sped up installs that have no lockfile by linking packages whose dependency subtree has no peer dependencies into the virtual store while resolution is still running
- **fixed** — pnpm run and pnpm exec now start without reinstalling on filesystems that keep sub-millisecond mtimes, such as NTFS
- **changed** — pnpm import now keeps the versions recorded in package-lock.json, npm-shrinkwrap.json, or yarn.lock when it generates pnpm-lock.yaml
- **changed** — pnpm import in a workspace now imports every workspace project into the shared lockfile
- **changed** — pnpm import now fails with ERR_PNPM_LOCKFILE_NOT_FOUND when none of the three source lockfiles is present and fails with ERR_PNPM_YARN_LOCKFILE_PARSE_FAILED when it cannot parse yarn.lock
- **changed** — pnpm import always resolves locally and warns when --pnpr-server or the pnpr-server setting is given
- **changed** — Sped up installs in large workspaces by optimizing workspace project discovery to no longer enumerate every matched directory
- **changed** — Sped up installs in large workspaces by reducing memory allocation in the resolver and peer pass for every dependency edge
- **fixed** — pnpm self-update, pnpm with, and automatic package-manager version switching no longer wait through registry retry delays when a configured registry has no signatures and registry.npmjs.org is unavailable
- **changed** — Sped up installs in large workspaces by making lockfile saving faster and finishing without waiting for memory cleanup
- **fixed** — pnpm install now relinks workspace packages when publishConfig.linkDirectory changes
- **fixed** — The pnpm npm wrapper keeps its placeholder shebang-less so pnpm 11 can install pnpm 12 through the version store
- **changed** — Sped up dependency resolution when there is no lockfile and for dependencies a lockfile does not cover
- **changed** — Sped up installs in large workspaces by deriving workspace link: targets and importer ids from the paths' suffixes under the workspace root
- **fixed** — pnpm install now reports Already up to date when local tarball dependencies have not changed
- **added** — pnpm update now accepts --ignore-scripts and skips lifecycle scripts during the update
- **changed** — Sped up installs that restore a deleted node_modules from a warm global virtual store by no longer re-linking packages that are already fully present in the global virtual store

##### Patch Changes

- `pnpm audit --fix update` no longer aborts when a vulnerable package has no safe version inside its declared range [#14508](https://github.com/pnpm/pnpm/issues/14508). The run updates every package it can and lists the rest as remaining.

- `pnpm install` no longer reruns root lifecycle scripts when the global virtual store contains an unfinished-build marker in a package slot that the current lockfile does not use [pnpm/pnpm#14485](https://github.com/pnpm/pnpm/issues/14485).

- Sped up installs that have no lockfile. pnpm now links packages whose dependency subtree has no peer dependencies into the virtual store while resolution is still running.

- `pnpm run` and `pnpm exec` now start without reinstalling on filesystems that keep sub-millisecond mtimes, such as NTFS. Previously, every run on those filesystems reinstalled first [pnpm/pnpm#14486](https://github.com/pnpm/pnpm/issues/14486).

- `pnpm import` now keeps the versions recorded in `package-lock.json`, `npm-shrinkwrap.json`, or `yarn.lock` when it generates `pnpm-lock.yaml`. A range in `package.json`, a catalog, or an override still decides which versions are eligible, and the recorded version is preferred among them. The generated lockfile previously could pin newer versions than the source lockfile [#14476](https://github.com/pnpm/pnpm/issues/14476).

  `pnpm import` in a workspace now imports every workspace project into the shared lockfile. It previously imported only the project in the current directory.

  `pnpm import` now fails with `ERR_PNPM_LOCKFILE_NOT_FOUND` when none of the three source lockfiles is present. It also fails with `ERR_PNPM_YARN_LOCKFILE_PARSE_FAILED` when it cannot parse `yarn.lock`. It previously generated a lockfile from scratch in both cases.

  `pnpm import` always resolves locally. It warns when `--pnpr-server` or the `pnpr-server` setting is given and does not use the server.

