pnpm 11.2

pnpm 11.2 提供了一个实验性的可选择加入 pacquet（pnpm 的 Rust 移植版）作为安装后端，扩展了 config dependencies 以安装一层 optionalDependencies（因此 esbuild/swc 平台二进制模式也适用于配置依赖），连接了长期文档化的 pnpm login --scope 标志，并在 pnpm outdated 和 pnpm update --interactive 中显示运行时条目（Node.js、Deno、Bun）。

🌐 pnpm 11.2 ships an experimental opt-in into pacquet (the Rust port of pnpm) as the install backend, expands config dependencies to install one level of optionalDependencies (so the esbuild/swc platform-binary pattern works for config deps too), wires up the long-documented pnpm login --scope flag, and surfaces runtime entries (Node.js, Deno, Bun) in pnpm outdated and pnpm update --interactive.

小幅更改

🌐 Minor Changes

实验性：pacquet 作为安装后端

🌐 Experimental: pacquet as the install backend

将 @pnpm/pacquet（pnpm 的 Rust 移植版）添加到 configDependencies 的 pnpm-workspace.yaml 中，现在会将 pnpm install 的物化阶段委派给 pacquet 二进制文件。pnpm 仍然负责依赖解析；pacquet 只从新生成的锁文件中获取和导入。这是 Rust 安装引擎的可选预览 — 参见 #11723。

🌐 Adding @pnpm/pacquet (the Rust port of pnpm) to configDependencies in pnpm-workspace.yaml now delegates the materialization phase of pnpm install to the pacquet binary. pnpm still owns dependency resolution; pacquet only fetches and imports from the freshly-written lockfile. This is an opt-in preview of the Rust install engine — see #11723.

要在项目中配置 pacquet，请运行：

🌐 To configure pacquet in a project, run:

pnpm add @pnpm/pacquet --config

你会看到 pnpm-workspace.yaml 和 pnpm-lock.yaml 中的更改需要提交。如果你在使用 pacquet 时遇到任何问题，请在你创建的 GitHub 问题中告知我们。

🌐 You'll see changes in pnpm-workspace.yaml and pnpm-lock.yaml that should be committed. If you experience any issues with pacquet, please let us know in the GitHub issue you create.

optionalDependencies 用于配置依赖

🌐 optionalDependencies for config dependencies

配置依赖 现在会解析并安装由配置依赖声明的一层 optionalDependencies，在安装时应用 os / cpu / libc 平台过滤。这解锁了 esbuild/swc 风格的模式，即一个包通过 optionalDependencies 发布平台特定的二进制文件 — 现在配置依赖也可以做到同样的事情，并在全局虚拟存储中将匹配的二进制文件建立符号链接，因此从配置依赖内部访问 require('pkg-platform-arch') 可以正确解析。

环境锁文件记录了所有平台变体，无论主机平台如何，因此它在不同机器之间保持可移植性。配置依赖的 optionalDependencies 中的每个条目必须声明一个确切的版本——为了保持安装可重复，范围和标签都会被拒绝。

🌐 The env lockfile records all platform variants regardless of host platform, so it remains portable across machines. Each entry in a config dependency's optionalDependencies must declare an exact version — ranges and tags are rejected to keep installs reproducible.

pnpm login --scope

长期记录的 pnpm login --scope <scope> 标志现在已实现。范围已标准化（如果缺少则添加前导 @；空值将被忽略），并且将 @<scope>:registry=<registry> 映射写入 pnpm 认证文件中， alongside 认证令牌。随后安装的 @<scope>/* 包将路由到所选的注册表。先前记录的标志在 Unknown option: 'scope' 时会报错。参见 #11716。

outdated 和 update --interactive 中的运行时

🌐 Runtimes in outdated and update --interactive

pnpm outdated 和 pnpm update --interactive 现在报告 Node.js、Deno 和 Bun 运行时已作为项目依赖安装（runtime: 指定符）。之前这些会被静默跳过。

补丁更改

🌐 Patch Changes

• Fixed cafile=<relative-path> in .npmrc being read from the wrong directory when pnpm is invoked from a different cwd (e.g. pnpm --dir <project> install from a CI wrapper or monorepo script). The path is now resolved against the directory of the .npmrc that declared it, not process.cwd(). Before this fix, the install proceeded without the configured CA and the user only saw TLS errors against a private registry with no log line tying back to the wrongly resolved path #11624.

• Fixed config.registry getting a trailing slash appended when registry is set in .npmrc and no registries.default is provided by pnpm-workspace.yaml.

• Fixed global add/update to handle minimumReleaseAge policy violations instead of surfacing an internal resolver guardrail error.

• Fixed two crashes with injectWorkspacePackages: true when the lockfile has been pruned (e.g. by turbo prune --docker): a Cannot use 'in' operator to search for 'directory' in undefined from peer-dependency-variant injected snapshots whose base packages: entry had been dropped, and an ERR_PNPM_ENOENT on node_modules/.bin/<tool> after prepare / postinstall re-imported each injected workspace package.

• Fixed pnpm login and pnpm logout ignoring registries.default from pnpm-workspace.yaml #10099.

• Fixed the minimumReleaseAge (publishedBy) maturity shortcut to be inclusive at the cutoff. Previously, abbreviated metadata whose modified field equalled the cutoff fell off the fast path and triggered a full-metadata re-fetch (or a MISSING_TIME error when full metadata wasn't permitted).

• Honor publishConfig.access when publishing packages.

11.2.1

• Mark optional subdependency snapshots of config dependencies with optional: true in the env lockfile, matching how optional dependencies are recorded elsewhere in pnpm-lock.yaml. Previously, snapshots for the platform-specific subdeps pulled in via a config dep's optionalDependencies were written as empty objects.

• Fixed pickRegistryForPackage returning the wrong registry for an unscoped npm: alias under a scoped local name. A manifest entry like "@private/foo": "npm:lodash@^1" was routing the lodash fetch through registries["@private"], even though lodash is unscoped.

• Don't print Installing config dependencies... when config dependencies are already installed and nothing needs to be fetched, re-linked, or removed.

11.2.2

• When the install engine is delegated to pacquet via configDependencies, the user's CLI flags passed to pnpm install (e.g. --no-runtime, --prod, --dev, --no-optional, --node-linker, --cpu / --os / --libc, --offline, --prefer-offline) are now forwarded to pacquet's install subcommand verbatim. Previously pacquet was invoked with a fixed argument list, so flags like --no-runtime were silently dropped. Flag forwarding is gated on the command being install / i; add, update, and dedupe still don't forward (their flag surface doesn't line up with pacquet's install).

• Fixed pnpm up (and pnpm add / pnpm remove) failing with pacquet_package_manager::outdated_lockfile when pacquet is declared in configDependencies. pnpm now passes --ignore-manifest-check to pacquet so its --frozen-lockfile check doesn't fire against the (pre-mutation) package.json pnpm hasn't written yet #11797.