# pnpm v11.21.0 — pnpm 11.21

- Product: pnpm (https://whatsnew.fyi/product/pnpm)
- Vendor: pnpm
- Date: 2026-08-09
- Version: v11.21.0
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v11.21.0
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v11.21.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Added interactive group selection to pnpm update --global --interactive
- **changed** — Running pnpm setup, pnpm self-update, or a command that modifies the global installation through sudo now prints a warning
- **fixed** — Fixed pnpm failing to start under asynchronous Node.js module loaders when no .pnpmfile.mjs exists
- **fixed** — Fixed minimumReleaseAge fallback for custom dist-tags so the selected version does not exceed the registry's original tag target
- **fixed** — Removing a dependency from package.json and reinstalling no longer re-resolves the dependency graph
- **fixed** — Changing a catalog entry to a different exact version no longer re-resolves the dependency graph
- **fixed** — Fixed github:owner/repo dependencies and other shorthand Git specifiers failing to install with Permission denied (publickey) on CI runners that lack SSH keys
- **fixed** — ng build and nuxt build now work under the global virtual store with built-in compatibility extensions adding required dependencies
- **fixed** — Fixed link: dependencies under enableGlobalVirtualStore so linked children are materialized and slots remain isolated
- **fixed** — An install that skips resolution because pnpm-lock.yaml is already up to date now reacts fully to packages the lockfile removed
- **fixed** — The held-back-update warning printed by pnpm update no longer fires when minimumReleaseAge is the actual reason a newer version was not picked
- **fixed** — Checking whether ignoredOptionalDependencies is up to date no longer reorders the configured patterns
- **fixed** — Changing autoInstallPeers, dedupePeers, peersSuffixMaxLength, excludeLinksFromLockfile, or injectWorkspacePackages no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it

##### Minor Changes

* Added interactive group selection to `pnpm update --global --interactive`.

* Running `pnpm setup`, `pnpm self-update`, or a command that modifies the global installation (such as `pnpm add --global`) through `sudo` now prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail with `ERR_PNPM_SUDO_NOT_SUPPORTED` in pnpm v12. Read-only global commands (such as `pnpm bin --global`) are unaffected.

##### Patch Changes

* Fixed pnpm failing to start under asynchronous Node.js module loaders when no `.pnpmfile.mjs` exists [pnpm/pnpm#11701](https://github.com/pnpm/pnpm/issues/11701).

* Fixed `minimumReleaseAge` fallback for custom dist-tags so the selected version does not exceed the registry’s original tag target.

* Removing a dependency from `package.json` and reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped from `pnpm-lock.yaml`, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune.

* Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in `pnpm-lock.yaml` directly, reusing the same check the `pnpm.overrides` fast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions.

* Fixed a CI regression where `github:owner/repo` dependencies (and other shorthand Git specifiers) would fail to install with `Permission denied (publickey)` on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. `git+ssh://` or `git@host:...`):

  * The repository visibility probe (an HTTP HEAD request) now retries transient failures such as `429 Too Many Requests`, so host throttling of CI runners is no longer mistaken for a private repository.
  * For non-SSH specifiers, anonymous HTTPS `git ls-remote` access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured.
  * When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL.
  * A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. `codeload.github.com`, which would fail to download for a private repository); it stays a regular `git` resolution so installs can use ambient Git credentials such as credential helpers and tokens.

  Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL.

  Fixes [pnpm/pnpm#13276](https://github.com/pnpm/pnpm/issues/13276).

  <!-- cspell:ignore publickey -->

* `ng build` and `nuxt build` now work under the global virtual store: pnpm's built-in compatibility extensions add the `tslib` dependency that `@angular/build` uses without declaring and the `unplugin` dependency that `@nuxt/vite-builder` v4 uses without declaring.

* Fixed `link:` dependencies under `enableGlobalVirtualStore` so linked children are materialized and slots remain isolated by their resolved link targets.

* An install that skips resolution because `pnpm-lock.yaml` is already up

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v11.21.0]_