pnpm 12.12.1 → 12.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +110 -0
- package/dist/node_modules/.pnpm-workspace-state-v1.json +9 -9
- package/package.json +15 -15
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,115 @@
|
|
|
1
1
|
# pnpm
|
|
2
2
|
|
|
3
|
+
## 12.14.0
|
|
4
|
+
|
|
5
|
+
This release adds the `sideEffectsCache.exclude` setting, stops `pnpm install` from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.
|
|
6
|
+
|
|
7
|
+
### Minor Changes
|
|
8
|
+
|
|
9
|
+
- Added the `sideEffectsCache.exclude` setting for packages whose build depends on something pnpm cannot include in the cache key, such as the system libraries a native addon links against. pnpm builds the listed packages in every project and never restores or saves their builds through the side-effects cache, locally or on a `remoteCache` server. Under the global virtual store, each project gets its own copy of these packages and of the packages that depend on them. Entries use the same `name`, `@scope/*`, and `name@version` patterns as `minimumReleaseAgeExclude` [#5271](https://github.com/pnpm/pnpm/issues/5271).
|
|
10
|
+
|
|
11
|
+
- `pnpm login` now prints the `npm-notice` response header during web-based login. Registries use it to show the verification code that completes the sign-in in the browser.
|
|
12
|
+
|
|
13
|
+
### Patch Changes
|
|
14
|
+
|
|
15
|
+
#### Installing packages
|
|
16
|
+
|
|
17
|
+
- `pnpm install` and `pnpm add` no longer wait for the daily update check. If the command finishes first, pnpm skips the update notice and checks again next time. On a registry that accepted the connection but never answered, an install that had nothing to do used to take minutes [#16839](https://github.com/pnpm/pnpm/issues/16839).
|
|
18
|
+
|
|
19
|
+
- `pnpm install`, `pnpm add` and `pnpm update` now reuse `pnpm-lock.yaml` when the workspace configures a catalog entry that no dependency references, such as an unused entry or one whose package an `overrides` entry replaces. Before, every resolution in such a workspace resolved all dependencies again from the registry [#16923](https://github.com/pnpm/pnpm/issues/16923).
|
|
20
|
+
|
|
21
|
+
- `pnpm install` now looks up a git dependency's branch or tag once per install, even when many workspace projects depend on it. With `linkWorkspacePackages` enabled, it used to run `git ls-remote` once per project [#16899](https://github.com/pnpm/pnpm/issues/16899).
|
|
22
|
+
|
|
23
|
+
- A filtered install, such as `pnpm install --filter <pkg>`, now keeps the `pnpm-lock.yaml` entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk [#16931](https://github.com/pnpm/pnpm/issues/16931).
|
|
24
|
+
|
|
25
|
+
- pnpm now decides whether a dependency that a package also declares as an optional peer is linked as a dependency or as a peer from the shallowest path that reaches the package. When an existing lockfile records such a dependency as a regular dependency and a newly added dependency now provides the peer, pnpm records it as a peer, as a fresh install does. The lockfile entry of such a package can change on the next install [#16901](https://github.com/pnpm/pnpm/issues/16901).
|
|
26
|
+
|
|
27
|
+
- An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store [#16929](https://github.com/pnpm/pnpm/issues/16929).
|
|
28
|
+
|
|
29
|
+
#### Running commands and scripts
|
|
30
|
+
|
|
31
|
+
- pnpm no longer aborts with a core dump when the reader of its output has exited, as in `pnpm list | head -1` or `pnpm start 2>&1 | head -1`. The command finishes with its usual exit code, and a failing script's exit code is kept. A write to stdout that fails for another reason, such as a full disk, ends the command with exit code 1 [#16904](https://github.com/pnpm/pnpm/issues/16904) [pnpm/tasks#132](https://github.com/pnpm/tasks/issues/132).
|
|
32
|
+
|
|
33
|
+
- On Windows, `pnpm exec`, `pnpm run`, and commands such as `pnpm nx` now return when the command they run exits, even if it left a detached process running and pnpm's output is redirected or piped. Previously a shell reading that output waited until the detached process, such as the Nx daemon, exited [#16930](https://github.com/pnpm/pnpm/issues/16930).