- Sped up installs in large workspaces. Discovering the workspace projects no longer enumerates every matched directory to learn which manifest files it holds [#14352](https://github.com/pnpm/pnpm/issues/14352).

- Sped up installs in large workspaces. The resolver and the peer pass allocate less for every dependency edge [#14352](https://github.com/pnpm/pnpm/issues/14352).

- `pnpm self-update`, `pnpm with`, and automatic package-manager version switching no longer wait through registry retry delays when a configured registry has no signatures and `registry.npmjs.org` is unavailable [#14483](https://github.com/pnpm/pnpm/issues/14483).

- Sped up installs in large workspaces. Saving the lockfile is faster, and the install finishes without waiting for memory cleanup [#14352](https://github.com/pnpm/pnpm/issues/14352).

- `pnpm install` now relinks workspace packages when `publishConfig.linkDirectory` changes. Frozen installs report an outdated lockfile until it is regenerated [pnpm/pnpm#14488](https://github.com/pnpm/pnpm/issues/14488).

- The pnpm npm wrapper keeps its placeholder shebang-less so pnpm 11 can install pnpm 12 through the version store. Wrapper installs must allow lifecycle scripts to install the native binary [#14502](https://github.com/pnpm/pnpm/issues/14502).

- Sped up dependency resolution when there is no lockfile, and for the dependencies a lockfile does not cover.

- Sped up installs in large workspaces. Workspace `link:` targets and importer ids are now derived from the paths' suffixes under the workspace root [#14352](https://github.com/pnpm/pnpm/issues/14352).

- `pnpm install` now reports "Already up to date" when local tarball dependencies have not changed [#14495](https://github.com/pnpm/pnpm/issues/14495).

- `pnpm update` now accepts `--ignore-scripts` and skips lifecycle scripts during the update [pnpm/pnpm#14512](https://github.com/pnpm/pnpm/issues/14512).

- Sped up installs that restore a deleted `node_modules` from a warm global virtual store. pnpm no longer re-links p

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.2]_

### v12.3.1 — pnpm 12.3.1

- Date: 2026-09-03
- Version: v12.3.1
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.1
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v12.3.1

- **fixed** — Fixed global commands such as node, npm, and yarn failing with unexpected argument '--shim' found after self-update from pnpm 12.2 to 12.3
- **changed** — Global commands now launch normally, and their first launch migrates the global bin directory to native shims
- **changed** — Sped up installs in large workspaces by deriving the anchor for re-rendering workspace link: targets once per project instead of once per dependency edge
- **changed** — Sped up installs in large workspaces by hashing project ordering paths by their raw bytes
- **changed** — Sped up installs in large workspaces by running lockfile verification checks for each project in parallel

##### Patch Changes

- Sped up installs in large workspaces: the anchor for re-rendering workspace `link:` targets is now derived once per project instead of once per dependency edge, and project ordering hashes paths by their raw bytes [#14352](https://github.com/pnpm/pnpm/issues/14352).

- After a self-update from pnpm 12.2 to 12.3, global commands such as `node`, `npm`, and `yarn` failed with `unexpected argument '--shim' found`. Global commands now launch normally, and their first launch migrates the global bin directory to native shims. When self-update downgrades to pnpm 12.2 or older, it keeps the newer native shims so those commands continue to work.

- Sped up installs in large workspaces. The check that verifies each project against the lockfile now runs the projects in parallel [#14352](https://github.com/pnpm/pnpm/issues/14352).

