# pnpm v11.22.0 — pnpm 11.22

- Product: pnpm (https://whatsnew.fyi/product/pnpm)
- Vendor: pnpm
- Date: 2026-08-15
- Version: v11.22.0
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v11.22.0
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v11.22.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add `pnpm cache path` command to print the directory pnpm uses for its metadata cache, including the lockfile verification log
- **changed** — Remove `--config.config-dir` and other `--config.` spellings for settings from project manifest resolution; use dedicated flags like `--dir` and `--global-dir` instead
- **changed** — Make `pnpm config set` refuse to write machine-level state settings to `pnpm-workspace.yaml` and fail with `ERR_PNPM_CONFIG_SET_NOT_A_PROJECT_SETTING`
- **added** — Add `minimumReleaseAgeExcludePrune` setting to prune unused entries from `minimumReleaseAgeExclude` during `pnpm add`, `pnpm update`, and `pnpm remove`
- **changed** — Rename `cleanupUnusedCatalogs` to `catalogPrune` for consistency with release-age exclude pruning vocabulary
- **changed** — Ignore `configDir`, `bin`, `dir`, `globalBinDir`, `globalDir`, `npmrcAuthFile`, `pnpmHomeDir`, `stateDir`, `userconfig`, and `workspaceDir` settings in `pnpm-workspace.yaml` and warn about them if found
- **changed** — Speed up Node.js runtime version resolution by caching per-version release metadata in the pnpm cache directory after signature verification
- **fixed** — Fix intermittent `ERR_PNPM_ENOENT` and `ERR_PNPM_ENOTEMPTY` errors while renaming `_tmp_*` directories during installation with `nodeLinker: hoisted` in workspaces using `patchedDependencies`
- **changed** — Optimize `pnpm add` to skip re-resolving the dependency graph when `pnpm-lock.yaml` already holds a satisfying version
- **changed** — Make global installs switch over atomically by pointing shims at stable per-package links instead of install-specific directories
- **fixed** — Fix `pnpm audit --fix` to not add `minimumReleaseAgeExclude` entries for patched versions published before the `minimumReleaseAge` cutoff
- **changed** — Make `pnpm add <pkg>@<version>` and `pnpm update <pkg>@<version>` under non-manual `catalogMode` move the catalog entry's resolution to the requested version

##### Minor Changes

* Added `pnpm cache path`, which prints the directory pnpm uses for its metadata cache. CI setups can use it to cache that directory — including the lockfile verification log, which lets a job skip re-checking an unchanged lockfile against the configured supply-chain policies.

* `--config.config-dir` no longer reaches the config through a project's `pnpm-workspace.yaml`, and neither do the `--config.` spellings of the other settings a project manifest may no longer contribute (`--config.pnpm-home-dir`, `--config.workspace-dir`, `--config.global-pkg-dir`, `--config.root-project-manifest-dir`). None of them was ever a supported way to set those directories: pnpm resolves them from the environment, and these flags took effect only because the project-manifest merge re-applied the command line afterwards. The dedicated flags, such as `--dir` and `--global-dir`, are unaffected [#13629](https://github.com/pnpm/pnpm/issues/13629).

* `pnpm config set` refuses to write a setting to a project's `pnpm-workspace.yaml` that pnpm does not read from there, rather than leaving a key in the file that does nothing. Those settings are `configDir`, `pnpmHomeDir`, `stateDir` and the others that name machine-level state. The command fails with `ERR_PNPM_CONFIG_SET_NOT_A_PROJECT_SETTING`, naming where the setting does belong when it belongs somewhere. `pnpm config delete` still clears one that a file already carries, in whichever spelling it uses [#13629](https://github.com/pnpm/pnpm/issues/13629).

* Added a new setting `minimumReleaseAgeExcludePrune`. When enabled, `pnpm add`, `pnpm update`, and `pnpm remove` prune the entries of `minimumReleaseAgeExclude` in `pnpm-workspace.yaml` that the freshly written lockfile no longer resolves: versions that are gone are dropped (an entry is removed once none of its versions remain), and entries for packages that are no longer in the lockfile are removed too. Name patterns (`@scope/*`) are always kept. The cleanup is skipped when the install's lockfile does not cover the whole workspace (`sharedWorkspaceLockfile: false`), since entries another project still needs would look stale.

  Renamed `cleanupUnusedCatalogs` to `catalogPrune`, so that catalog pruning and release-age exclude pruning use one vocabulary. `cleanupUnusedCatalogs` continues to work; when both are set, `catalogPrune` wins.

* A project's `pnpm-workspace.yaml` can no longer choose where pnpm keeps its credentials, its own installation, or the registry it downloads its next version from. One of those settings is `configDir`, which decided where `pnpm login` writes the granted token. `bin`, `dir`, `globalBinDir`, `globalDir`, `npmrcAuthFile`, `pnpmHomeDir`, `stateDir`, `userconfig` and `workspaceDir` are ignored there now too, and pnpm warns about the ones it finds. `cacheDir` and `storeDir` are unaffected [#13629](https://github.com/pnpm/pnpm/issues/13629).

* Resolving a Node.js runtime version (`devEngines.runtime` / `runtime:` specifiers) is now much faster: the per-version release metadata is cached in the pnpm cache directory after its signature is verified, and an exact stable version such as `runtime:22.23.2` no longer downloads the Node.js release index. A pinned runtime whose metadata was fetched once resolves without any network access, which removes the noticeable delay on the first `node` invocation in a project pinning an already-downloaded runtime [#13899](https://github.com/pnpm/pnpm/issues/13899).

##### Patch Changes

* Fixed intermittent `ERR_PNPM_ENOENT` and `ERR_PNPM_ENOTEMPTY` errors while renaming `_tmp_*` directories during installation with `nodeLinker: hoisted`, in workspaces that also use `patchedDependencies`.

* `pnpm add` no longer re-resolves the dependency graph when `pnpm-lock.yaml` already holds a version satisfying the request — promoting a transitive dependency to a direct one, or adding to a second workspace package what a first one already depends on, now only save

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v11.22.0]_