chore(deps): update pnpm to v12 - #710

Open

renovate[bot] wants to merge 1 commit into

mainfrom

renovate/pnpm-12.x

renovate Bot commented Sep 5, 2026 •

edited

Loading

Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
pnpm (source)	`10.18.0` → `12.5.1`

Release Notes

pnpm/pnpm (pnpm)

`v12.5.1`: pnpm 12.5.1

Patch Changes

pnpm now reports an unknown task setting in pnpm-workspace.yaml and carries on. It used to refuse to start, so a project could not use a task setting that only the pnpm version its packageManager pins reads. The setting is still an error when the running pnpm is that pinned version.
Python interpreter installation now retries historical release metadata requests. It caches the release list for up to 24 hours and refreshes it once after a lookup miss. When a release omits the current platform, the search samples at most eight other releases before reporting that the lookup is inconclusive.
Python registries entries now route packages by exact names or trailing-prefix patterns in packages. Registry declaration order no longer affects resolution. A matched package resolves exclusively from its assigned registry, including transitive and build dependencies. Use packages: ["*"] to declare the default index.
pnpm install no longer fails with "Too many levels of symbolic links" when a Cargo configuration file above the workspace is a symlink, such as a ~/.cargo/config.toml linked from a dotfiles repository.
pnpm install now returns "Already up to date" in a workspace where dedupeDirectDeps left a project without a node_modules directory of its own. Such a project forced a full install on every run.
pnpm install no longer refuses the repeat-install fast path just because a changed pnpm-lock.yaml is 16 MiB or larger. Such a lockfile forced a full install on the run after every change.

Platinum Sponsors

Gold Sponsors

`v12.5.0`: pnpm 12.5

pnpm 12.5.0 makes Python a first-class ecosystem, accepts Package URLs in pnpm add, names whole platforms in supportedArchitectures, and gives tasks machine-wide concurrency limits. It also fixes an install that could reuse one package's downloaded tarball for another.

Minor Changes

Installing packages

pnpm add accepts a Package URL in place of a package name. pnpm add pkg:npm/express@4.18.2 saves express to package.json. pnpm add pkg:cargo/serde@1.0.188 saves serde to Cargo.toml. pnpm add pkg:pypi/requests@2.31.0 saves requests to pyproject.toml. pkg is now a reserved specifier prefix, whatever case it is written in, so a named registry can no longer be called pkg.
A registries entry can now name the ecosystem it serves.
```
registries:
  https://internal.example/simple/:
    ecosystem: pypi
  https://pypi.org/simple/:
    ecosystem: pypi
  https://index.crates.io/:
    ecosystem: cargo
```
ecosystem accepts npm, cargo and pypi. An entry that does not name one serves npm, as every entry did before.

An ecosystem with several indexes searches them in the order they are declared. The first index that has a package supplies it, so the one declared last answers what none before it had.

A registries entry may not carry credentials. pnpm reads them from .npmrc, matched by origin, for a PyPI index as for every other package source.

Configuring pnpm

supportedArchitectures now accepts a list of platforms, in place of the os, cpu and libc axes.
```
supportedArchitectures:
  - linux-x64
  - darwin-arm64
  - win32-x64
```
An install prepares for the platforms the list names, and for those only. A platform reads as <os>-<cpu>, with a C library on Linux, as in linux-x64-musl or linux-x64-manylinux_2_28. The Rust target triple of the same machine is accepted too, so x86_64-unknown-linux-gnu names the platform linux-x64 names. A Linux platform that names no C library is the glibc platform. current is the platform the install runs on.

The os, cpu and libc mapping keeps working and keeps its meaning.
Added concurrency groups for tasks. A task in pnpm-workspace.yaml can name a concurrencyGroup. The new concurrencyGroups setting gives each group a limit. At most that many tasks of the group run at once on the machine, counted across every pnpm process, pnpm pipeline included. A task past the limit waits for a running one to finish. A script that calls pnpm run for a task of the same group runs under the slot its parent holds.
```
tasks:
  test:rust:
    concurrencyGroup: cargo
concurrencyGroups:
  cargo: 2
```
tools names the programs pnpm downloads, and mirror says where each one comes from.
```
tools:
  node:
    mirror: https://mirror.example.com/node/download
    channels:
      nightly: https://nightly.example.com/
  bun:
    mirror: https://mirror.example.com/bun
  python:
    mirror: https://mirror.example.com/python-build-standalone/releases
```
node, bun and python can be named. Any other tool is refused.

mirror is the base a tool's own layout hangs off.

channels sends one release channel elsewhere. A channel neither it nor node-mirror:<channel> names is left to mirror. Only node publishes channels, so naming them for another tool is refused.