<!-- sponsors -->

##### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
        <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
            <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/notion.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/notion_light.svg" />
            <img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

##### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
            <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
            <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
        <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="h

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.1]_

### v12.3.0 — pnpm 12.3

- Date: 2026-09-02
- Version: v12.3.0
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.0
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v12.3.0

- **added** — Context-aware global commands (node, deno, bun, and shims created with pnpm shim add) are now native executables on every platform, allowing environment variables with non-shell-identifier names to reach these commands
- **added** — pnpm remove and pnpm update now accept --trust-lockfile, --no-trust-lockfile, --trust-policy, --trust-policy-exclude, and --trust-policy-ignore-after flags
- **added** — pnpm now honors --config.trust-lockfile=<value> and accepts bare --trust-lockfile / --no-trust-lockfile spelling on commands that previously took the setting from config file alone
- **added** — pnpm config now accepts -g/--global, --location, and --json before its subcommand
- **changed** — On Windows, <name>.exe replaces the .cmd and .ps1 shims for context-aware global commands
- **changed** — pnpm remove verifies the lockfile against active policies the way pnpm install does
- **changed** — Sped up installs in large workspaces by reading pnpm-lock.yaml while workspace projects are being discovered
- **changed** — Sped up installs in large workspaces by improving the lockfile update check to no longer compare every project against every lockfile entry
- **changed** — Sped up dependency resolution in large workspaces that use link: dependencies
- **changed** — Sped up dependency resolution in large workspaces by having the resolver build fewer lookup keys for each dependency
- **changed** — Improved peer dependency resolution performance when many packages reuse the same peer ranges
- **changed** — pnpm outdated and pnpm update now follow local actions and reusable workflows referenced with GitHub's self-repository syntax (uses: $/.github/actions/setup) when looking for outdated GitHub Actions
- **changed** — On Linux, pnpm now resolves registry hostnames through the system resolver (getaddrinfo) instead of the bundled pure-Rust resolver
- **fixed** — pnpm add <local directory>, pnpm add <local tarball>, pnpm add file:<path>, and pnpm add <tarball URL> work again
- **fixed** — Fixed pnpm deploy --legacy ignoring allowUnusedPatches supplied through --config.allow-unused-patches or the PNPM_CONFIG_ALLOW_UNUSED_PATCHES environment variable
- **fixed** — Fixed pnpm install --lockfile-only writing a lockfile that referenced a missing peer-suffixed snapshot when an npm-aliased dependency participated in a cyclic peer dependency graph
- **fixed** — Fixed pnpm dedupe to converge in one pass when re-resolving a lockfile created by pnpm 11
- **fixed** — Fixed detached child processes being terminated on Windows when another program launches pnpm directly without a shell
- **fixed** — Fixed pnpm docs <package>@<version> ignoring the requested version
- **fixed** — Fixed filtered and recursive pnpm run and pnpm exec hanging when a script reads from the terminal
- **fixed** — Fixed false unmet peer errors for auto-installed peers in linked workspace packages

##### Minor Changes

- Every context-aware global command (`node`, `deno`, `bun`, and the shims created with `pnpm shim add`) is now a native executable on every platform, so environment variables whose names are not valid shell identifiers reach these commands. On Windows, `<name>.exe` replaces the `.cmd` and `.ps1` shims for them. Shims written by earlier pnpm 12 releases are migrated on the next global install or self-update.

- `pnpm remove` and `pnpm update` now accept `--trust-lockfile`, `--no-trust-lockfile`, `--trust-policy`, `--trust-policy-exclude` and `--trust-policy-ignore-after`, the same flags `pnpm install` and `pnpm add` take, so the supply-chain settings can be overridden for a single run. `pnpm remove` verifies the lockfile against the active policies the way `pnpm install` does, and `--trust-lockfile` skips that pass for every entry, not only the package being removed.

  `pnpm` now also honors `--config.trust-lockfile=<value>`, and accepts the bare `--trust-lockfile` / `--no-trust-lockfile` spelling on the commands that previously took the setting from the config file alone.

##### Patch Changes

- `pnpm add <local directory>`, `pnpm add <local tarball>`, `pnpm add file:<path>` and `pnpm add <tarball URL>` work again. A specifier given without a `<name>@` prefix is no longer read as a registry package name and rejected with `ERR_PNPM_PACKAGE_MANAGER_ADD_RESOLVE_LATEST` [#14437](https://github.com/pnpm/pnpm/issues/14437).