|
|
34
|
+
|
|
35
|
+
- Commands that do not write the project manifest now leave a missing `package.json` absent. This covers queries such as `pnpm why` and `pnpm outdated`, `pnpm fetch`, `pnpm dedupe --check`, and commands that exit with an error, such as `pnpm rt ls`. These commands used to create one from the initialization template. `pnpm sbom` run from a lockfile alone now reports the root component as `unknown` with version `0.0.0` [#16907](https://github.com/pnpm/pnpm/issues/16907).
|
|
36
|
+
|
|
37
|
+
- `pnpm run` now reports a failed script as a JSON record under `--reporter=ndjson`. It printed a plain `[ELIFECYCLE]` line to stderr.
|
|
38
|
+
|
|
39
|
+
- `pnpm run` no longer prints `[ELIFECYCLE] Command failed with exit code N.` to stderr when a script fails under `--reporter=silent`, `--silent`, or `--loglevel=silent`.
|
|
40
|
+
|
|
41
|
+
- `pnpm pipeline --dry-run` no longer writes a run report when no projects are selected. With `--json` it prints `{"tasks": []}` [pnpm/tasks#126](https://github.com/pnpm/tasks/issues/126).
|
|
42
|
+
|
|
43
|
+
#### Packing and publishing
|
|
44
|
+
|
|
45
|
+
- `pnpm pack` and `pnpm publish` now ship the whole gitignored directory that `main`, `browser`, or `bin` points into, as npm does. Previously only the `main` and `bin` files themselves were packed, and a gitignored `browser` file was left out [#16908](https://github.com/pnpm/pnpm/issues/16908).
|
|
46
|
+
|
|
47
|
+
- `pnpm pack` and `pnpm publish` now honor a `.npmignore` or `.gitignore` inside a subdirectory when `package.json` has a `files` field. The package root's ignore files and those inherited from the workspace are still skipped [#16909](https://github.com/pnpm/pnpm/issues/16909).
|
|
48
|
+
|
|
49
|
+
#### Setting up pnpm and toolchains
|
|
50
|
+
|
|
51
|
+
- `--registry`, `--https-proxy`, `--http-proxy`, and `--no-proxy` now apply when pnpm resolves and downloads the pnpm version a project pins in `packageManager`. Before, these lookups went to `https://registry.npmjs.org/`, which a firewall that only allows a private registry blocks [#16911](https://github.com/pnpm/pnpm/discussions/16911).
|
|
52
|
+
|
|
53
|
+
- On Windows, `pnpm install` now installs the Rust toolchain for rustup's default host, so a machine set up with `rustup set default-host x86_64-pc-windows-gnu` gets the MinGW toolchain. Without a default host, pnpm installs the MSVC toolchain for the machine's architecture, as rustup does. This includes a pnpm built for MinGW, such as the MSYS2 package, which has installed the MinGW toolchain since 12.13.0. An x64 pnpm on ARM64 Windows now installs the ARM64 toolchain [#16854](https://github.com/pnpm/pnpm/issues/16854).
|
|
54
|
+
|
|
55
|
+
## 12.13.0
|
|
56
|
+
|
|
57
|
+
This release adds the `pnpm profile` and `pnpm token` commands, the `storeIndexFormat: files` setting for stores shared over a network filesystem, and faster Python dependency resolution.
|
|
58
|
+
|
|
59
|
+
### Minor Changes
|
|
60
|
+
|
|
61
|
+
- Added the `pnpm profile` command to view and update registry user profile settings.
|
|
62
|
+
|
|
63
|
+
- Added `pnpm token` to list, create, and revoke authentication tokens on the registry.
|
|
64
|
+
|
|
65
|
+
- Added the `storeIndexFormat` setting. Set it to `files` to keep a store's package index as one file per package instead of the SQLite `index.db`, for a store on a network filesystem that several machines use at once. SQLite's locking does not work across machines, so concurrent installs on such a store could corrupt `index.db`.
|
|
66
|
+
|
|
67
|
+
- Added the `nodePackageMap` setting, which groups the package-map settings. `nodePackageMap.mode: write-only` writes `node_modules/.package-map.json` for other tools without making Node.js load it. `mode: load` also makes Node.js load the map, like `nodeExperimentalPackageMap: true`. `nodePackageMap.type` replaces `nodePackageMapType`. The old settings still work [#14937](https://github.com/pnpm/pnpm/issues/14937).
