pnpm 12.15.0

What's new in 12.15.0

This release lets pnpm-workspace.yaml delegate settings to other files and config dependencies with include, adds lockfile.integrityTarget：tar and tar-registry support, accepts zstd-compressed registry responses, and honors SOURCE_DATE_EPOCH in pnpm deploy and pnpm install. It also rejects registry metadata that names a different package than the one requested and speeds up workspace installs and macOS file linking.

Minor Changes

• pnpm-workspace.yaml can now delegate settings to other YAML files and to config dependencies through a new include field. Each source may define only the settings the root manifest delegates to it. Every setting has one owner. Commands that change settings write each one to the file that owns it. A relative path in an included file is relative to that file. See Splitting Settings Across Files.

A config dependency supplies its settings through the YAML file named in the pnpm.config field of its package.json. The new bootConfig setting sets the release-age and trust policy pnpm uses to install config dependencies and the pnpm version from packageManager.

• Added the lockfile.integrityTarget setting. With integrityTarget：tar, pnpm-lock.yaml pins the hash of every package's uncompressed tar, so the lockfile no longer changes when a registry recompresses its tarballs or serves them as tars. pnpm learns a version's tar hash from the store or by downloading it once. pnpm audit signatures ties the tar hash to the signed .tgz integrity.

yaml title="pnpm-workspace.yaml"
lockfile:
integrityTarget：tar

• pnpm can now install from a registry that serves uncompressed tars with zstd or gzip content coding. pnpm-lock.yaml records the hash of each tar. Declare such a registry with serverType：pnpr in registries to keep tarball URLs out of the lockfile. See Tar registries.

pnpm now decodes the content coding of tarball downloads itself. It rejects a zstd response whose window is larger than 8 MiB.

Added the maxTarballUnpackedSize setting. It caps the bytes the files of one package may unpack to, 4 GiB by default.

• Registry revisions now always pin the hash of the uncompressed tar, the original included. pnpm records an original selected through the revision protocol, for example with a +r0 specifier, as revision：0 in the lockfile and fetches it from the registry's digest route. …

Full release notes »