- Fixed `pnpm deploy --legacy` ignoring `allowUnusedPatches` supplied through `--config.allow-unused-patches` or the `PNPM_CONFIG_ALLOW_UNUSED_PATCHES` environment variable [pnpm/pnpm#14450](https://github.com/pnpm/pnpm/issues/14450).

- Fixed `pnpm install --lockfile-only` writing a lockfile that referenced a missing peer-suffixed snapshot when an npm-aliased dependency took part in a cyclic peer dependency graph. The following `pnpm install --frozen-lockfile` failed with `ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY` [#14449](https://github.com/pnpm/pnpm/issues/14449).

- `pnpm config` now accepts `-g`/`--global`, `--location`, and `--json` before its subcommand [pnpm/pnpm#14421](https://github.com/pnpm/pnpm/issues/14421).

- `pnpm dedupe` now converges in one pass when it re-resolves a lockfile created by pnpm 11, so a second run no longer changes the lockfile [#14455](https://github.com/pnpm/pnpm/issues/14455).

- Fixed detached child processes being terminated on Windows when another program launches `pnpm` directly, without a shell, as `nr` from `@antfu/ni` does [#14447](https://github.com/pnpm/pnpm/issues/14447).

- Fixed `pnpm docs <package>@<version>` ignoring the requested version. It now opens the selected version's homepage and reports a missing version instead of opening the package-level homepage [pnpm/pnpm#14428](https://github.com/pnpm/pnpm/issues/14428).

- Sped up installs in large workspaces. `pnpm-lock.yaml` is now read while the workspace projects are being discovered [#14352](https://github.com/pnpm/pnpm/issues/14352).

- Fixed filtered and recursive `pnpm run` and `pnpm exec` hanging when a script reads from the terminal. Interactive prompts work again in a script that pnpm never runs alongside another one, such as a single `--filter`ed project, `--workspace-concurrency=1`, a dependency chain, or a task declaring `concurrency: 1` [#14397](https://github.com/pnpm/pnpm/issues/14397).

- Fixed false unmet peer errors for auto-installed peers in linked workspace packages.

- Fixed npm global installs on Windows so the PowerShell shims invoke `pnpm.exe`.

- Fixed `pnpm with current <command>` when global options precede it, such as `pnpm --workspace-root with current --version` [pnpm/pnpm#14413](https://github.com/pnpm/pnpm/issues/14413).

  A short-option cluster that mixes a global flag with an option owned by the command, such as `pnpm -ro dist pack-app`, is now parsed like the same options written after the command.

  An option written bef

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.0]_

### v12.2.1 — pnpm 12.2.1

- Date: 2026-09-01
- Version: v12.2.1
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v12.2.1
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v12.2.1

- **fixed** — Restore the pnpm executable target without a file extension so pnpm 12.1 and earlier can upgrade to newer pnpm 12 releases on POSIX systems

##### Patch Changes

- Restored the `pnpm` executable target without a file extension so pnpm 12.1 and earlier can upgrade to newer pnpm 12 releases on POSIX systems.

<!-- sponsors -->

##### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
        <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
            <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/notion.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/notion_light.svg" />
            <img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

##### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
        <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
            <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
            <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
        <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
            <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
        <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
          <picture>
            <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
            <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/i

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v12.2.1]_

### v12.2.0 — pnpm 12.2

- Date: 2026-09-01
- Version: v12.2.0
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v12.2.0
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v12.2.0