Set it in the global config.yaml or in PNPM_CONFIG_TOOLS. A pnpm-workspace.yaml that names a tool mirror is ignored.

pnpm pack-app downloads the Node.js it embeds through tools.node. node-mirror:<channel> keeps working and names the same thing as an entry under channels.

Python interpreters and environments

pnpm install now chooses a Python interpreter for each project instead of installing every project with one interpreter #14945. A project is installed with the first interpreter on the machine that its requires-python accepts, so a workspace can hold projects that support different Python versions. pnpm reads .python-version too, and prefers the version it asks for. Set python.executable in pnpm-workspace.yaml to name one interpreter for every project.
pnpm install now installs a Python interpreter when no interpreter on the machine fits the project #14945. The builds are python-build-standalone's, which uv and rye install too. One interpreter is shared by every project on the machine, and a later install uses it without downloading anything. runtimeOnFail decides what an install with no interpreter that fits does, the way it does for a Node.js runtime. error reports the project instead of installing one. warn and ignore install with an interpreter the machine has that the project's requires-python rejects. tools.python.mirror names a mirror.
Python environments now live in the store. Each project keeps only its .venv link, which points at the project's current environment generation under python-envs in the store. A repository with many Python projects no longer holds a .pnpm/python-envs directory in each of them. The next install relinks a .venv that an earlier release published. The old .pnpm/python-envs directory is left in place, since a running program may still use it, and can be deleted once none does. With frozenStore set, pnpm writes nothing to the store, so environments stay in the project's .pnpm/python-envs #15014.
Python environments now use packageImportMethod to import wheel files from the store. Use clone-or-copy for copy-on-write clones with a copy fallback, or copy for independent files. Hardlinked files share writes with the store and other environments.

Isolated Python build environments keep backend writes private with copy-on-write clones or copies.

Python projects and workspaces

pnpm install now installs a Python project's own package, so the project can be imported and the commands in [project.scripts] run right after an install #14945. The installed package points at the source tree, so an edit to a module takes effect without another install. pnpm installs the package of a project that declares a [build-system]. tool.uv.package overrides that either way.
pnpm install now installs a Python project in the workspace from its own source. Declare it under [tool.uv.sources], as shared = { workspace = true } or shared = { path = "../shared", editable = true }. pnpm builds the project with the backend it declares. It installs the build editable, so an edit to the project takes effect without another install.

Approve the build backend under allowBuilds in pnpm-workspace.yaml as a Package URL, as `pkg:py

❗ Important

✂ PR body was truncated to here.

Configuration

The updateConfig pnpmfile hook now receives the resolved configuration, including settings that came from .npmrc, the command line, or a default #14676. Scoped registries are reported under registriesByScope, and a hook may rewrite that map to change where packages are fetched from. Registry credentials are reported under configByUri, as pnpm 11 reports them. An unset setting is left out rather than reported as null.
pnpm audit --fix and the minimumReleaseAgeStrict approval prompt now keep the comments in minimumReleaseAgeExclude when they append an entry to it in pnpm-workspace.yaml. The rest of the list is left as written, and the trustPolicyExcludePrune and minimumReleaseAgeExcludePrune cleanups keep the comments of the entries they retain.

pnpm install and pnpm dedupe now run those cleanups too #14759. Only pnpm add, pnpm update, and pnpm remove pruned the entries that the freshly written lockfile no longer resolves.
pnpm config set --global node-download-mirrors no longer rejects the key #13611. The global config file already accepted nodeDownloadMirrors, but the command refused to write it.
NO_PROXY entries that start with a dot, such as .npmjs.org, now bypass the proxy for the domain and its subdomains #14686.
pnpm no longer creates a project pnpm-lock.yaml when devEngines.packageManager.onFail is download and lockfile writing is off through lockfile: false or --no-lockfile #14728. pnpm still switches to the pinned version.
pnpm now writes node_modules/.package-map.json only when nodeExperimentalPackageMap is enabled. Nothing reads the file without that setting, and an install that stops writing the map removes the one a previous install left.