|
|
68
|
+
|
|
69
|
+
```yaml
|
|
70
|
+
nodePackageMap:
|
|
71
|
+
mode: write-only
|
|
72
|
+
type: loose
|
|
73
|
+
```
|
|
74
|
+
|
|
75
|
+
### Patch Changes
|
|
76
|
+
|
|
77
|
+
#### Setting up pnpm
|
|
78
|
+
|
|
79
|
+
- `pnpm setup` now works when pnpm was installed with npm on macOS. It installed pnpm from npm's `bin` directory and left a `$PNPM_HOME/bin/pnpm` that could not run [#16855](https://github.com/pnpm/pnpm/issues/16855).
|
|
80
|
+
|
|
81
|
+
- pnpm runs again after `pnpm setup` when `globalShims` enables pnpm. Every command failed with "the global target of the pnpm shim points back at the shim" [#16874](https://github.com/pnpm/pnpm/issues/16874).
|
|
82
|
+
|
|
83
|
+
- A pnpm built for the MinGW target on Windows, such as the MSYS2 package, now installs the MinGW Rust toolchain that `rust-toolchain.toml` names. It used to install the MSVC toolchain.
|
|
84
|
+
|
|
85
|
+
#### Installing packages
|
|
86
|
+
|
|
87
|
+
- On macOS, `pnpm install` no longer fails with `ERR_PNPM_LOCKFILE_WRITE_FILE` when the project is on a virtiofs or SMB share. pnpm now falls back to a regular `fsync` when the file system rejects a full sync [#16846](https://github.com/pnpm/pnpm/issues/16846).
|
|
88
|
+
|
|
89
|
+
- On macOS, `pnpm install`, `pnpm patch-commit`, and other commands that load a pnpmfile no longer hang at random.
|
|
90
|
+
|
|
91
|
+
- `pnpm install` now puts the executables of a Python build backend's requirements on the `PATH` while the backend runs. Projects built with `uv_build` now install. Before, they failed with "uv-build was not properly installed".
|
|
92
|
+
|
|
93
|
+
- Removing a `link:` dependency now also removes its symlink from `node_modules` when `nodeLinker` is `hoisted` [#16884](https://github.com/pnpm/pnpm/issues/16884).
|
|
94
|
+
|
|
95
|
+
- `pnpm-lock.yaml` no longer records the tarball URL of a package installed from a scoped registry, such as one set by `@types:registry=`, when pnpm can rebuild the URL from that registry [#16866](https://github.com/pnpm/pnpm/issues/16866).
|
|
96
|
+
|
|
97
|
+
#### Packing, auditing, and pipelines
|
|
98
|
+
|
|
99
|
+
- `pnpm pack` and `pnpm publish` now pack only `package.json`, the README, the license, and the files named in `main` and `bin` when `files` is an empty array. They used to pack every file in the package [#16889](https://github.com/pnpm/pnpm/issues/16889).
|
|
100
|
+
|
|
101
|
+
- `pnpm audit` and `pnpm audit signatures` no longer check runtimes installed through `devEngines.runtime`, such as `node@runtime:24.21.0`, against the npm package of the same name. `pnpm audit signatures` reported these runtimes as having an invalid registry signature [#16869](https://github.com/pnpm/pnpm/issues/16869).
|
|
102
|
+
|
|
103
|
+
- `pnpm pipeline` now runs the root's tasks when `pnpm-workspace.yaml` lists only the root in `packages` or omits `packages`, as `pnpm -r run` does. A change to a root file in such a workspace no longer triggers a full-run warning. When a full run has no projects to run, `pnpm pipeline` now reports that no projects are selected [#16849](https://github.com/pnpm/pnpm/issues/16849).
|
|
104
|
+
|
|
105
|
+
#### Performance
|
|
106
|
+
|
|
107
|
+
- `pnpm install` resolves Python dependencies faster. With `--lockfile-only`, a project with 10 dependencies now resolves in about 4 seconds, down from about 40. When the index publishes a metadata file beside each wheel (PEP 658), as PyPI does, pnpm downloads only the wheels of the releases it selects.
|
|
108
|
+
|
|
109
|
+
- A repeat install against an existing lockfile no longer reads registry metadata for the dependencies it takes from that lockfile. On a warm store this removes thousands of metadata lookups from a repeat install of a large workspace.