- **added** — Catalogs can now resolve workspace dependencies through the `workspace:` protocol
- **fixed** — Fixed `pnpm audit --fix` failing with `ERR_PNPM_INVALID_FIX_OPTION` when used without a value, including when another flag follows it
- **fixed** — Fixed `pnpm audit --fix=override` ignoring the `saveExact` and `savePrefix` settings when writing vulnerability overrides
- **changed** — Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with URL-scoped npm registry credentials, including bearer tokens, basic auth, and `tokenHelper`
- **fixed** — Fixed detached child processes being terminated after successful commands on Windows
- **changed** — Sped up installs in large workspaces by resolving each named `workspace:` dependency once and reusing it across every project that declares it
- **fixed** — Fixed `pnpm install --fix-lockfile` to derive its repair and filtered-merge views from one lockfile snapshot
- **changed** — Load pnpmfile `updateConfig` hooks before packing so hook-provided catalogs resolve in `pnpm pack`, `pnpm publish`, and `pnpm stage publish`
- **changed** — `pnpm deploy` no longer requires `injectWorkspacePackages` to be enabled and now reports `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER` when a peer resolves to more than one version
- **fixed** — Fixed global virtual store hashes for dependency cycles so every package that transitively depends on an allowed build includes the engine in its store path
- **fixed** — Fixed `ERR_PNPM_CMD_SHIM_CHMOD` when several installs run at once against a shared global virtual store
- **fixed** — Fixed the PowerShell shim generated by `npm install -g pnpm` on Windows so it invokes the native `pnpm.exe` binary
- **fixed** — Fixed context-aware global shims on WSL2 so native Linux installations dispatch through the project runtime
- **fixed** — `pnpm install` no longer writes global `minimumReleaseAgeExclude` entries to the project's `pnpm-workspace.yaml`
- **fixed** — Fixed `catalog:` ranges in workspace package peer dependencies being reported as unmet
- **changed** — `globalDir` and `globalBinDir` are honored wherever they are set and the global `config.yaml` is read again with environment variables and tilde expansion support
- **fixed** — Fixed the install progress line reporting `added 0` under `nodeLinker: hoisted`, even when packages were linked into `node_modules`
- **fixed** — An auto-installed optional peer is now resolved to a version its declared peer range accepts, even when the workspace root depends on that package at a version outside the range
- **fixed** — Fixed `pnpm run "/pattern/"` running matching scripts one at a time and now runs them concurrently up to `workspaceConcurrency`
- **changed** — Speed up workspace discovery for literal directories and conventional trailing-star patterns with wildcard no longer matching dot-prefixed directories

##### Minor Changes

- Catalogs can now resolve workspace dependencies through the `workspace:` protocol.

##### Patch Changes

- Fixed `pnpm audit --fix` failing with `ERR_PNPM_INVALID_FIX_OPTION` when used without a value, including when another flag follows it, as in `pnpm audit --fix --json` [#13261](https://github.com/pnpm/pnpm/issues/13261). Fixed `pnpm audit --fix=override` ignoring the `saveExact` and `savePrefix` settings when writing vulnerability overrides [#11523](https://github.com/pnpm/pnpm/issues/11523).

- Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with URL-scoped npm registry credentials, including bearer tokens, basic auth, and `tokenHelper` [pnpm/pnpm#14334](https://github.com/pnpm/pnpm/issues/14334).

- Fixed detached child processes being terminated after successful commands on Windows.

- Sped up installs in large workspaces by resolving each named `workspace:` dependency (`workspace:*`, `workspace:^`, `workspace:1.2.3`) once and reusing it across every project that declares it, instead of re-resolving it per project.

- Fixed `pnpm install --fix-lockfile` to derive its repair and filtered-merge views from one lockfile snapshot.

- Load pnpmfile `updateConfig` hooks before packing so hook-provided catalogs resolve in `pnpm pack`, `pnpm publish`, and `pnpm stage publish` [pnpm/pnpm#14377](https://github.com/pnpm/pnpm/issues/14377).

- `pnpm deploy` no longer requires `injectWorkspacePackages` to be enabled. A linked workspace dependency is rewritten to a `file:` dependency in the dedicated deploy lockfile, and the peer dependencies it declares are bound to the deployed graph's own resolution.

  When a peer resolves to more than one version in that graph the binding is ambiguous, and choosing between the candidates is exactly what injecting the package would have decided, so the deploy still fails — now with `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER`, which names the package, the peer, and the competing versions, instead of refusing every non-injected workspace up front, and suggests pinning the peer to one version with an `overrides` entry as the way to keep deploying without injection [#9386](https://github.com/pnpm/pnpm/issues/9386).

