pnpm 12.3.0 → 12.3.2

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # pnpm
 
+## 12.3.2
+
+### Patch Changes
+
+- `pnpm audit --fix update` no longer aborts when a vulnerable package has no safe version inside its declared range [#14508](https://github.com/pnpm/pnpm/issues/14508). The run updates every package it can and lists the rest as remaining.
+
+- `pnpm install` no longer reruns root lifecycle scripts when the global virtual store contains an unfinished-build marker in a package slot that the current lockfile does not use [pnpm/pnpm#14485](https://github.com/pnpm/pnpm/issues/14485).
+
+- Sped up installs that have no lockfile. pnpm now links packages whose dependency subtree has no peer dependencies into the virtual store while resolution is still running.
+
+- `pnpm run` and `pnpm exec` now start without reinstalling on filesystems that keep sub-millisecond mtimes, such as NTFS. Previously, every run on those filesystems reinstalled first [pnpm/pnpm#14486](https://github.com/pnpm/pnpm/issues/14486).
+
+- `pnpm import` now keeps the versions recorded in `package-lock.json`, `npm-shrinkwrap.json`, or `yarn.lock` when it generates `pnpm-lock.yaml`. A range in `package.json`, a catalog, or an override still decides which versions are eligible, and the recorded version is preferred among them. The generated lockfile previously could pin newer versions than the source lockfile [#14476](https://github.com/pnpm/pnpm/issues/14476).
+
+  `pnpm import` in a workspace now imports every workspace project into the shared lockfile. It previously imported only the project in the current directory.
+
+  `pnpm import` now fails with `ERR_PNPM_LOCKFILE_NOT_FOUND` when none of the three source lockfiles is present. It also fails with `ERR_PNPM_YARN_LOCKFILE_PARSE_FAILED` when it cannot parse `yarn.lock`. It previously generated a lockfile from scratch in both cases.
+
+  `pnpm import` always resolves locally. It warns when `--pnpr-server` or the `pnpr-server` setting is given and does not use the server.
+
+- Sped up installs in large workspaces. Discovering the workspace projects no longer enumerates every matched directory to learn which manifest files it holds [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- Sped up installs in large workspaces. The resolver and the peer pass allocate less for every dependency edge [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- `pnpm self-update`, `pnpm with`, and automatic package-manager version switching no longer wait through registry retry delays when a configured registry has no signatures and `registry.npmjs.org` is unavailable [#14483](https://github.com/pnpm/pnpm/issues/14483).
+
+- Sped up installs in large workspaces. Saving the lockfile is faster, and the install finishes without waiting for memory cleanup [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- `pnpm install` now relinks workspace packages when `publishConfig.linkDirectory` changes. Frozen installs report an outdated lockfile until it is regenerated [pnpm/pnpm#14488](https://github.com/pnpm/pnpm/issues/14488).
+
+- The pnpm npm wrapper keeps its placeholder shebang-less so pnpm 11 can install pnpm 12 through the version store. Wrapper installs must allow lifecycle scripts to install the native binary [#14502](https://github.com/pnpm/pnpm/issues/14502).
+
+- Sped up dependency resolution when there is no lockfile, and for the dependencies a lockfile does not cover.
+
+- Sped up installs in large workspaces. Workspace `link:` targets and importer ids are now derived from the paths' suffixes under the workspace root [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- `pnpm install` now reports "Already up to date" when local tarball dependencies have not changed [#14495](https://github.com/pnpm/pnpm/issues/14495).
+
+- `pnpm update` now accepts `--ignore-scripts` and skips lifecycle scripts during the update [pnpm/pnpm#14512](https://github.com/pnpm/pnpm/issues/14512).
+
+- Sped up installs that restore a deleted `node_modules` from a warm global virtual store. pnpm no longer re-links packages that are already fully present in the global virtual store [#14510](https://github.com/pnpm/pnpm/issues/14510).
+
+## 12.3.1
+
+### Patch Changes
+
+- Sped up installs in large workspaces: the anchor for re-rendering workspace `link:` targets is now derived once per project instead of once per dependency edge, and project ordering hashes paths by their raw bytes [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
+- After a self-update from pnpm 12.2 to 12.3, global commands such as `node`, `npm`, and `yarn` failed with `unexpected argument '--shim' found`. Global commands now launch normally, and their first launch migrates the global bin directory to native shims. When self-update downgrades to pnpm 12.2 or older, it keeps the newer native shims so those commands continue to work.
+
+- Sped up installs in large workspaces. The check that verifies each project against the lockfile now runs the projects in parallel [#14352](https://github.com/pnpm/pnpm/issues/14352).
+
 ## 12.3.0
 
