Pnpm 12.0

pnpm 12.0 has been released. This update is a rewrite of pnpm in Rust, and it maintains the same commands, flags, settings, and lockfile format as pnpm 11. The documentation outlines the differences between the two versions.

The latest pnpm version on npm still points to the pnpm 11 line, so to install pnpm 12, users must use the next-12 tag: pnpm self-update next-12. For now, Homebrew, winget, Scoop, and Chocolatey do not offer pnpm 12.

In GitHub, GitLab, and Bitbucket repositories, the specifier now names the repository instead of choosing the transport method. The lockfile no longer records SSH URLs for these hosts, and the lockfile remains compatible with repository changes.

A new setting, pnpm does not recognize, is now reported as an error if a user tries to use it with a pnpm version it was not intended for. Otherwise, it is treated as a warning and does not affect the command execution.

Peer resolution has been improved during the installation process, making it faster, using less memory, and generating a more consistent lockfile. The lockfile remains compatible with existing installations, and installing a project without re-resolving the lockfile will leave it unchanged.

On Linux, auto now defaults to using hardlinks when possible, which can roughly halve the time it takes to install packages. macOS continues to use clone-first by default.

When an incompatible package is reached through a regular dependencies edge of an installable package with engineStrict, an install will now fail instead of emitting a warning. Packages reachable only through optional edges or a package that was skipped will still be skipped in both pnpm 11 and pnpm 12.

The pnpm config subcommands no longer fail when encountering unknown workspace settings. Dependency cycles are now broken canonically during peer resolution, resulting in byte-identical lockfiles regardless of the order in which packages are installed.

A new feature allows a globally installed node, deno, or bun to follow the version pinned for the current project instead of always using the globally installed version. Users can also specify which globally installed packages should have a shim using the globalShims setting.

A stable Node.js release is now authenticated against the Node.js release team's signatures and installed without any prompts. Other Deno, Bun, and Node.js prereleases ask for user confirmation before installation.