- Fixed global virtual store hashes for dependency cycles. Every package that transitively depends on an allowed build now includes the engine in its store path, independent of traversal order [pnpm/pnpm#14341](https://github.com/pnpm/pnpm/issues/14341).

- Fixed `ERR_PNPM_CMD_SHIM_CHMOD` when several installs run at once against a shared global virtual store. One install could remove a command shim while another was making it executable ([pnpm/pnpm#14353](https://github.com/pnpm/pnpm/issues/14353)).

- Fixed the PowerShell shim generated by `npm install -g pnpm` on Windows so it invokes the native `pnpm.exe` binary [pnpm/pnpm#14362](https://github.com/pnpm/pnpm/issues/14362).

- Fixed context-aware global shims on WSL2 so native Linux installations dispatch through the project runtime.

- `pnpm install` no longer writes global `minimumReleaseAgeExclude` entries to the project's `pnpm-workspace.yaml` [pnpm/pnpm#14347](https://github.com/pnpm/pnpm/issues/14347).

- Fixed `catalog:` ranges in workspace package peer dependencies being reported as unmet [pnpm/pnpm#14361](https://github.com/pnpm/pnpm/issues/14361).

- `globalDir` and `globalBinDir` are honored wherever they are set, so `pnpm add -g` no longer fails with `ERR_PNPM_GLOBAL_BIN_DIR_NOT_IN_PATH` after `pnpm config set -g global-bin-dir` [#14336](https://github.com/pnpm/pnpm/issues/14336). The global `config.yaml` is read again, `PNPM_CONFIG_GLOBAL_DIR` / `PNPM_CONFIG_GLOBAL_BIN_DIR` reach the directories derived from them, and a leading `~/` is expanded before that derivation. A project's `pnpm-workspace.yaml` still cannot set either key.

- Fixed the install progress line reporting `added 0` under `nodeLinker: hoisted`, even when packages were linked into `node_modul

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v12.2.0]_

### v12.1.0 — pnpm 12.1

- Date: 2026-08-29
- Version: v12.1.0
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v12.1.0
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v12.1.0

- **changed** — pnpm login and pnpm adduser now record the granted token in the global config.yaml under the _auth setting, with --scope's scope routed to that registry under registries
- **changed** — pnpm logout removes tokens from the global config.yaml and still removes them from auth.ini written by earlier versions
- **changed** — A scope set in a project's pnpm-workspace.yaml is now ignored with a warning
- **changed** — Verified remote build artifacts are persisted in the shared store with their signed origin metadata and reverified against current trust, policy, platform, and source before reuse
- **added** — Persist completed recursive tasks so --resume-from skips exactly the work that passed during a matching interrupted or failed pnpm -r run or pnpm -r exec invocation
- **changed** — Workspace install, rebuild, pack, publish, stage, and lifecycle work now starts as soon as its dependencies finish instead of waiting for an unrelated topological group
- **added** — Added per-task concurrency limits to workspace task orchestration via tasks.<name>.concurrency in pnpm-workspace.yaml
- **changed** — sideEffectsCache now declares the whole of how a package's build output is reused with read, write, and remote tier settings
- **changed** — sideEffectsCacheReadonly: true now blocks writing to the cache
- **changed** — Setting sideEffectsCacheReadonly alongside sideEffectsCache: false gives a read-only view rather than switching the cache off
- **added** — A cache can now be declared write-only to populate one the run does not read
- **changed** — pnpm -r run and pnpm -r exec now schedule per task instead of in topological chunks using a new tasks section in pnpm-workspace.yaml
- **added** — A dependency cycle among the tasks of a run is now an error naming the participating tasks instead of silently running in an arbitrary order
- **added** — Setting ignoreWorkspaceCycles: true downgrades task cycle errors to warnings
- **changed** — --resume-from now skips exactly the transitive dependencies of the anchor package
- **changed** — Under --no-bail, tasks whose dependencies failed are reported as skipped instead of failed
- **added** — pnpm -r run --dry-run <script> prints the task graph that would execute without running anything
- **added** — Added macOS and Windows x64 and arm64 support to remote shared build artifacts
- **changed** — Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject

##### Minor Changes

- `pnpm login` and `pnpm adduser` now record the granted token in the global `config.yaml`, under the `_auth` setting, with `--scope`'s scope routed to that registry under `registries`. `pnpm logout` removes it from there, and still from an `auth.ini` an earlier version wrote. Tokens already in `auth.ini` keep working.