 ### Minor Changes

package/bin/pnpm.mjs

@@ -3,17 +3,14 @@
 // `./bin/pnpx.mjs` for every pnpm >=11 (see its `config.json`) and loads them
 // into its own Node.js process, which a native executable cannot be loaded into.
 //
-// The `pnpm` placeholder bin runs it too, when the install script that
-// replaces it with the native binary did not run (build scripts blocked). An
-// ordinary `npm install -g pnpm` never pays for a Node.js startup:
-// `package.json#bin` points at the native binary.
+// Only Corepack reaches this file: `package.json#bin` still points at the native
+// binary, so an ordinary `npm install -g pnpm` never pays for a Node.js startup.
 //
 // Corepack installs no dependencies and runs no lifecycle scripts, so the
 // `@pnpm/exe.<target>` package that carries the binary is absent and
 // `install.js` never ran. The binary is therefore downloaded on first use and
 // kept next to this wrapper — where the native binary also finds the `dist/`
-// payload it ships node-gyp in. The placeholder's installs usually do carry
-// that package, and the binary is taken from there.
+// payload it ships node-gyp in.
 //
 // The download itself is `get-pnpm`, the package behind https://get.pnpm.io,
 // which already knows how to verify one; it travels in that same `dist/`

package/dist/node_modules/.pnpm-workspace-state-v1.json

@@ -1,9 +1,9 @@
 {
-  "lastValidatedTimestamp": 1788364975827,
+  "lastValidatedTimestamp": 1788478744905,
   "projects": {
     "/home/runner/_work/pnpm/pnpm/pnpm/npm/pnpm/temp-deploy": {
       "name": "pacquet",
-      "version": "12.3.0"
+      "version": "12.3.2"
     }
   },
   "pnpmfiles": [],
@@ -87,7 +87,7 @@
         "@types/write-file-atomic": "^4.0.3",
         "@types/yarnpkg__lockfile": "^1.1.9",
         "@types/zkochan__table": "npm:@types/table@6.3.2",
-        "@typescript-eslint/utils": "^8.68.0",
+        "@typescript-eslint/utils": "^8.69.0",
         "@typescript/native-preview": "7.0.0-dev.20260707.2",
         "@yarnpkg/core": "4.9.1",
         "@yarnpkg/extensions": "2.0.7",
@@ -190,7 +190,7 @@
         "p-defer": "^4.0.1",
         "p-every": "^2.0.0",
         "p-filter": "^4.1.0",
-        "p-limit": "^7.3.1",
+        "p-limit": "^7.3.2",
         "p-queue": "^9.3.3",
         "parse-json": "^8.3.0",
         "parse-npm-tarball-url": "^5.0.0",
@@ -247,7 +247,7 @@
         "tree-kill": "^1.2.2",
         "ts-jest-resolver": "2.0.1",
         "typescript": "6.0.3",
-        "typescript-eslint": "^8.68.0",
+        "typescript-eslint": "^8.69.0",
         "undici": "^7.29.0",
         "unified": "^11.0.5",
         "validate-npm-package-name": "7.0.2",

