Skip to main content

pnpm 11.5

· 5 min read
Zoltan Kochan
Zoltan Kochan
Lead maintainer of pnpm

pnpm 11.5 添加了一个 hoistingLimits 设置，用于控制在 nodeLinker: hoisted 安装中依赖提升的程度，替换了交互提示库以修复长列表选择中的滚动问题，能够识别信任等级中的阶段发布，并发布了多个安装和 dist-tag 修复。

🌐 pnpm 11.5 adds a hoistingLimits setting for controlling how far dependencies hoist in nodeLinker: hoisted installs, replaces the interactive prompt library to fix scrolling in long choice lists, recognizes staged publishes in the trust scale, and ships several install and dist-tag fixes.

小幅更改​

🌐 Minor Changes

新的 hoistingLimits 设置​

🌐 New hoistingLimits setting

一个新的 hoistingLimits 设置控制在使用 nodeLinker: hoisted 时依赖提升的程度。它与 yarn 的 nmHoistingLimits 相对应，并接受：

🌐 A new hoistingLimits setting controls how far dependencies are hoisted when using nodeLinker: hoisted. It mirrors yarn's nmHoistingLimits and accepts:

  • 无 - 尽可能升起（默认）。
  • 工作区 - 仅提升到每个工作区包的程度。
  • 依赖 - 仅提升到每个工作区包的直接依赖。

最初在 #6468 提出，正在关闭 #6457。

🌐 Originally proposed in #6468, closing #6457.

新的互动提示库​

🌐 New interactive prompt library

pnpm 已将 enquirer 替换为 @inquirer/prompts 用于所有交互式提示。这修复了 update -i 滚动溢出错误，在终端中长选项列表被截断的问题 (#6643)。新库使用了基于可视行的分页，因此当有许多包可用时，滚动现在可以正常工作。

🌐 pnpm replaced enquirer with @inquirer/prompts for all interactive prompts. This fixes the update -i scrolling overflow bug where long choice lists were clipped in the terminal (#6643). The new library uses visual-line-aware pagination, so scrolling now works correctly when many packages are available.

受影响的命令包括 pnpm update -i（和 --latest）、pnpm audit --fix -i、pnpm approve-builds、pnpm patch、pnpm patch-remove、pnpm publish、pnpm login，以及 pnpm run / pnpm exec（与 verifyDepsBeforeRun=prompt 一起）。

🌐 Affected commands include pnpm update -i (and --latest), pnpm audit --fix -i, pnpm approve-builds, pnpm patch, pnpm patch-remove, pnpm publish, pnpm login, and pnpm run / pnpm exec (with verifyDepsBeforeRun=prompt).

在所有交互式提示中，Vim 风格的 j / k 键仍然可以用于上下导航。

🌐 Vim-style j / k keys still work for up/down navigation in all interactive prompts.

分阶段发布在信任度量表中被认可​

🌐 Staged publishes recognized in the trust scale

分阶段发布现在在信任等级中被认可。当一个包版本的注册表元数据包含 approver 字段时，它被视为最强的信任证据（排名高于受信任发布者和来源证明），因为分阶段发布需要两步验证（2FA）发布批准。这可以防止在从分阶段发布转向较低信任级别时出现误报的信任降级错误（#11887）。

🌐 Staged publishes are now recognized in the trust scale. When a package version's registry metadata carries an approver field, it is treated as the strongest trust evidence (ranked above trusted publishers and provenance attestations), since staged publishes require 2FA publish approvals. This prevents false-positive trust downgrade errors when moving from a staged publish to a lower trust level (#11887).

补丁更改​

🌐 Patch Changes

  • Fix pnpm hanging during peer resolution when an aliased install pulls in transitive packages with mutual peer cycles at different depths in the dependency tree (for example, pnpm i nuxt@npm:nuxt-nightly@5x) (#11999).

  • Fix pnpm dist-tag add and pnpm dist-tag rm against npmjs.org failing without --otp. pnpm now surfaces the OTP challenge through the existing browser-based 2FA flow (the same one used by pnpm publish), so the browser opens, the user authenticates, and the dist-tag is set on retry. --otp=<code> continues to work via the classic flow.

  • Fix minimumReleaseAgeExclude handling in npm resolution fast paths so excluded packages do not get pinned to stale versions.

  • Fix the integrity field being dropped from the lockfile entry of a remote (non-registry) https-tarball dependency when an unrelated package is installed afterwards. The missing integrity could otherwise make subsequent --frozen-lockfile installs fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY (#12001).

  • Skip dependency re-resolution when pnpm-lock.yaml is missing but node_modules/.pnpm/lock.yaml exists and still satisfies the manifest. pnpm install now reuses the materialized snapshot to regenerate pnpm-lock.yaml instead of walking the registry to rebuild it from scratch (#11993). --frozen-lockfile still refuses to proceed when pnpm-lock.yaml is absent.