- A `scope` set in a project's `pnpm-workspace.yaml` is now ignored, with a warning naming where to set it instead. `pnpm login` records the scope as a `@scope:registry` route in the machine-global `auth.ini`, which outranks `~/.npmrc` in every project — so a repository-committed file could redirect a scope such as `@acme` for all of a user's other projects after one routine login. Use `--scope`, the `PNPM_CONFIG_SCOPE` environment variable, or the global config file instead [#13557](https://github.com/pnpm/pnpm/issues/13557).

- Verified remote build artifacts are persisted in the shared store with their signed origin metadata. Later installs reverify the artifact against current trust, policy, platform, and source before reuse, while invalid remote variants are quarantined per channel ([pnpm/pnpm#13771](https://github.com/pnpm/pnpm/issues/13771)).

- Persist completed recursive tasks so `--resume-from` skips exactly the work that passed during a matching interrupted or failed `pnpm -r run` / `pnpm -r exec` invocation. When no compatible state exists, pnpm retains its graph-based resume behavior.

- Workspace install, rebuild, pack, publish, stage, and lifecycle work now starts as soon as its dependencies finish instead of waiting for an unrelated topological group.

- Added per-task concurrency limits to workspace task orchestration. Set `tasks.<name>.concurrency` in `pnpm-workspace.yaml` to limit how many instances of that task may run across workspace projects at once:

  ```yaml
  tasks:
    build:
      concurrency: 2
  ```

- `sideEffectsCache` now declares the whole of how a package's build output is reused — whether one is restored, whether one is saved, and the remote tier that shares it between machines:

  ```yaml
  sideEffectsCache:
    read: true
    write: true
    remote:
      org: acme
      packages: ['native-addon']
  ```

  `sideEffectsCache: true`, `sideEffectsCacheReadonly`, `remoteSideEffectsCache`, and its `organization` field all keep working. Where a field is set under both spellings the one above wins; where it is set under only one, it is kept.

  Two behaviors change, both bringing this CLI in line with what the Rust one already did: `sideEffectsCacheReadonly: true` now blocks writing to the cache, and setting it alongside `sideEffectsCache: false` gives a read-only view rather than switching the cache off entirely. A cache can also be declared write-only now, to populate one the run does not read.

- Workspace task orchestration ([pnpm/rfcs#23](https://github.com/pnpm/rfcs/pull/23)). `pnpm -r run` and `pnpm -r exec` now schedule per task instead of in topological chunks: a task starts as soon as the tasks it depends on have finished, so a project no longer waits for unrelated projects that happen to share its chunk.

  A new `tasks` section in `pnpm-workspace.yaml` declares what a task depends on, using the `^` convention:

  ```yaml
  tasks:
    build:
      dependsOn: ['^build']
    test:
      dependsOn: ['build']
    lint: {}
  ```

  `^name` means the named task in each of the project's workspace dependencies; a bare `name` means the task in the same project; an entry with no `dependsOn` declares an empty dependency list. A task with no entry behaves as `dependsOn: ['^<its own name>']`, which is exactly what the previous chunked ordering implied — an unconfigured workspace gets the scheduler improvement and nothing else changes meaning. A project without the script is reported skipped and passes its edges through to its own dependencies, so a scriptless package does not sever a chain.