|
|
110
|
+
|
|
111
|
+
- `pnpm install` with `enableModulesDir: false` now verifies the packages already in the store while the dependencies resolve, and checks a package's files in parallel. On a 5,100-package install with the store on a network filesystem, this removed a 19-second pause between resolution and fetching.
|
|
112
|
+
|
|
3
113
|
## 12.12.1
|
|
4
114
|
|
|
5
115
|
This release adds OIDC authentication to `pnpm dist-tag` and the `tool:` protocol. `pnpm publish` now checks which registry an `NPM_ID_TOKEN` was issued for before using it.
|
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
{
|
|
2
|
-
"lastValidatedTimestamp":
|
|
2
|
+
"lastValidatedTimestamp": 1792067892741,
|
|
3
3
|
"projects": {
|
|
4
4
|
"/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
|
|
5
5
|
"name": "pacquet",
|
|
6
|
-
"version": "12.
|
|
6
|
+
"version": "12.14.0",
|
|
7
7
|
"hasModulesDir": true
|
|
8
8
|
}
|
|
9
9
|
},
|
|
@@ -49,7 +49,7 @@
|
|
|
49
49
|
"@rushstack/worker-pool": "0.7.30",
|
|
50
50
|
"@stylistic/eslint-plugin": "^5.10.0",
|
|
51
51
|
"@tybys/wasm-util": "0.10.4",
|
|
52
|
-
"@types/adm-zip": "^0.
|
|
52
|
+
"@types/adm-zip": "^0.6.0",
|
|
53
53
|
"@types/archy": "0.0.36",
|
|
54
54
|
"@types/cross-spawn": "^6.0.6",
|
|
55
55
|
"@types/fs-extra": "^11.0.4",
|
|
@@ -88,7 +88,7 @@
|
|
|
88
88
|
"@types/yarnpkg__lockfile": "^1.1.9",
|
|
89
89
|
"@types/yauzl": "^3.4.0",
|
|
90
90
|
"@types/zkochan__table": "npm:@types/table@6.3.2",
|
|
91
|
-
"@typescript-eslint/utils": "^8.71.
|
|
91
|
+
"@typescript-eslint/utils": "^8.71.2",
|
|
92
92
|
"@typescript/native-preview": "7.0.0-dev.20260707.2",
|
|
93
93
|
"@webcontainer/api": "^1.6.4",
|
|
94
94
|
"@yarnpkg/core": "4.9.1",
|
|
@@ -112,7 +112,7 @@
|
|
|
112
112
|
"bole": "^5.0.29",
|
|
113
113
|
"boxen": "npm:@zkochan/boxen@5.1.2",
|
|
114
114
|
"c8": "^12.0.0",
|
|
115
|
-
"camelcase": "^
|
|
115
|
+
"camelcase": "^10.0.0",
|
|
116
116
|
"camelcase-keys": "^10.0.3",
|
|
117
117
|
"can-link": "^3.0.0",
|
|
118
118
|
"can-write-to-dir": "^2.0.0",
|
|
@@ -137,7 +137,7 @@
|
|
|
137
137
|
"escape-string-regexp": "^5.0.0",
|
|
138
138
|
"eslint": "^10.12.0",
|
|
139
139
|
"eslint-plugin-import-x": "^4.17.1",
|
|
140
|
-
"eslint-plugin-jest": "^29.
|
|
140
|
+
"eslint-plugin-jest": "^29.17.0",
|
|
141
141
|
"eslint-plugin-n": "^18.4.1",
|
|
142
142
|
"eslint-plugin-promise": "^7.3.0",
|
|
143
143
|
"eslint-plugin-regexp": "^3.1.1",
|
|
@@ -199,7 +199,7 @@
|
|
|
199
199
|
"p-every": "^2.0.0",
|
|
200
200
|
"p-filter": "^4.1.0",
|
|
201
201
|
"p-limit": "^7.3.3",
|
|
202
|
-
"p-queue": "^
|
|
202
|
+
"p-queue": "^10.0.0",
|
|
203
203
|
"parse-json": "^8.3.0",
|
|
204
204
|
"parse-npm-tarball-url": "^5.0.0",
|
|
205
205
|
"path-absolute": "^2.0.0",
|
|
@@ -210,7 +210,7 @@
|
|
|
210
210
|
"playwright-core": "^1.64.0",
|
|
211
211
|
"preferred-pm": "^5.0.1",
|
|
212
212
|
"pretty-bytes": "^7.2.0",
|
|
213
|
-
"pretty-ms": "^
|
|
213
|
+
"pretty-ms": "^10.0.0",
|
|
214
214
|
"promise-share": "^2.0.1",
|
|
215
215
|
"proxy": "^4.1.0",
|
|
216
216
|
"proxyquire": "^2.1.3",
|
|
@@ -261,7 +261,7 @@
|
|
|
261
261
|
"tree-kill": "^1.2.2",
|
|
262
262
|
"ts-jest-resolver": "2.0.1",
|
|
263
263
|
"typescript": "6.0.3",
|
|
264
|
-
"typescript-eslint": "^8.71.
