Skip to main content

pnpm 11.6

· 5 min read
Zoltan Kochan
Zoltan Kochan
Lead maintainer of pnpm

pnpm 11.6 添加了一种无需文件的方式，通过 npm_config_//… 和 pnpm_config_//… 环境变量提供注册表身份验证，提高了默认的网络并发，并且当只缺少 pnpm-lock.yaml 时会跳过完整的重新解析。它还会为可选依赖推断平台字段，因此不会下载非本平台的二进制文件。

🌐 pnpm 11.6 adds a file-free way to supply registry authentication through npm_config_//… and pnpm_config_//… environment variables, raises the default network concurrency, and skips full re-resolution when only pnpm-lock.yaml is missing. It also infers platform fields for optional dependencies so foreign-platform binaries are never downloaded.

小幅更改​

🌐 Minor Changes

通过环境变量进行无文件注册认证​

🌐 File-free registry auth via environment variables

你现在可以通过 npm_config_//… 和 pnpm_config_//… 环境变量配置 URL 范围的注册表设置，而无需任何 .npmrc 文件：

🌐 You can now configure URL-scoped registry settings through npm_config_//… and pnpm_config_//… environment variables, with no .npmrc file at all:

env "pnpm_config_//registry.npmjs.org/:_authToken=$NPM_TOKEN" pnpm install

请注意，变量名包含 /、: 和 .，因此 export 和 NAME=value 的 shell 赋值语法会将其视为无效标识符。使用 env 工具（如上所示）将其传递给单个命令，或通过接受任意变量名的工具设置它（例如你的 CI 提供商的环境设置）。

🌐 Note that the variable name contains /, :, and ., so export and the NAME=value shell assignment syntax reject it as an invalid identifier. Use the env utility (as shown above) to pass it to a single command, or set it through a tool that accepts arbitrary variable names (such as your CI provider's environment settings).

因为注册表值所适用的注册表是编码在（受信任的）环境变量名称中的，所以它从设计上来说是主机范围的，不能通过仓库控制的配置重定向到另一个注册表。环境值被视为受信任的配置：它优先于项目/工作区 .npmrc，但仍会被命令行选项覆盖。当同一个键通过两种前缀提供时，pnpm_config_ 优先。

🌐 Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace .npmrc but is still overridden by command-line options. When the same key is provided through both prefixes, pnpm_config_ wins.

这是对已提交的 //registry.npmjs.org/:_authToken=${NPM_TOKEN} 行最直接的替代，其 ${...} 占位符自 v11.5.3 起在项目 .npmrc 中不再展开。请参阅 身份验证设置中的环境变量。

🌐 This is the most direct replacement for a committed //registry.npmjs.org/:_authToken=${NPM_TOKEN} line, whose ${...} placeholders are no longer expanded in a project .npmrc since v11.5.3. See Environment variables in auth settings.

更高的默认网络并发​

🌐 Higher default network concurrency

默认的网络并发从 min(64, max(cpuCores * 3, 16)) 提高到 min(96, max(cpuCores * 3, 64))。软件包下载是 I/O 受限的，而不是 CPU 受限的，因此根据核心数量设置下限会导致核心较少的机器（例如 4-vCPU 的 CI 运行器）一次只能下载 16 个 tar 包，无法充分利用低延迟的注册表。networkConcurrency 设置仍然会覆盖默认值。

🌐 The default network concurrency was raised from min(64, max(cpuCores * 3, 16)) to min(96, max(cpuCores * 3, 64)). Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. The networkConcurrency setting still overrides the default.

仅缺少锁文件时不重新解析​

🌐 No re-resolution when only the lockfile is missing

pnpm install 现在在 pnpm-lock.yaml 被删除但 node_modules 完好时可以完成而无需重新解析。最新检查会将当前的锁文件（node_modules/.pnpm/lock.yaml）——之前安装生成的记录——视为所需锁文件，验证清单仍然与其匹配，从中恢复 pnpm-lock.yaml，并报告“已是最新”。之前，这会触发完全解析并重新验证每个锁定包与注册表的一致性。

补丁更改​

🌐 Patch Changes

  • Platform-specific optional dependencies are now skipped even when their os / cpu / libc fields are missing from the registry metadata or the lockfile. Some registries strip these fields, which made pnpm download and install the binaries of every platform regardless of supportedArchitectures. The missing fields are now inferred from the package name (e.g. @nx/nx-win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform binaries are skipped without even downloading them (#11702).

  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level ~/.npmrc or running pnpm config set "<key>" <value> — with a link to https://pnpm.nodejs.cn/npmrc. The pnpm config set example is only suggested when the key has no ${...} placeholder, so the snippet is always safe to copy-paste.

  • Print a "Lockfile passes supply-chain policies (verified 2h ago)" message when lockfile verification is skipped because a cached verdict for the same lockfile content and policy is reused. Previously the cached short-circuit was completely silent, which made it look like the policy gate never ran (#12324).