pnpm 11.1

pnpm 11.1 添加了一些新命令 — pnpm audit signatures、pnpm bugs 和 pnpm owner — 同时支持从任意命名的注册表安装（包括 GitHub Packages npm 注册表的内置别名）、在 CI 中跳过运行时安装的能力以及若干修复。

🌐 pnpm 11.1 adds a few new commands — pnpm audit signatures, pnpm bugs, and pnpm owner — alongside support for installing from arbitrary named registries (including a built-in alias for the GitHub Packages npm registry), the ability to skip runtime installation in CI, and several fixes.

小幅更改

🌐 Minor Changes

pnpm audit signatures

一个新的 pnpm audit signatures 子命令会根据 /-/npm/v1/keys 上发布的密钥验证已安装包的 ECDSA 注册表签名 #7909。会遵循作用域注册表；没有发布签名密钥的注册表会被跳过。

🌐 A new pnpm audit signatures subcommand verifies ECDSA registry signatures for installed packages against keys published at /-/npm/v1/keys #7909. Scoped registries are respected; registries that don't publish signing keys are skipped.

pnpm audit signatures

命名注册表（以及内置的 gh: 别名）

🌐 Named registries (and a built-in gh: alias)

现在，你可以通过内置的 gh: 前缀从 GitHub Packages npm 注册表 安装包，并且——更广泛地——可以从类似 vlt 的命名注册表别名 的任意命名注册表中安装包：

🌐 You can now install packages from the GitHub Packages npm registry via a built-in gh: prefix, and — more broadly — from arbitrary named registries in the style of vlt's named-registry aliases:

pnpm add gh:@acme/private

身份验证会从现有的每个 URL 的 .npmrc 条目（例如 //npm.pkg.github.com/:_authToken=...）中获取，因此不需要单独的认证机制。

🌐 Authentication is picked up from existing per-URL .npmrc entries (e.g. //npm.pkg.github.com/:_authToken=...), so no separate auth mechanism is required.

额外的别名——或 GitHub Enterprise Server 内置 gh 别名的覆盖——可以在 pnpm-workspace.yaml 中的 namedRegistries 下配置：

🌐 Additional aliases — or an override for the built-in gh alias, for GitHub Enterprise Server — can be configured under namedRegistries in pnpm-workspace.yaml:

pnpm-workspace.yaml

namedRegistries:
  gh: https://npm.pkg.github.example.com/
  work: https://npm.work.example.com/

通过这个，work:@corp/lib@^2.0.0 针对 https://npm.work.example.com/ 进行解析。见 #8941。

🌐 With this, work:@corp/lib@^2.0.0 resolves against https://npm.work.example.com/. See #8941.

--sbom-spec-version

[pnpm sbom](/cli/sbom) 现在接受一个 --sbom-spec-version 标志来选择 CycloneDX 规范版本（1.5、1.6 或 1.7 — 默认 1.7）。该标志仅在 --sbom-format cyclonedx 下有效。请参见 #11389。

--no-runtime 用于 CI 矩阵

🌐 --no-runtime for CI matrices

一个新的 --no-runtime 标志（配置：runtime=false）会跳过安装运行时条目（例如通过 devEngines.runtime 下载的 Node.js），而不修改锁文件。锁文件仍然保留运行时条目，因此 frozen-lockfile 验证仍然可以通过；仅跳过运行时获取和 .bin 链接。这在 CI 矩阵中非常有用，当运行时在 pnpm install 运行之前由外部（例如通过 pnpm runtime -g set node <version>）提供时。

🌐 A new --no-runtime flag (config: runtime=false) skips installing runtime entries (e.g. Node.js downloaded via devEngines.runtime) without modifying the lockfile. The lockfile keeps the runtime entry so frozen-lockfile validation still passes; only the runtime fetch and .bin linking are skipped. This is useful in CI matrices where the runtime is provisioned externally (e.g. via pnpm runtime -g set node <version>) before pnpm install runs.

pnpm bugs

新的 pnpm bugs 命令会在浏览器中打开一个软件包的错误跟踪器 URL。如果没有参数，它会读取当前项目的 package.json；如果提供一个或多个软件包名称，它会从注册表获取每个软件包的元数据并打开其错误跟踪器。当缺少 bugs 字段时，它会回退到 <repository>/issues。参见 #11279。

🌐 The new pnpm bugs command opens a package's bug tracker URL in the browser. With no arguments, it reads the current project's package.json; with one or more package names, it fetches each package's metadata from the registry and opens its bug tracker. It falls back to <repository>/issues when the bugs field is missing. See #11279.

pnpm owner

新的 pnpm owner 命令管理注册表上的软件包所有者：

🌐 The new pnpm owner command manages package owners on the registry:

pnpm owner ls <package>
pnpm owner add <package> <user>
pnpm owner rm <package> <user>

补丁更改

🌐 Patch Changes

• pnpm view now prints "published X ago by Y" alongside the rest of its output, mirroring npm view. This is useful when comparing against minimumReleaseAge. For example, pnpm view pnpm now shows published 17 hours ago by GitHub Actions.

• pnpm publish now honors the configured HTTP/HTTPS proxy (including the https_proxy / http_proxy / no_proxy environment variables) when polling the registry's doneUrl during the web-based authentication flow. Previously the poll bypassed the proxy, causing the registry to respond 403 from a different source IP and the login to never complete #11561.

• pnpm add -g now installs each space-separated package into its own isolated directory by default. To bundle multiple packages into the same isolated install (so they share dependencies and are removed together), pass them as a comma-separated list. For example:

  • pnpm add -g foo bar 安装 foo 和 bar 作为两个独立的全局 —— 移除其中一个不会影响另一个。
  • pnpm add -g foo,bar qar 将 foo 和 bar 打包成一个独立安装，而 qar 则单独安装。

  相关：#11587。

• pnpm runtime set <name> <version> no longer fails in the root of a multi-package workspace with the ADDING_TO_ROOT error. Installing the workspace root is a valid target for a runtime, so the command now bypasses that safety check.

• Fixed pnpm --version hanging for the lifetime of the worker pool after the version was printed. The CLI entry now runs finishWorkers() from its own finally, so every exit path tears the pool down.