# pnpm v12.1.0 — pnpm 12.1

- Product: pnpm (https://whatsnew.fyi/product/pnpm)
- Vendor: pnpm
- Date: 2026-08-29
- Version: v12.1.0
- Original notes: https://github.com/pnpm/pnpm/releases/tag/v12.1.0
- Permalink: https://whatsnew.fyi/product/pnpm/releases/v12.1.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **changed** — pnpm login and pnpm adduser now record the granted token in the global config.yaml under the _auth setting, with --scope's scope routed to that registry under registries
- **changed** — pnpm logout removes tokens from the global config.yaml and still removes them from auth.ini written by earlier versions
- **changed** — A scope set in a project's pnpm-workspace.yaml is now ignored with a warning
- **changed** — Verified remote build artifacts are persisted in the shared store with their signed origin metadata and reverified against current trust, policy, platform, and source before reuse
- **added** — Persist completed recursive tasks so --resume-from skips exactly the work that passed during a matching interrupted or failed pnpm -r run or pnpm -r exec invocation
- **changed** — Workspace install, rebuild, pack, publish, stage, and lifecycle work now starts as soon as its dependencies finish instead of waiting for an unrelated topological group
- **added** — Added per-task concurrency limits to workspace task orchestration via tasks.<name>.concurrency in pnpm-workspace.yaml
- **changed** — sideEffectsCache now declares the whole of how a package's build output is reused with read, write, and remote tier settings
- **changed** — sideEffectsCacheReadonly: true now blocks writing to the cache
- **changed** — Setting sideEffectsCacheReadonly alongside sideEffectsCache: false gives a read-only view rather than switching the cache off
- **added** — A cache can now be declared write-only to populate one the run does not read
- **changed** — pnpm -r run and pnpm -r exec now schedule per task instead of in topological chunks using a new tasks section in pnpm-workspace.yaml
- **added** — A dependency cycle among the tasks of a run is now an error naming the participating tasks instead of silently running in an arbitrary order
- **added** — Setting ignoreWorkspaceCycles: true downgrades task cycle errors to warnings
- **changed** — --resume-from now skips exactly the transitive dependencies of the anchor package
- **changed** — Under --no-bail, tasks whose dependencies failed are reported as skipped instead of failed
- **added** — pnpm -r run --dry-run <script> prints the task graph that would execute without running anything
- **added** — Added macOS and Windows x64 and arm64 support to remote shared build artifacts
- **changed** — Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject

##### Minor Changes

- `pnpm login` and `pnpm adduser` now record the granted token in the global `config.yaml`, under the `_auth` setting, with `--scope`'s scope routed to that registry under `registries`. `pnpm logout` removes it from there, and still from an `auth.ini` an earlier version wrote. Tokens already in `auth.ini` keep working.

- A `scope` set in a project's `pnpm-workspace.yaml` is now ignored, with a warning naming where to set it instead. `pnpm login` records the scope as a `@scope:registry` route in the machine-global `auth.ini`, which outranks `~/.npmrc` in every project — so a repository-committed file could redirect a scope such as `@acme` for all of a user's other projects after one routine login. Use `--scope`, the `PNPM_CONFIG_SCOPE` environment variable, or the global config file instead [#13557](https://github.com/pnpm/pnpm/issues/13557).

- Verified remote build artifacts are persisted in the shared store with their signed origin metadata. Later installs reverify the artifact against current trust, policy, platform, and source before reuse, while invalid remote variants are quarantined per channel ([pnpm/pnpm#13771](https://github.com/pnpm/pnpm/issues/13771)).

- Persist completed recursive tasks so `--resume-from` skips exactly the work that passed during a matching interrupted or failed `pnpm -r run` / `pnpm -r exec` invocation. When no compatible state exists, pnpm retains its graph-based resume behavior.

- Workspace install, rebuild, pack, publish, stage, and lifecycle work now starts as soon as its dependencies finish instead of waiting for an unrelated topological group.

- Added per-task concurrency limits to workspace task orchestration. Set `tasks.<name>.concurrency` in `pnpm-workspace.yaml` to limit how many instances of that task may run across workspace projects at once:

  ```yaml
  tasks:
    build:
      concurrency: 2
  ```

- `sideEffectsCache` now declares the whole of how a package's build output is reused — whether one is restored, whether one is saved, and the remote tier that shares it between machines:

  ```yaml
  sideEffectsCache:
    read: true
    write: true
    remote:
      org: acme
      packages: ['native-addon']
  ```

  `sideEffectsCache: true`, `sideEffectsCacheReadonly`, `remoteSideEffectsCache`, and its `organization` field all keep working. Where a field is set under both spellings the one above wins; where it is set under only one, it is kept.

  Two behaviors change, both bringing this CLI in line with what the Rust one already did: `sideEffectsCacheReadonly: true` now blocks writing to the cache, and setting it alongside `sideEffectsCache: false` gives a read-only view rather than switching the cache off entirely. A cache can also be declared write-only now, to populate one the run does not read.

- Workspace task orchestration ([pnpm/rfcs#23](https://github.com/pnpm/rfcs/pull/23)). `pnpm -r run` and `pnpm -r exec` now schedule per task instead of in topological chunks: a task starts as soon as the tasks it depends on have finished, so a project no longer waits for unrelated projects that happen to share its chunk.

  A new `tasks` section in `pnpm-workspace.yaml` declares what a task depends on, using the `^` convention:

  ```yaml
  tasks:
    build:
      dependsOn: ['^build']
    test:
      dependsOn: ['build']
    lint: {}
  ```

  `^name` means the named task in each of the project's workspace dependencies; a bare `name` means the task in the same project; an entry with no `dependsOn` declares an empty dependency list. A task with no entry behaves as `dependsOn: ['^<its own name>']`, which is exactly what the previous chunked ordering implied — an unconfigured workspace gets the scheduler improvement and nothing else changes meaning. A project without the script is reported skipped and passes its edges through to its own dependencies, so a scriptless package does not sever a chain.

  Also part of this

_[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v12.1.0]_