Windows

pnpm pipeline no longer fails with intermittent access denied errors when concurrent tasks save their cache entries on Windows.
Windows filesystem operations now retry permission errors for up to one second #14682. A permanent permission error delayed the failure by a minute. Sharing and lock violations keep their one minute retry budget.

Messages and output

pnpm now warns when the root package.json declares a non-empty workspaces array and the project has no pnpm-workspace.yaml #2255. Such an install linked no project and said nothing about why.
ERR_PNPM_PACKAGE_MANAGER_REMOVE_MODULES_DIR now names the file or directory in node_modules that pnpm could not clean up. It reported only the underlying OS error, such as "Access is denied (os error 5)".
pnpm --help no longer describes pnpm as experimental.

Platinum Sponsors

Gold Sponsors

`v12.4.0`: pnpm 12.4

Minor Changes

pnpm can now manage npm, Python, and Cargo dependencies in the same workspace. Enable python.enabled or cargo.enabled in pnpm-workspace.yaml, then use pnpm install to install them together.
- Add Python packages with pnpm add pypi:<package>. pnpm uses pyproject.toml, pylock.toml, and a managed .venv. Frozen and offline installs are supported, and pnpm run and pnpm exec make the environment's executables available #14566.
- Add Rust crates with pnpm add crate:<package>. pnpm supports crates.io and custom sparse registries configured with cargo.indexUrl. Registry authentication supports pnpm credentials and, for crates.io, CARGO_REGISTRY_TOKEN or $CARGO_HOME/credentials.toml.
Both ecosystems support faster dependency resolution through pnprServer, with local resolution as a fallback when the server does not support it.
Added pnpm pipeline [name] to install frozen dependencies and run workspace tasks declared in pipelines. It selects affected projects, runs their task graph, and continues running tasks after a task fails.

Tasks support inputs, outputs, env, and cache settings. Cached results restore task outputs and replay logs. Cargo tasks can reuse local build state between worktrees with tasks.<name>.cargoTargetDir. Set includeWorkspaceRoot: true to include root tasks.

Use pnpm pipeline --dry-run to preview the task graph without installing configuration dependencies or running workspace hooks.
Added support for Android on arm64 and x64, FreeBSD on x64, and Linux on ppc64le, s390x, and RISC-V (riscv64 with glibc) #14431, #14597, #7582.
Added trustPolicyExcludePrune to automatically remove unused versions and packages from trustPolicyExclude when running pnpm add, pnpm update, or pnpm remove. It is disabled by default. Package name patterns such as @scope/* are kept, and cleanup is skipped when sharedWorkspaceLockfile is false.
Added pnpm change check for CI validation of package versions against the versioning.epics bands and versioning.fixed groups in pnpm-workspace.yaml. It reports all violations, including packages that are not part of the current release.

Patch Changes

Registry metadata is now kept separate for registries with different URL paths or schemes. This prevents installs from using another registry's package versions or tarball URLs, and keeps metadata fetched over HTTP from being reused for HTTPS #13558.

