# pnpm v11.25.0 — pnpm 11.25

- Product: pnpm (https://whatsnew.fyi/product/pnpm)
- Vendor: pnpm
- Date: 2026-08-29
- Version: v11.25.0
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v11.25.0
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v11.25.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally with the new remoteSideEffectsCache setting
- **added** — Added macOS and Windows x64 and arm64 support to remote shared build artifacts
- **added** — Added the audit.ignorePrune setting to remove ignored GHSA entries that no longer appear in the audit report when pnpm audit --fix is run with it set to true
- **added** — Added explicit registry revision selection with <version>+rN and pnpm update --patches for refreshing revision artifacts without changing package versions
- **added** — Added per-task concurrency limits to workspace task orchestration with tasks.<name>.concurrency in pnpm-workspace.yaml
- **added** — Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the registries setting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts
- **changed** — Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject with dependency side effects using package and source-integrity subjects and workspace tasks using project and task subjects
- **changed** — pnpm init now pins the latest pnpm version from the latest tag on package-manager registries instead of the version of pnpm that ran the command
- **changed** — A scope set in a project's pnpm-workspace.yaml is now ignored with a warning, requiring --scope, PNPM_CONFIG_SCOPE environment variable, or the global config file instead
- **changed** — Workspace install, rebuild, pack, publish, stage, and lifecycle work now starts as soon as its dependencies finish instead of waiting for an unrelated topological group
- **changed** — sideEffectsCache now declares the whole of how a package's build output is reused including whether one is restored, whether one is saved, and the remote tier that shares it between machines
- **changed** — sideEffectsCacheReadonly: true now blocks writing to the cache, and setting it alongside sideEffectsCache: false gives a read-only view rather than switching the cache off entirely
- **fixed** — Verified remote build artifacts are persisted in the shared store with their signed origin metadata and reverified against current trust, policy, platform, and source before reuse on later installs
- **added** — pnpm stage approve now approves several staged packages at once and asks for a one-time password only once per batch
- **added** — Allowed pnpm update --patches to refresh registry revisions through a configured pnpr server while retaining locked package versions
- **added** — Persist completed recursive tasks so --resume-from skips exactly the work that passed during a matching interrupted or failed pnpm -r run or pnpm -r exec invocation

##### Minor Changes

* Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally.

  Configure it with the new `remoteSideEffectsCache` setting. A workspace names the eligible `organization` and `packages`; everything describing the act of signing — `publish`, `keyId`, `builderId`, `trustedKeys`, `privateKey` and the provenance fields — is refused in `pnpm-workspace.yaml` and read from the global config file or the environment instead.

* Added macOS and Windows x64 and arm64 support to remote shared build artifacts [pnpm/pnpm#13771](https://github.com/pnpm/pnpm/issues/13771).

* Added the `audit.ignorePrune` setting. When set to `true`, `pnpm audit --fix` removes ignored GHSA entries that no longer appear in the audit report.

* Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject. Dependency side effects use package and source-integrity subjects, while workspace tasks use project and task subjects.

  This changes shared-artifact request bodies and signed payloads. A pnpr server and its clients have to be on matching versions.

* `pnpm init` now pins the latest pnpm version, instead of the version of pnpm that ran the command. A project scaffolded by an outdated pnpm therefore no longer inherits that staleness through its own `devEngines.packageManager` / `packageManager` pin [#7490](https://github.com/pnpm/pnpm/issues/7490).

  The version is read from the `latest` tag on the package-manager registries. When that lookup cannot answer — no network, an unreachable or slow registry, `offline`, or a `latest` that the `minimumReleaseAge` / `trustPolicy` settings reject — `pnpm init` pins the running version as before, and never fails or hangs on the lookup. A `latest` that is older than the running pnpm is never pinned either.

* A `scope` set in a project's `pnpm-workspace.yaml` is now ignored, with a warning naming where to set it instead. `pnpm login` records the scope as a `@scope:registry` route in the machine-global `auth.ini`, which outranks `~/.npmrc` in every project — so a repository-committed file could redirect a scope such as `@acme` for all of a user's other projects after one routine login. Use `--scope`, the `PNPM_CONFIG_SCOPE` environment variable, or the global config file instead [#13557](https://github.com/pnpm/pnpm/issues/13557).

* Verified remote build artifacts are persisted in the shared store with their signed origin metadata. Later installs reverify the artifact against current trust, policy, platform, and source before reuse, while invalid remote variants are quarantined per channel ([pnpm/pnpm#13771](https://github.com/pnpm/pnpm/issues/13771)).

* Persist completed recursive tasks so `--resume-from` skips exactly the work that passed during a matching interrupted or failed `pnpm -r run` / `pnpm -r exec` invocation. When no compatible state exists, pnpm retains its graph-based resume behavior.

* Allowed `pnpm update --patches` to refresh registry revisions through a configured pnpr server while retaining locked package versions.

* Added explicit registry revision selection with `<version>+rN` and `pnpm update --patches` for refreshing revision artifacts without changing package versions. Registry-backed lockfile policy checks recognize historical revisions, and pnpr now preserves safe revision histories from upstream registries.

* Workspace install, rebuild, pack, publish, stage, and lifecycle work now starts as soon as its dependencies finish instead of waiting for an unrelated topological group.

* `pnpm stage approve` now approves several staged packages at once. Run it without a stage id to pick from the staged versions interactively, or pass a list of stage ids. The whole batch is approved with a single one-time password, and p

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v11.25.0]_