Skip to main content

pnpm 11.9

· 5 min read
Zoltan Kochan
Zoltan Kochan
Lead maintainer of pnpm

pnpm 11.9 为无法发布校验和的注册表计算缺失的 tarball 完整性，添加了 pnpm sbom --exclude-peers，提高了循环锁文件的审计性能，修复了 peer 解析的不确定性，并加强了对 minimumReleaseAge 和 trustPolicy 的排除处理。

🌐 pnpm 11.9 computes missing tarball integrity for registries that cannot publish checksums, adds pnpm sbom --exclude-peers, improves audit performance on cyclic lockfiles, fixes peer-resolution nondeterminism, and tightens exclusion handling for minimumReleaseAge and trustPolicy.

小幅更改​

🌐 Minor Changes

生成的注册表 tar 包的完整性​

🌐 Integrity for generated registry tarballs

有些注册表会按需生成 tar 包，无法在包元数据中提供完整性校验值。pnpm 现在会从下载的 tar 包计算完整性，并将其存储在锁文件中，这样以后安装时就可以验证该条目。

🌐 Some registries generate tarballs on demand and cannot provide an integrity checksum in package metadata. pnpm now computes the integrity from the downloaded tarball and stores it in the lockfile, so later installs can verify the entry.

这也适用于 --lockfile-only：pnpm 会在需要时下载 tar 包，以便锁文件可以包含其完整性。如果锁文件条目仍然缺少完整性，锁文件验证会用 ERR_PNPM_MISSING_TARBALL_INTEGRITY 拒绝它，而不是静默地重新获取。

🌐 This also applies to --lockfile-only: pnpm downloads the tarball when needed so the lockfile can include its integrity. If a lockfile entry is still missing integrity, lockfile verification rejects it with ERR_PNPM_MISSING_TARBALL_INTEGRITY instead of silently refetching.

pnpm sbom --exclude-peers​

pnpm sbom 现在支持 --exclude-peers。启用 auto-install-peers 后，对等依赖会被解析到锁文件中，否则在 SBOM 中看起来像常规依赖。该标志会移除对等依赖以及仅通过它们可达的任何传递子树。

标志名称与 pnpm list --exclude-peers 匹配；SBOM 行为更严格，因为 CycloneDX 1.7 没有清晰的方式来表示由消费者提供的对等关系。

🌐 The flag name matches pnpm list --exclude-peers; the SBOM behavior is stricter because CycloneDX 1.7 has no clean way to represent a consumer-provided peer relationship.

补丁更改​

🌐 Patch Changes

  • pnpm audit --fix now writes one combined minimumReleaseAgeExclude entry per package, such as axios@0.18.1 || 0.21.1, matching the documented setting format. Existing per-version entries are merged into the combined form (#12534).

  • Fixed nondeterministic peer resolution that could add or remove an optional transitive peer from a package's peer-dependency suffix across identical installs, causing lockfile churn and intermittent pnpm dedupe --check failures.

  • Fixed Windows pnpm dlx flakiness where cleanup of a failed install could mask the original error with EBUSY.

  • Shortened the pnpm dlx cache path so deep dependency trees are less likely to exceed Windows MAX_PATH.

  • Fixed pnpm hanging or crashing with an unhandled rejection when a non-retryable network error, such as SELF_SIGNED_CERT_IN_CHAIN, occurs while fetching from a registry.

  • Fixed a pnpm audit performance regression on lockfiles with dependency cycles. Reachability is now computed with Tarjan's strongly connected components algorithm, and the path walk no longer recurses, keeping time and memory linear in cyclic graphs (#12212).

  • Fixed failed optional dependency updates rewriting unrelated dependency specs (#11267).

  • When enableGlobalVirtualStore is turned on for a project previously installed without it, stale hoisted symlinks under node_modules/.pnpm/node_modules are now replaced (#9739).

  • Fixed pnpm install --ignore-workspace overwriting the allowBuilds map in pnpm-workspace.yaml (#12469).

  • Fixed minimumReleaseAgeExclude and trustPolicyExclude so multiple exact-version entries for the same package behave like a single || disjunction entry (#12463).

  • Populated the in-memory package metadata cache on the exact-version disk fast path, avoiding repeated disk reads during large monorepo installs. The cache key now includes the registry, so the same package name from different registries cannot share cached metadata.

  • Fixed pnpm patch dropping the package name and leaking internal option fields when the patched dependency resolves to a single git-hosted version.

  • Moved pnpr resolver endpoints under the reserved /-/pnpr namespace: POST /v1/resolve is now POST /-/pnpr/v0/resolve, and POST /v1/verify-lockfile is now POST /-/pnpr/v0/verify-lockfile.

  • Removing a runtime dependency now removes the matching devEngines.runtime or engines.runtime entry that was materialized from it. Blank runtime selectors are normalized to latest.

  • pnpm sbom now emits a CycloneDX issue-tracker external reference for components whose package.json declares a bugs URL.

  • Added @pnpm/resolving.tarball-url, which builds and recognizes canonical npm tarball URLs. Custom pnpmfile resolvers can use it to rewrite proxy tarball URLs to canonical registry URLs so host-specific URLs are not persisted to the lockfile.

  • Lockfile verification no longer reports registry metadata fetch failures as ERR_PNPM_TARBALL_URL_MISMATCH. The install now aborts with the registry fetch error, and registry fetch errors no longer leak basic-auth credentials embedded in the registry URL.