package/install.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 // Preinstall for the pnpm v12 wrapper (shared verbatim by `pnpm` and
-// `@pnpm/exe`): replace the placeholder bins with the host's native binary so
-// `pnpm` runs directly, no Node startup per call. Package managers write bin
-// shims after preinstall, so the shims are made from the binary; where build
-// scripts are blocked (`--ignore-scripts`, the pnpm/Bun default) the
-// placeholder stays and runs pnpm through Node.js (see the `pnpm` file). npm
-// does not re-read the rewritten `bin` during the same install pass, so on a
-// global Windows install, postinstall asks it to relink.
+// `@pnpm/exe`): replace the shebang-less placeholder bins with the host's native
+// binary so `pnpm` runs directly, no Node startup per call. The placeholder must
+// stay shebang-less because pnpm 11 records its interpreter before installing
+// the native binary at the same path. npm's global Windows shims still target
+// the extensionless path after the `bin` rewrite, so postinstall asks npm to
+// regenerate them against `pnpm.exe`. When lifecycle scripts are blocked
+// (`--ignore-scripts`, pnpm/Bun default), the placeholder remains and pnpm
+// cannot run.
 //
 // `pn`/`pnpx`/`pnx` are committed `#!/bin/sh` scripts on Unix (so only `pnpm` is
 // relinked); on Windows the native binary is hardlinked onto each and

package/package.json

@@ -9,7 +9,7 @@
       "./dist/node_modules/node-gyp/gyp/gyp"
     ]
   },
-  "version": "12.3.0",
+  "version": "12.3.2",
   "description": "Fast, disk space efficient package manager",
   "keywords": [
     "pnpm",
@@ -46,14 +46,14 @@
     "THIRD-PARTY-NOTICES.md"
   ],
   "optionalDependencies": {
-    "@pnpm/exe.win32-x64": "12.3.0",
-    "@pnpm/exe.win32-arm64": "12.3.0",
-    "@pnpm/exe.darwin-x64": "12.3.0",
-    "@pnpm/exe.darwin-arm64": "12.3.0",
-    "@pnpm/exe.linux-x64": "12.3.0",
-    "@pnpm/exe.linux-arm64": "12.3.0",
-    "@pnpm/exe.linux-x64-musl": "12.3.0",
-    "@pnpm/exe.linux-arm64-musl": "12.3.0"
+    "@pnpm/exe.win32-x64": "12.3.2",
+    "@pnpm/exe.win32-arm64": "12.3.2",
+    "@pnpm/exe.darwin-x64": "12.3.2",
+    "@pnpm/exe.darwin-arm64": "12.3.2",
+    "@pnpm/exe.linux-x64": "12.3.2",
+    "@pnpm/exe.linux-arm64": "12.3.2",
+    "@pnpm/exe.linux-x64-musl": "12.3.2",
+    "@pnpm/exe.linux-arm64-musl": "12.3.2"
   },
   "scripts": {
     "preinstall": "node install.js",

package/pnpm

@@ -1,21 +1,4 @@
-#!/usr/bin/env node
-// pnpm's native binary replaces this file during installation (see
-// ./install.js). If this is running, that install script did not — build
-// scripts were blocked (pnpm and Bun block them by default) or skipped
-// (`--ignore-scripts`) — so pnpm runs through Node.js instead: `bin/pnpm.mjs`
-// finds the installed binary, or downloads one, and spawns it.
-//
-// Package managers write bin shims after preinstall has had its chance to run,
-// so a shim made from this file's shebang exists only where the binary never
-// arrived. That is also why this file is left in place once it is running: a
-// binary put here under such a shim would be run through `node`.
-import process from 'node:process'
-
-if (process.stderr.isTTY) {
-  process.stderr.write(
-    'pnpm is running through Node.js because the script that installs its native binary was skipped. ' +
-    'Reinstall pnpm with its build scripts allowed to run the binary directly.\n'
-  )
-}
-
-await import('./bin/pnpm.mjs')
+This is a placeholder. pnpm's native binary replaces this file during
+installation (see ./install.js). If you are reading this, the install/build
+script did not run — reinstall with build scripts enabled (e.g. allow-list
+pnpm's build under pnpm or Bun, or drop --ignore-scripts).