  Also part of this

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v12.1.0]_

### v12.0.0 — pnpm 12

- Date: 2026-08-26
- Version: v12.0.0
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v12.0.0
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v12.0.0

- **changed** — Git dependencies on known hosts are now treated as identities rather than transport choices, resolving through the host's canonical HTTPS URL and never recording SSH URLs in the lockfile
- **changed** — Unrecognized settings in pnpm-workspace.yaml are now reported as errors when the project pins a pnpm version, with warnings elsewhere
- **changed** — Dependency cycles are now broken canonically during peer resolution, producing byte-identical lockfiles regardless of importer or resolution order
- **changed** — packageImportMethod: auto now tries hardlinks before cloning on Linux for faster node_modules materialization
- **changed** — Under engineStrict, installs now fail when an incompatible package is reached through a regular dependencies edge of an installable package, even when that subtree hangs off optionalDependencies

##### Major Changes

- Git dependencies on known hosts (GitHub, GitLab, Bitbucket) are now treated as identities rather than transport choices. Every representation of the same repository — `github:owner/repo`, `owner/repo`, `git+https://…`, `git+ssh://git@…` — resolves through the host's canonical HTTPS URL, and the lockfile never records an SSH URL for them. Repositories whose archive endpoint is anonymously reachable resolve to the host's archive (fast tarball download); all others resolve to a `git` clone of the canonical HTTPS URL, which every machine with access to the repository can fetch.

  To reach a private hosted repository over SSH, configure the machine (not the project) with git's own URL rewriting, for example:

  ```sh
  git config --global url."git@github.com:".insteadOf https://github.com/
  ```

  pnpm shells out to `git`, so the rewrite applies to all of pnpm's git operations automatically. URLs of unknown hosts (self-hosted servers) are unaffected and keep their exact URL, including SSH. URLs with embedded credentials are also kept verbatim and never resolve to a host archive.

  This removes the network probing that previously decided between HTTPS and SSH at resolution time, which could record a transport that only worked on the machine that happened to run the resolution (e.g. an SSH URL that broke CI runners without SSH keys).

- A project's `pnpm-workspace.yaml` may no longer carry a setting pnpm does not recognize. Such a setting used to be ignored in silence — a misspelled `minimumReleaseAge` dropped the policy it was meant to set, and nothing said so. Now it is reported, suggesting the closest real setting name when the key looks like a typo, and it fails the command with `ERR_PNPM_UNRECOGNIZED_WORKSPACE_SETTINGS` when the project pins a pnpm version the running pnpm satisfies: with the pin honored, the setting cannot be meant for a different pnpm version, so it is a mistake to fix rather than a key to ignore. Everywhere else it is a warning, so a project that has yet to be cleaned up keeps working.

  The `pnpm config` subcommands never fail on such a setting, so a broken file can still be inspected and repaired, and `pnpm config get <key>` prints the value with no warnings at all. Keys the global config file cannot set are likewise split between workspace-only settings (still directed to `pnpm-workspace.yaml`) and settings unknown to this version.

- Dependency cycles are now broken canonically during peer resolution: the members of each cycle are ordered by package id, and the edges that close a cycle are always cut at the same place, no matter where the installation walks into the cycle from. Previously the cut depended on the walk path, so installing the same dependencies could produce different lockfiles depending on importer order or resolution order [#13846](https://github.com/pnpm/pnpm/issues/13846), and a peer-resolution verdict computed for one occurrence of a cyclic package could be wrongly reused at another [#13865](https://github.com/pnpm/pnpm/issues/13865).

  With canonical cycle breaking the lockfile is a pure function of the dependency graph: repeated installs, reordered importers, and reordered dependencies all produce byte-identical lockfiles. Peer dependencies of packages inside a cycle keep nearest-wins resolution along the canonical order, and a dependency edge that closes a cycle references an occurrence of its target resolved at the importer level. On large cycle-heavy workspaces peer resolution is 2–3× faster, uses about 25% less memory, and produces a substantially smaller lockfile (fewer redundant peer variants).

  Existing lockfiles keep working: headless (`--frozen-lockfile`) installs consume them unchanged, and installs that skip resolution leave them untouched. The first install that actually re-resolves (for example after a dependency change) re-keys walk-order-dependent peer variants of cyclic packages once.

- `packageImportMethod: auto`

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v12.0.0]_