|
|
264
|
+
"typescript-eslint": "^8.71.2",
|
|
265
265
|
"uid-number": "0.0.6",
|
|
266
266
|
"undici": "^7.29.1",
|
|
267
267
|
"unified": "^11.0.5",
|
package/package.json
CHANGED
|
@@ -9,7 +9,7 @@
|
|
|
9
9
|
"./dist/node_modules/node-gyp/gyp/gyp"
|
|
10
10
|
]
|
|
11
11
|
},
|
|
12
|
-
"version": "12.
|
|
12
|
+
"version": "12.14.0",
|
|
13
13
|
"description": "Fast, disk space efficient package manager",
|
|
14
14
|
"keywords": [
|
|
15
15
|
"pnpm",
|
|
@@ -46,20 +46,20 @@
|
|
|
46
46
|
"THIRD-PARTY-NOTICES.md"
|
|
47
47
|
],
|
|
48
48
|
"optionalDependencies": {
|
|
49
|
-
"@pnpm/exe.win32-x64": "12.
|
|
50
|
-
"@pnpm/exe.win32-arm64": "12.
|
|
51
|
-
"@pnpm/exe.darwin-x64": "12.
|
|
52
|
-
"@pnpm/exe.darwin-arm64": "12.
|
|
53
|
-
"@pnpm/exe.linux-x64": "12.
|
|
54
|
-
"@pnpm/exe.linux-arm64": "12.
|
|
55
|
-
"@pnpm/exe.linux-riscv64": "12.
|
|
56
|
-
"@pnpm/exe.linux-ppc64": "12.
|
|
57
|
-
"@pnpm/exe.linux-s390x": "12.
|
|
58
|
-
"@pnpm/exe.linux-x64-musl": "12.
|
|
59
|
-
"@pnpm/exe.linux-arm64-musl": "12.
|
|
60
|
-
"@pnpm/exe.freebsd-x64": "12.
|
|
61
|
-
"@pnpm/exe.android-arm64": "12.
|
|
62
|
-
"@pnpm/exe.android-x64": "12.
|
|
49
|
+
"@pnpm/exe.win32-x64": "12.14.0",
|
|
50
|
+
"@pnpm/exe.win32-arm64": "12.14.0",
|
|
51
|
+
"@pnpm/exe.darwin-x64": "12.14.0",
|
|
52
|
+
"@pnpm/exe.darwin-arm64": "12.14.0",
|
|
53
|
+
"@pnpm/exe.linux-x64": "12.14.0",
|
|
54
|
+
"@pnpm/exe.linux-arm64": "12.14.0",
|
|
55
|
+
"@pnpm/exe.linux-riscv64": "12.14.0",
|
|
56
|
+
"@pnpm/exe.linux-ppc64": "12.14.0",
|
|
57
|
+
"@pnpm/exe.linux-s390x": "12.14.0",
|
|
58
|
+
"@pnpm/exe.linux-x64-musl": "12.14.0",
|
|
59
|
+
"@pnpm/exe.linux-arm64-musl": "12.14.0",
|
|
60
|
+
"@pnpm/exe.freebsd-x64": "12.14.0",
|
|
61
|
+
"@pnpm/exe.android-arm64": "12.14.0",
|
|
62
|
+
"@pnpm/exe.android-x64": "12.14.0"
|
|
63
63
|
},
|
|
64
64
|
"scripts": {
|
|
65
65
|
"preinstall": "node install.js",
|