pnpm v11 Released with Major Updates
The pnpm package manager has released version 11, introducing significant changes to the JavaScript tooling ecosystem. Key updates include a migration to ESM, Standalone Executable Application (SEA) builds, and performance improvements for runtimes like Node, Bun, and Deno.
- The performance improvements in v11 are driven by a switch from JSON to the MessagePack format for internal store and cache files, which provides faster serialization and more compact file sizes. Additionally, the index file format was optimized to store package manifest data directly, reducing I/O operations during installation. - This release drops support for several Node.js versions, specifically v18, v19, v20, and v21. Projects using pnpm v11 will need to be running on a supported Node.js version. - For improved developer experience in debugging dependencies, the `pnpm why` command has been changed to display a reverse dependency tree. This shows the searched package at the root with its dependents as branches, making it easier to understand why a specific package is included in a project. - As part of the migration to pure ESM, `pnpm init` will now default to creating a `package.json` with `"type": "module"`. Developers can now also use ESM for pnpm hooks by using a `.pnpmfile.mjs` file. - The Standalone Executable Application (SEA) version is packaged with its own Node.js runtime, allowing it to be used on systems without Node.js pre-installed. This makes pnpm not just a package manager but also a Node.js version manager. - Configuration management has been refactored; registry and authentication settings remain in INI files (like `.npmrc`), while pnpm-specific settings are now loaded from global or local YAML files (e.g., `pnpm-workspace.yaml`). - Several command-line aliases have changed, which could be a breaking change for developers' scripts and workflows. For instance, with `pnpm add`, `-p` is now an alias for `--save-prod` and `-d` is an alias for `--save-dev`. - Security and build behaviors are now stricter by default. The `strictDepBuilds` setting is enabled, meaning pnpm will fail if it encounters unapproved dependency builds, making CI/CD pipelines more secure.