The first install after upgrading refetches registry metadata. The package store is unchanged. pnpm cache view now shows full registry URLs. Scripts that parse the directory names from pnpm cache list-registries or pnpm cache list need updating.
Patches that add build scripts or a binding.gyp now trigger a build, subject to build approval. Unapproved builds appear under "Ignored build scripts" #14648.
Build scripts can now be rejected before installing a package with pnpm add --allow-build=!<pkg>, including global installs. pnpm approve-builds <pkg> and pnpm approve-builds !<pkg> also save decisions when no packages are awaiting approval. They warn if the named package is not awaiting approval #14067.
A registry configured in .npmrc now takes precedence over registry settings saved by pnpm login in the global config.yaml. This fixes installs using the wrong registry after login #14614.
Large downloads over slow connections no longer time out while data is still arriving. fetch-timeout now limits how long a request can go without making progress #14604.
Sped up installs in workspaces with many projects when reusing a warm global virtual store #14540.
pnpm deploy is faster in large workspaces and no longer fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH when the project includes a .pnpmfile.mjs #14539, #14671.
pnpm add --workspace <pkg> works again. It saves the dependency with the workspace: protocol and links it from the workspace. The command fails if no workspace project provides the package #14602.
pnpm add and pnpm install now accept protocol-prefixed selectors such as jsr:@scope/pkg, npm:pkg@^1.0.0, and workspace:pkg@* #14590. Installs with JSR dependencies in the lockfile also no longer fail with ERR_PNPM_META_FETCH_FAIL #14649.
Boolean flags now accept explicit inline values. For example, pnpm install --prod=false installs devDependencies, while --prod=true skips them #14553.
pnpm install <pkg> now accepts --offline and --prefer-offline, as pnpm add <pkg> already did #14194.
Fixed pnpm install --frozen-lockfile rejecting a freshly generated lockfile when overrides use relative file: or link: paths in a workspace #14555.
Fixed installs with config dependencies failing on symlinked lockfiles, such as those used by Bazel and Nix, when the config dependencies have not changed. Updates that would write through a symlink remain disallowed. Updating config dependencies also preserves lockfiles that start with a byte order mark #14372.
Fixed package manager version pins being written to the wrong lockfile when lockfileDir is set. The pins also remain consistent across commands when version switching is disabled, avoiding unnecessary lockfile changes #14633, #14575.
pnpm import now respects lockfileDir and branch lockfiles without modifying other lockfiles. Failed imports restore the destination lockfile #14563.
pnpm patch-commit now produces valid patches when files are added or deleted. pnpm install also accepts patches that delete files without listing their contents, and patch files with CRLF line endings #14559, #14557.
Fixed version ranges with partial upper bounds. For example, <=16 now includes all 16.x versions, and >=0.11 <=3 correctly accepts 3.0.1 #14419.
Workspace package patterns now support . and .. segments and repeated slashes. Patterns such as ./packages/* and exclusions such as !./packages/foo now match correctly #14571.
packageConfigs settings now apply to the specified projects when sharedWorkspaceLockfile is false, including overrides, hoist, modulesDir, saveExact, and savePrefix. Workspaces with a shared lockfile report which entries were ignored #14556.
pnpm run and pnpm exec no longer report a changed workspace structure after a successful install when sharedWorkspaceLockfile is false and verifyDepsBeforeRun is enabled #14588.
Commands run from a project's subdirectory now find the nearest ancestor with a manifest. This fixes commands such as pnpm bin returning paths under the wrong directory. pnpm init still creates its manifest in the current directory, and pnpm exec still runs there #14622.
Relative scriptShell paths in pnpm-workspace.yaml now resolve from the workspace root, including when scripts run in nested packages. Bare command names such as bash still use PATH #14422.
Fixed installing the pnpm version pinned in packageManager when nodeLinker is hoisted. Managed Node.js, Deno, and Bun installations also work when the global config uses nodeLinker: hoisted #14595.
The JavaScript pnpm can again switch to a project's pinned pnpm version on platforms without a native binary for that version, such as Alpine Linux with pnpm 10 or Intel Macs with pnpm 11. If a native pnpm version does not support the platform, the error now names the missing target #13622.
Provisioning Yarn 6 now uses GH_TOKEN or GITHUB_TOKEN when available to avoid GitHub's anonymous API rate limit in CI. Tokens are only sent when strict-ssl is enabled.
Fixed concurrent installs sharing a global virtual store on macOS failing with "failed to import ... No such file or directory" #14560.
Fixed pnpm setup failing with ERR_PNPM_DIRECTORY_FETCHER_PATH_ESCAPE on Windows. Local file: dependencies whose directories are symlinks or junctions are now packed correctly #14618.
On Windows, installs now retry replacing command shims temporarily locked by another process #14549.
Fixed argument forwarding on Windows with shellEmulator enabled. Paths ending in a backslash, line breaks, and literal shell expressions are preserved #14548.
Windows store paths now consistently use backslashes in pnpm store path output and in the storeDir and virtualStoreDir fields of node_modules/.modules.yaml.
Invalid certificates in ca or cafile no longer cause an Invalid CA certificate error. Valid certificates still apply, and blank cert or key values are treated as unset #14646.
Installs now respect the archive extraction concurrency limit even after a download is abandoned #14585.
pnpm audit summaries now exclude advisories ignored through auditConfig.ignoreGhsas and report them separately. When all advisories are ignored, the summary says so #14535.
pnpm pack --json now reports errors as JSON. Lifecycle script output appears before the final JSON output.
pnpm outdated -r now wraps the Dependents column, keeping the table readable when many workspace projects use the same dependency #14591.
Shell completions now support the pn alias in bash, fish, pwsh, and zsh #11955.
pnpm version now accepts -m as a short alias for --message #14567.

