# pnpm v12.3.0 — pnpm 12.3 - Product: pnpm (https://whatsnew.fyi/product/pnpm) - Vendor: pnpm - Date: 2026-09-02 - Version: v12.3.0 - Original notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.0 - Permalink: https://whatsnew.fyi/product/pnpm/releases/v12.3.0 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **added** — Context-aware global commands (node, deno, bun, and shims created with pnpm shim add) are now native executables on every platform, allowing environment variables with non-shell-identifier names to reach these commands - **added** — pnpm remove and pnpm update now accept --trust-lockfile, --no-trust-lockfile, --trust-policy, --trust-policy-exclude, and --trust-policy-ignore-after flags - **added** — pnpm now honors --config.trust-lockfile= and accepts bare --trust-lockfile / --no-trust-lockfile spelling on commands that previously took the setting from config file alone - **added** — pnpm config now accepts -g/--global, --location, and --json before its subcommand - **changed** — On Windows, .exe replaces the .cmd and .ps1 shims for context-aware global commands - **changed** — pnpm remove verifies the lockfile against active policies the way pnpm install does - **changed** — Sped up installs in large workspaces by reading pnpm-lock.yaml while workspace projects are being discovered - **changed** — Sped up installs in large workspaces by improving the lockfile update check to no longer compare every project against every lockfile entry - **changed** — Sped up dependency resolution in large workspaces that use link: dependencies - **changed** — Sped up dependency resolution in large workspaces by having the resolver build fewer lookup keys for each dependency - **changed** — Improved peer dependency resolution performance when many packages reuse the same peer ranges - **changed** — pnpm outdated and pnpm update now follow local actions and reusable workflows referenced with GitHub's self-repository syntax (uses: $/.github/actions/setup) when looking for outdated GitHub Actions - **changed** — On Linux, pnpm now resolves registry hostnames through the system resolver (getaddrinfo) instead of the bundled pure-Rust resolver - **fixed** — pnpm add , pnpm add , pnpm add file:, and pnpm add work again - **fixed** — Fixed pnpm deploy --legacy ignoring allowUnusedPatches supplied through --config.allow-unused-patches or the PNPM_CONFIG_ALLOW_UNUSED_PATCHES environment variable - **fixed** — Fixed pnpm install --lockfile-only writing a lockfile that referenced a missing peer-suffixed snapshot when an npm-aliased dependency participated in a cyclic peer dependency graph - **fixed** — Fixed pnpm dedupe to converge in one pass when re-resolving a lockfile created by pnpm 11 - **fixed** — Fixed detached child processes being terminated on Windows when another program launches pnpm directly without a shell - **fixed** — Fixed pnpm docs @ ignoring the requested version - **fixed** — Fixed filtered and recursive pnpm run and pnpm exec hanging when a script reads from the terminal - **fixed** — Fixed false unmet peer errors for auto-installed peers in linked workspace packages ##### Minor Changes - Every context-aware global command (`node`, `deno`, `bun`, and the shims created with `pnpm shim add`) is now a native executable on every platform, so environment variables whose names are not valid shell identifiers reach these commands. On Windows, `.exe` replaces the `.cmd` and `.ps1` shims for them. Shims written by earlier pnpm 12 releases are migrated on the next global install or self-update. - `pnpm remove` and `pnpm update` now accept `--trust-lockfile`, `--no-trust-lockfile`, `--trust-policy`, `--trust-policy-exclude` and `--trust-policy-ignore-after`, the same flags `pnpm install` and `pnpm add` take, so the supply-chain settings can be overridden for a single run. `pnpm remove` verifies the lockfile against the active policies the way `pnpm install` does, and `--trust-lockfile` skips that pass for every entry, not only the package being removed. `pnpm` now also honors `--config.trust-lockfile=`, and accepts the bare `--trust-lockfile` / `--no-trust-lockfile` spelling on the commands that previously took the setting from the config file alone. ##### Patch Changes - `pnpm add `, `pnpm add `, `pnpm add file:` and `pnpm add ` work again. A specifier given without a `@` prefix is no longer read as a registry package name and rejected with `ERR_PNPM_PACKAGE_MANAGER_ADD_RESOLVE_LATEST` [#14437](https://github.com/pnpm/pnpm/issues/14437). - Fixed `pnpm deploy --legacy` ignoring `allowUnusedPatches` supplied through `--config.allow-unused-patches` or the `PNPM_CONFIG_ALLOW_UNUSED_PATCHES` environment variable [pnpm/pnpm#14450](https://github.com/pnpm/pnpm/issues/14450). - Fixed `pnpm install --lockfile-only` writing a lockfile that referenced a missing peer-suffixed snapshot when an npm-aliased dependency took part in a cyclic peer dependency graph. The following `pnpm install --frozen-lockfile` failed with `ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY` [#14449](https://github.com/pnpm/pnpm/issues/14449). - `pnpm config` now accepts `-g`/`--global`, `--location`, and `--json` before its subcommand [pnpm/pnpm#14421](https://github.com/pnpm/pnpm/issues/14421). - `pnpm dedupe` now converges in one pass when it re-resolves a lockfile created by pnpm 11, so a second run no longer changes the lockfile [#14455](https://github.com/pnpm/pnpm/issues/14455). - Fixed detached child processes being terminated on Windows when another program launches `pnpm` directly, without a shell, as `nr` from `@antfu/ni` does [#14447](https://github.com/pnpm/pnpm/issues/14447). - Fixed `pnpm docs @` ignoring the requested version. It now opens the selected version's homepage and reports a missing version instead of opening the package-level homepage [pnpm/pnpm#14428](https://github.com/pnpm/pnpm/issues/14428). - Sped up installs in large workspaces. `pnpm-lock.yaml` is now read while the workspace projects are being discovered [#14352](https://github.com/pnpm/pnpm/issues/14352). - Fixed filtered and recursive `pnpm run` and `pnpm exec` hanging when a script reads from the terminal. Interactive prompts work again in a script that pnpm never runs alongside another one, such as a single `--filter`ed project, `--workspace-concurrency=1`, a dependency chain, or a task declaring `concurrency: 1` [#14397](https://github.com/pnpm/pnpm/issues/14397). - Fixed false unmet peer errors for auto-installed peers in linked workspace packages. - Fixed npm global installs on Windows so the PowerShell shims invoke `pnpm.exe`. - Fixed `pnpm with current ` when global options precede it, such as `pnpm --workspace-root with current --version` [pnpm/pnpm#14413](https://github.com/pnpm/pnpm/issues/14413). A short-option cluster that mixes a global flag with an option owned by the command, such as `pnpm -ro dist pack-app`, is now parsed like the same options written after the command. An option written bef _[Truncated at 4000 characters — full notes: https://github.com/pnpm/pnpm/releases/tag/v12.3.0]_