Platinum Sponsors

Gold Sponsors

`v12.3.4`

`v12.3.3`

`v12.3.2`

`v12.3.1`

`v12.3.0`

`v12.2.1`

`v12.2.0`

`v12.1.0`

`v12.0.0`

`v11.27.1`

`v11.27.0`

`v11.26.0`

`v11.25.0`

`v11.24.0`

`v11.23.0`

`v11.22.0`

`v11.21.0`

`v11.20.0`

`v11.19.0`

`v11.18.0`

`v11.17.0`

`v11.16.0`

`v11.15.1`

`v11.15.0`

`v11.14.0`

`v11.13.1`

`v11.13.0`

`v11.12.0`

`v11.11.0`

`v11.10.0`

`v11.9.0`

`v11.8.0`

`v11.7.0`

`v11.6.0`

`v11.5.3`

`v11.5.2`

`v11.5.1`

`v11.5.0`

`v11.4.0`

`v11.3.0`

`v11.2.2`

`v11.2.1`

`v11.2.0`

`v11.1.3`

`v11.1.2`

`v11.1.1`

`v11.1.0`

`v11.0.9`

`v11.0.8`

`v11.0.7`

`v11.0.6`

`v11.0.5`

`v11.0.4`

`v11.0.3`

`v11.0.2`

`v11.0.1`

`v11.0.0`

`v10.34.5`

`v10.34.4`

`v10.34.3`

`v10.34.2`

`v10.34.1`

`v10.34.0`

`v10.33.4`

`v10.33.3`

`v10.33.2`

`v10.33.1`

`v10.33.0`

`v10.32.1`

`v10.32.0`

`v10.31.0`

`v10.30.3`

`v10.30.2`

`v10.30.1`

`v10.30.0`

`v10.29.3`

`v10.29.2`

`v10.29.1`

`v10.28.2`

`v10.28.1`

`v10.28.0`

`v10.27.0`

`v10.26.2`

`v10.26.1`

`v10.26.0`

`v10.25.0`

`v10.24.0`

`v10.23.0`

`v10.22.0`

`v10.21.0`

`v10.20.0`

`v10.19.0`

`v10.18.3`

`v10.18.2`

`v10.18.1`

If you want to rebase/retry this PR, check this box

renovate Bot added the dependencies label

renovate Bot requested a review from IgorKowalczyk

September 5, 2026 22:08

vercel Bot had a problem deploying to Preview

September 5, 2026 22:09

Failure

renovate Bot force-pushed the renovate/pnpm-12.x branch from b512165 to 979057d Compare

September 11, 2026 20:42

vercel Bot had a problem deploying to Preview

September 11, 2026 20:42

Failure

renovate Bot force-pushed the renovate/pnpm-12.x branch from 979057d to 6ffd97d Compare

September 16, 2026 11:03

vercel Bot had a problem deploying to Preview

September 16, 2026 11:04

Failure


          chore(deps): update pnpm to v12

bd5d686

renovate Bot force-pushed the renovate/pnpm-12.x branch from 6ffd97d to bd5d686 Compare

September 20, 2026 05:59

vercel Bot had a problem deploying to Preview

September 20, 2026 05:59

Failure

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels