<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="5">
<package pkgid="3ebf3a3d213562846f5313ad79513f90d2471b10966a45417b8b4195e889d59dbf820f6a768456eedb17cd8462ec6747a06b2b56d0695fe5d06f278b533300fb" name="pnpm" arch="noarch">
  <version epoch="0" ver="11.6.0" rel="11.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- update to 10.17:
  * Minor Changes
  - The minimumReleaseAgeExclude setting now supports patterns.
    For instance:
    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
  - "@eslint/*"
  * Patch Changes
  - Don't ignore the minimumReleaseAge check, when the package is
    requested by exact version and the packument is loaded from
    cache #9978.
  - When minimumReleaseAge is set and the active version under a
    dist-tag is not mature enough, do not downgrade to a
    prerelease version in case the original version wasn't a
    prerelease one #9979.
- update to 10.16.1:
  * Patch Changes
  - The full metadata cache should be stored not at the same
    location as the abbreviated metadata. This fixes a bug where
    pnpm was loading the abbreviated metadata from cache and
    couldn't find the "time" field as a result #9963.
  - Forcibly disable ANSI color codes when generating patch diff
    [#9914].
- update to 10.16:
  * Minor Changes
  - There have been several incidents recently where popular
    packages were successfully attacked. To reduce the risk of
    installing a compromised version, we are introducing a new
    setting that delays the installation of newly released
    dependencies. In most cases, such attacks are discovered
    quickly and the malicious versions are removed from the
    registry within an hour.
  - The new setting is called minimumReleaseAge. It specifies the
    number of minutes that must pass after a version is published
    before pnpm will install it. For example, setting
    minimumReleaseAge: 1440 ensures that only packages released
    at least one day ago can be installed.
  - If you set minimumReleaseAge but need to disable this
    restriction for certain dependencies, you can list them under
    the minimumReleaseAgeExclude setting. For instance, with the
    following configuration pnpm will always install the latest
    version of webpack, regardless of its release time:
    minimumReleaseAgeExclude:
  - webpack
  - Added support for finders #9946.
    In the past, pnpm list and pnpm why could only search for
    dependencies by name (and optionally version). For example:
    pnpm why minimist
    prints the chain of dependencies to any installed instance of
    minimist:
    verdaccio 5.20.1
    ├─┬ handlebars 4.7.7
    │ └── minimist 1.2.8
    └─┬ mv 2.1.1
    └─┬ mkdirp 0.5.6
    └── minimist 1.2.8
    What if we want to search by other properties of a
    dependency, not just its name? For instance, find all
    packages that have react@17 in their peer dependencies?
    This is now possible with "finder functions". Finder
    functions can be declared in .pnpmfile.cjs and invoked with
    the --find-by=&lt;function name&gt; flag when running pnpm list or
    pnpm why.
    Let's say we want to find any dependencies that have React 17
    in peer dependencies. We can add this finder to our
    .pnpmfile.cjs:
    module.exports = {
    finders: {
    react17: (ctx) =&gt; {
    return ctx.readManifest().peerDependencies?.react === "^17.0.0";
    },
    },
    };
    Now we can use this finder function by running:
    pnpm why --find-by=react17
    pnpm will find all dependencies that have this React in peer
    dependencies and print their exact locations in the
    dependency graph.
    @apollo/client 4.0.4
    ├── @graphql-typed-document-node/core 3.2.0
    └── graphql-tag 2.12.6
    It is also possible to print out some additional information
    in the output by returning a string from the finder. For
    example, with the following finder:
    module.exports = {
    finders: {
    react17: (ctx) =&gt; {
    const manifest = ctx.readManifest();
    if (manifest.peerDependencies?.react === "^17.0.0") {
    return `license: ${manifest.license}`;
    }
    return false;
    },
    },
    };
    Every matched package will also print out the license from
    its package.json:
    @apollo/client 4.0.4
    ├── @graphql-typed-document-node/core 3.2.0
    │   license: MIT
    └── graphql-tag 2.12.6
    license: MIT
  * Patch Changes
  - Fix deprecation warning printed when executing pnpm with
    Node.js 24 #9529.
  - Throw an error if nodeVersion is not set to an exact semver
    version #9934.
  - pnpm publish should be able to publish a .tar.gz file #9927.
  - Canceling a running process with Ctrl-C should make pnpm run
    return a non-zero exit code #9626.
- update to 10.15.1:
  * Patch Changes
  - Fix .pnp.cjs crash when importing subpath #9904.
  - When resolving peer dependencies, pnpm looks whether the peer
    dependency is present in the root workspace project's
    dependencies. This change makes it so that the peer
    dependency is correctly resolved even from aliased npm-hosted
    dependencies or other types of dependencies #9913.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758628800">- update to 10.17.1:
  * Patch Changes
  - When a version specifier cannot be resolved because the versions
    don't satisfy the minimumReleaseAge setting, print this
    information out in the error message #9974.
  - Fix state.json creation path when executing pnpm patch in a
    workspace project #9733.
  - When minimumReleaseAge is set and the latest tag is not mature
    enough, prefer a non-deprecated version as the new latest #9987.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761998400">- update to 10.20.0:
  * Minor Changes
  - Support --all option in pnpm --help to list all commands
    [#8628].
  * Patch Changes
  - When the latest version doesn't satisfy the maturity
    requirement configured by minimumReleaseAge, pick the highest
    version that is mature enough, even if it has a different
    major version #10100.
  - create command should not verify patch info.
  - Set managePackageManagerVersions to false, when switching to
    a different version of pnpm CLI, in order to avoid subsequent
    switches #10063.
- update to 10.19.0:
  * Minor Changes
  - You can now allow specific versions of dependencies to run
    postinstall scripts. onlyBuiltDependencies now accepts
    package names with lists of trusted versions. For example:
    Related PR: #10104.
    onlyBuiltDependencies:
  - nx@21.6.4 || 21.6.5
  - esbuild@0.25.1
  - Added support for exact versions in minimumReleaseAgeExclude
    [#9985].
    You can now list one or more specific versions that pnpm
    should allow to install, even if those versions don’t satisfy
    the maturity requirement set by minimumReleaseAge. For
    example:
    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
  - nx@21.6.5
  - webpack@4.47.0 || 5.102.1
- update to 10.18.3:
  * Patch Changes
  - Fix a bug where pnpm would infinitely recurse when using
    verifyDepsBeforeInstall: install and pre/post install scripts
    that called other pnpm scripts #10060.
  - Fixed scoped registry keys (e.g., @scope:registry) being
    parsed as property paths in pnpm config get when
  - -location=project is used #9362.
  - Remove pnpm-specific CLI options before passing to npm
    publish to prevent "Unknown cli config" warnings #9646.
  - Fixed EISDIR error when bin field points to a directory
    [#9441].
  - Preserve version and hasBin for variations packages #10022.
  - Fixed pnpm config set --location=project incorrectly handling
    keys with slashes (auth tokens, registry settings) #9884.
  - When both pnpm-workspace.yaml and .npmrc exist, pnpm config
    set --location=project now writes to pnpm-workspace.yaml
    (matching read priority) #10072.
  - Prevent a table width error in pnpm outdated --long #10040.
  - Sync bin links after injected dependencies are updated by
    build scripts. This ensures that binaries created during
    build processes are properly linked and accessible to
    consuming projects #10057.
- update to 10.18.2:
  * Patch Changes
  - pnpm outdated --long should work #10040.
  - Replace ndjson with split2. Reduce the bundle size of pnpm
    CLI #10054.
  - pnpm dlx should request the full metadata of packages, when
    minimumReleaseAge is set #9963.
  - pnpm version switching should work when the pnpm home
    directory is in a symlinked directory #9715.
  - Fix EPIPE errors when piping output to other commands #10027.
- update to 10.18.1:
  * Patch Changes
  - Don't print a warning, when --lockfile-only is used #8320.
  - pnpm setup creates a command shim to the pnpm executable.
    This is needed to be able to run pnpm self-update on Windows
    [#5700].
  - When using pnpm catalogs and running a normal pnpm install,
    pnpm produced false positive warnings for "skip adding to the
    default catalog because it already exists". This warning now
    only prints when using pnpm add --save-catalog as originally
    intended.
- update to 10.18.0:
  * Minor Changes
  - Added network performance monitoring to pnpm by implementing
    warnings for slow network requests, including both metadata
    fetches and tarball downloads.
    Added configuration options for warning thresholds:
    fetchWarnTimeoutMs and fetchMinSpeedKiBps.
    Warning messages are displayed when requests exceed time
    thresholds or fall below speed minimums
    Related PR: #10025.
  * Patch Changes
  - Retry filesystem operations on EAGAIN errors #9959.
  - Outdated command respects minimumReleaseAge configuration
    [#10030].
  - Correctly apply the cleanupUnusedCatalogs configuration when
    removing dependent packages.
  - Don't fail with a meaningless error when scriptShell is set
    to false #8748.
  - pnpm dlx should not fail when minimumReleaseAge is set
    [#10037].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- update to 10.21.0:
  * Minor Changes
  - Node.js Runtime Installation for Dependencies. Added support
    for automatic Node.js runtime installation for dependencies.
    pnpm will now install the Node.js version required by a
    dependency if that dependency declares a Node.js runtime in
    the "engines" field. For example:
    {
    "engines": {
    "runtime": {
    "name": "node",
    "version": "^24.11.0",
    "onFail": "download"
    }
    }
    }
    If the package with the Node.js runtime dependency is a CLI
    app, pnpm will bind the CLI app to the required Node.js
    version. This ensures that, regardless of the globally
    installed Node.js instance, the CLI will use the compatible
    version of Node.js.
    If the package has a postinstall script, that script will be
    executed using the specified Node.js version.
    Related PR: #10141
  - Added a new setting: trustPolicy.
    When set to no-downgrade, pnpm will fail installation if a
    package’s trust level has decreased compared to previous
    releases — for example, if it was previously published by a
    trusted publisher but now only has provenance or no trust
    evidence.
    This helps prevent installing potentially compromised
    versions of a package.
    Related issue: #8889.
  - Added support for pnpm config get globalconfig to retrieve
    the global config file path #9977.
  * Patch Changes
  - When a user runs pnpm update on a dependency that is not
    directly listed in package.json, none of the direct
    dependencies should be updated #10155.
  - Don't crash when two processes of pnpm are hardlinking the
    contents of a directory to the same destination
    simultaneously #10160.
  - Setting gitBranchLockfile and related settings via
    pnpm-workspace.yaml should work #9651.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467201">- update to 10.22.0:
  * Minor Changes
  - Added support for trustPolicyExclude #10164.
    You can now list one or more specific packages or versions
    that pnpm should allow to install, even if those packages
    don't satisfy the trust policy requirement. For example:
    trustPolicy: no-downgrade
    trustPolicyExclude:
  - chokidar@4.0.3
  - webpack@4.47.0 || 5.102.1
  - Allow to override the engines field on publish by the
    publishConfig.engines field.
  * Patch Changes
  - Don't crash when two processes of pnpm are hardlinking the
    contents of a directory to the same destination
    simultaneously #10179.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763899200">- update to 10.23.0:
  * Minor Changes
  - Added --lockfile-only option to pnpm list #10020.
  * Patch Changes
  - pnpm self-update should download pnpm from the configured npm
    registry #10205.
  - pnpm self-update should always install the non-executable
    pnpm package (pnpm in the registry) and never the @pnpm/exe
    package, when installing v11 or newer. We currently cannot
    ship @pnpm/exe as pkg doesn't work with ESM #10190.
  - Node.js runtime is not added to "dependencies" on pnpm add,
    if there's a engines.runtime setting declared in package.json
    [#10209].
  - The installation should fail if an optional dependency cannot
    be installed due to a trust policy check failure #10208.
  - pnpm list and pnpm why now display npm: protocol for aliased
    packages (e.g., foo npm:is-odd@3.0.1) #8660.
  - Don't add an extra slash to the Node.js mirror URL #10204.
  - pnpm store prune should not fail if the store contains
    Node.js packages #10131.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765627200">- update to 10.24.0:
  * Minor Changes
  - Increased network concurrency on machines with many CPU
    cores. pnpm now automatically selects a network concurrency
    between 16 and 64, based on the number of pnpm workers
    (calculated as workers × 3). This improves performance on
    high-core systems #10068.
  * Patch Changes
  - trustPolicy should ignore the trust evidences of prerelease
    versions, when installing a non-prerelease version.
  - Handle ENOENT errors thrown by fs.linkSync(), which can occur
    in containerized environments (OverlayFS) instead of EXDEV.
    The operation now gracefully falls back to fs.copyFileSync()
    in these cases #10217.
  - Reverted: pnpm self-update should download pnpm from the
    configured npm registry #10205.
  - Packages that don't have a package.json file (like Node.js)
    should not be reimported from the store on every install.
    Another file from the package should be checked in order to
    verify its presence in node_modules.
  - Correctly read auth tokens for URLs that contain underscores
    [#17].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765627201">- update to 10.25.0:
  * Minor Changes
  - Allow loading certificates from cert, ca, and key for
    specific registry URLs. E.g.,
    //registry.example.com/:ca=-----BEGIN CERTIFICATE-----....
    Previously this was only working via certfile, cafile, and
    keyfile.
    These properties are supported in .npmrc, but were ignored by
    pnpm, this will make pnpm read and use them as well.
    Related PR: #10230.
  - Added a new flag called --bare to pnpm init for creating a
    package.json with the bare minimum of required fields #10226.
  * Patch Changes
  - Improved reporting of ignored dependency scripts #10276.
  - pnpm install should build any dependencies that were added to
    onlyBuiltDependencies and were not built yet #10256.
  - pnpm publish -r --force should allow to run publish over
    already existing versions in the registry #10272.
  - Don't fail with a ERR_PNPM_MISSING_TIME error if a package
    that is excluded from trust policy checks is missing the time
    field in the metadata.</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1765800000">- update to 10.26.0
  * Minor Changes
  - Semi-breaking. Block git-hosted dependencies from running
    prepare scripts unless explicitly allowed in onlyBuiltDependencies #10288.
  - Semi-breaking. Compute integrity hash for HTTP tarball
    dependencies when fetching, storing it in the lockfile to
    prevent servers from serving altered content on subsequent installs #10287.
  - Added a new setting blockExoticSubdeps that prevents the
    resolution of exotic protocols in transitive dependencies.
  - Added support for allowBuilds, which is a new field that
    can be used instead of onlyBuiltDependencies and
    ignoredBuiltDependencies. The new allowBuilds field in your
    pnpm-workspace.yaml uses a map of package matchers to
    explicitly allow (true) or disallow (false) script execution.
    This allows for a single, easy-to-manage source of truth for
    your build permissions.
  * Patch Changes
  - Show deprecation in table/list formats when latest version
    is deprecated #8658.
  - Remove the injectWorkspacePackages setting from the
    lockfile on the deploy command #10294.
  - Normalize the tarball URLs before saving them to the
    lockfile. URLs should not contain default ports, like :80 for
    http and :443 for https #10273.
  - When a dependency is installed via a direct URL that
    redirects to another URL and is immutable, the original URL
    is normalized and saved to package.json #10197.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- update to 10.28.0:
  * Minor Changes
  - Add support for a hook called beforePacking that can be used
    to customize the package.json contents at publish time #3816.
  - In some cases, a filtered install (i.e. pnpm install --filter
    ...) was slower than running pnpm install without any filter
    arguments. This performance regression is now fixed. Filtered
    installs should be as fast or faster than a full install
    [#10408].
  * Patch Changes
  - Do not add a symlink to the project into the store's project
    registry if the store is in a subdirectory of the project
    [#10411].
  - It should be possible to declare the requiredScripts setting
    in pnpm-workspace.yaml #10261.
- update to 10.27.0:
  * Minor Changes
  - Adding trustPolicyIgnoreAfter allows you to ignore trust
    policy checks for packages published more than a specified
    time ago#10352.
  - Added project registry for global virtual store prune
    support.
  - Projects using the store are now registered via symlinks in
    {storeDir}/v10/projects/. This enables pnpm store prune to
    track which packages are still in use by active projects and
    safely remove unused packages from the global virtual store.
  - Semi-breaking. Changed the location of unscoped packages in
    the virtual global store. They will now be stored under a
    directory named @ to maintain a uniform 4-level directory
    depth.
  - Added mark-and-sweep garbage collection for global virtual
    store.
  - pnpm store prune now removes unused packages from the global
    virtual store's links/ directory. The algorithm:
  - Scans all registered projects for symlinks pointing to the
    store
  - Walks transitive dependencies to mark reachable packages
  - Removes any package directories not marked as reachable
  - This includes support for workspace monorepos - all
    node_modules directories within a project (including those in
    workspace packages) are scanned.
  * Patch Changes
  - Throw an error if the value of the tokenHelper or
    &lt;url&gt;:tokenHelper setting contains an environment variable.
  - Git dependencies with build scripts should respect the
    dangerouslyAllowAllBuilds settings #10376.
  - Skip the package manager check when running with --global and
    a project packageManager is configured, and warn that the
    check is skipped.
  - pnpm store prune should not fail if the dlx cache directory
    has files, not only directories #10384
  - Fixed a bug (#9759) where pnpm add would incorrectly modify a
    catalog entry in pnpm-workspace.yaml to its exact version.
- update to 10.26.2:
  * Patch Changes
  - Improve error message when a package version exists but does
    not meet the minimumReleaseAge constraint. The error now
    clearly states that the version exists and shows a
    human-readable time since release (e.g., "released 6 hours
    ago") #10307.
  - Fix installation of Git dependencies using annotated tags
    [#10335].
  - Previously, pnpm would store the annotated tag object's SHA
    in the lockfile instead of the actual commit SHA. This caused
    ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out
    commit hash didn't match the stored tag object hash.
  - Binaries of runtime engines (Node.js, Deno, Bun) are written
    to node_modules/.bin before lifecycle scripts (install,
    postinstall, prepare) are executed #10244.
  - Try to avoid making network calls with preferOffline #10334.
- update to 10.26.1:
  * Patch Changes
  - Don't fail on pnpm add, when blockExoticSubdeps is set to
    true #10324.
  - Always resolve git references to full commits and ensure HEAD
    points to the commit after checkout #10310.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- update to 10.28.2:
  * Patch Changes
  - Security fix: prevent path traversal in directories.bin
    field.
  - When pnpm installs a file: or git: dependency, it now
    validates that symlinks point within the package directory.
    Symlinks to paths outside the package root are skipped to
    prevent local data from being leaked into node_modules.
    This fixes a security issue where a malicious package could
    create symlinks to sensitive files (e.g., /etc/passwd,
    ~/.ssh/id_rsa) and have their contents copied when the
    package is installed.
    Note: This only affects file: and git: dependencies. Registry
    packages (npm) have symlinks stripped during publish and are
    not affected.
  - Fixed optional dependencies to request full metadata from the
    registry to get the libc field, which is required for proper
    platform compatibility checks #9950.
- update to 10.28.1:
  * Patch Changes
  - Fixed installation of config dependencies from private
    registries.
    Added support for object type in configDependencies when the
    tarball URL returned from package metadata differs from the
    computed URL #10431.
  - Fix path traversal vulnerability in binary fetcher ZIP
    extraction
  - Validate ZIP entry paths before extraction to prevent
    writing files outside target directory
  - Validate BinaryResolution.prefix (basename) to prevent
    directory escape via crafted prefix
  - Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error
  - Support plain http:// and https:// URLs ending with .git as
    git repository dependencies.
    Previously, URLs like
    https://gitea.example.org/user/repo.git#commit were not
    recognized as git repositories because they lacked the git+
    prefix (e.g., git+https://). This caused issues when
    installing dependencies from self-hosted git servers like
    Gitea or Forgejo that don't provide tarball downloads.
    Changes:
  - The git resolver now runs before the tarball resolver,
    ensuring git URLs are handled by the correct resolver
  - The git resolver now recognizes plain http:// and https://
    URLs ending in .git as git repositories
  - Removed the isRepository check from the tarball resolver
    since it's no longer needed with the new resolver order
    Fixes #10468
  - pnpm run -r and pnpm run --filter now fail with a non-zero
    exit code when no packages have the specified script.
    Previously, this only failed when all packages were selected.
    Use --if-present to suppress this error #6844.
  - Fixed a path traversal vulnerability in tarball extraction on
    Windows. The path normalization was only checking for ./ but
    not .\. Since backslashes are directory separators on
    Windows, malicious packages could use paths like
    foo\..\..\.npmrc to write files outside the package
    directory.
  - When running "pnpm exec" from a subdirectory of a project,
    don't change the current working directory to the root of the
    project #5759.
  - Fixed a path traversal vulnerability in pnpm's bin linking.
    Bin names starting with @ bypassed validation, and after
    scope normalization, path traversal sequences like ../../
    remained intact.
  - Revert Try to avoid making network calls with preferOffline
    [#10334].
  - Fix --save-peer to write valid semver ranges to
    peerDependencies for protocol-based installs (e.g. jsr:) by
    deriving from resolved versions when available and falling
    back to * if none is available #10417.
  - Do not exclude the root workspace project, when it is
    explicitly selected via a filter #10465.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772452800">- update to 10.30.3:
  * Patch Changes
  - Fixed version switching via packageManager field failing when
    pnpm is installed as a standalone executable in environments
    without a system Node.js #10687.
- update to 10.30.2:
  * Patch Changes
  - Fix auto-installed peer dependencies ignoring overrides when
    a stale version exists in the lockfile.
  - Fixed "input line too long" error on Windows when running
    lifecycle scripts with the global virtual store enabled
    [#10673].
  - Update @zkochan/js-yaml to fix moderate vulnerability.
- update to 10.30.1:
  * Patch Changes
  - Use the /-/npm/v1/security/audits/quick endpoint as the
    primary audit endpoint, falling back to
    /-/npm/v1/security/audits when it fails #10649.
- update to 10.30.0:
  * Minor Changes
  - pnpm why now shows a reverse dependency tree. The searched
    package appears at the root with its dependents as branches,
    walking back to workspace roots. This replaces the previous
    forward-tree output which was noisy and hard to read for
    deeply nested dependencies.
  * Patch Changes
  - Revert pnpm why dependency pruning to prefer correctness over
    memory consumption. Reverted PR: #7122.
  - Optimize pnpm why and pnpm list performance in workspaces
    with many importers by sharing the dependency graph and
    materialization cache across all importers instead of
    rebuilding them independently for each one #10596.
- update to 10.29.3:
  * Patch Changes
  - Fixed an out-of-memory error in pnpm list (and pnpm why) on
    large dependency graphs by replacing the recursive tree
    builder with a two-phase approach: a BFS dependency graph
    followed by cached tree materialization. Duplicate subtrees
    are now deduplicated in the output, shown as "deduped (N deps
    hidden)" #10586.
  - Fixed allowBuilds not working when set via .pnpmfile.cjs
    [#10516].
  - When the enableGlobalVirtualStore option is set, the pnpm
    deploy command would incorrectly create symlinks to the
    global virtual store. To keep the deploy directory
    self-contained, pnpm deploy now ignores this setting and
    always creates a localized virtual store within the deploy
    directory.
  - Fixed minimumReleaseAgeExclude not being respected by pnpm
    dlx #10338.
- update to 10.29.2:
  * Patch Changes
  - Reverted a fix shipped in v10.29.1, which caused another
    issue #10571.
  - Reverted fix: Fixed pnpm run -r failing with "No projects
    matched the filters" when an empty pnpm-workspace.yaml exists
    [#10497].
- update to 10.29.1 (10.29.0 was not released):
  * Minor Changes
  - The pnpm dlx / pnpx command now supports the catalog:
    protocol. Example: pnpm dlx shx@catalog:.
  - Support configuring auditLevel in the pnpm-workspace.yaml
    file #10540.
  - Support bare workspace: protocol without version specifier.
    It is now treated as workspace:* and resolves to the concrete
    version during publish #10436.
  * Patch Changes
  - Fixed pnpm list --json returning incorrect paths when using
    global virtual store #10187.
  - Fix pnpm store path and pnpm store status using workspace
    root for path resolution when storeDir is relative #10290.
  - Fixed pnpm run -r failing with "No projects matched the
    filters" when an empty pnpm-workspace.yaml exists #10497.
  - Fixed a bug where catalogMode: strict would write the literal
    string "catalog:" to pnpm-workspace.yaml instead of the
    resolved version specifier when re-adding an existing catalog
    dependency #10176.
  - Fixed the documentation URL shown in pnpm completion --help
    to point to the correct page at https://pnpm.io/completion
    [#10281].
  - Skip local file: protocol dependencies during pnpm fetch.
    This fixes an issue where pnpm fetch would fail in Docker
    builds when local directory dependencies were not available
    [#10460].
  - Fixed pnpm audit --json to respect the --audit-level setting
    for both exit code and output filtering #10540.
  - update tar to version 7.5.7 to fix security issue
  - Updating the version of dependency tar to 7.5.7 because the
    previous one have a security vulnerability reported here:
    CVE-2026-24842
  - Fix pnpm audit --fix replacing reference overrides (e.g.
    $foo) with concrete versions #10325.
  - Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not
    being converted to publicHoistPattern #10271.
  - pnpm help should correctly report if the currently running
    pnpm CLI is bundled with Node.js #10561.
  - Add a warning when the current directory contains the PATH
    delimiter character. On macOS, folder names containing
    forward slashes (/) appear as colons (:) at the Unix layer.
    Since colons are PATH separators in POSIX systems, this
    breaks PATH injection for node_modules/.bin, causing binaries
    to not be found when running commands like pnpm exec #10457.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773576000">- update to 10.32.1:
  * Patch Changes
  - Fix a regression where pnpm-workspace.yaml without a packages
    field caused all directories to be treated as workspace
    projects. This broke projects that use pnpm-workspace.yaml
    only for settings (e.g. minimumReleaseAge) without defining
    workspace packages #10909.
- update to 10.32.0:
  * Minor Changes
  - Added --all flag to pnpm approve-builds that approves all
    pending builds without interactive prompts #10136.
  * Patch Changes
  - Reverted change related to setting explicitly the npm config
    file path, which caused regressions.
  - Reverted fix related to lockfile-include-tarball-url. Fixes
    [#10915].
- update to 10.31.0:
  * Minor Changes
  - When pnpm updates the pnpm-workspace.yaml, comments, string
    formatting, and whitespace will be preserved.
  * Patch Changes
  - Added -F as a short alias for the --filter option in the help
    output.
  - Handle undefined pkgSnapshot in pnpm why -r #10700.
  - Fix headless install not being used when a project has an
    injected self-referencing file: dependency that resolves to
    link: in the lockfile.
  - Fixed a race condition when multiple worker threads import
    the same package to the global virtual store concurrently.
    The rename operation now tolerates ENOTEMPTY/EEXIST errors if
    another thread already completed the import.
  - When lockfile-include-tarball-url is set to false, tarball
    URLs are now always excluded from the lockfile. Previously,
    tarball URLs could still appear for packages hosted under
    non-standard URLs, making the behavior flaky and inconsistent
    [#6667].
  - Fixed optimisticRepeatInstall skipping install when
    overrides, packageExtensions, ignoredOptionalDependencies,
    patchedDependencies, or peersSuffixMaxLength changed.
  - Fixed pnpm patch-commit failing with "unable to access
    '/.config/git/attributes': Permission denied" error in
    environments where HOME is unset or non-standard (Docker
    containers, CI systems).
  - The issue occurred because pnpm was setting HOME and the
    Windows user profile env var to empty strings to suppress
    user git configuration when running git diff. This caused git
    to resolve the home directory (~) as root (/), leading to
    permission errors when attempting to access
    /.config/git/attributes.
  - Now uses GIT_CONFIG_GLOBAL: os.devNull instead, which is
    git's proper mechanism for bypassing user-level configuration
    without corrupting the home directory path resolution.
  - Fixes #6537
  - Fix pnpm why -r --parseable missing dependents when multiple
    workspace packages share the same dependency #8100.
  - Fix link-workspace-packages=true incorrectly linking
    workspace packages when the requested version doesn't match
    the workspace package's version. Previously, on fresh
    installs the version constraint is overridden to * in the
    fallback resolution paths, causing any workspace package with
    a matching name to be linked regardless of version #10173.
  - Fixed pnpm update --interactive table breaking with long
    version strings (e.g., prerelease versions like
    7.0.0-dev.20251209.1) by dynamically calculating column
    widths instead of using hardcoded values #10316.
  - Explicitly tell npm the path to the global rc config file.
  - The parameter set by the --allow-build flag is written to
    allowBuilds.
  - Fix a bug in which specifying filter on pnpm-workspace.yaml
    would cause pnpm to not detect any projects.
  - Print help message on running pnpm dlx without arguments and
    exit.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774785600">- update to 10.33:
  * Minor Changes
  - Added a new dedupePeers setting that reduces peer dependency
    duplication. When enabled, peer dependency suffixes use
    version-only identifiers (name@version) instead of full dep
    paths, eliminating nested suffixes like
    (foo@1.0.0(bar@2.0.0)). This dramatically reduces the number
    of package instances in projects with many recursive peer
    dependencies #11070.
  * Patch Changes
  - Fail on incompatible lockfiles in CI when frozen lockfile
    mode is enabled, while preserving non-frozen CI fallback
    behavior.
  - When package metadata is malformed or can't be fetched, the
    error thrown will now show the originating error.
  - Fixed intermittent failures when multiple pnpm dlx calls run
    concurrently for the same package. When the global virtual
    store is enabled, the importer now verifies file content
    before skipping a rename, avoiding destructive swap-renames
    that break concurrent processes. Also tolerates EPERM during
    bin creation on Windows and properly propagates
    enableGlobalVirtualStore through the install pipeline.
  - Fixed handling of non-string version selectors in hoistPeers,
    preventing invalid peer dependency specifiers.
  - Improve the non-interactive modules purge error hint to
    include the confirmModulesPurge=false workaround.
  - When pnpm needs to recreate node_modules but no TTY is
    available, the error now suggests either setting CI=true or
    disabling the purge confirmation prompt via
    confirmModulesPurge=false.
  - Adds a regression test for the non-TTY flow.
  - Fixed false "Command not found" errors on Windows when a
    command exists in PATH but exits with a non-zero code. Also
    fixed path resolution for --filter contexts where the command
    runs in a different package directory.
  - When a pnpm-lock.yaml contains two documents, ignore the
    first one. pnpm v11 will write two lockfile documents into
    pnpm-lock.yaml in order to store pnpm version integrities and
    config dependency resolutions.
  - Fixed a bug preventing the clearCache function returned by
    createNpmResolver from properly clearing metadata cache.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777204800">- update to 10.33.2:
  * Patch Changes
  - Globally-installed bins no longer fail with
    ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND when pnpm was installed
    via the standalone @pnpm/exe binary (e.g. curl -fsSL
    https://get.pnpm.io/install.sh | sh -) on a system without a
    separate Node.js installation. Previously, when which('node')
    failed during pnpm add --global, pnpm fell back to
    process.execPath, which in @pnpm/exe is the pnpm binary
    itself — and that path was baked into the generated bin shim,
    causing the shim to invoke pnpm instead of Node #11291,
    [#4645].
  - Fix an infinite fork-bomb that could happen when pnpm was
    installed with one version (e.g. npm install -g pnpm@A) and
    run inside a project whose package.json selected a different
    pnpm version via the packageManager field (e.g. pnpm@B),
    while a pnpm-workspace.yaml also existed at the project root.
  - The child's environment is now forced to
    manage-package-manager-versions=false (v10) and
    pm-on-fail=ignore (v11+), which disables the
    package-manager-version handling in whichever pnpm runs as
    the child.
  - Fixes #11337.
- update to 10.33.1:
  * Patch Changes
  - When a project's packageManager field selects pnpm v11 or
    newer, commands that v10 would have passed through to npm
    (version, login, logout, publish, unpublish, deprecate,
    dist-tag, docs, ping, search, star, stars, unstar, whoami,
    etc.) are now handed over to the wanted pnpm, which
    implements them natively. Previously they silently shelled
    out to npm — making, for example, pnpm version --help print
    npm's help on a project with packageManager: pnpm@11.0.0-rc.3
    [#11328].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778068800">- update to 10.33.4:
  * Patch Changes
  - Pin the integrity of git-hosted tarballs
    (codeload.github.com, gitlab.com, bitbucket.org) in the
    lockfile so that subsequent installs detect a tampered or
    substituted tarball and refuse to install it. Previously the
    lockfile only stored the tarball URL for git dependencies, so
    a compromised git host or a man-in-the-middle could serve
    arbitrary code on later installs without lockfile changes.
  - A new gitHosted: true field is recorded on git-hosted tarball
    resolutions in the lockfile, letting every reader/writer
    route them by a single typed check instead of
    pattern-matching the tarball URL in each call site. Lockfiles
    written by older pnpm versions are enriched on load (URL
    fallback) so the field can be relied on uniformly across the
    codebase.
  - Fix a regression where pnpm --recursive --filter '!&lt;pkg&gt;'
    run/exec/test/add would include the workspace root in the
    matched projects. The workspace root is now correctly
    excluded by default when only negative --filter arguments are
    provided, matching the documented behavior. To include the
    root, pass --include-workspace-root #11341.
- update to 10.33.3:
  * Patch Changes
  - When self-updating from v10's @pnpm/exe to v11+ on Intel
    macOS (darwin-x64), pnpm self-update now transparently
    switches to the JS-only pnpm package on npm instead of
    installing @pnpm/exe@v11+ (which doesn't ship a working
    binary for Intel Macs because of an upstream Node.js SEA bug
    — see #11423 and nodejs/node#62893). Without this, the
    self-update would silently leave the user with no working
    pnpm binary. The new install requires Node.js to be available
    on PATH; a warning is printed when the swap happens. All
    other host/version combinations are unchanged.
  - pnpm self-update (with no version argument) no longer
    downgrades pnpm when the registry's latest dist-tag points to
    an older release than the currently active version. Run pnpm
    self-update latest to force a downgrade #11418.</changelog>
  <changelog author="Elisei Roca &lt;eroca@suse.com&gt;" date="1779451200">- update to 11.2.2:
  * Find the full changelog and breaking changes at:
    https://github.com/pnpm/pnpm/blob/v11.2.2/pnpm/CHANGELOG.md
  * Automated migration steps:
    https://pnpm.io/migration
  - cd /path/to/your/project
  - pnpx codemod run pnpm-v10-to-v11
  * Non-automated steps you might have to do:
    https://pnpm.io/migration#manual-follow-ups
  * Requires at least Node.js v22.13</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1780660800">- Update to 11.5.2:
  * Find the full changelog and breaking changes at:
    https://github.com/pnpm/pnpm/blob/v11.5.2/pnpm/CHANGELOG.md</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1781179200">- Update to 11.5.3:
  * ⚠️ Security fix — environment variables in a project .npmrc
  * Stopped expanding environment variables in repository-
    controlled registry/proxy request destinations and registry
    credential values from .npmrc, and in workspace registry URLs
    from pnpm-workspace.yaml. Move dynamic registry URL and token
    configuration to trusted user, global, CLI, or environment config.
  * Resolve package-manager bootstrap dependencies with trusted
    user or CLI registry and network config, and reject package-
    manager env-lockfile records that do not use registry package
    paths with integrity-only resolutions before auto-switch execution.
  * Avoid writing packageManagerDependencies to pnpm-lock.yaml
    when package manager policy is set to onFail: ignore or
    pmOnFail: ignore #12228.
  * Avoid running dependency-status auto-install when the
    dependency status is unavailable without a project manifest.
  * Using the $ version reference syntax in overrides (e.g. "react": "$react")
    now prints a deprecation warning. The syntax still works, but
    catalogs are the recommended way to keep an overridden
    version in sync with the rest of the workspace. Reference a
    catalog entry with the catalog: protocol instead.
  * Fixed pnpm config get globalconfig to return the global config
    .yaml path again pnpm/pnpm#11962.
  * Fixed bare --color so it does not consume the following CLI
    flag, allowing command shorthands like --parallel to expand
    correctly and forms like pnpm --color with current &lt;command&gt;
    to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.
  * Fix pnpm install ignoring enableGlobalVirtualStore toggle by
    including it in the workspace state settings check #12142.
  * Security: pnpm now verifies the npm registry signature of a
    package-manager binary before spawning it, so a cloned
    repository cannot make pnpm download and execute an arbitrary native binary.
  * Made peer-dependent deduplication deterministic. When a peer-
    suffixed package variant was a subset of two or more mutually
    incompatible larger variants, the variant it collapsed into
    depended on the order importers were resolved in, which
    varies between machines. This could resolve the same
    workspace to different lockfiles on different platforms and
    make pnpm dedupe --check alternate between passing and failing.
  * Reject invalid package names and versions from staged tarball
    manifests before deriving filenames for pnpm stage download.
  * Clarified in CLI help that the pnpm store is trusted shared
    state and store integrity checks are corruption detection,
    not a tamper boundary for untrusted store writers.
  * Reject reserved manifest bin names ("", ".", "..", and scoped
    forms such as @scope/..) when resolving a package's bins.
    These names previously passed the bin-name guard and, when
    joined to the global bin directory during global remove/update
    /add operations, could resolve to the global bin directory
    itself or its parent and have it recursively deleted.
  * Require trusted package identity before package-name
    allowBuilds entries can approve lifecycle scripts for git, git
  - hosted tarball, direct tarball, and local directory artifacts.
    To approve one of those artifacts explicitly, use its peer-
    suffix-free lockfile depPath as the allowBuilds key. Lockfile
    verification now rejects lockfiles where a registry-style
    dependency path (name@semver) is backed by a git, directory,
    or git-hosted tarball resolution (
    ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path
    is a reliable artifact identity by the time scripts can run.
  * Security: pnpm now verifies the OpenPGP signature of a
    downloaded Node.js runtime's SHASUMS256.txt before trusting
    its integrity hashes.</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1781265600">- Update to 11.6.0:
  * pnpm install completes without re-resolving when pnpm-lock.
    yaml was deleted but node_modules is intact: the up-to-date
    check now treats the current lockfile (node_modules/.pnpm/lock.
    yaml) — the record of what the previous install materialized —
    as the wanted lockfile, verifies the manifests still match it,
    restores pnpm-lock.yaml from it, and reports "Already up to date".
    Previously this scenario triggered a full resolution and a re-
    verification of every locked package against the registry.
  * 615c669: Added support for configuring URL-scoped registry
    settings through npm_config_//… and pnpm_config_//…
    environment variables, for example:
  * Improved the warning printed when a project .npmrc uses an
    environment variable in a registry/proxy URL or in registry
    credentials. The message now explains why the setting was
    ignored and how to migrate it to a trusted source — for example
    by moving the line to the user-level ~/.npmrc or running pnpm
    config set "&lt;key&gt;" &lt;value&gt; — with a link to https://pnpm.io/npmrc.
    The pnpm config set example is only suggested when the key has
    no ${...} placeholder, so the snippet is always safe to copy-paste.
  * Print a "Lockfile passes supply-chain policies (verified 2h
    ago)" message when lockfile verification is skipped because a
    cached verdict for the same lockfile content and policy is reused.
    Previously the cached short-circuit was completely silent,
    which made it look like the policy gate never ran #12324.
  * Platform-specific optional dependencies are now skipped even
    when their os/cpu/libc fields are missing from the registry
    metadata or the lockfile. Some registries strip these fields
    from the package metadata, which made pnpm download and install
    the binaries of every platform regardless of
    supportedArchitectures. The missing platform fields of an
    optional dependency are now inferred from its name (e.g. @nx/nx-
    win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform
    binaries are skipped without even downloading them #11702.</changelog>
</package>
<package pkgid="9afb04c2d1fe273af71346f4ac715f3fc3b537b9503d4256ff75366550b80990e80fab6d15a2f0aaaf64a1e3eda6fdbf244cefab425dab04cf3e936e69bbd983" name="pnpm" arch="src">
  <version epoch="0" ver="11.6.0" rel="11.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- update to 10.17:
  * Minor Changes
  - The minimumReleaseAgeExclude setting now supports patterns.
    For instance:
    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
  - "@eslint/*"
  * Patch Changes
  - Don't ignore the minimumReleaseAge check, when the package is
    requested by exact version and the packument is loaded from
    cache #9978.
  - When minimumReleaseAge is set and the active version under a
    dist-tag is not mature enough, do not downgrade to a
    prerelease version in case the original version wasn't a
    prerelease one #9979.
- update to 10.16.1:
  * Patch Changes
  - The full metadata cache should be stored not at the same
    location as the abbreviated metadata. This fixes a bug where
    pnpm was loading the abbreviated metadata from cache and
    couldn't find the "time" field as a result #9963.
  - Forcibly disable ANSI color codes when generating patch diff
    [#9914].
- update to 10.16:
  * Minor Changes
  - There have been several incidents recently where popular
    packages were successfully attacked. To reduce the risk of
    installing a compromised version, we are introducing a new
    setting that delays the installation of newly released
    dependencies. In most cases, such attacks are discovered
    quickly and the malicious versions are removed from the
    registry within an hour.
  - The new setting is called minimumReleaseAge. It specifies the
    number of minutes that must pass after a version is published
    before pnpm will install it. For example, setting
    minimumReleaseAge: 1440 ensures that only packages released
    at least one day ago can be installed.
  - If you set minimumReleaseAge but need to disable this
    restriction for certain dependencies, you can list them under
    the minimumReleaseAgeExclude setting. For instance, with the
    following configuration pnpm will always install the latest
    version of webpack, regardless of its release time:
    minimumReleaseAgeExclude:
  - webpack
  - Added support for finders #9946.
    In the past, pnpm list and pnpm why could only search for
    dependencies by name (and optionally version). For example:
    pnpm why minimist
    prints the chain of dependencies to any installed instance of
    minimist:
    verdaccio 5.20.1
    ├─┬ handlebars 4.7.7
    │ └── minimist 1.2.8
    └─┬ mv 2.1.1
    └─┬ mkdirp 0.5.6
    └── minimist 1.2.8
    What if we want to search by other properties of a
    dependency, not just its name? For instance, find all
    packages that have react@17 in their peer dependencies?
    This is now possible with "finder functions". Finder
    functions can be declared in .pnpmfile.cjs and invoked with
    the --find-by=&lt;function name&gt; flag when running pnpm list or
    pnpm why.
    Let's say we want to find any dependencies that have React 17
    in peer dependencies. We can add this finder to our
    .pnpmfile.cjs:
    module.exports = {
    finders: {
    react17: (ctx) =&gt; {
    return ctx.readManifest().peerDependencies?.react === "^17.0.0";
    },
    },
    };
    Now we can use this finder function by running:
    pnpm why --find-by=react17
    pnpm will find all dependencies that have this React in peer
    dependencies and print their exact locations in the
    dependency graph.
    @apollo/client 4.0.4
    ├── @graphql-typed-document-node/core 3.2.0
    └── graphql-tag 2.12.6
    It is also possible to print out some additional information
    in the output by returning a string from the finder. For
    example, with the following finder:
    module.exports = {
    finders: {
    react17: (ctx) =&gt; {
    const manifest = ctx.readManifest();
    if (manifest.peerDependencies?.react === "^17.0.0") {
    return `license: ${manifest.license}`;
    }
    return false;
    },
    },
    };
    Every matched package will also print out the license from
    its package.json:
    @apollo/client 4.0.4
    ├── @graphql-typed-document-node/core 3.2.0
    │   license: MIT
    └── graphql-tag 2.12.6
    license: MIT
  * Patch Changes
  - Fix deprecation warning printed when executing pnpm with
    Node.js 24 #9529.
  - Throw an error if nodeVersion is not set to an exact semver
    version #9934.
  - pnpm publish should be able to publish a .tar.gz file #9927.
  - Canceling a running process with Ctrl-C should make pnpm run
    return a non-zero exit code #9626.
- update to 10.15.1:
  * Patch Changes
  - Fix .pnp.cjs crash when importing subpath #9904.
  - When resolving peer dependencies, pnpm looks whether the peer
    dependency is present in the root workspace project's
    dependencies. This change makes it so that the peer
    dependency is correctly resolved even from aliased npm-hosted
    dependencies or other types of dependencies #9913.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758628800">- update to 10.17.1:
  * Patch Changes
  - When a version specifier cannot be resolved because the versions
    don't satisfy the minimumReleaseAge setting, print this
    information out in the error message #9974.
  - Fix state.json creation path when executing pnpm patch in a
    workspace project #9733.
  - When minimumReleaseAge is set and the latest tag is not mature
    enough, prefer a non-deprecated version as the new latest #9987.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761998400">- update to 10.20.0:
  * Minor Changes
  - Support --all option in pnpm --help to list all commands
    [#8628].
  * Patch Changes
  - When the latest version doesn't satisfy the maturity
    requirement configured by minimumReleaseAge, pick the highest
    version that is mature enough, even if it has a different
    major version #10100.
  - create command should not verify patch info.
  - Set managePackageManagerVersions to false, when switching to
    a different version of pnpm CLI, in order to avoid subsequent
    switches #10063.
- update to 10.19.0:
  * Minor Changes
  - You can now allow specific versions of dependencies to run
    postinstall scripts. onlyBuiltDependencies now accepts
    package names with lists of trusted versions. For example:
    Related PR: #10104.
    onlyBuiltDependencies:
  - nx@21.6.4 || 21.6.5
  - esbuild@0.25.1
  - Added support for exact versions in minimumReleaseAgeExclude
    [#9985].
    You can now list one or more specific versions that pnpm
    should allow to install, even if those versions don’t satisfy
    the maturity requirement set by minimumReleaseAge. For
    example:
    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
  - nx@21.6.5
  - webpack@4.47.0 || 5.102.1
- update to 10.18.3:
  * Patch Changes
  - Fix a bug where pnpm would infinitely recurse when using
    verifyDepsBeforeInstall: install and pre/post install scripts
    that called other pnpm scripts #10060.
  - Fixed scoped registry keys (e.g., @scope:registry) being
    parsed as property paths in pnpm config get when
  - -location=project is used #9362.
  - Remove pnpm-specific CLI options before passing to npm
    publish to prevent "Unknown cli config" warnings #9646.
  - Fixed EISDIR error when bin field points to a directory
    [#9441].
  - Preserve version and hasBin for variations packages #10022.
  - Fixed pnpm config set --location=project incorrectly handling
    keys with slashes (auth tokens, registry settings) #9884.
  - When both pnpm-workspace.yaml and .npmrc exist, pnpm config
    set --location=project now writes to pnpm-workspace.yaml
    (matching read priority) #10072.
  - Prevent a table width error in pnpm outdated --long #10040.
  - Sync bin links after injected dependencies are updated by
    build scripts. This ensures that binaries created during
    build processes are properly linked and accessible to
    consuming projects #10057.
- update to 10.18.2:
  * Patch Changes
  - pnpm outdated --long should work #10040.
  - Replace ndjson with split2. Reduce the bundle size of pnpm
    CLI #10054.
  - pnpm dlx should request the full metadata of packages, when
    minimumReleaseAge is set #9963.
  - pnpm version switching should work when the pnpm home
    directory is in a symlinked directory #9715.
  - Fix EPIPE errors when piping output to other commands #10027.
- update to 10.18.1:
  * Patch Changes
  - Don't print a warning, when --lockfile-only is used #8320.
  - pnpm setup creates a command shim to the pnpm executable.
    This is needed to be able to run pnpm self-update on Windows
    [#5700].
  - When using pnpm catalogs and running a normal pnpm install,
    pnpm produced false positive warnings for "skip adding to the
    default catalog because it already exists". This warning now
    only prints when using pnpm add --save-catalog as originally
    intended.
- update to 10.18.0:
  * Minor Changes
  - Added network performance monitoring to pnpm by implementing
    warnings for slow network requests, including both metadata
    fetches and tarball downloads.
    Added configuration options for warning thresholds:
    fetchWarnTimeoutMs and fetchMinSpeedKiBps.
    Warning messages are displayed when requests exceed time
    thresholds or fall below speed minimums
    Related PR: #10025.
  * Patch Changes
  - Retry filesystem operations on EAGAIN errors #9959.
  - Outdated command respects minimumReleaseAge configuration
    [#10030].
  - Correctly apply the cleanupUnusedCatalogs configuration when
    removing dependent packages.
  - Don't fail with a meaningless error when scriptShell is set
    to false #8748.
  - pnpm dlx should not fail when minimumReleaseAge is set
    [#10037].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- update to 10.21.0:
  * Minor Changes
  - Node.js Runtime Installation for Dependencies. Added support
    for automatic Node.js runtime installation for dependencies.
    pnpm will now install the Node.js version required by a
    dependency if that dependency declares a Node.js runtime in
    the "engines" field. For example:
    {
    "engines": {
    "runtime": {
    "name": "node",
    "version": "^24.11.0",
    "onFail": "download"
    }
    }
    }
    If the package with the Node.js runtime dependency is a CLI
    app, pnpm will bind the CLI app to the required Node.js
    version. This ensures that, regardless of the globally
    installed Node.js instance, the CLI will use the compatible
    version of Node.js.
    If the package has a postinstall script, that script will be
    executed using the specified Node.js version.
    Related PR: #10141
  - Added a new setting: trustPolicy.
    When set to no-downgrade, pnpm will fail installation if a
    package’s trust level has decreased compared to previous
    releases — for example, if it was previously published by a
    trusted publisher but now only has provenance or no trust
    evidence.
    This helps prevent installing potentially compromised
    versions of a package.
    Related issue: #8889.
  - Added support for pnpm config get globalconfig to retrieve
    the global config file path #9977.
  * Patch Changes
  - When a user runs pnpm update on a dependency that is not
    directly listed in package.json, none of the direct
    dependencies should be updated #10155.
  - Don't crash when two processes of pnpm are hardlinking the
    contents of a directory to the same destination
    simultaneously #10160.
  - Setting gitBranchLockfile and related settings via
    pnpm-workspace.yaml should work #9651.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467201">- update to 10.22.0:
  * Minor Changes
  - Added support for trustPolicyExclude #10164.
    You can now list one or more specific packages or versions
    that pnpm should allow to install, even if those packages
    don't satisfy the trust policy requirement. For example:
    trustPolicy: no-downgrade
    trustPolicyExclude:
  - chokidar@4.0.3
  - webpack@4.47.0 || 5.102.1
  - Allow to override the engines field on publish by the
    publishConfig.engines field.
  * Patch Changes
  - Don't crash when two processes of pnpm are hardlinking the
    contents of a directory to the same destination
    simultaneously #10179.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763899200">- update to 10.23.0:
  * Minor Changes
  - Added --lockfile-only option to pnpm list #10020.
  * Patch Changes
  - pnpm self-update should download pnpm from the configured npm
    registry #10205.
  - pnpm self-update should always install the non-executable
    pnpm package (pnpm in the registry) and never the @pnpm/exe
    package, when installing v11 or newer. We currently cannot
    ship @pnpm/exe as pkg doesn't work with ESM #10190.
  - Node.js runtime is not added to "dependencies" on pnpm add,
    if there's a engines.runtime setting declared in package.json
    [#10209].
  - The installation should fail if an optional dependency cannot
    be installed due to a trust policy check failure #10208.
  - pnpm list and pnpm why now display npm: protocol for aliased
    packages (e.g., foo npm:is-odd@3.0.1) #8660.
  - Don't add an extra slash to the Node.js mirror URL #10204.
  - pnpm store prune should not fail if the store contains
    Node.js packages #10131.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765627200">- update to 10.24.0:
  * Minor Changes
  - Increased network concurrency on machines with many CPU
    cores. pnpm now automatically selects a network concurrency
    between 16 and 64, based on the number of pnpm workers
    (calculated as workers × 3). This improves performance on
    high-core systems #10068.
  * Patch Changes
  - trustPolicy should ignore the trust evidences of prerelease
    versions, when installing a non-prerelease version.
  - Handle ENOENT errors thrown by fs.linkSync(), which can occur
    in containerized environments (OverlayFS) instead of EXDEV.
    The operation now gracefully falls back to fs.copyFileSync()
    in these cases #10217.
  - Reverted: pnpm self-update should download pnpm from the
    configured npm registry #10205.
  - Packages that don't have a package.json file (like Node.js)
    should not be reimported from the store on every install.
    Another file from the package should be checked in order to
    verify its presence in node_modules.
  - Correctly read auth tokens for URLs that contain underscores
    [#17].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765627201">- update to 10.25.0:
  * Minor Changes
  - Allow loading certificates from cert, ca, and key for
    specific registry URLs. E.g.,
    //registry.example.com/:ca=-----BEGIN CERTIFICATE-----....
    Previously this was only working via certfile, cafile, and
    keyfile.
    These properties are supported in .npmrc, but were ignored by
    pnpm, this will make pnpm read and use them as well.
    Related PR: #10230.
  - Added a new flag called --bare to pnpm init for creating a
    package.json with the bare minimum of required fields #10226.
  * Patch Changes
  - Improved reporting of ignored dependency scripts #10276.
  - pnpm install should build any dependencies that were added to
    onlyBuiltDependencies and were not built yet #10256.
  - pnpm publish -r --force should allow to run publish over
    already existing versions in the registry #10272.
  - Don't fail with a ERR_PNPM_MISSING_TIME error if a package
    that is excluded from trust policy checks is missing the time
    field in the metadata.</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1765800000">- update to 10.26.0
  * Minor Changes
  - Semi-breaking. Block git-hosted dependencies from running
    prepare scripts unless explicitly allowed in onlyBuiltDependencies #10288.
  - Semi-breaking. Compute integrity hash for HTTP tarball
    dependencies when fetching, storing it in the lockfile to
    prevent servers from serving altered content on subsequent installs #10287.
  - Added a new setting blockExoticSubdeps that prevents the
    resolution of exotic protocols in transitive dependencies.
  - Added support for allowBuilds, which is a new field that
    can be used instead of onlyBuiltDependencies and
    ignoredBuiltDependencies. The new allowBuilds field in your
    pnpm-workspace.yaml uses a map of package matchers to
    explicitly allow (true) or disallow (false) script execution.
    This allows for a single, easy-to-manage source of truth for
    your build permissions.
  * Patch Changes
  - Show deprecation in table/list formats when latest version
    is deprecated #8658.
  - Remove the injectWorkspacePackages setting from the
    lockfile on the deploy command #10294.
  - Normalize the tarball URLs before saving them to the
    lockfile. URLs should not contain default ports, like :80 for
    http and :443 for https #10273.
  - When a dependency is installed via a direct URL that
    redirects to another URL and is immutable, the original URL
    is normalized and saved to package.json #10197.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- update to 10.28.0:
  * Minor Changes
  - Add support for a hook called beforePacking that can be used
    to customize the package.json contents at publish time #3816.
  - In some cases, a filtered install (i.e. pnpm install --filter
    ...) was slower than running pnpm install without any filter
    arguments. This performance regression is now fixed. Filtered
    installs should be as fast or faster than a full install
    [#10408].
  * Patch Changes
  - Do not add a symlink to the project into the store's project
    registry if the store is in a subdirectory of the project
    [#10411].
  - It should be possible to declare the requiredScripts setting
    in pnpm-workspace.yaml #10261.
- update to 10.27.0:
  * Minor Changes
  - Adding trustPolicyIgnoreAfter allows you to ignore trust
    policy checks for packages published more than a specified
    time ago#10352.
  - Added project registry for global virtual store prune
    support.
  - Projects using the store are now registered via symlinks in
    {storeDir}/v10/projects/. This enables pnpm store prune to
    track which packages are still in use by active projects and
    safely remove unused packages from the global virtual store.
  - Semi-breaking. Changed the location of unscoped packages in
    the virtual global store. They will now be stored under a
    directory named @ to maintain a uniform 4-level directory
    depth.
  - Added mark-and-sweep garbage collection for global virtual
    store.
  - pnpm store prune now removes unused packages from the global
    virtual store's links/ directory. The algorithm:
  - Scans all registered projects for symlinks pointing to the
    store
  - Walks transitive dependencies to mark reachable packages
  - Removes any package directories not marked as reachable
  - This includes support for workspace monorepos - all
    node_modules directories within a project (including those in
    workspace packages) are scanned.
  * Patch Changes
  - Throw an error if the value of the tokenHelper or
    &lt;url&gt;:tokenHelper setting contains an environment variable.
  - Git dependencies with build scripts should respect the
    dangerouslyAllowAllBuilds settings #10376.
  - Skip the package manager check when running with --global and
    a project packageManager is configured, and warn that the
    check is skipped.
  - pnpm store prune should not fail if the dlx cache directory
    has files, not only directories #10384
  - Fixed a bug (#9759) where pnpm add would incorrectly modify a
    catalog entry in pnpm-workspace.yaml to its exact version.
- update to 10.26.2:
  * Patch Changes
  - Improve error message when a package version exists but does
    not meet the minimumReleaseAge constraint. The error now
    clearly states that the version exists and shows a
    human-readable time since release (e.g., "released 6 hours
    ago") #10307.
  - Fix installation of Git dependencies using annotated tags
    [#10335].
  - Previously, pnpm would store the annotated tag object's SHA
    in the lockfile instead of the actual commit SHA. This caused
    ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out
    commit hash didn't match the stored tag object hash.
  - Binaries of runtime engines (Node.js, Deno, Bun) are written
    to node_modules/.bin before lifecycle scripts (install,
    postinstall, prepare) are executed #10244.
  - Try to avoid making network calls with preferOffline #10334.
- update to 10.26.1:
  * Patch Changes
  - Don't fail on pnpm add, when blockExoticSubdeps is set to
    true #10324.
  - Always resolve git references to full commits and ensure HEAD
    points to the commit after checkout #10310.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- update to 10.28.2:
  * Patch Changes
  - Security fix: prevent path traversal in directories.bin
    field.
  - When pnpm installs a file: or git: dependency, it now
    validates that symlinks point within the package directory.
    Symlinks to paths outside the package root are skipped to
    prevent local data from being leaked into node_modules.
    This fixes a security issue where a malicious package could
    create symlinks to sensitive files (e.g., /etc/passwd,
    ~/.ssh/id_rsa) and have their contents copied when the
    package is installed.
    Note: This only affects file: and git: dependencies. Registry
    packages (npm) have symlinks stripped during publish and are
    not affected.
  - Fixed optional dependencies to request full metadata from the
    registry to get the libc field, which is required for proper
    platform compatibility checks #9950.
- update to 10.28.1:
  * Patch Changes
  - Fixed installation of config dependencies from private
    registries.
    Added support for object type in configDependencies when the
    tarball URL returned from package metadata differs from the
    computed URL #10431.
  - Fix path traversal vulnerability in binary fetcher ZIP
    extraction
  - Validate ZIP entry paths before extraction to prevent
    writing files outside target directory
  - Validate BinaryResolution.prefix (basename) to prevent
    directory escape via crafted prefix
  - Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error
  - Support plain http:// and https:// URLs ending with .git as
    git repository dependencies.
    Previously, URLs like
    https://gitea.example.org/user/repo.git#commit were not
    recognized as git repositories because they lacked the git+
    prefix (e.g., git+https://). This caused issues when
    installing dependencies from self-hosted git servers like
    Gitea or Forgejo that don't provide tarball downloads.
    Changes:
  - The git resolver now runs before the tarball resolver,
    ensuring git URLs are handled by the correct resolver
  - The git resolver now recognizes plain http:// and https://
    URLs ending in .git as git repositories
  - Removed the isRepository check from the tarball resolver
    since it's no longer needed with the new resolver order
    Fixes #10468
  - pnpm run -r and pnpm run --filter now fail with a non-zero
    exit code when no packages have the specified script.
    Previously, this only failed when all packages were selected.
    Use --if-present to suppress this error #6844.
  - Fixed a path traversal vulnerability in tarball extraction on
    Windows. The path normalization was only checking for ./ but
    not .\. Since backslashes are directory separators on
    Windows, malicious packages could use paths like
    foo\..\..\.npmrc to write files outside the package
    directory.
  - When running "pnpm exec" from a subdirectory of a project,
    don't change the current working directory to the root of the
    project #5759.
  - Fixed a path traversal vulnerability in pnpm's bin linking.
    Bin names starting with @ bypassed validation, and after
    scope normalization, path traversal sequences like ../../
    remained intact.
  - Revert Try to avoid making network calls with preferOffline
    [#10334].
  - Fix --save-peer to write valid semver ranges to
    peerDependencies for protocol-based installs (e.g. jsr:) by
    deriving from resolved versions when available and falling
    back to * if none is available #10417.
  - Do not exclude the root workspace project, when it is
    explicitly selected via a filter #10465.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772452800">- update to 10.30.3:
  * Patch Changes
  - Fixed version switching via packageManager field failing when
    pnpm is installed as a standalone executable in environments
    without a system Node.js #10687.
- update to 10.30.2:
  * Patch Changes
  - Fix auto-installed peer dependencies ignoring overrides when
    a stale version exists in the lockfile.
  - Fixed "input line too long" error on Windows when running
    lifecycle scripts with the global virtual store enabled
    [#10673].
  - Update @zkochan/js-yaml to fix moderate vulnerability.
- update to 10.30.1:
  * Patch Changes
  - Use the /-/npm/v1/security/audits/quick endpoint as the
    primary audit endpoint, falling back to
    /-/npm/v1/security/audits when it fails #10649.
- update to 10.30.0:
  * Minor Changes
  - pnpm why now shows a reverse dependency tree. The searched
    package appears at the root with its dependents as branches,
    walking back to workspace roots. This replaces the previous
    forward-tree output which was noisy and hard to read for
    deeply nested dependencies.
  * Patch Changes
  - Revert pnpm why dependency pruning to prefer correctness over
    memory consumption. Reverted PR: #7122.
  - Optimize pnpm why and pnpm list performance in workspaces
    with many importers by sharing the dependency graph and
    materialization cache across all importers instead of
    rebuilding them independently for each one #10596.
- update to 10.29.3:
  * Patch Changes
  - Fixed an out-of-memory error in pnpm list (and pnpm why) on
    large dependency graphs by replacing the recursive tree
    builder with a two-phase approach: a BFS dependency graph
    followed by cached tree materialization. Duplicate subtrees
    are now deduplicated in the output, shown as "deduped (N deps
    hidden)" #10586.
  - Fixed allowBuilds not working when set via .pnpmfile.cjs
    [#10516].
  - When the enableGlobalVirtualStore option is set, the pnpm
    deploy command would incorrectly create symlinks to the
    global virtual store. To keep the deploy directory
    self-contained, pnpm deploy now ignores this setting and
    always creates a localized virtual store within the deploy
    directory.
  - Fixed minimumReleaseAgeExclude not being respected by pnpm
    dlx #10338.
- update to 10.29.2:
  * Patch Changes
  - Reverted a fix shipped in v10.29.1, which caused another
    issue #10571.
  - Reverted fix: Fixed pnpm run -r failing with "No projects
    matched the filters" when an empty pnpm-workspace.yaml exists
    [#10497].
- update to 10.29.1 (10.29.0 was not released):
  * Minor Changes
  - The pnpm dlx / pnpx command now supports the catalog:
    protocol. Example: pnpm dlx shx@catalog:.
  - Support configuring auditLevel in the pnpm-workspace.yaml
    file #10540.
  - Support bare workspace: protocol without version specifier.
    It is now treated as workspace:* and resolves to the concrete
    version during publish #10436.
  * Patch Changes
  - Fixed pnpm list --json returning incorrect paths when using
    global virtual store #10187.
  - Fix pnpm store path and pnpm store status using workspace
    root for path resolution when storeDir is relative #10290.
  - Fixed pnpm run -r failing with "No projects matched the
    filters" when an empty pnpm-workspace.yaml exists #10497.
  - Fixed a bug where catalogMode: strict would write the literal
    string "catalog:" to pnpm-workspace.yaml instead of the
    resolved version specifier when re-adding an existing catalog
    dependency #10176.
  - Fixed the documentation URL shown in pnpm completion --help
    to point to the correct page at https://pnpm.io/completion
    [#10281].
  - Skip local file: protocol dependencies during pnpm fetch.
    This fixes an issue where pnpm fetch would fail in Docker
    builds when local directory dependencies were not available
    [#10460].
  - Fixed pnpm audit --json to respect the --audit-level setting
    for both exit code and output filtering #10540.
  - update tar to version 7.5.7 to fix security issue
  - Updating the version of dependency tar to 7.5.7 because the
    previous one have a security vulnerability reported here:
    CVE-2026-24842
  - Fix pnpm audit --fix replacing reference overrides (e.g.
    $foo) with concrete versions #10325.
  - Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not
    being converted to publicHoistPattern #10271.
  - pnpm help should correctly report if the currently running
    pnpm CLI is bundled with Node.js #10561.
  - Add a warning when the current directory contains the PATH
    delimiter character. On macOS, folder names containing
    forward slashes (/) appear as colons (:) at the Unix layer.
    Since colons are PATH separators in POSIX systems, this
    breaks PATH injection for node_modules/.bin, causing binaries
    to not be found when running commands like pnpm exec #10457.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773576000">- update to 10.32.1:
  * Patch Changes
  - Fix a regression where pnpm-workspace.yaml without a packages
    field caused all directories to be treated as workspace
    projects. This broke projects that use pnpm-workspace.yaml
    only for settings (e.g. minimumReleaseAge) without defining
    workspace packages #10909.
- update to 10.32.0:
  * Minor Changes
  - Added --all flag to pnpm approve-builds that approves all
    pending builds without interactive prompts #10136.
  * Patch Changes
  - Reverted change related to setting explicitly the npm config
    file path, which caused regressions.
  - Reverted fix related to lockfile-include-tarball-url. Fixes
    [#10915].
- update to 10.31.0:
  * Minor Changes
  - When pnpm updates the pnpm-workspace.yaml, comments, string
    formatting, and whitespace will be preserved.
  * Patch Changes
  - Added -F as a short alias for the --filter option in the help
    output.
  - Handle undefined pkgSnapshot in pnpm why -r #10700.
  - Fix headless install not being used when a project has an
    injected self-referencing file: dependency that resolves to
    link: in the lockfile.
  - Fixed a race condition when multiple worker threads import
    the same package to the global virtual store concurrently.
    The rename operation now tolerates ENOTEMPTY/EEXIST errors if
    another thread already completed the import.
  - When lockfile-include-tarball-url is set to false, tarball
    URLs are now always excluded from the lockfile. Previously,
    tarball URLs could still appear for packages hosted under
    non-standard URLs, making the behavior flaky and inconsistent
    [#6667].
  - Fixed optimisticRepeatInstall skipping install when
    overrides, packageExtensions, ignoredOptionalDependencies,
    patchedDependencies, or peersSuffixMaxLength changed.
  - Fixed pnpm patch-commit failing with "unable to access
    '/.config/git/attributes': Permission denied" error in
    environments where HOME is unset or non-standard (Docker
    containers, CI systems).
  - The issue occurred because pnpm was setting HOME and the
    Windows user profile env var to empty strings to suppress
    user git configuration when running git diff. This caused git
    to resolve the home directory (~) as root (/), leading to
    permission errors when attempting to access
    /.config/git/attributes.
  - Now uses GIT_CONFIG_GLOBAL: os.devNull instead, which is
    git's proper mechanism for bypassing user-level configuration
    without corrupting the home directory path resolution.
  - Fixes #6537
  - Fix pnpm why -r --parseable missing dependents when multiple
    workspace packages share the same dependency #8100.
  - Fix link-workspace-packages=true incorrectly linking
    workspace packages when the requested version doesn't match
    the workspace package's version. Previously, on fresh
    installs the version constraint is overridden to * in the
    fallback resolution paths, causing any workspace package with
    a matching name to be linked regardless of version #10173.
  - Fixed pnpm update --interactive table breaking with long
    version strings (e.g., prerelease versions like
    7.0.0-dev.20251209.1) by dynamically calculating column
    widths instead of using hardcoded values #10316.
  - Explicitly tell npm the path to the global rc config file.
  - The parameter set by the --allow-build flag is written to
    allowBuilds.
  - Fix a bug in which specifying filter on pnpm-workspace.yaml
    would cause pnpm to not detect any projects.
  - Print help message on running pnpm dlx without arguments and
    exit.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774785600">- update to 10.33:
  * Minor Changes
  - Added a new dedupePeers setting that reduces peer dependency
    duplication. When enabled, peer dependency suffixes use
    version-only identifiers (name@version) instead of full dep
    paths, eliminating nested suffixes like
    (foo@1.0.0(bar@2.0.0)). This dramatically reduces the number
    of package instances in projects with many recursive peer
    dependencies #11070.
  * Patch Changes
  - Fail on incompatible lockfiles in CI when frozen lockfile
    mode is enabled, while preserving non-frozen CI fallback
    behavior.
  - When package metadata is malformed or can't be fetched, the
    error thrown will now show the originating error.
  - Fixed intermittent failures when multiple pnpm dlx calls run
    concurrently for the same package. When the global virtual
    store is enabled, the importer now verifies file content
    before skipping a rename, avoiding destructive swap-renames
    that break concurrent processes. Also tolerates EPERM during
    bin creation on Windows and properly propagates
    enableGlobalVirtualStore through the install pipeline.
  - Fixed handling of non-string version selectors in hoistPeers,
    preventing invalid peer dependency specifiers.
  - Improve the non-interactive modules purge error hint to
    include the confirmModulesPurge=false workaround.
  - When pnpm needs to recreate node_modules but no TTY is
    available, the error now suggests either setting CI=true or
    disabling the purge confirmation prompt via
    confirmModulesPurge=false.
  - Adds a regression test for the non-TTY flow.
  - Fixed false "Command not found" errors on Windows when a
    command exists in PATH but exits with a non-zero code. Also
    fixed path resolution for --filter contexts where the command
    runs in a different package directory.
  - When a pnpm-lock.yaml contains two documents, ignore the
    first one. pnpm v11 will write two lockfile documents into
    pnpm-lock.yaml in order to store pnpm version integrities and
    config dependency resolutions.
  - Fixed a bug preventing the clearCache function returned by
    createNpmResolver from properly clearing metadata cache.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777204800">- update to 10.33.2:
  * Patch Changes
  - Globally-installed bins no longer fail with
    ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND when pnpm was installed
    via the standalone @pnpm/exe binary (e.g. curl -fsSL
    https://get.pnpm.io/install.sh | sh -) on a system without a
    separate Node.js installation. Previously, when which('node')
    failed during pnpm add --global, pnpm fell back to
    process.execPath, which in @pnpm/exe is the pnpm binary
    itself — and that path was baked into the generated bin shim,
    causing the shim to invoke pnpm instead of Node #11291,
    [#4645].
  - Fix an infinite fork-bomb that could happen when pnpm was
    installed with one version (e.g. npm install -g pnpm@A) and
    run inside a project whose package.json selected a different
    pnpm version via the packageManager field (e.g. pnpm@B),
    while a pnpm-workspace.yaml also existed at the project root.
  - The child's environment is now forced to
    manage-package-manager-versions=false (v10) and
    pm-on-fail=ignore (v11+), which disables the
    package-manager-version handling in whichever pnpm runs as
    the child.
  - Fixes #11337.
- update to 10.33.1:
  * Patch Changes
  - When a project's packageManager field selects pnpm v11 or
    newer, commands that v10 would have passed through to npm
    (version, login, logout, publish, unpublish, deprecate,
    dist-tag, docs, ping, search, star, stars, unstar, whoami,
    etc.) are now handed over to the wanted pnpm, which
    implements them natively. Previously they silently shelled
    out to npm — making, for example, pnpm version --help print
    npm's help on a project with packageManager: pnpm@11.0.0-rc.3
    [#11328].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778068800">- update to 10.33.4:
  * Patch Changes
  - Pin the integrity of git-hosted tarballs
    (codeload.github.com, gitlab.com, bitbucket.org) in the
    lockfile so that subsequent installs detect a tampered or
    substituted tarball and refuse to install it. Previously the
    lockfile only stored the tarball URL for git dependencies, so
    a compromised git host or a man-in-the-middle could serve
    arbitrary code on later installs without lockfile changes.
  - A new gitHosted: true field is recorded on git-hosted tarball
    resolutions in the lockfile, letting every reader/writer
    route them by a single typed check instead of
    pattern-matching the tarball URL in each call site. Lockfiles
    written by older pnpm versions are enriched on load (URL
    fallback) so the field can be relied on uniformly across the
    codebase.
  - Fix a regression where pnpm --recursive --filter '!&lt;pkg&gt;'
    run/exec/test/add would include the workspace root in the
    matched projects. The workspace root is now correctly
    excluded by default when only negative --filter arguments are
    provided, matching the documented behavior. To include the
    root, pass --include-workspace-root #11341.
- update to 10.33.3:
  * Patch Changes
  - When self-updating from v10's @pnpm/exe to v11+ on Intel
    macOS (darwin-x64), pnpm self-update now transparently
    switches to the JS-only pnpm package on npm instead of
    installing @pnpm/exe@v11+ (which doesn't ship a working
    binary for Intel Macs because of an upstream Node.js SEA bug
    — see #11423 and nodejs/node#62893). Without this, the
    self-update would silently leave the user with no working
    pnpm binary. The new install requires Node.js to be available
    on PATH; a warning is printed when the swap happens. All
    other host/version combinations are unchanged.
  - pnpm self-update (with no version argument) no longer
    downgrades pnpm when the registry's latest dist-tag points to
    an older release than the currently active version. Run pnpm
    self-update latest to force a downgrade #11418.</changelog>
  <changelog author="Elisei Roca &lt;eroca@suse.com&gt;" date="1779451200">- update to 11.2.2:
  * Find the full changelog and breaking changes at:
    https://github.com/pnpm/pnpm/blob/v11.2.2/pnpm/CHANGELOG.md
  * Automated migration steps:
    https://pnpm.io/migration
  - cd /path/to/your/project
  - pnpx codemod run pnpm-v10-to-v11
  * Non-automated steps you might have to do:
    https://pnpm.io/migration#manual-follow-ups
  * Requires at least Node.js v22.13</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1780660800">- Update to 11.5.2:
  * Find the full changelog and breaking changes at:
    https://github.com/pnpm/pnpm/blob/v11.5.2/pnpm/CHANGELOG.md</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1781179200">- Update to 11.5.3:
  * ⚠️ Security fix — environment variables in a project .npmrc
  * Stopped expanding environment variables in repository-
    controlled registry/proxy request destinations and registry
    credential values from .npmrc, and in workspace registry URLs
    from pnpm-workspace.yaml. Move dynamic registry URL and token
    configuration to trusted user, global, CLI, or environment config.
  * Resolve package-manager bootstrap dependencies with trusted
    user or CLI registry and network config, and reject package-
    manager env-lockfile records that do not use registry package
    paths with integrity-only resolutions before auto-switch execution.
  * Avoid writing packageManagerDependencies to pnpm-lock.yaml
    when package manager policy is set to onFail: ignore or
    pmOnFail: ignore #12228.
  * Avoid running dependency-status auto-install when the
    dependency status is unavailable without a project manifest.
  * Using the $ version reference syntax in overrides (e.g. "react": "$react")
    now prints a deprecation warning. The syntax still works, but
    catalogs are the recommended way to keep an overridden
    version in sync with the rest of the workspace. Reference a
    catalog entry with the catalog: protocol instead.
  * Fixed pnpm config get globalconfig to return the global config
    .yaml path again pnpm/pnpm#11962.
  * Fixed bare --color so it does not consume the following CLI
    flag, allowing command shorthands like --parallel to expand
    correctly and forms like pnpm --color with current &lt;command&gt;
    to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.
  * Fix pnpm install ignoring enableGlobalVirtualStore toggle by
    including it in the workspace state settings check #12142.
  * Security: pnpm now verifies the npm registry signature of a
    package-manager binary before spawning it, so a cloned
    repository cannot make pnpm download and execute an arbitrary native binary.
  * Made peer-dependent deduplication deterministic. When a peer-
    suffixed package variant was a subset of two or more mutually
    incompatible larger variants, the variant it collapsed into
    depended on the order importers were resolved in, which
    varies between machines. This could resolve the same
    workspace to different lockfiles on different platforms and
    make pnpm dedupe --check alternate between passing and failing.
  * Reject invalid package names and versions from staged tarball
    manifests before deriving filenames for pnpm stage download.
  * Clarified in CLI help that the pnpm store is trusted shared
    state and store integrity checks are corruption detection,
    not a tamper boundary for untrusted store writers.
  * Reject reserved manifest bin names ("", ".", "..", and scoped
    forms such as @scope/..) when resolving a package's bins.
    These names previously passed the bin-name guard and, when
    joined to the global bin directory during global remove/update
    /add operations, could resolve to the global bin directory
    itself or its parent and have it recursively deleted.
  * Require trusted package identity before package-name
    allowBuilds entries can approve lifecycle scripts for git, git
  - hosted tarball, direct tarball, and local directory artifacts.
    To approve one of those artifacts explicitly, use its peer-
    suffix-free lockfile depPath as the allowBuilds key. Lockfile
    verification now rejects lockfiles where a registry-style
    dependency path (name@semver) is backed by a git, directory,
    or git-hosted tarball resolution (
    ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path
    is a reliable artifact identity by the time scripts can run.
  * Security: pnpm now verifies the OpenPGP signature of a
    downloaded Node.js runtime's SHASUMS256.txt before trusting
    its integrity hashes.</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1781265600">- Update to 11.6.0:
  * pnpm install completes without re-resolving when pnpm-lock.
    yaml was deleted but node_modules is intact: the up-to-date
    check now treats the current lockfile (node_modules/.pnpm/lock.
    yaml) — the record of what the previous install materialized —
    as the wanted lockfile, verifies the manifests still match it,
    restores pnpm-lock.yaml from it, and reports "Already up to date".
    Previously this scenario triggered a full resolution and a re-
    verification of every locked package against the registry.
  * 615c669: Added support for configuring URL-scoped registry
    settings through npm_config_//… and pnpm_config_//…
    environment variables, for example:
  * Improved the warning printed when a project .npmrc uses an
    environment variable in a registry/proxy URL or in registry
    credentials. The message now explains why the setting was
    ignored and how to migrate it to a trusted source — for example
    by moving the line to the user-level ~/.npmrc or running pnpm
    config set "&lt;key&gt;" &lt;value&gt; — with a link to https://pnpm.io/npmrc.
    The pnpm config set example is only suggested when the key has
    no ${...} placeholder, so the snippet is always safe to copy-paste.
  * Print a "Lockfile passes supply-chain policies (verified 2h
    ago)" message when lockfile verification is skipped because a
    cached verdict for the same lockfile content and policy is reused.
    Previously the cached short-circuit was completely silent,
    which made it look like the policy gate never ran #12324.
  * Platform-specific optional dependencies are now skipped even
    when their os/cpu/libc fields are missing from the registry
    metadata or the lockfile. Some registries strip these fields
    from the package metadata, which made pnpm download and install
    the binaries of every platform regardless of
    supportedArchitectures. The missing platform fields of an
    optional dependency are now inferred from its name (e.g. @nx/nx-
    win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform
    binaries are skipped without even downloading them #11702.</changelog>
</package>
<package pkgid="f4c5816d18bf32443407b0a1f472beb775de2a96802945981d55ba1d0d5243cdbc0113e5595e30fd88d62f0667d7e93accdd22b4a46d32dbc37788132f334441" name="pnpm-bash-completion" arch="noarch">
  <version epoch="0" ver="11.6.0" rel="11.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- update to 10.17:
  * Minor Changes
  - The minimumReleaseAgeExclude setting now supports patterns.
    For instance:
    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
  - "@eslint/*"
  * Patch Changes
  - Don't ignore the minimumReleaseAge check, when the package is
    requested by exact version and the packument is loaded from
    cache #9978.
  - When minimumReleaseAge is set and the active version under a
    dist-tag is not mature enough, do not downgrade to a
    prerelease version in case the original version wasn't a
    prerelease one #9979.
- update to 10.16.1:
  * Patch Changes
  - The full metadata cache should be stored not at the same
    location as the abbreviated metadata. This fixes a bug where
    pnpm was loading the abbreviated metadata from cache and
    couldn't find the "time" field as a result #9963.
  - Forcibly disable ANSI color codes when generating patch diff
    [#9914].
- update to 10.16:
  * Minor Changes
  - There have been several incidents recently where popular
    packages were successfully attacked. To reduce the risk of
    installing a compromised version, we are introducing a new
    setting that delays the installation of newly released
    dependencies. In most cases, such attacks are discovered
    quickly and the malicious versions are removed from the
    registry within an hour.
  - The new setting is called minimumReleaseAge. It specifies the
    number of minutes that must pass after a version is published
    before pnpm will install it. For example, setting
    minimumReleaseAge: 1440 ensures that only packages released
    at least one day ago can be installed.
  - If you set minimumReleaseAge but need to disable this
    restriction for certain dependencies, you can list them under
    the minimumReleaseAgeExclude setting. For instance, with the
    following configuration pnpm will always install the latest
    version of webpack, regardless of its release time:
    minimumReleaseAgeExclude:
  - webpack
  - Added support for finders #9946.
    In the past, pnpm list and pnpm why could only search for
    dependencies by name (and optionally version). For example:
    pnpm why minimist
    prints the chain of dependencies to any installed instance of
    minimist:
    verdaccio 5.20.1
    ├─┬ handlebars 4.7.7
    │ └── minimist 1.2.8
    └─┬ mv 2.1.1
    └─┬ mkdirp 0.5.6
    └── minimist 1.2.8
    What if we want to search by other properties of a
    dependency, not just its name? For instance, find all
    packages that have react@17 in their peer dependencies?
    This is now possible with "finder functions". Finder
    functions can be declared in .pnpmfile.cjs and invoked with
    the --find-by=&lt;function name&gt; flag when running pnpm list or
    pnpm why.
    Let's say we want to find any dependencies that have React 17
    in peer dependencies. We can add this finder to our
    .pnpmfile.cjs:
    module.exports = {
    finders: {
    react17: (ctx) =&gt; {
    return ctx.readManifest().peerDependencies?.react === "^17.0.0";
    },
    },
    };
    Now we can use this finder function by running:
    pnpm why --find-by=react17
    pnpm will find all dependencies that have this React in peer
    dependencies and print their exact locations in the
    dependency graph.
    @apollo/client 4.0.4
    ├── @graphql-typed-document-node/core 3.2.0
    └── graphql-tag 2.12.6
    It is also possible to print out some additional information
    in the output by returning a string from the finder. For
    example, with the following finder:
    module.exports = {
    finders: {
    react17: (ctx) =&gt; {
    const manifest = ctx.readManifest();
    if (manifest.peerDependencies?.react === "^17.0.0") {
    return `license: ${manifest.license}`;
    }
    return false;
    },
    },
    };
    Every matched package will also print out the license from
    its package.json:
    @apollo/client 4.0.4
    ├── @graphql-typed-document-node/core 3.2.0
    │   license: MIT
    └── graphql-tag 2.12.6
    license: MIT
  * Patch Changes
  - Fix deprecation warning printed when executing pnpm with
    Node.js 24 #9529.
  - Throw an error if nodeVersion is not set to an exact semver
    version #9934.
  - pnpm publish should be able to publish a .tar.gz file #9927.
  - Canceling a running process with Ctrl-C should make pnpm run
    return a non-zero exit code #9626.
- update to 10.15.1:
  * Patch Changes
  - Fix .pnp.cjs crash when importing subpath #9904.
  - When resolving peer dependencies, pnpm looks whether the peer
    dependency is present in the root workspace project's
    dependencies. This change makes it so that the peer
    dependency is correctly resolved even from aliased npm-hosted
    dependencies or other types of dependencies #9913.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758628800">- update to 10.17.1:
  * Patch Changes
  - When a version specifier cannot be resolved because the versions
    don't satisfy the minimumReleaseAge setting, print this
    information out in the error message #9974.
  - Fix state.json creation path when executing pnpm patch in a
    workspace project #9733.
  - When minimumReleaseAge is set and the latest tag is not mature
    enough, prefer a non-deprecated version as the new latest #9987.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761998400">- update to 10.20.0:
  * Minor Changes
  - Support --all option in pnpm --help to list all commands
    [#8628].
  * Patch Changes
  - When the latest version doesn't satisfy the maturity
    requirement configured by minimumReleaseAge, pick the highest
    version that is mature enough, even if it has a different
    major version #10100.
  - create command should not verify patch info.
  - Set managePackageManagerVersions to false, when switching to
    a different version of pnpm CLI, in order to avoid subsequent
    switches #10063.
- update to 10.19.0:
  * Minor Changes
  - You can now allow specific versions of dependencies to run
    postinstall scripts. onlyBuiltDependencies now accepts
    package names with lists of trusted versions. For example:
    Related PR: #10104.
    onlyBuiltDependencies:
  - nx@21.6.4 || 21.6.5
  - esbuild@0.25.1
  - Added support for exact versions in minimumReleaseAgeExclude
    [#9985].
    You can now list one or more specific versions that pnpm
    should allow to install, even if those versions don’t satisfy
    the maturity requirement set by minimumReleaseAge. For
    example:
    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
  - nx@21.6.5
  - webpack@4.47.0 || 5.102.1
- update to 10.18.3:
  * Patch Changes
  - Fix a bug where pnpm would infinitely recurse when using
    verifyDepsBeforeInstall: install and pre/post install scripts
    that called other pnpm scripts #10060.
  - Fixed scoped registry keys (e.g., @scope:registry) being
    parsed as property paths in pnpm config get when
  - -location=project is used #9362.
  - Remove pnpm-specific CLI options before passing to npm
    publish to prevent "Unknown cli config" warnings #9646.
  - Fixed EISDIR error when bin field points to a directory
    [#9441].
  - Preserve version and hasBin for variations packages #10022.
  - Fixed pnpm config set --location=project incorrectly handling
    keys with slashes (auth tokens, registry settings) #9884.
  - When both pnpm-workspace.yaml and .npmrc exist, pnpm config
    set --location=project now writes to pnpm-workspace.yaml
    (matching read priority) #10072.
  - Prevent a table width error in pnpm outdated --long #10040.
  - Sync bin links after injected dependencies are updated by
    build scripts. This ensures that binaries created during
    build processes are properly linked and accessible to
    consuming projects #10057.
- update to 10.18.2:
  * Patch Changes
  - pnpm outdated --long should work #10040.
  - Replace ndjson with split2. Reduce the bundle size of pnpm
    CLI #10054.
  - pnpm dlx should request the full metadata of packages, when
    minimumReleaseAge is set #9963.
  - pnpm version switching should work when the pnpm home
    directory is in a symlinked directory #9715.
  - Fix EPIPE errors when piping output to other commands #10027.
- update to 10.18.1:
  * Patch Changes
  - Don't print a warning, when --lockfile-only is used #8320.
  - pnpm setup creates a command shim to the pnpm executable.
    This is needed to be able to run pnpm self-update on Windows
    [#5700].
  - When using pnpm catalogs and running a normal pnpm install,
    pnpm produced false positive warnings for "skip adding to the
    default catalog because it already exists". This warning now
    only prints when using pnpm add --save-catalog as originally
    intended.
- update to 10.18.0:
  * Minor Changes
  - Added network performance monitoring to pnpm by implementing
    warnings for slow network requests, including both metadata
    fetches and tarball downloads.
    Added configuration options for warning thresholds:
    fetchWarnTimeoutMs and fetchMinSpeedKiBps.
    Warning messages are displayed when requests exceed time
    thresholds or fall below speed minimums
    Related PR: #10025.
  * Patch Changes
  - Retry filesystem operations on EAGAIN errors #9959.
  - Outdated command respects minimumReleaseAge configuration
    [#10030].
  - Correctly apply the cleanupUnusedCatalogs configuration when
    removing dependent packages.
  - Don't fail with a meaningless error when scriptShell is set
    to false #8748.
  - pnpm dlx should not fail when minimumReleaseAge is set
    [#10037].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- update to 10.21.0:
  * Minor Changes
  - Node.js Runtime Installation for Dependencies. Added support
    for automatic Node.js runtime installation for dependencies.
    pnpm will now install the Node.js version required by a
    dependency if that dependency declares a Node.js runtime in
    the "engines" field. For example:
    {
    "engines": {
    "runtime": {
    "name": "node",
    "version": "^24.11.0",
    "onFail": "download"
    }
    }
    }
    If the package with the Node.js runtime dependency is a CLI
    app, pnpm will bind the CLI app to the required Node.js
    version. This ensures that, regardless of the globally
    installed Node.js instance, the CLI will use the compatible
    version of Node.js.
    If the package has a postinstall script, that script will be
    executed using the specified Node.js version.
    Related PR: #10141
  - Added a new setting: trustPolicy.
    When set to no-downgrade, pnpm will fail installation if a
    package’s trust level has decreased compared to previous
    releases — for example, if it was previously published by a
    trusted publisher but now only has provenance or no trust
    evidence.
    This helps prevent installing potentially compromised
    versions of a package.
    Related issue: #8889.
  - Added support for pnpm config get globalconfig to retrieve
    the global config file path #9977.
  * Patch Changes
  - When a user runs pnpm update on a dependency that is not
    directly listed in package.json, none of the direct
    dependencies should be updated #10155.
  - Don't crash when two processes of pnpm are hardlinking the
    contents of a directory to the same destination
    simultaneously #10160.
  - Setting gitBranchLockfile and related settings via
    pnpm-workspace.yaml should work #9651.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467201">- update to 10.22.0:
  * Minor Changes
  - Added support for trustPolicyExclude #10164.
    You can now list one or more specific packages or versions
    that pnpm should allow to install, even if those packages
    don't satisfy the trust policy requirement. For example:
    trustPolicy: no-downgrade
    trustPolicyExclude:
  - chokidar@4.0.3
  - webpack@4.47.0 || 5.102.1
  - Allow to override the engines field on publish by the
    publishConfig.engines field.
  * Patch Changes
  - Don't crash when two processes of pnpm are hardlinking the
    contents of a directory to the same destination
    simultaneously #10179.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763899200">- update to 10.23.0:
  * Minor Changes
  - Added --lockfile-only option to pnpm list #10020.
  * Patch Changes
  - pnpm self-update should download pnpm from the configured npm
    registry #10205.
  - pnpm self-update should always install the non-executable
    pnpm package (pnpm in the registry) and never the @pnpm/exe
    package, when installing v11 or newer. We currently cannot
    ship @pnpm/exe as pkg doesn't work with ESM #10190.
  - Node.js runtime is not added to "dependencies" on pnpm add,
    if there's a engines.runtime setting declared in package.json
    [#10209].
  - The installation should fail if an optional dependency cannot
    be installed due to a trust policy check failure #10208.
  - pnpm list and pnpm why now display npm: protocol for aliased
    packages (e.g., foo npm:is-odd@3.0.1) #8660.
  - Don't add an extra slash to the Node.js mirror URL #10204.
  - pnpm store prune should not fail if the store contains
    Node.js packages #10131.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765627200">- update to 10.24.0:
  * Minor Changes
  - Increased network concurrency on machines with many CPU
    cores. pnpm now automatically selects a network concurrency
    between 16 and 64, based on the number of pnpm workers
    (calculated as workers × 3). This improves performance on
    high-core systems #10068.
  * Patch Changes
  - trustPolicy should ignore the trust evidences of prerelease
    versions, when installing a non-prerelease version.
  - Handle ENOENT errors thrown by fs.linkSync(), which can occur
    in containerized environments (OverlayFS) instead of EXDEV.
    The operation now gracefully falls back to fs.copyFileSync()
    in these cases #10217.
  - Reverted: pnpm self-update should download pnpm from the
    configured npm registry #10205.
  - Packages that don't have a package.json file (like Node.js)
    should not be reimported from the store on every install.
    Another file from the package should be checked in order to
    verify its presence in node_modules.
  - Correctly read auth tokens for URLs that contain underscores
    [#17].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765627201">- update to 10.25.0:
  * Minor Changes
  - Allow loading certificates from cert, ca, and key for
    specific registry URLs. E.g.,
    //registry.example.com/:ca=-----BEGIN CERTIFICATE-----....
    Previously this was only working via certfile, cafile, and
    keyfile.
    These properties are supported in .npmrc, but were ignored by
    pnpm, this will make pnpm read and use them as well.
    Related PR: #10230.
  - Added a new flag called --bare to pnpm init for creating a
    package.json with the bare minimum of required fields #10226.
  * Patch Changes
  - Improved reporting of ignored dependency scripts #10276.
  - pnpm install should build any dependencies that were added to
    onlyBuiltDependencies and were not built yet #10256.
  - pnpm publish -r --force should allow to run publish over
    already existing versions in the registry #10272.
  - Don't fail with a ERR_PNPM_MISSING_TIME error if a package
    that is excluded from trust policy checks is missing the time
    field in the metadata.</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1765800000">- update to 10.26.0
  * Minor Changes
  - Semi-breaking. Block git-hosted dependencies from running
    prepare scripts unless explicitly allowed in onlyBuiltDependencies #10288.
  - Semi-breaking. Compute integrity hash for HTTP tarball
    dependencies when fetching, storing it in the lockfile to
    prevent servers from serving altered content on subsequent installs #10287.
  - Added a new setting blockExoticSubdeps that prevents the
    resolution of exotic protocols in transitive dependencies.
  - Added support for allowBuilds, which is a new field that
    can be used instead of onlyBuiltDependencies and
    ignoredBuiltDependencies. The new allowBuilds field in your
    pnpm-workspace.yaml uses a map of package matchers to
    explicitly allow (true) or disallow (false) script execution.
    This allows for a single, easy-to-manage source of truth for
    your build permissions.
  * Patch Changes
  - Show deprecation in table/list formats when latest version
    is deprecated #8658.
  - Remove the injectWorkspacePackages setting from the
    lockfile on the deploy command #10294.
  - Normalize the tarball URLs before saving them to the
    lockfile. URLs should not contain default ports, like :80 for
    http and :443 for https #10273.
  - When a dependency is installed via a direct URL that
    redirects to another URL and is immutable, the original URL
    is normalized and saved to package.json #10197.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- update to 10.28.0:
  * Minor Changes
  - Add support for a hook called beforePacking that can be used
    to customize the package.json contents at publish time #3816.
  - In some cases, a filtered install (i.e. pnpm install --filter
    ...) was slower than running pnpm install without any filter
    arguments. This performance regression is now fixed. Filtered
    installs should be as fast or faster than a full install
    [#10408].
  * Patch Changes
  - Do not add a symlink to the project into the store's project
    registry if the store is in a subdirectory of the project
    [#10411].
  - It should be possible to declare the requiredScripts setting
    in pnpm-workspace.yaml #10261.
- update to 10.27.0:
  * Minor Changes
  - Adding trustPolicyIgnoreAfter allows you to ignore trust
    policy checks for packages published more than a specified
    time ago#10352.
  - Added project registry for global virtual store prune
    support.
  - Projects using the store are now registered via symlinks in
    {storeDir}/v10/projects/. This enables pnpm store prune to
    track which packages are still in use by active projects and
    safely remove unused packages from the global virtual store.
  - Semi-breaking. Changed the location of unscoped packages in
    the virtual global store. They will now be stored under a
    directory named @ to maintain a uniform 4-level directory
    depth.
  - Added mark-and-sweep garbage collection for global virtual
    store.
  - pnpm store prune now removes unused packages from the global
    virtual store's links/ directory. The algorithm:
  - Scans all registered projects for symlinks pointing to the
    store
  - Walks transitive dependencies to mark reachable packages
  - Removes any package directories not marked as reachable
  - This includes support for workspace monorepos - all
    node_modules directories within a project (including those in
    workspace packages) are scanned.
  * Patch Changes
  - Throw an error if the value of the tokenHelper or
    &lt;url&gt;:tokenHelper setting contains an environment variable.
  - Git dependencies with build scripts should respect the
    dangerouslyAllowAllBuilds settings #10376.
  - Skip the package manager check when running with --global and
    a project packageManager is configured, and warn that the
    check is skipped.
  - pnpm store prune should not fail if the dlx cache directory
    has files, not only directories #10384
  - Fixed a bug (#9759) where pnpm add would incorrectly modify a
    catalog entry in pnpm-workspace.yaml to its exact version.
- update to 10.26.2:
  * Patch Changes
  - Improve error message when a package version exists but does
    not meet the minimumReleaseAge constraint. The error now
    clearly states that the version exists and shows a
    human-readable time since release (e.g., "released 6 hours
    ago") #10307.
  - Fix installation of Git dependencies using annotated tags
    [#10335].
  - Previously, pnpm would store the annotated tag object's SHA
    in the lockfile instead of the actual commit SHA. This caused
    ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out
    commit hash didn't match the stored tag object hash.
  - Binaries of runtime engines (Node.js, Deno, Bun) are written
    to node_modules/.bin before lifecycle scripts (install,
    postinstall, prepare) are executed #10244.
  - Try to avoid making network calls with preferOffline #10334.
- update to 10.26.1:
  * Patch Changes
  - Don't fail on pnpm add, when blockExoticSubdeps is set to
    true #10324.
  - Always resolve git references to full commits and ensure HEAD
    points to the commit after checkout #10310.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- update to 10.28.2:
  * Patch Changes
  - Security fix: prevent path traversal in directories.bin
    field.
  - When pnpm installs a file: or git: dependency, it now
    validates that symlinks point within the package directory.
    Symlinks to paths outside the package root are skipped to
    prevent local data from being leaked into node_modules.
    This fixes a security issue where a malicious package could
    create symlinks to sensitive files (e.g., /etc/passwd,
    ~/.ssh/id_rsa) and have their contents copied when the
    package is installed.
    Note: This only affects file: and git: dependencies. Registry
    packages (npm) have symlinks stripped during publish and are
    not affected.
  - Fixed optional dependencies to request full metadata from the
    registry to get the libc field, which is required for proper
    platform compatibility checks #9950.
- update to 10.28.1:
  * Patch Changes
  - Fixed installation of config dependencies from private
    registries.
    Added support for object type in configDependencies when the
    tarball URL returned from package metadata differs from the
    computed URL #10431.
  - Fix path traversal vulnerability in binary fetcher ZIP
    extraction
  - Validate ZIP entry paths before extraction to prevent
    writing files outside target directory
  - Validate BinaryResolution.prefix (basename) to prevent
    directory escape via crafted prefix
  - Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error
  - Support plain http:// and https:// URLs ending with .git as
    git repository dependencies.
    Previously, URLs like
    https://gitea.example.org/user/repo.git#commit were not
    recognized as git repositories because they lacked the git+
    prefix (e.g., git+https://). This caused issues when
    installing dependencies from self-hosted git servers like
    Gitea or Forgejo that don't provide tarball downloads.
    Changes:
  - The git resolver now runs before the tarball resolver,
    ensuring git URLs are handled by the correct resolver
  - The git resolver now recognizes plain http:// and https://
    URLs ending in .git as git repositories
  - Removed the isRepository check from the tarball resolver
    since it's no longer needed with the new resolver order
    Fixes #10468
  - pnpm run -r and pnpm run --filter now fail with a non-zero
    exit code when no packages have the specified script.
    Previously, this only failed when all packages were selected.
    Use --if-present to suppress this error #6844.
  - Fixed a path traversal vulnerability in tarball extraction on
    Windows. The path normalization was only checking for ./ but
    not .\. Since backslashes are directory separators on
    Windows, malicious packages could use paths like
    foo\..\..\.npmrc to write files outside the package
    directory.
  - When running "pnpm exec" from a subdirectory of a project,
    don't change the current working directory to the root of the
    project #5759.
  - Fixed a path traversal vulnerability in pnpm's bin linking.
    Bin names starting with @ bypassed validation, and after
    scope normalization, path traversal sequences like ../../
    remained intact.
  - Revert Try to avoid making network calls with preferOffline
    [#10334].
  - Fix --save-peer to write valid semver ranges to
    peerDependencies for protocol-based installs (e.g. jsr:) by
    deriving from resolved versions when available and falling
    back to * if none is available #10417.
  - Do not exclude the root workspace project, when it is
    explicitly selected via a filter #10465.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772452800">- update to 10.30.3:
  * Patch Changes
  - Fixed version switching via packageManager field failing when
    pnpm is installed as a standalone executable in environments
    without a system Node.js #10687.
- update to 10.30.2:
  * Patch Changes
  - Fix auto-installed peer dependencies ignoring overrides when
    a stale version exists in the lockfile.
  - Fixed "input line too long" error on Windows when running
    lifecycle scripts with the global virtual store enabled
    [#10673].
  - Update @zkochan/js-yaml to fix moderate vulnerability.
- update to 10.30.1:
  * Patch Changes
  - Use the /-/npm/v1/security/audits/quick endpoint as the
    primary audit endpoint, falling back to
    /-/npm/v1/security/audits when it fails #10649.
- update to 10.30.0:
  * Minor Changes
  - pnpm why now shows a reverse dependency tree. The searched
    package appears at the root with its dependents as branches,
    walking back to workspace roots. This replaces the previous
    forward-tree output which was noisy and hard to read for
    deeply nested dependencies.
  * Patch Changes
  - Revert pnpm why dependency pruning to prefer correctness over
    memory consumption. Reverted PR: #7122.
  - Optimize pnpm why and pnpm list performance in workspaces
    with many importers by sharing the dependency graph and
    materialization cache across all importers instead of
    rebuilding them independently for each one #10596.
- update to 10.29.3:
  * Patch Changes
  - Fixed an out-of-memory error in pnpm list (and pnpm why) on
    large dependency graphs by replacing the recursive tree
    builder with a two-phase approach: a BFS dependency graph
    followed by cached tree materialization. Duplicate subtrees
    are now deduplicated in the output, shown as "deduped (N deps
    hidden)" #10586.
  - Fixed allowBuilds not working when set via .pnpmfile.cjs
    [#10516].
  - When the enableGlobalVirtualStore option is set, the pnpm
    deploy command would incorrectly create symlinks to the
    global virtual store. To keep the deploy directory
    self-contained, pnpm deploy now ignores this setting and
    always creates a localized virtual store within the deploy
    directory.
  - Fixed minimumReleaseAgeExclude not being respected by pnpm
    dlx #10338.
- update to 10.29.2:
  * Patch Changes
  - Reverted a fix shipped in v10.29.1, which caused another
    issue #10571.
  - Reverted fix: Fixed pnpm run -r failing with "No projects
    matched the filters" when an empty pnpm-workspace.yaml exists
    [#10497].
- update to 10.29.1 (10.29.0 was not released):
  * Minor Changes
  - The pnpm dlx / pnpx command now supports the catalog:
    protocol. Example: pnpm dlx shx@catalog:.
  - Support configuring auditLevel in the pnpm-workspace.yaml
    file #10540.
  - Support bare workspace: protocol without version specifier.
    It is now treated as workspace:* and resolves to the concrete
    version during publish #10436.
  * Patch Changes
  - Fixed pnpm list --json returning incorrect paths when using
    global virtual store #10187.
  - Fix pnpm store path and pnpm store status using workspace
    root for path resolution when storeDir is relative #10290.
  - Fixed pnpm run -r failing with "No projects matched the
    filters" when an empty pnpm-workspace.yaml exists #10497.
  - Fixed a bug where catalogMode: strict would write the literal
    string "catalog:" to pnpm-workspace.yaml instead of the
    resolved version specifier when re-adding an existing catalog
    dependency #10176.
  - Fixed the documentation URL shown in pnpm completion --help
    to point to the correct page at https://pnpm.io/completion
    [#10281].
  - Skip local file: protocol dependencies during pnpm fetch.
    This fixes an issue where pnpm fetch would fail in Docker
    builds when local directory dependencies were not available
    [#10460].
  - Fixed pnpm audit --json to respect the --audit-level setting
    for both exit code and output filtering #10540.
  - update tar to version 7.5.7 to fix security issue
  - Updating the version of dependency tar to 7.5.7 because the
    previous one have a security vulnerability reported here:
    CVE-2026-24842
  - Fix pnpm audit --fix replacing reference overrides (e.g.
    $foo) with concrete versions #10325.
  - Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not
    being converted to publicHoistPattern #10271.
  - pnpm help should correctly report if the currently running
    pnpm CLI is bundled with Node.js #10561.
  - Add a warning when the current directory contains the PATH
    delimiter character. On macOS, folder names containing
    forward slashes (/) appear as colons (:) at the Unix layer.
    Since colons are PATH separators in POSIX systems, this
    breaks PATH injection for node_modules/.bin, causing binaries
    to not be found when running commands like pnpm exec #10457.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773576000">- update to 10.32.1:
  * Patch Changes
  - Fix a regression where pnpm-workspace.yaml without a packages
    field caused all directories to be treated as workspace
    projects. This broke projects that use pnpm-workspace.yaml
    only for settings (e.g. minimumReleaseAge) without defining
    workspace packages #10909.
- update to 10.32.0:
  * Minor Changes
  - Added --all flag to pnpm approve-builds that approves all
    pending builds without interactive prompts #10136.
  * Patch Changes
  - Reverted change related to setting explicitly the npm config
    file path, which caused regressions.
  - Reverted fix related to lockfile-include-tarball-url. Fixes
    [#10915].
- update to 10.31.0:
  * Minor Changes
  - When pnpm updates the pnpm-workspace.yaml, comments, string
    formatting, and whitespace will be preserved.
  * Patch Changes
  - Added -F as a short alias for the --filter option in the help
    output.
  - Handle undefined pkgSnapshot in pnpm why -r #10700.
  - Fix headless install not being used when a project has an
    injected self-referencing file: dependency that resolves to
    link: in the lockfile.
  - Fixed a race condition when multiple worker threads import
    the same package to the global virtual store concurrently.
    The rename operation now tolerates ENOTEMPTY/EEXIST errors if
    another thread already completed the import.
  - When lockfile-include-tarball-url is set to false, tarball
    URLs are now always excluded from the lockfile. Previously,
    tarball URLs could still appear for packages hosted under
    non-standard URLs, making the behavior flaky and inconsistent
    [#6667].
  - Fixed optimisticRepeatInstall skipping install when
    overrides, packageExtensions, ignoredOptionalDependencies,
    patchedDependencies, or peersSuffixMaxLength changed.
  - Fixed pnpm patch-commit failing with "unable to access
    '/.config/git/attributes': Permission denied" error in
    environments where HOME is unset or non-standard (Docker
    containers, CI systems).
  - The issue occurred because pnpm was setting HOME and the
    Windows user profile env var to empty strings to suppress
    user git configuration when running git diff. This caused git
    to resolve the home directory (~) as root (/), leading to
    permission errors when attempting to access
    /.config/git/attributes.
  - Now uses GIT_CONFIG_GLOBAL: os.devNull instead, which is
    git's proper mechanism for bypassing user-level configuration
    without corrupting the home directory path resolution.
  - Fixes #6537
  - Fix pnpm why -r --parseable missing dependents when multiple
    workspace packages share the same dependency #8100.
  - Fix link-workspace-packages=true incorrectly linking
    workspace packages when the requested version doesn't match
    the workspace package's version. Previously, on fresh
    installs the version constraint is overridden to * in the
    fallback resolution paths, causing any workspace package with
    a matching name to be linked regardless of version #10173.
  - Fixed pnpm update --interactive table breaking with long
    version strings (e.g., prerelease versions like
    7.0.0-dev.20251209.1) by dynamically calculating column
    widths instead of using hardcoded values #10316.
  - Explicitly tell npm the path to the global rc config file.
  - The parameter set by the --allow-build flag is written to
    allowBuilds.
  - Fix a bug in which specifying filter on pnpm-workspace.yaml
    would cause pnpm to not detect any projects.
  - Print help message on running pnpm dlx without arguments and
    exit.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774785600">- update to 10.33:
  * Minor Changes
  - Added a new dedupePeers setting that reduces peer dependency
    duplication. When enabled, peer dependency suffixes use
    version-only identifiers (name@version) instead of full dep
    paths, eliminating nested suffixes like
    (foo@1.0.0(bar@2.0.0)). This dramatically reduces the number
    of package instances in projects with many recursive peer
    dependencies #11070.
  * Patch Changes
  - Fail on incompatible lockfiles in CI when frozen lockfile
    mode is enabled, while preserving non-frozen CI fallback
    behavior.
  - When package metadata is malformed or can't be fetched, the
    error thrown will now show the originating error.
  - Fixed intermittent failures when multiple pnpm dlx calls run
    concurrently for the same package. When the global virtual
    store is enabled, the importer now verifies file content
    before skipping a rename, avoiding destructive swap-renames
    that break concurrent processes. Also tolerates EPERM during
    bin creation on Windows and properly propagates
    enableGlobalVirtualStore through the install pipeline.
  - Fixed handling of non-string version selectors in hoistPeers,
    preventing invalid peer dependency specifiers.
  - Improve the non-interactive modules purge error hint to
    include the confirmModulesPurge=false workaround.
  - When pnpm needs to recreate node_modules but no TTY is
    available, the error now suggests either setting CI=true or
    disabling the purge confirmation prompt via
    confirmModulesPurge=false.
  - Adds a regression test for the non-TTY flow.
  - Fixed false "Command not found" errors on Windows when a
    command exists in PATH but exits with a non-zero code. Also
    fixed path resolution for --filter contexts where the command
    runs in a different package directory.
  - When a pnpm-lock.yaml contains two documents, ignore the
    first one. pnpm v11 will write two lockfile documents into
    pnpm-lock.yaml in order to store pnpm version integrities and
    config dependency resolutions.
  - Fixed a bug preventing the clearCache function returned by
    createNpmResolver from properly clearing metadata cache.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777204800">- update to 10.33.2:
  * Patch Changes
  - Globally-installed bins no longer fail with
    ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND when pnpm was installed
    via the standalone @pnpm/exe binary (e.g. curl -fsSL
    https://get.pnpm.io/install.sh | sh -) on a system without a
    separate Node.js installation. Previously, when which('node')
    failed during pnpm add --global, pnpm fell back to
    process.execPath, which in @pnpm/exe is the pnpm binary
    itself — and that path was baked into the generated bin shim,
    causing the shim to invoke pnpm instead of Node #11291,
    [#4645].
  - Fix an infinite fork-bomb that could happen when pnpm was
    installed with one version (e.g. npm install -g pnpm@A) and
    run inside a project whose package.json selected a different
    pnpm version via the packageManager field (e.g. pnpm@B),
    while a pnpm-workspace.yaml also existed at the project root.
  - The child's environment is now forced to
    manage-package-manager-versions=false (v10) and
    pm-on-fail=ignore (v11+), which disables the
    package-manager-version handling in whichever pnpm runs as
    the child.
  - Fixes #11337.
- update to 10.33.1:
  * Patch Changes
  - When a project's packageManager field selects pnpm v11 or
    newer, commands that v10 would have passed through to npm
    (version, login, logout, publish, unpublish, deprecate,
    dist-tag, docs, ping, search, star, stars, unstar, whoami,
    etc.) are now handed over to the wanted pnpm, which
    implements them natively. Previously they silently shelled
    out to npm — making, for example, pnpm version --help print
    npm's help on a project with packageManager: pnpm@11.0.0-rc.3
    [#11328].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778068800">- update to 10.33.4:
  * Patch Changes
  - Pin the integrity of git-hosted tarballs
    (codeload.github.com, gitlab.com, bitbucket.org) in the
    lockfile so that subsequent installs detect a tampered or
    substituted tarball and refuse to install it. Previously the
    lockfile only stored the tarball URL for git dependencies, so
    a compromised git host or a man-in-the-middle could serve
    arbitrary code on later installs without lockfile changes.
  - A new gitHosted: true field is recorded on git-hosted tarball
    resolutions in the lockfile, letting every reader/writer
    route them by a single typed check instead of
    pattern-matching the tarball URL in each call site. Lockfiles
    written by older pnpm versions are enriched on load (URL
    fallback) so the field can be relied on uniformly across the
    codebase.
  - Fix a regression where pnpm --recursive --filter '!&lt;pkg&gt;'
    run/exec/test/add would include the workspace root in the
    matched projects. The workspace root is now correctly
    excluded by default when only negative --filter arguments are
    provided, matching the documented behavior. To include the
    root, pass --include-workspace-root #11341.
- update to 10.33.3:
  * Patch Changes
  - When self-updating from v10's @pnpm/exe to v11+ on Intel
    macOS (darwin-x64), pnpm self-update now transparently
    switches to the JS-only pnpm package on npm instead of
    installing @pnpm/exe@v11+ (which doesn't ship a working
    binary for Intel Macs because of an upstream Node.js SEA bug
    — see #11423 and nodejs/node#62893). Without this, the
    self-update would silently leave the user with no working
    pnpm binary. The new install requires Node.js to be available
    on PATH; a warning is printed when the swap happens. All
    other host/version combinations are unchanged.
  - pnpm self-update (with no version argument) no longer
    downgrades pnpm when the registry's latest dist-tag points to
    an older release than the currently active version. Run pnpm
    self-update latest to force a downgrade #11418.</changelog>
  <changelog author="Elisei Roca &lt;eroca@suse.com&gt;" date="1779451200">- update to 11.2.2:
  * Find the full changelog and breaking changes at:
    https://github.com/pnpm/pnpm/blob/v11.2.2/pnpm/CHANGELOG.md
  * Automated migration steps:
    https://pnpm.io/migration
  - cd /path/to/your/project
  - pnpx codemod run pnpm-v10-to-v11
  * Non-automated steps you might have to do:
    https://pnpm.io/migration#manual-follow-ups
  * Requires at least Node.js v22.13</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1780660800">- Update to 11.5.2:
  * Find the full changelog and breaking changes at:
    https://github.com/pnpm/pnpm/blob/v11.5.2/pnpm/CHANGELOG.md</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1781179200">- Update to 11.5.3:
  * ⚠️ Security fix — environment variables in a project .npmrc
  * Stopped expanding environment variables in repository-
    controlled registry/proxy request destinations and registry
    credential values from .npmrc, and in workspace registry URLs
    from pnpm-workspace.yaml. Move dynamic registry URL and token
    configuration to trusted user, global, CLI, or environment config.
  * Resolve package-manager bootstrap dependencies with trusted
    user or CLI registry and network config, and reject package-
    manager env-lockfile records that do not use registry package
    paths with integrity-only resolutions before auto-switch execution.
  * Avoid writing packageManagerDependencies to pnpm-lock.yaml
    when package manager policy is set to onFail: ignore or
    pmOnFail: ignore #12228.
  * Avoid running dependency-status auto-install when the
    dependency status is unavailable without a project manifest.
  * Using the $ version reference syntax in overrides (e.g. "react": "$react")
    now prints a deprecation warning. The syntax still works, but
    catalogs are the recommended way to keep an overridden
    version in sync with the rest of the workspace. Reference a
    catalog entry with the catalog: protocol instead.
  * Fixed pnpm config get globalconfig to return the global config
    .yaml path again pnpm/pnpm#11962.
  * Fixed bare --color so it does not consume the following CLI
    flag, allowing command shorthands like --parallel to expand
    correctly and forms like pnpm --color with current &lt;command&gt;
    to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.
  * Fix pnpm install ignoring enableGlobalVirtualStore toggle by
    including it in the workspace state settings check #12142.
  * Security: pnpm now verifies the npm registry signature of a
    package-manager binary before spawning it, so a cloned
    repository cannot make pnpm download and execute an arbitrary native binary.
  * Made peer-dependent deduplication deterministic. When a peer-
    suffixed package variant was a subset of two or more mutually
    incompatible larger variants, the variant it collapsed into
    depended on the order importers were resolved in, which
    varies between machines. This could resolve the same
    workspace to different lockfiles on different platforms and
    make pnpm dedupe --check alternate between passing and failing.
  * Reject invalid package names and versions from staged tarball
    manifests before deriving filenames for pnpm stage download.
  * Clarified in CLI help that the pnpm store is trusted shared
    state and store integrity checks are corruption detection,
    not a tamper boundary for untrusted store writers.
  * Reject reserved manifest bin names ("", ".", "..", and scoped
    forms such as @scope/..) when resolving a package's bins.
    These names previously passed the bin-name guard and, when
    joined to the global bin directory during global remove/update
    /add operations, could resolve to the global bin directory
    itself or its parent and have it recursively deleted.
  * Require trusted package identity before package-name
    allowBuilds entries can approve lifecycle scripts for git, git
  - hosted tarball, direct tarball, and local directory artifacts.
    To approve one of those artifacts explicitly, use its peer-
    suffix-free lockfile depPath as the allowBuilds key. Lockfile
    verification now rejects lockfiles where a registry-style
    dependency path (name@semver) is backed by a git, directory,
    or git-hosted tarball resolution (
    ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path
    is a reliable artifact identity by the time scripts can run.
  * Security: pnpm now verifies the OpenPGP signature of a
    downloaded Node.js runtime's SHASUMS256.txt before trusting
    its integrity hashes.</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1781265600">- Update to 11.6.0:
  * pnpm install completes without re-resolving when pnpm-lock.
    yaml was deleted but node_modules is intact: the up-to-date
    check now treats the current lockfile (node_modules/.pnpm/lock.
    yaml) — the record of what the previous install materialized —
    as the wanted lockfile, verifies the manifests still match it,
    restores pnpm-lock.yaml from it, and reports "Already up to date".
    Previously this scenario triggered a full resolution and a re-
    verification of every locked package against the registry.
  * 615c669: Added support for configuring URL-scoped registry
    settings through npm_config_//… and pnpm_config_//…
    environment variables, for example:
  * Improved the warning printed when a project .npmrc uses an
    environment variable in a registry/proxy URL or in registry
    credentials. The message now explains why the setting was
    ignored and how to migrate it to a trusted source — for example
    by moving the line to the user-level ~/.npmrc or running pnpm
    config set "&lt;key&gt;" &lt;value&gt; — with a link to https://pnpm.io/npmrc.
    The pnpm config set example is only suggested when the key has
    no ${...} placeholder, so the snippet is always safe to copy-paste.
  * Print a "Lockfile passes supply-chain policies (verified 2h
    ago)" message when lockfile verification is skipped because a
    cached verdict for the same lockfile content and policy is reused.
    Previously the cached short-circuit was completely silent,
    which made it look like the policy gate never ran #12324.
  * Platform-specific optional dependencies are now skipped even
    when their os/cpu/libc fields are missing from the registry
    metadata or the lockfile. Some registries strip these fields
    from the package metadata, which made pnpm download and install
    the binaries of every platform regardless of
    supportedArchitectures. The missing platform fields of an
    optional dependency are now inferred from its name (e.g. @nx/nx-
    win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform
    binaries are skipped without even downloading them #11702.</changelog>
</package>
<package pkgid="fad61d1d3a9e62b3ee1ab8f5ff48e80eaae1678138dc4edc242aa99a815801dcc2d7ff6b471e683dd914be15b755f232c1a14cbbd2703624673783207ea0460c" name="pnpm-fish-completion" arch="noarch">
  <version epoch="0" ver="11.6.0" rel="11.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- update to 10.17:
  * Minor Changes
  - The minimumReleaseAgeExclude setting now supports patterns.
    For instance:
    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
  - "@eslint/*"
  * Patch Changes
  - Don't ignore the minimumReleaseAge check, when the package is
    requested by exact version and the packument is loaded from
    cache #9978.
  - When minimumReleaseAge is set and the active version under a
    dist-tag is not mature enough, do not downgrade to a
    prerelease version in case the original version wasn't a
    prerelease one #9979.
- update to 10.16.1:
  * Patch Changes
  - The full metadata cache should be stored not at the same
    location as the abbreviated metadata. This fixes a bug where
    pnpm was loading the abbreviated metadata from cache and
    couldn't find the "time" field as a result #9963.
  - Forcibly disable ANSI color codes when generating patch diff
    [#9914].
- update to 10.16:
  * Minor Changes
  - There have been several incidents recently where popular
    packages were successfully attacked. To reduce the risk of
    installing a compromised version, we are introducing a new
    setting that delays the installation of newly released
    dependencies. In most cases, such attacks are discovered
    quickly and the malicious versions are removed from the
    registry within an hour.
  - The new setting is called minimumReleaseAge. It specifies the
    number of minutes that must pass after a version is published
    before pnpm will install it. For example, setting
    minimumReleaseAge: 1440 ensures that only packages released
    at least one day ago can be installed.
  - If you set minimumReleaseAge but need to disable this
    restriction for certain dependencies, you can list them under
    the minimumReleaseAgeExclude setting. For instance, with the
    following configuration pnpm will always install the latest
    version of webpack, regardless of its release time:
    minimumReleaseAgeExclude:
  - webpack
  - Added support for finders #9946.
    In the past, pnpm list and pnpm why could only search for
    dependencies by name (and optionally version). For example:
    pnpm why minimist
    prints the chain of dependencies to any installed instance of
    minimist:
    verdaccio 5.20.1
    ├─┬ handlebars 4.7.7
    │ └── minimist 1.2.8
    └─┬ mv 2.1.1
    └─┬ mkdirp 0.5.6
    └── minimist 1.2.8
    What if we want to search by other properties of a
    dependency, not just its name? For instance, find all
    packages that have react@17 in their peer dependencies?
    This is now possible with "finder functions". Finder
    functions can be declared in .pnpmfile.cjs and invoked with
    the --find-by=&lt;function name&gt; flag when running pnpm list or
    pnpm why.
    Let's say we want to find any dependencies that have React 17
    in peer dependencies. We can add this finder to our
    .pnpmfile.cjs:
    module.exports = {
    finders: {
    react17: (ctx) =&gt; {
    return ctx.readManifest().peerDependencies?.react === "^17.0.0";
    },
    },
    };
    Now we can use this finder function by running:
    pnpm why --find-by=react17
    pnpm will find all dependencies that have this React in peer
    dependencies and print their exact locations in the
    dependency graph.
    @apollo/client 4.0.4
    ├── @graphql-typed-document-node/core 3.2.0
    └── graphql-tag 2.12.6
    It is also possible to print out some additional information
    in the output by returning a string from the finder. For
    example, with the following finder:
    module.exports = {
    finders: {
    react17: (ctx) =&gt; {
    const manifest = ctx.readManifest();
    if (manifest.peerDependencies?.react === "^17.0.0") {
    return `license: ${manifest.license}`;
    }
    return false;
    },
    },
    };
    Every matched package will also print out the license from
    its package.json:
    @apollo/client 4.0.4
    ├── @graphql-typed-document-node/core 3.2.0
    │   license: MIT
    └── graphql-tag 2.12.6
    license: MIT
  * Patch Changes
  - Fix deprecation warning printed when executing pnpm with
    Node.js 24 #9529.
  - Throw an error if nodeVersion is not set to an exact semver
    version #9934.
  - pnpm publish should be able to publish a .tar.gz file #9927.
  - Canceling a running process with Ctrl-C should make pnpm run
    return a non-zero exit code #9626.
- update to 10.15.1:
  * Patch Changes
  - Fix .pnp.cjs crash when importing subpath #9904.
  - When resolving peer dependencies, pnpm looks whether the peer
    dependency is present in the root workspace project's
    dependencies. This change makes it so that the peer
    dependency is correctly resolved even from aliased npm-hosted
    dependencies or other types of dependencies #9913.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758628800">- update to 10.17.1:
  * Patch Changes
  - When a version specifier cannot be resolved because the versions
    don't satisfy the minimumReleaseAge setting, print this
    information out in the error message #9974.
  - Fix state.json creation path when executing pnpm patch in a
    workspace project #9733.
  - When minimumReleaseAge is set and the latest tag is not mature
    enough, prefer a non-deprecated version as the new latest #9987.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761998400">- update to 10.20.0:
  * Minor Changes
  - Support --all option in pnpm --help to list all commands
    [#8628].
  * Patch Changes
  - When the latest version doesn't satisfy the maturity
    requirement configured by minimumReleaseAge, pick the highest
    version that is mature enough, even if it has a different
    major version #10100.
  - create command should not verify patch info.
  - Set managePackageManagerVersions to false, when switching to
    a different version of pnpm CLI, in order to avoid subsequent
    switches #10063.
- update to 10.19.0:
  * Minor Changes
  - You can now allow specific versions of dependencies to run
    postinstall scripts. onlyBuiltDependencies now accepts
    package names with lists of trusted versions. For example:
    Related PR: #10104.
    onlyBuiltDependencies:
  - nx@21.6.4 || 21.6.5
  - esbuild@0.25.1
  - Added support for exact versions in minimumReleaseAgeExclude
    [#9985].
    You can now list one or more specific versions that pnpm
    should allow to install, even if those versions don’t satisfy
    the maturity requirement set by minimumReleaseAge. For
    example:
    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
  - nx@21.6.5
  - webpack@4.47.0 || 5.102.1
- update to 10.18.3:
  * Patch Changes
  - Fix a bug where pnpm would infinitely recurse when using
    verifyDepsBeforeInstall: install and pre/post install scripts
    that called other pnpm scripts #10060.
  - Fixed scoped registry keys (e.g., @scope:registry) being
    parsed as property paths in pnpm config get when
  - -location=project is used #9362.
  - Remove pnpm-specific CLI options before passing to npm
    publish to prevent "Unknown cli config" warnings #9646.
  - Fixed EISDIR error when bin field points to a directory
    [#9441].
  - Preserve version and hasBin for variations packages #10022.
  - Fixed pnpm config set --location=project incorrectly handling
    keys with slashes (auth tokens, registry settings) #9884.
  - When both pnpm-workspace.yaml and .npmrc exist, pnpm config
    set --location=project now writes to pnpm-workspace.yaml
    (matching read priority) #10072.
  - Prevent a table width error in pnpm outdated --long #10040.
  - Sync bin links after injected dependencies are updated by
    build scripts. This ensures that binaries created during
    build processes are properly linked and accessible to
    consuming projects #10057.
- update to 10.18.2:
  * Patch Changes
  - pnpm outdated --long should work #10040.
  - Replace ndjson with split2. Reduce the bundle size of pnpm
    CLI #10054.
  - pnpm dlx should request the full metadata of packages, when
    minimumReleaseAge is set #9963.
  - pnpm version switching should work when the pnpm home
    directory is in a symlinked directory #9715.
  - Fix EPIPE errors when piping output to other commands #10027.
- update to 10.18.1:
  * Patch Changes
  - Don't print a warning, when --lockfile-only is used #8320.
  - pnpm setup creates a command shim to the pnpm executable.
    This is needed to be able to run pnpm self-update on Windows
    [#5700].
  - When using pnpm catalogs and running a normal pnpm install,
    pnpm produced false positive warnings for "skip adding to the
    default catalog because it already exists". This warning now
    only prints when using pnpm add --save-catalog as originally
    intended.
- update to 10.18.0:
  * Minor Changes
  - Added network performance monitoring to pnpm by implementing
    warnings for slow network requests, including both metadata
    fetches and tarball downloads.
    Added configuration options for warning thresholds:
    fetchWarnTimeoutMs and fetchMinSpeedKiBps.
    Warning messages are displayed when requests exceed time
    thresholds or fall below speed minimums
    Related PR: #10025.
  * Patch Changes
  - Retry filesystem operations on EAGAIN errors #9959.
  - Outdated command respects minimumReleaseAge configuration
    [#10030].
  - Correctly apply the cleanupUnusedCatalogs configuration when
    removing dependent packages.
  - Don't fail with a meaningless error when scriptShell is set
    to false #8748.
  - pnpm dlx should not fail when minimumReleaseAge is set
    [#10037].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- update to 10.21.0:
  * Minor Changes
  - Node.js Runtime Installation for Dependencies. Added support
    for automatic Node.js runtime installation for dependencies.
    pnpm will now install the Node.js version required by a
    dependency if that dependency declares a Node.js runtime in
    the "engines" field. For example:
    {
    "engines": {
    "runtime": {
    "name": "node",
    "version": "^24.11.0",
    "onFail": "download"
    }
    }
    }
    If the package with the Node.js runtime dependency is a CLI
    app, pnpm will bind the CLI app to the required Node.js
    version. This ensures that, regardless of the globally
    installed Node.js instance, the CLI will use the compatible
    version of Node.js.
    If the package has a postinstall script, that script will be
    executed using the specified Node.js version.
    Related PR: #10141
  - Added a new setting: trustPolicy.
    When set to no-downgrade, pnpm will fail installation if a
    package’s trust level has decreased compared to previous
    releases — for example, if it was previously published by a
    trusted publisher but now only has provenance or no trust
    evidence.
    This helps prevent installing potentially compromised
    versions of a package.
    Related issue: #8889.
  - Added support for pnpm config get globalconfig to retrieve
    the global config file path #9977.
  * Patch Changes
  - When a user runs pnpm update on a dependency that is not
    directly listed in package.json, none of the direct
    dependencies should be updated #10155.
  - Don't crash when two processes of pnpm are hardlinking the
    contents of a directory to the same destination
    simultaneously #10160.
  - Setting gitBranchLockfile and related settings via
    pnpm-workspace.yaml should work #9651.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467201">- update to 10.22.0:
  * Minor Changes
  - Added support for trustPolicyExclude #10164.
    You can now list one or more specific packages or versions
    that pnpm should allow to install, even if those packages
    don't satisfy the trust policy requirement. For example:
    trustPolicy: no-downgrade
    trustPolicyExclude:
  - chokidar@4.0.3
  - webpack@4.47.0 || 5.102.1
  - Allow to override the engines field on publish by the
    publishConfig.engines field.
  * Patch Changes
  - Don't crash when two processes of pnpm are hardlinking the
    contents of a directory to the same destination
    simultaneously #10179.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763899200">- update to 10.23.0:
  * Minor Changes
  - Added --lockfile-only option to pnpm list #10020.
  * Patch Changes
  - pnpm self-update should download pnpm from the configured npm
    registry #10205.
  - pnpm self-update should always install the non-executable
    pnpm package (pnpm in the registry) and never the @pnpm/exe
    package, when installing v11 or newer. We currently cannot
    ship @pnpm/exe as pkg doesn't work with ESM #10190.
  - Node.js runtime is not added to "dependencies" on pnpm add,
    if there's a engines.runtime setting declared in package.json
    [#10209].
  - The installation should fail if an optional dependency cannot
    be installed due to a trust policy check failure #10208.
  - pnpm list and pnpm why now display npm: protocol for aliased
    packages (e.g., foo npm:is-odd@3.0.1) #8660.
  - Don't add an extra slash to the Node.js mirror URL #10204.
  - pnpm store prune should not fail if the store contains
    Node.js packages #10131.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765627200">- update to 10.24.0:
  * Minor Changes
  - Increased network concurrency on machines with many CPU
    cores. pnpm now automatically selects a network concurrency
    between 16 and 64, based on the number of pnpm workers
    (calculated as workers × 3). This improves performance on
    high-core systems #10068.
  * Patch Changes
  - trustPolicy should ignore the trust evidences of prerelease
    versions, when installing a non-prerelease version.
  - Handle ENOENT errors thrown by fs.linkSync(), which can occur
    in containerized environments (OverlayFS) instead of EXDEV.
    The operation now gracefully falls back to fs.copyFileSync()
    in these cases #10217.
  - Reverted: pnpm self-update should download pnpm from the
    configured npm registry #10205.
  - Packages that don't have a package.json file (like Node.js)
    should not be reimported from the store on every install.
    Another file from the package should be checked in order to
    verify its presence in node_modules.
  - Correctly read auth tokens for URLs that contain underscores
    [#17].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765627201">- update to 10.25.0:
  * Minor Changes
  - Allow loading certificates from cert, ca, and key for
    specific registry URLs. E.g.,
    //registry.example.com/:ca=-----BEGIN CERTIFICATE-----....
    Previously this was only working via certfile, cafile, and
    keyfile.
    These properties are supported in .npmrc, but were ignored by
    pnpm, this will make pnpm read and use them as well.
    Related PR: #10230.
  - Added a new flag called --bare to pnpm init for creating a
    package.json with the bare minimum of required fields #10226.
  * Patch Changes
  - Improved reporting of ignored dependency scripts #10276.
  - pnpm install should build any dependencies that were added to
    onlyBuiltDependencies and were not built yet #10256.
  - pnpm publish -r --force should allow to run publish over
    already existing versions in the registry #10272.
  - Don't fail with a ERR_PNPM_MISSING_TIME error if a package
    that is excluded from trust policy checks is missing the time
    field in the metadata.</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1765800000">- update to 10.26.0
  * Minor Changes
  - Semi-breaking. Block git-hosted dependencies from running
    prepare scripts unless explicitly allowed in onlyBuiltDependencies #10288.
  - Semi-breaking. Compute integrity hash for HTTP tarball
    dependencies when fetching, storing it in the lockfile to
    prevent servers from serving altered content on subsequent installs #10287.
  - Added a new setting blockExoticSubdeps that prevents the
    resolution of exotic protocols in transitive dependencies.
  - Added support for allowBuilds, which is a new field that
    can be used instead of onlyBuiltDependencies and
    ignoredBuiltDependencies. The new allowBuilds field in your
    pnpm-workspace.yaml uses a map of package matchers to
    explicitly allow (true) or disallow (false) script execution.
    This allows for a single, easy-to-manage source of truth for
    your build permissions.
  * Patch Changes
  - Show deprecation in table/list formats when latest version
    is deprecated #8658.
  - Remove the injectWorkspacePackages setting from the
    lockfile on the deploy command #10294.
  - Normalize the tarball URLs before saving them to the
    lockfile. URLs should not contain default ports, like :80 for
    http and :443 for https #10273.
  - When a dependency is installed via a direct URL that
    redirects to another URL and is immutable, the original URL
    is normalized and saved to package.json #10197.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- update to 10.28.0:
  * Minor Changes
  - Add support for a hook called beforePacking that can be used
    to customize the package.json contents at publish time #3816.
  - In some cases, a filtered install (i.e. pnpm install --filter
    ...) was slower than running pnpm install without any filter
    arguments. This performance regression is now fixed. Filtered
    installs should be as fast or faster than a full install
    [#10408].
  * Patch Changes
  - Do not add a symlink to the project into the store's project
    registry if the store is in a subdirectory of the project
    [#10411].
  - It should be possible to declare the requiredScripts setting
    in pnpm-workspace.yaml #10261.
- update to 10.27.0:
  * Minor Changes
  - Adding trustPolicyIgnoreAfter allows you to ignore trust
    policy checks for packages published more than a specified
    time ago#10352.
  - Added project registry for global virtual store prune
    support.
  - Projects using the store are now registered via symlinks in
    {storeDir}/v10/projects/. This enables pnpm store prune to
    track which packages are still in use by active projects and
    safely remove unused packages from the global virtual store.
  - Semi-breaking. Changed the location of unscoped packages in
    the virtual global store. They will now be stored under a
    directory named @ to maintain a uniform 4-level directory
    depth.
  - Added mark-and-sweep garbage collection for global virtual
    store.
  - pnpm store prune now removes unused packages from the global
    virtual store's links/ directory. The algorithm:
  - Scans all registered projects for symlinks pointing to the
    store
  - Walks transitive dependencies to mark reachable packages
  - Removes any package directories not marked as reachable
  - This includes support for workspace monorepos - all
    node_modules directories within a project (including those in
    workspace packages) are scanned.
  * Patch Changes
  - Throw an error if the value of the tokenHelper or
    &lt;url&gt;:tokenHelper setting contains an environment variable.
  - Git dependencies with build scripts should respect the
    dangerouslyAllowAllBuilds settings #10376.
  - Skip the package manager check when running with --global and
    a project packageManager is configured, and warn that the
    check is skipped.
  - pnpm store prune should not fail if the dlx cache directory
    has files, not only directories #10384
  - Fixed a bug (#9759) where pnpm add would incorrectly modify a
    catalog entry in pnpm-workspace.yaml to its exact version.
- update to 10.26.2:
  * Patch Changes
  - Improve error message when a package version exists but does
    not meet the minimumReleaseAge constraint. The error now
    clearly states that the version exists and shows a
    human-readable time since release (e.g., "released 6 hours
    ago") #10307.
  - Fix installation of Git dependencies using annotated tags
    [#10335].
  - Previously, pnpm would store the annotated tag object's SHA
    in the lockfile instead of the actual commit SHA. This caused
    ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out
    commit hash didn't match the stored tag object hash.
  - Binaries of runtime engines (Node.js, Deno, Bun) are written
    to node_modules/.bin before lifecycle scripts (install,
    postinstall, prepare) are executed #10244.
  - Try to avoid making network calls with preferOffline #10334.
- update to 10.26.1:
  * Patch Changes
  - Don't fail on pnpm add, when blockExoticSubdeps is set to
    true #10324.
  - Always resolve git references to full commits and ensure HEAD
    points to the commit after checkout #10310.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- update to 10.28.2:
  * Patch Changes
  - Security fix: prevent path traversal in directories.bin
    field.
  - When pnpm installs a file: or git: dependency, it now
    validates that symlinks point within the package directory.
    Symlinks to paths outside the package root are skipped to
    prevent local data from being leaked into node_modules.
    This fixes a security issue where a malicious package could
    create symlinks to sensitive files (e.g., /etc/passwd,
    ~/.ssh/id_rsa) and have their contents copied when the
    package is installed.
    Note: This only affects file: and git: dependencies. Registry
    packages (npm) have symlinks stripped during publish and are
    not affected.
  - Fixed optional dependencies to request full metadata from the
    registry to get the libc field, which is required for proper
    platform compatibility checks #9950.
- update to 10.28.1:
  * Patch Changes
  - Fixed installation of config dependencies from private
    registries.
    Added support for object type in configDependencies when the
    tarball URL returned from package metadata differs from the
    computed URL #10431.
  - Fix path traversal vulnerability in binary fetcher ZIP
    extraction
  - Validate ZIP entry paths before extraction to prevent
    writing files outside target directory
  - Validate BinaryResolution.prefix (basename) to prevent
    directory escape via crafted prefix
  - Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error
  - Support plain http:// and https:// URLs ending with .git as
    git repository dependencies.
    Previously, URLs like
    https://gitea.example.org/user/repo.git#commit were not
    recognized as git repositories because they lacked the git+
    prefix (e.g., git+https://). This caused issues when
    installing dependencies from self-hosted git servers like
    Gitea or Forgejo that don't provide tarball downloads.
    Changes:
  - The git resolver now runs before the tarball resolver,
    ensuring git URLs are handled by the correct resolver
  - The git resolver now recognizes plain http:// and https://
    URLs ending in .git as git repositories
  - Removed the isRepository check from the tarball resolver
    since it's no longer needed with the new resolver order
    Fixes #10468
  - pnpm run -r and pnpm run --filter now fail with a non-zero
    exit code when no packages have the specified script.
    Previously, this only failed when all packages were selected.
    Use --if-present to suppress this error #6844.
  - Fixed a path traversal vulnerability in tarball extraction on
    Windows. The path normalization was only checking for ./ but
    not .\. Since backslashes are directory separators on
    Windows, malicious packages could use paths like
    foo\..\..\.npmrc to write files outside the package
    directory.
  - When running "pnpm exec" from a subdirectory of a project,
    don't change the current working directory to the root of the
    project #5759.
  - Fixed a path traversal vulnerability in pnpm's bin linking.
    Bin names starting with @ bypassed validation, and after
    scope normalization, path traversal sequences like ../../
    remained intact.
  - Revert Try to avoid making network calls with preferOffline
    [#10334].
  - Fix --save-peer to write valid semver ranges to
    peerDependencies for protocol-based installs (e.g. jsr:) by
    deriving from resolved versions when available and falling
    back to * if none is available #10417.
  - Do not exclude the root workspace project, when it is
    explicitly selected via a filter #10465.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772452800">- update to 10.30.3:
  * Patch Changes
  - Fixed version switching via packageManager field failing when
    pnpm is installed as a standalone executable in environments
    without a system Node.js #10687.
- update to 10.30.2:
  * Patch Changes
  - Fix auto-installed peer dependencies ignoring overrides when
    a stale version exists in the lockfile.
  - Fixed "input line too long" error on Windows when running
    lifecycle scripts with the global virtual store enabled
    [#10673].
  - Update @zkochan/js-yaml to fix moderate vulnerability.
- update to 10.30.1:
  * Patch Changes
  - Use the /-/npm/v1/security/audits/quick endpoint as the
    primary audit endpoint, falling back to
    /-/npm/v1/security/audits when it fails #10649.
- update to 10.30.0:
  * Minor Changes
  - pnpm why now shows a reverse dependency tree. The searched
    package appears at the root with its dependents as branches,
    walking back to workspace roots. This replaces the previous
    forward-tree output which was noisy and hard to read for
    deeply nested dependencies.
  * Patch Changes
  - Revert pnpm why dependency pruning to prefer correctness over
    memory consumption. Reverted PR: #7122.
  - Optimize pnpm why and pnpm list performance in workspaces
    with many importers by sharing the dependency graph and
    materialization cache across all importers instead of
    rebuilding them independently for each one #10596.
- update to 10.29.3:
  * Patch Changes
  - Fixed an out-of-memory error in pnpm list (and pnpm why) on
    large dependency graphs by replacing the recursive tree
    builder with a two-phase approach: a BFS dependency graph
    followed by cached tree materialization. Duplicate subtrees
    are now deduplicated in the output, shown as "deduped (N deps
    hidden)" #10586.
  - Fixed allowBuilds not working when set via .pnpmfile.cjs
    [#10516].
  - When the enableGlobalVirtualStore option is set, the pnpm
    deploy command would incorrectly create symlinks to the
    global virtual store. To keep the deploy directory
    self-contained, pnpm deploy now ignores this setting and
    always creates a localized virtual store within the deploy
    directory.
  - Fixed minimumReleaseAgeExclude not being respected by pnpm
    dlx #10338.
- update to 10.29.2:
  * Patch Changes
  - Reverted a fix shipped in v10.29.1, which caused another
    issue #10571.
  - Reverted fix: Fixed pnpm run -r failing with "No projects
    matched the filters" when an empty pnpm-workspace.yaml exists
    [#10497].
- update to 10.29.1 (10.29.0 was not released):
  * Minor Changes
  - The pnpm dlx / pnpx command now supports the catalog:
    protocol. Example: pnpm dlx shx@catalog:.
  - Support configuring auditLevel in the pnpm-workspace.yaml
    file #10540.
  - Support bare workspace: protocol without version specifier.
    It is now treated as workspace:* and resolves to the concrete
    version during publish #10436.
  * Patch Changes
  - Fixed pnpm list --json returning incorrect paths when using
    global virtual store #10187.
  - Fix pnpm store path and pnpm store status using workspace
    root for path resolution when storeDir is relative #10290.
  - Fixed pnpm run -r failing with "No projects matched the
    filters" when an empty pnpm-workspace.yaml exists #10497.
  - Fixed a bug where catalogMode: strict would write the literal
    string "catalog:" to pnpm-workspace.yaml instead of the
    resolved version specifier when re-adding an existing catalog
    dependency #10176.
  - Fixed the documentation URL shown in pnpm completion --help
    to point to the correct page at https://pnpm.io/completion
    [#10281].
  - Skip local file: protocol dependencies during pnpm fetch.
    This fixes an issue where pnpm fetch would fail in Docker
    builds when local directory dependencies were not available
    [#10460].
  - Fixed pnpm audit --json to respect the --audit-level setting
    for both exit code and output filtering #10540.
  - update tar to version 7.5.7 to fix security issue
  - Updating the version of dependency tar to 7.5.7 because the
    previous one have a security vulnerability reported here:
    CVE-2026-24842
  - Fix pnpm audit --fix replacing reference overrides (e.g.
    $foo) with concrete versions #10325.
  - Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not
    being converted to publicHoistPattern #10271.
  - pnpm help should correctly report if the currently running
    pnpm CLI is bundled with Node.js #10561.
  - Add a warning when the current directory contains the PATH
    delimiter character. On macOS, folder names containing
    forward slashes (/) appear as colons (:) at the Unix layer.
    Since colons are PATH separators in POSIX systems, this
    breaks PATH injection for node_modules/.bin, causing binaries
    to not be found when running commands like pnpm exec #10457.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773576000">- update to 10.32.1:
  * Patch Changes
  - Fix a regression where pnpm-workspace.yaml without a packages
    field caused all directories to be treated as workspace
    projects. This broke projects that use pnpm-workspace.yaml
    only for settings (e.g. minimumReleaseAge) without defining
    workspace packages #10909.
- update to 10.32.0:
  * Minor Changes
  - Added --all flag to pnpm approve-builds that approves all
    pending builds without interactive prompts #10136.
  * Patch Changes
  - Reverted change related to setting explicitly the npm config
    file path, which caused regressions.
  - Reverted fix related to lockfile-include-tarball-url. Fixes
    [#10915].
- update to 10.31.0:
  * Minor Changes
  - When pnpm updates the pnpm-workspace.yaml, comments, string
    formatting, and whitespace will be preserved.
  * Patch Changes
  - Added -F as a short alias for the --filter option in the help
    output.
  - Handle undefined pkgSnapshot in pnpm why -r #10700.
  - Fix headless install not being used when a project has an
    injected self-referencing file: dependency that resolves to
    link: in the lockfile.
  - Fixed a race condition when multiple worker threads import
    the same package to the global virtual store concurrently.
    The rename operation now tolerates ENOTEMPTY/EEXIST errors if
    another thread already completed the import.
  - When lockfile-include-tarball-url is set to false, tarball
    URLs are now always excluded from the lockfile. Previously,
    tarball URLs could still appear for packages hosted under
    non-standard URLs, making the behavior flaky and inconsistent
    [#6667].
  - Fixed optimisticRepeatInstall skipping install when
    overrides, packageExtensions, ignoredOptionalDependencies,
    patchedDependencies, or peersSuffixMaxLength changed.
  - Fixed pnpm patch-commit failing with "unable to access
    '/.config/git/attributes': Permission denied" error in
    environments where HOME is unset or non-standard (Docker
    containers, CI systems).
  - The issue occurred because pnpm was setting HOME and the
    Windows user profile env var to empty strings to suppress
    user git configuration when running git diff. This caused git
    to resolve the home directory (~) as root (/), leading to
    permission errors when attempting to access
    /.config/git/attributes.
  - Now uses GIT_CONFIG_GLOBAL: os.devNull instead, which is
    git's proper mechanism for bypassing user-level configuration
    without corrupting the home directory path resolution.
  - Fixes #6537
  - Fix pnpm why -r --parseable missing dependents when multiple
    workspace packages share the same dependency #8100.
  - Fix link-workspace-packages=true incorrectly linking
    workspace packages when the requested version doesn't match
    the workspace package's version. Previously, on fresh
    installs the version constraint is overridden to * in the
    fallback resolution paths, causing any workspace package with
    a matching name to be linked regardless of version #10173.
  - Fixed pnpm update --interactive table breaking with long
    version strings (e.g., prerelease versions like
    7.0.0-dev.20251209.1) by dynamically calculating column
    widths instead of using hardcoded values #10316.
  - Explicitly tell npm the path to the global rc config file.
  - The parameter set by the --allow-build flag is written to
    allowBuilds.
  - Fix a bug in which specifying filter on pnpm-workspace.yaml
    would cause pnpm to not detect any projects.
  - Print help message on running pnpm dlx without arguments and
    exit.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774785600">- update to 10.33:
  * Minor Changes
  - Added a new dedupePeers setting that reduces peer dependency
    duplication. When enabled, peer dependency suffixes use
    version-only identifiers (name@version) instead of full dep
    paths, eliminating nested suffixes like
    (foo@1.0.0(bar@2.0.0)). This dramatically reduces the number
    of package instances in projects with many recursive peer
    dependencies #11070.
  * Patch Changes
  - Fail on incompatible lockfiles in CI when frozen lockfile
    mode is enabled, while preserving non-frozen CI fallback
    behavior.
  - When package metadata is malformed or can't be fetched, the
    error thrown will now show the originating error.
  - Fixed intermittent failures when multiple pnpm dlx calls run
    concurrently for the same package. When the global virtual
    store is enabled, the importer now verifies file content
    before skipping a rename, avoiding destructive swap-renames
    that break concurrent processes. Also tolerates EPERM during
    bin creation on Windows and properly propagates
    enableGlobalVirtualStore through the install pipeline.
  - Fixed handling of non-string version selectors in hoistPeers,
    preventing invalid peer dependency specifiers.
  - Improve the non-interactive modules purge error hint to
    include the confirmModulesPurge=false workaround.
  - When pnpm needs to recreate node_modules but no TTY is
    available, the error now suggests either setting CI=true or
    disabling the purge confirmation prompt via
    confirmModulesPurge=false.
  - Adds a regression test for the non-TTY flow.
  - Fixed false "Command not found" errors on Windows when a
    command exists in PATH but exits with a non-zero code. Also
    fixed path resolution for --filter contexts where the command
    runs in a different package directory.
  - When a pnpm-lock.yaml contains two documents, ignore the
    first one. pnpm v11 will write two lockfile documents into
    pnpm-lock.yaml in order to store pnpm version integrities and
    config dependency resolutions.
  - Fixed a bug preventing the clearCache function returned by
    createNpmResolver from properly clearing metadata cache.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777204800">- update to 10.33.2:
  * Patch Changes
  - Globally-installed bins no longer fail with
    ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND when pnpm was installed
    via the standalone @pnpm/exe binary (e.g. curl -fsSL
    https://get.pnpm.io/install.sh | sh -) on a system without a
    separate Node.js installation. Previously, when which('node')
    failed during pnpm add --global, pnpm fell back to
    process.execPath, which in @pnpm/exe is the pnpm binary
    itself — and that path was baked into the generated bin shim,
    causing the shim to invoke pnpm instead of Node #11291,
    [#4645].
  - Fix an infinite fork-bomb that could happen when pnpm was
    installed with one version (e.g. npm install -g pnpm@A) and
    run inside a project whose package.json selected a different
    pnpm version via the packageManager field (e.g. pnpm@B),
    while a pnpm-workspace.yaml also existed at the project root.
  - The child's environment is now forced to
    manage-package-manager-versions=false (v10) and
    pm-on-fail=ignore (v11+), which disables the
    package-manager-version handling in whichever pnpm runs as
    the child.
  - Fixes #11337.
- update to 10.33.1:
  * Patch Changes
  - When a project's packageManager field selects pnpm v11 or
    newer, commands that v10 would have passed through to npm
    (version, login, logout, publish, unpublish, deprecate,
    dist-tag, docs, ping, search, star, stars, unstar, whoami,
    etc.) are now handed over to the wanted pnpm, which
    implements them natively. Previously they silently shelled
    out to npm — making, for example, pnpm version --help print
    npm's help on a project with packageManager: pnpm@11.0.0-rc.3
    [#11328].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778068800">- update to 10.33.4:
  * Patch Changes
  - Pin the integrity of git-hosted tarballs
    (codeload.github.com, gitlab.com, bitbucket.org) in the
    lockfile so that subsequent installs detect a tampered or
    substituted tarball and refuse to install it. Previously the
    lockfile only stored the tarball URL for git dependencies, so
    a compromised git host or a man-in-the-middle could serve
    arbitrary code on later installs without lockfile changes.
  - A new gitHosted: true field is recorded on git-hosted tarball
    resolutions in the lockfile, letting every reader/writer
    route them by a single typed check instead of
    pattern-matching the tarball URL in each call site. Lockfiles
    written by older pnpm versions are enriched on load (URL
    fallback) so the field can be relied on uniformly across the
    codebase.
  - Fix a regression where pnpm --recursive --filter '!&lt;pkg&gt;'
    run/exec/test/add would include the workspace root in the
    matched projects. The workspace root is now correctly
    excluded by default when only negative --filter arguments are
    provided, matching the documented behavior. To include the
    root, pass --include-workspace-root #11341.
- update to 10.33.3:
  * Patch Changes
  - When self-updating from v10's @pnpm/exe to v11+ on Intel
    macOS (darwin-x64), pnpm self-update now transparently
    switches to the JS-only pnpm package on npm instead of
    installing @pnpm/exe@v11+ (which doesn't ship a working
    binary for Intel Macs because of an upstream Node.js SEA bug
    — see #11423 and nodejs/node#62893). Without this, the
    self-update would silently leave the user with no working
    pnpm binary. The new install requires Node.js to be available
    on PATH; a warning is printed when the swap happens. All
    other host/version combinations are unchanged.
  - pnpm self-update (with no version argument) no longer
    downgrades pnpm when the registry's latest dist-tag points to
    an older release than the currently active version. Run pnpm
    self-update latest to force a downgrade #11418.</changelog>
  <changelog author="Elisei Roca &lt;eroca@suse.com&gt;" date="1779451200">- update to 11.2.2:
  * Find the full changelog and breaking changes at:
    https://github.com/pnpm/pnpm/blob/v11.2.2/pnpm/CHANGELOG.md
  * Automated migration steps:
    https://pnpm.io/migration
  - cd /path/to/your/project
  - pnpx codemod run pnpm-v10-to-v11
  * Non-automated steps you might have to do:
    https://pnpm.io/migration#manual-follow-ups
  * Requires at least Node.js v22.13</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1780660800">- Update to 11.5.2:
  * Find the full changelog and breaking changes at:
    https://github.com/pnpm/pnpm/blob/v11.5.2/pnpm/CHANGELOG.md</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1781179200">- Update to 11.5.3:
  * ⚠️ Security fix — environment variables in a project .npmrc
  * Stopped expanding environment variables in repository-
    controlled registry/proxy request destinations and registry
    credential values from .npmrc, and in workspace registry URLs
    from pnpm-workspace.yaml. Move dynamic registry URL and token
    configuration to trusted user, global, CLI, or environment config.
  * Resolve package-manager bootstrap dependencies with trusted
    user or CLI registry and network config, and reject package-
    manager env-lockfile records that do not use registry package
    paths with integrity-only resolutions before auto-switch execution.
  * Avoid writing packageManagerDependencies to pnpm-lock.yaml
    when package manager policy is set to onFail: ignore or
    pmOnFail: ignore #12228.
  * Avoid running dependency-status auto-install when the
    dependency status is unavailable without a project manifest.
  * Using the $ version reference syntax in overrides (e.g. "react": "$react")
    now prints a deprecation warning. The syntax still works, but
    catalogs are the recommended way to keep an overridden
    version in sync with the rest of the workspace. Reference a
    catalog entry with the catalog: protocol instead.
  * Fixed pnpm config get globalconfig to return the global config
    .yaml path again pnpm/pnpm#11962.
  * Fixed bare --color so it does not consume the following CLI
    flag, allowing command shorthands like --parallel to expand
    correctly and forms like pnpm --color with current &lt;command&gt;
    to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.
  * Fix pnpm install ignoring enableGlobalVirtualStore toggle by
    including it in the workspace state settings check #12142.
  * Security: pnpm now verifies the npm registry signature of a
    package-manager binary before spawning it, so a cloned
    repository cannot make pnpm download and execute an arbitrary native binary.
  * Made peer-dependent deduplication deterministic. When a peer-
    suffixed package variant was a subset of two or more mutually
    incompatible larger variants, the variant it collapsed into
    depended on the order importers were resolved in, which
    varies between machines. This could resolve the same
    workspace to different lockfiles on different platforms and
    make pnpm dedupe --check alternate between passing and failing.
  * Reject invalid package names and versions from staged tarball
    manifests before deriving filenames for pnpm stage download.
  * Clarified in CLI help that the pnpm store is trusted shared
    state and store integrity checks are corruption detection,
    not a tamper boundary for untrusted store writers.
  * Reject reserved manifest bin names ("", ".", "..", and scoped
    forms such as @scope/..) when resolving a package's bins.
    These names previously passed the bin-name guard and, when
    joined to the global bin directory during global remove/update
    /add operations, could resolve to the global bin directory
    itself or its parent and have it recursively deleted.
  * Require trusted package identity before package-name
    allowBuilds entries can approve lifecycle scripts for git, git
  - hosted tarball, direct tarball, and local directory artifacts.
    To approve one of those artifacts explicitly, use its peer-
    suffix-free lockfile depPath as the allowBuilds key. Lockfile
    verification now rejects lockfiles where a registry-style
    dependency path (name@semver) is backed by a git, directory,
    or git-hosted tarball resolution (
    ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path
    is a reliable artifact identity by the time scripts can run.
  * Security: pnpm now verifies the OpenPGP signature of a
    downloaded Node.js runtime's SHASUMS256.txt before trusting
    its integrity hashes.</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1781265600">- Update to 11.6.0:
  * pnpm install completes without re-resolving when pnpm-lock.
    yaml was deleted but node_modules is intact: the up-to-date
    check now treats the current lockfile (node_modules/.pnpm/lock.
    yaml) — the record of what the previous install materialized —
    as the wanted lockfile, verifies the manifests still match it,
    restores pnpm-lock.yaml from it, and reports "Already up to date".
    Previously this scenario triggered a full resolution and a re-
    verification of every locked package against the registry.
  * 615c669: Added support for configuring URL-scoped registry
    settings through npm_config_//… and pnpm_config_//…
    environment variables, for example:
  * Improved the warning printed when a project .npmrc uses an
    environment variable in a registry/proxy URL or in registry
    credentials. The message now explains why the setting was
    ignored and how to migrate it to a trusted source — for example
    by moving the line to the user-level ~/.npmrc or running pnpm
    config set "&lt;key&gt;" &lt;value&gt; — with a link to https://pnpm.io/npmrc.
    The pnpm config set example is only suggested when the key has
    no ${...} placeholder, so the snippet is always safe to copy-paste.
  * Print a "Lockfile passes supply-chain policies (verified 2h
    ago)" message when lockfile verification is skipped because a
    cached verdict for the same lockfile content and policy is reused.
    Previously the cached short-circuit was completely silent,
    which made it look like the policy gate never ran #12324.
  * Platform-specific optional dependencies are now skipped even
    when their os/cpu/libc fields are missing from the registry
    metadata or the lockfile. Some registries strip these fields
    from the package metadata, which made pnpm download and install
    the binaries of every platform regardless of
    supportedArchitectures. The missing platform fields of an
    optional dependency are now inferred from its name (e.g. @nx/nx-
    win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform
    binaries are skipped without even downloading them #11702.</changelog>
</package>
<package pkgid="0a391f15fb1bebcf201c5b99ec853b9383fc171aae8981695367773b2c8cae0108d0c1d684d2f26654632f8258604c26e6ff488498c7b51d8f3801401fdd4908" name="pnpm-zsh-completion" arch="noarch">
  <version epoch="0" ver="11.6.0" rel="11.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- update to 10.17:
  * Minor Changes
  - The minimumReleaseAgeExclude setting now supports patterns.
    For instance:
    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
  - "@eslint/*"
  * Patch Changes
  - Don't ignore the minimumReleaseAge check, when the package is
    requested by exact version and the packument is loaded from
    cache #9978.
  - When minimumReleaseAge is set and the active version under a
    dist-tag is not mature enough, do not downgrade to a
    prerelease version in case the original version wasn't a
    prerelease one #9979.
- update to 10.16.1:
  * Patch Changes
  - The full metadata cache should be stored not at the same
    location as the abbreviated metadata. This fixes a bug where
    pnpm was loading the abbreviated metadata from cache and
    couldn't find the "time" field as a result #9963.
  - Forcibly disable ANSI color codes when generating patch diff
    [#9914].
- update to 10.16:
  * Minor Changes
  - There have been several incidents recently where popular
    packages were successfully attacked. To reduce the risk of
    installing a compromised version, we are introducing a new
    setting that delays the installation of newly released
    dependencies. In most cases, such attacks are discovered
    quickly and the malicious versions are removed from the
    registry within an hour.
  - The new setting is called minimumReleaseAge. It specifies the
    number of minutes that must pass after a version is published
    before pnpm will install it. For example, setting
    minimumReleaseAge: 1440 ensures that only packages released
    at least one day ago can be installed.
  - If you set minimumReleaseAge but need to disable this
    restriction for certain dependencies, you can list them under
    the minimumReleaseAgeExclude setting. For instance, with the
    following configuration pnpm will always install the latest
    version of webpack, regardless of its release time:
    minimumReleaseAgeExclude:
  - webpack
  - Added support for finders #9946.
    In the past, pnpm list and pnpm why could only search for
    dependencies by name (and optionally version). For example:
    pnpm why minimist
    prints the chain of dependencies to any installed instance of
    minimist:
    verdaccio 5.20.1
    ├─┬ handlebars 4.7.7
    │ └── minimist 1.2.8
    └─┬ mv 2.1.1
    └─┬ mkdirp 0.5.6
    └── minimist 1.2.8
    What if we want to search by other properties of a
    dependency, not just its name? For instance, find all
    packages that have react@17 in their peer dependencies?
    This is now possible with "finder functions". Finder
    functions can be declared in .pnpmfile.cjs and invoked with
    the --find-by=&lt;function name&gt; flag when running pnpm list or
    pnpm why.
    Let's say we want to find any dependencies that have React 17
    in peer dependencies. We can add this finder to our
    .pnpmfile.cjs:
    module.exports = {
    finders: {
    react17: (ctx) =&gt; {
    return ctx.readManifest().peerDependencies?.react === "^17.0.0";
    },
    },
    };
    Now we can use this finder function by running:
    pnpm why --find-by=react17
    pnpm will find all dependencies that have this React in peer
    dependencies and print their exact locations in the
    dependency graph.
    @apollo/client 4.0.4
    ├── @graphql-typed-document-node/core 3.2.0
    └── graphql-tag 2.12.6
    It is also possible to print out some additional information
    in the output by returning a string from the finder. For
    example, with the following finder:
    module.exports = {
    finders: {
    react17: (ctx) =&gt; {
    const manifest = ctx.readManifest();
    if (manifest.peerDependencies?.react === "^17.0.0") {
    return `license: ${manifest.license}`;
    }
    return false;
    },
    },
    };
    Every matched package will also print out the license from
    its package.json:
    @apollo/client 4.0.4
    ├── @graphql-typed-document-node/core 3.2.0
    │   license: MIT
    └── graphql-tag 2.12.6
    license: MIT
  * Patch Changes
  - Fix deprecation warning printed when executing pnpm with
    Node.js 24 #9529.
  - Throw an error if nodeVersion is not set to an exact semver
    version #9934.
  - pnpm publish should be able to publish a .tar.gz file #9927.
  - Canceling a running process with Ctrl-C should make pnpm run
    return a non-zero exit code #9626.
- update to 10.15.1:
  * Patch Changes
  - Fix .pnp.cjs crash when importing subpath #9904.
  - When resolving peer dependencies, pnpm looks whether the peer
    dependency is present in the root workspace project's
    dependencies. This change makes it so that the peer
    dependency is correctly resolved even from aliased npm-hosted
    dependencies or other types of dependencies #9913.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758628800">- update to 10.17.1:
  * Patch Changes
  - When a version specifier cannot be resolved because the versions
    don't satisfy the minimumReleaseAge setting, print this
    information out in the error message #9974.
  - Fix state.json creation path when executing pnpm patch in a
    workspace project #9733.
  - When minimumReleaseAge is set and the latest tag is not mature
    enough, prefer a non-deprecated version as the new latest #9987.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761998400">- update to 10.20.0:
  * Minor Changes
  - Support --all option in pnpm --help to list all commands
    [#8628].
  * Patch Changes
  - When the latest version doesn't satisfy the maturity
    requirement configured by minimumReleaseAge, pick the highest
    version that is mature enough, even if it has a different
    major version #10100.
  - create command should not verify patch info.
  - Set managePackageManagerVersions to false, when switching to
    a different version of pnpm CLI, in order to avoid subsequent
    switches #10063.
- update to 10.19.0:
  * Minor Changes
  - You can now allow specific versions of dependencies to run
    postinstall scripts. onlyBuiltDependencies now accepts
    package names with lists of trusted versions. For example:
    Related PR: #10104.
    onlyBuiltDependencies:
  - nx@21.6.4 || 21.6.5
  - esbuild@0.25.1
  - Added support for exact versions in minimumReleaseAgeExclude
    [#9985].
    You can now list one or more specific versions that pnpm
    should allow to install, even if those versions don’t satisfy
    the maturity requirement set by minimumReleaseAge. For
    example:
    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
  - nx@21.6.5
  - webpack@4.47.0 || 5.102.1
- update to 10.18.3:
  * Patch Changes
  - Fix a bug where pnpm would infinitely recurse when using
    verifyDepsBeforeInstall: install and pre/post install scripts
    that called other pnpm scripts #10060.
  - Fixed scoped registry keys (e.g., @scope:registry) being
    parsed as property paths in pnpm config get when
  - -location=project is used #9362.
  - Remove pnpm-specific CLI options before passing to npm
    publish to prevent "Unknown cli config" warnings #9646.
  - Fixed EISDIR error when bin field points to a directory
    [#9441].
  - Preserve version and hasBin for variations packages #10022.
  - Fixed pnpm config set --location=project incorrectly handling
    keys with slashes (auth tokens, registry settings) #9884.
  - When both pnpm-workspace.yaml and .npmrc exist, pnpm config
    set --location=project now writes to pnpm-workspace.yaml
    (matching read priority) #10072.
  - Prevent a table width error in pnpm outdated --long #10040.
  - Sync bin links after injected dependencies are updated by
    build scripts. This ensures that binaries created during
    build processes are properly linked and accessible to
    consuming projects #10057.
- update to 10.18.2:
  * Patch Changes
  - pnpm outdated --long should work #10040.
  - Replace ndjson with split2. Reduce the bundle size of pnpm
    CLI #10054.
  - pnpm dlx should request the full metadata of packages, when
    minimumReleaseAge is set #9963.
  - pnpm version switching should work when the pnpm home
    directory is in a symlinked directory #9715.
  - Fix EPIPE errors when piping output to other commands #10027.
- update to 10.18.1:
  * Patch Changes
  - Don't print a warning, when --lockfile-only is used #8320.
  - pnpm setup creates a command shim to the pnpm executable.
    This is needed to be able to run pnpm self-update on Windows
    [#5700].
  - When using pnpm catalogs and running a normal pnpm install,
    pnpm produced false positive warnings for "skip adding to the
    default catalog because it already exists". This warning now
    only prints when using pnpm add --save-catalog as originally
    intended.
- update to 10.18.0:
  * Minor Changes
  - Added network performance monitoring to pnpm by implementing
    warnings for slow network requests, including both metadata
    fetches and tarball downloads.
    Added configuration options for warning thresholds:
    fetchWarnTimeoutMs and fetchMinSpeedKiBps.
    Warning messages are displayed when requests exceed time
    thresholds or fall below speed minimums
    Related PR: #10025.
  * Patch Changes
  - Retry filesystem operations on EAGAIN errors #9959.
  - Outdated command respects minimumReleaseAge configuration
    [#10030].
  - Correctly apply the cleanupUnusedCatalogs configuration when
    removing dependent packages.
  - Don't fail with a meaningless error when scriptShell is set
    to false #8748.
  - pnpm dlx should not fail when minimumReleaseAge is set
    [#10037].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- update to 10.21.0:
  * Minor Changes
  - Node.js Runtime Installation for Dependencies. Added support
    for automatic Node.js runtime installation for dependencies.
    pnpm will now install the Node.js version required by a
    dependency if that dependency declares a Node.js runtime in
    the "engines" field. For example:
    {
    "engines": {
    "runtime": {
    "name": "node",
    "version": "^24.11.0",
    "onFail": "download"
    }
    }
    }
    If the package with the Node.js runtime dependency is a CLI
    app, pnpm will bind the CLI app to the required Node.js
    version. This ensures that, regardless of the globally
    installed Node.js instance, the CLI will use the compatible
    version of Node.js.
    If the package has a postinstall script, that script will be
    executed using the specified Node.js version.
    Related PR: #10141
  - Added a new setting: trustPolicy.
    When set to no-downgrade, pnpm will fail installation if a
    package’s trust level has decreased compared to previous
    releases — for example, if it was previously published by a
    trusted publisher but now only has provenance or no trust
    evidence.
    This helps prevent installing potentially compromised
    versions of a package.
    Related issue: #8889.
  - Added support for pnpm config get globalconfig to retrieve
    the global config file path #9977.
  * Patch Changes
  - When a user runs pnpm update on a dependency that is not
    directly listed in package.json, none of the direct
    dependencies should be updated #10155.
  - Don't crash when two processes of pnpm are hardlinking the
    contents of a directory to the same destination
    simultaneously #10160.
  - Setting gitBranchLockfile and related settings via
    pnpm-workspace.yaml should work #9651.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467201">- update to 10.22.0:
  * Minor Changes
  - Added support for trustPolicyExclude #10164.
    You can now list one or more specific packages or versions
    that pnpm should allow to install, even if those packages
    don't satisfy the trust policy requirement. For example:
    trustPolicy: no-downgrade
    trustPolicyExclude:
  - chokidar@4.0.3
  - webpack@4.47.0 || 5.102.1
  - Allow to override the engines field on publish by the
    publishConfig.engines field.
  * Patch Changes
  - Don't crash when two processes of pnpm are hardlinking the
    contents of a directory to the same destination
    simultaneously #10179.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763899200">- update to 10.23.0:
  * Minor Changes
  - Added --lockfile-only option to pnpm list #10020.
  * Patch Changes
  - pnpm self-update should download pnpm from the configured npm
    registry #10205.
  - pnpm self-update should always install the non-executable
    pnpm package (pnpm in the registry) and never the @pnpm/exe
    package, when installing v11 or newer. We currently cannot
    ship @pnpm/exe as pkg doesn't work with ESM #10190.
  - Node.js runtime is not added to "dependencies" on pnpm add,
    if there's a engines.runtime setting declared in package.json
    [#10209].
  - The installation should fail if an optional dependency cannot
    be installed due to a trust policy check failure #10208.
  - pnpm list and pnpm why now display npm: protocol for aliased
    packages (e.g., foo npm:is-odd@3.0.1) #8660.
  - Don't add an extra slash to the Node.js mirror URL #10204.
  - pnpm store prune should not fail if the store contains
    Node.js packages #10131.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765627200">- update to 10.24.0:
  * Minor Changes
  - Increased network concurrency on machines with many CPU
    cores. pnpm now automatically selects a network concurrency
    between 16 and 64, based on the number of pnpm workers
    (calculated as workers × 3). This improves performance on
    high-core systems #10068.
  * Patch Changes
  - trustPolicy should ignore the trust evidences of prerelease
    versions, when installing a non-prerelease version.
  - Handle ENOENT errors thrown by fs.linkSync(), which can occur
    in containerized environments (OverlayFS) instead of EXDEV.
    The operation now gracefully falls back to fs.copyFileSync()
    in these cases #10217.
  - Reverted: pnpm self-update should download pnpm from the
    configured npm registry #10205.
  - Packages that don't have a package.json file (like Node.js)
    should not be reimported from the store on every install.
    Another file from the package should be checked in order to
    verify its presence in node_modules.
  - Correctly read auth tokens for URLs that contain underscores
    [#17].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765627201">- update to 10.25.0:
  * Minor Changes
  - Allow loading certificates from cert, ca, and key for
    specific registry URLs. E.g.,
    //registry.example.com/:ca=-----BEGIN CERTIFICATE-----....
    Previously this was only working via certfile, cafile, and
    keyfile.
    These properties are supported in .npmrc, but were ignored by
    pnpm, this will make pnpm read and use them as well.
    Related PR: #10230.
  - Added a new flag called --bare to pnpm init for creating a
    package.json with the bare minimum of required fields #10226.
  * Patch Changes
  - Improved reporting of ignored dependency scripts #10276.
  - pnpm install should build any dependencies that were added to
    onlyBuiltDependencies and were not built yet #10256.
  - pnpm publish -r --force should allow to run publish over
    already existing versions in the registry #10272.
  - Don't fail with a ERR_PNPM_MISSING_TIME error if a package
    that is excluded from trust policy checks is missing the time
    field in the metadata.</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1765800000">- update to 10.26.0
  * Minor Changes
  - Semi-breaking. Block git-hosted dependencies from running
    prepare scripts unless explicitly allowed in onlyBuiltDependencies #10288.
  - Semi-breaking. Compute integrity hash for HTTP tarball
    dependencies when fetching, storing it in the lockfile to
    prevent servers from serving altered content on subsequent installs #10287.
  - Added a new setting blockExoticSubdeps that prevents the
    resolution of exotic protocols in transitive dependencies.
  - Added support for allowBuilds, which is a new field that
    can be used instead of onlyBuiltDependencies and
    ignoredBuiltDependencies. The new allowBuilds field in your
    pnpm-workspace.yaml uses a map of package matchers to
    explicitly allow (true) or disallow (false) script execution.
    This allows for a single, easy-to-manage source of truth for
    your build permissions.
  * Patch Changes
  - Show deprecation in table/list formats when latest version
    is deprecated #8658.
  - Remove the injectWorkspacePackages setting from the
    lockfile on the deploy command #10294.
  - Normalize the tarball URLs before saving them to the
    lockfile. URLs should not contain default ports, like :80 for
    http and :443 for https #10273.
  - When a dependency is installed via a direct URL that
    redirects to another URL and is immutable, the original URL
    is normalized and saved to package.json #10197.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- update to 10.28.0:
  * Minor Changes
  - Add support for a hook called beforePacking that can be used
    to customize the package.json contents at publish time #3816.
  - In some cases, a filtered install (i.e. pnpm install --filter
    ...) was slower than running pnpm install without any filter
    arguments. This performance regression is now fixed. Filtered
    installs should be as fast or faster than a full install
    [#10408].
  * Patch Changes
  - Do not add a symlink to the project into the store's project
    registry if the store is in a subdirectory of the project
    [#10411].
  - It should be possible to declare the requiredScripts setting
    in pnpm-workspace.yaml #10261.
- update to 10.27.0:
  * Minor Changes
  - Adding trustPolicyIgnoreAfter allows you to ignore trust
    policy checks for packages published more than a specified
    time ago#10352.
  - Added project registry for global virtual store prune
    support.
  - Projects using the store are now registered via symlinks in
    {storeDir}/v10/projects/. This enables pnpm store prune to
    track which packages are still in use by active projects and
    safely remove unused packages from the global virtual store.
  - Semi-breaking. Changed the location of unscoped packages in
    the virtual global store. They will now be stored under a
    directory named @ to maintain a uniform 4-level directory
    depth.
  - Added mark-and-sweep garbage collection for global virtual
    store.
  - pnpm store prune now removes unused packages from the global
    virtual store's links/ directory. The algorithm:
  - Scans all registered projects for symlinks pointing to the
    store
  - Walks transitive dependencies to mark reachable packages
  - Removes any package directories not marked as reachable
  - This includes support for workspace monorepos - all
    node_modules directories within a project (including those in
    workspace packages) are scanned.
  * Patch Changes
  - Throw an error if the value of the tokenHelper or
    &lt;url&gt;:tokenHelper setting contains an environment variable.
  - Git dependencies with build scripts should respect the
    dangerouslyAllowAllBuilds settings #10376.
  - Skip the package manager check when running with --global and
    a project packageManager is configured, and warn that the
    check is skipped.
  - pnpm store prune should not fail if the dlx cache directory
    has files, not only directories #10384
  - Fixed a bug (#9759) where pnpm add would incorrectly modify a
    catalog entry in pnpm-workspace.yaml to its exact version.
- update to 10.26.2:
  * Patch Changes
  - Improve error message when a package version exists but does
    not meet the minimumReleaseAge constraint. The error now
    clearly states that the version exists and shows a
    human-readable time since release (e.g., "released 6 hours
    ago") #10307.
  - Fix installation of Git dependencies using annotated tags
    [#10335].
  - Previously, pnpm would store the annotated tag object's SHA
    in the lockfile instead of the actual commit SHA. This caused
    ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out
    commit hash didn't match the stored tag object hash.
  - Binaries of runtime engines (Node.js, Deno, Bun) are written
    to node_modules/.bin before lifecycle scripts (install,
    postinstall, prepare) are executed #10244.
  - Try to avoid making network calls with preferOffline #10334.
- update to 10.26.1:
  * Patch Changes
  - Don't fail on pnpm add, when blockExoticSubdeps is set to
    true #10324.
  - Always resolve git references to full commits and ensure HEAD
    points to the commit after checkout #10310.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- update to 10.28.2:
  * Patch Changes
  - Security fix: prevent path traversal in directories.bin
    field.
  - When pnpm installs a file: or git: dependency, it now
    validates that symlinks point within the package directory.
    Symlinks to paths outside the package root are skipped to
    prevent local data from being leaked into node_modules.
    This fixes a security issue where a malicious package could
    create symlinks to sensitive files (e.g., /etc/passwd,
    ~/.ssh/id_rsa) and have their contents copied when the
    package is installed.
    Note: This only affects file: and git: dependencies. Registry
    packages (npm) have symlinks stripped during publish and are
    not affected.
  - Fixed optional dependencies to request full metadata from the
    registry to get the libc field, which is required for proper
    platform compatibility checks #9950.
- update to 10.28.1:
  * Patch Changes
  - Fixed installation of config dependencies from private
    registries.
    Added support for object type in configDependencies when the
    tarball URL returned from package metadata differs from the
    computed URL #10431.
  - Fix path traversal vulnerability in binary fetcher ZIP
    extraction
  - Validate ZIP entry paths before extraction to prevent
    writing files outside target directory
  - Validate BinaryResolution.prefix (basename) to prevent
    directory escape via crafted prefix
  - Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error
  - Support plain http:// and https:// URLs ending with .git as
    git repository dependencies.
    Previously, URLs like
    https://gitea.example.org/user/repo.git#commit were not
    recognized as git repositories because they lacked the git+
    prefix (e.g., git+https://). This caused issues when
    installing dependencies from self-hosted git servers like
    Gitea or Forgejo that don't provide tarball downloads.
    Changes:
  - The git resolver now runs before the tarball resolver,
    ensuring git URLs are handled by the correct resolver
  - The git resolver now recognizes plain http:// and https://
    URLs ending in .git as git repositories
  - Removed the isRepository check from the tarball resolver
    since it's no longer needed with the new resolver order
    Fixes #10468
  - pnpm run -r and pnpm run --filter now fail with a non-zero
    exit code when no packages have the specified script.
    Previously, this only failed when all packages were selected.
    Use --if-present to suppress this error #6844.
  - Fixed a path traversal vulnerability in tarball extraction on
    Windows. The path normalization was only checking for ./ but
    not .\. Since backslashes are directory separators on
    Windows, malicious packages could use paths like
    foo\..\..\.npmrc to write files outside the package
    directory.
  - When running "pnpm exec" from a subdirectory of a project,
    don't change the current working directory to the root of the
    project #5759.
  - Fixed a path traversal vulnerability in pnpm's bin linking.
    Bin names starting with @ bypassed validation, and after
    scope normalization, path traversal sequences like ../../
    remained intact.
  - Revert Try to avoid making network calls with preferOffline
    [#10334].
  - Fix --save-peer to write valid semver ranges to
    peerDependencies for protocol-based installs (e.g. jsr:) by
    deriving from resolved versions when available and falling
    back to * if none is available #10417.
  - Do not exclude the root workspace project, when it is
    explicitly selected via a filter #10465.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772452800">- update to 10.30.3:
  * Patch Changes
  - Fixed version switching via packageManager field failing when
    pnpm is installed as a standalone executable in environments
    without a system Node.js #10687.
- update to 10.30.2:
  * Patch Changes
  - Fix auto-installed peer dependencies ignoring overrides when
    a stale version exists in the lockfile.
  - Fixed "input line too long" error on Windows when running
    lifecycle scripts with the global virtual store enabled
    [#10673].
  - Update @zkochan/js-yaml to fix moderate vulnerability.
- update to 10.30.1:
  * Patch Changes
  - Use the /-/npm/v1/security/audits/quick endpoint as the
    primary audit endpoint, falling back to
    /-/npm/v1/security/audits when it fails #10649.
- update to 10.30.0:
  * Minor Changes
  - pnpm why now shows a reverse dependency tree. The searched
    package appears at the root with its dependents as branches,
    walking back to workspace roots. This replaces the previous
    forward-tree output which was noisy and hard to read for
    deeply nested dependencies.
  * Patch Changes
  - Revert pnpm why dependency pruning to prefer correctness over
    memory consumption. Reverted PR: #7122.
  - Optimize pnpm why and pnpm list performance in workspaces
    with many importers by sharing the dependency graph and
    materialization cache across all importers instead of
    rebuilding them independently for each one #10596.
- update to 10.29.3:
  * Patch Changes
  - Fixed an out-of-memory error in pnpm list (and pnpm why) on
    large dependency graphs by replacing the recursive tree
    builder with a two-phase approach: a BFS dependency graph
    followed by cached tree materialization. Duplicate subtrees
    are now deduplicated in the output, shown as "deduped (N deps
    hidden)" #10586.
  - Fixed allowBuilds not working when set via .pnpmfile.cjs
    [#10516].
  - When the enableGlobalVirtualStore option is set, the pnpm
    deploy command would incorrectly create symlinks to the
    global virtual store. To keep the deploy directory
    self-contained, pnpm deploy now ignores this setting and
    always creates a localized virtual store within the deploy
    directory.
  - Fixed minimumReleaseAgeExclude not being respected by pnpm
    dlx #10338.
- update to 10.29.2:
  * Patch Changes
  - Reverted a fix shipped in v10.29.1, which caused another
    issue #10571.
  - Reverted fix: Fixed pnpm run -r failing with "No projects
    matched the filters" when an empty pnpm-workspace.yaml exists
    [#10497].
- update to 10.29.1 (10.29.0 was not released):
  * Minor Changes
  - The pnpm dlx / pnpx command now supports the catalog:
    protocol. Example: pnpm dlx shx@catalog:.
  - Support configuring auditLevel in the pnpm-workspace.yaml
    file #10540.
  - Support bare workspace: protocol without version specifier.
    It is now treated as workspace:* and resolves to the concrete
    version during publish #10436.
  * Patch Changes
  - Fixed pnpm list --json returning incorrect paths when using
    global virtual store #10187.
  - Fix pnpm store path and pnpm store status using workspace
    root for path resolution when storeDir is relative #10290.
  - Fixed pnpm run -r failing with "No projects matched the
    filters" when an empty pnpm-workspace.yaml exists #10497.
  - Fixed a bug where catalogMode: strict would write the literal
    string "catalog:" to pnpm-workspace.yaml instead of the
    resolved version specifier when re-adding an existing catalog
    dependency #10176.
  - Fixed the documentation URL shown in pnpm completion --help
    to point to the correct page at https://pnpm.io/completion
    [#10281].
  - Skip local file: protocol dependencies during pnpm fetch.
    This fixes an issue where pnpm fetch would fail in Docker
    builds when local directory dependencies were not available
    [#10460].
  - Fixed pnpm audit --json to respect the --audit-level setting
    for both exit code and output filtering #10540.
  - update tar to version 7.5.7 to fix security issue
  - Updating the version of dependency tar to 7.5.7 because the
    previous one have a security vulnerability reported here:
    CVE-2026-24842
  - Fix pnpm audit --fix replacing reference overrides (e.g.
    $foo) with concrete versions #10325.
  - Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not
    being converted to publicHoistPattern #10271.
  - pnpm help should correctly report if the currently running
    pnpm CLI is bundled with Node.js #10561.
  - Add a warning when the current directory contains the PATH
    delimiter character. On macOS, folder names containing
    forward slashes (/) appear as colons (:) at the Unix layer.
    Since colons are PATH separators in POSIX systems, this
    breaks PATH injection for node_modules/.bin, causing binaries
    to not be found when running commands like pnpm exec #10457.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773576000">- update to 10.32.1:
  * Patch Changes
  - Fix a regression where pnpm-workspace.yaml without a packages
    field caused all directories to be treated as workspace
    projects. This broke projects that use pnpm-workspace.yaml
    only for settings (e.g. minimumReleaseAge) without defining
    workspace packages #10909.
- update to 10.32.0:
  * Minor Changes
  - Added --all flag to pnpm approve-builds that approves all
    pending builds without interactive prompts #10136.
  * Patch Changes
  - Reverted change related to setting explicitly the npm config
    file path, which caused regressions.
  - Reverted fix related to lockfile-include-tarball-url. Fixes
    [#10915].
- update to 10.31.0:
  * Minor Changes
  - When pnpm updates the pnpm-workspace.yaml, comments, string
    formatting, and whitespace will be preserved.
  * Patch Changes
  - Added -F as a short alias for the --filter option in the help
    output.
  - Handle undefined pkgSnapshot in pnpm why -r #10700.
  - Fix headless install not being used when a project has an
    injected self-referencing file: dependency that resolves to
    link: in the lockfile.
  - Fixed a race condition when multiple worker threads import
    the same package to the global virtual store concurrently.
    The rename operation now tolerates ENOTEMPTY/EEXIST errors if
    another thread already completed the import.
  - When lockfile-include-tarball-url is set to false, tarball
    URLs are now always excluded from the lockfile. Previously,
    tarball URLs could still appear for packages hosted under
    non-standard URLs, making the behavior flaky and inconsistent
    [#6667].
  - Fixed optimisticRepeatInstall skipping install when
    overrides, packageExtensions, ignoredOptionalDependencies,
    patchedDependencies, or peersSuffixMaxLength changed.
  - Fixed pnpm patch-commit failing with "unable to access
    '/.config/git/attributes': Permission denied" error in
    environments where HOME is unset or non-standard (Docker
    containers, CI systems).
  - The issue occurred because pnpm was setting HOME and the
    Windows user profile env var to empty strings to suppress
    user git configuration when running git diff. This caused git
    to resolve the home directory (~) as root (/), leading to
    permission errors when attempting to access
    /.config/git/attributes.
  - Now uses GIT_CONFIG_GLOBAL: os.devNull instead, which is
    git's proper mechanism for bypassing user-level configuration
    without corrupting the home directory path resolution.
  - Fixes #6537
  - Fix pnpm why -r --parseable missing dependents when multiple
    workspace packages share the same dependency #8100.
  - Fix link-workspace-packages=true incorrectly linking
    workspace packages when the requested version doesn't match
    the workspace package's version. Previously, on fresh
    installs the version constraint is overridden to * in the
    fallback resolution paths, causing any workspace package with
    a matching name to be linked regardless of version #10173.
  - Fixed pnpm update --interactive table breaking with long
    version strings (e.g., prerelease versions like
    7.0.0-dev.20251209.1) by dynamically calculating column
    widths instead of using hardcoded values #10316.
  - Explicitly tell npm the path to the global rc config file.
  - The parameter set by the --allow-build flag is written to
    allowBuilds.
  - Fix a bug in which specifying filter on pnpm-workspace.yaml
    would cause pnpm to not detect any projects.
  - Print help message on running pnpm dlx without arguments and
    exit.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774785600">- update to 10.33:
  * Minor Changes
  - Added a new dedupePeers setting that reduces peer dependency
    duplication. When enabled, peer dependency suffixes use
    version-only identifiers (name@version) instead of full dep
    paths, eliminating nested suffixes like
    (foo@1.0.0(bar@2.0.0)). This dramatically reduces the number
    of package instances in projects with many recursive peer
    dependencies #11070.
  * Patch Changes
  - Fail on incompatible lockfiles in CI when frozen lockfile
    mode is enabled, while preserving non-frozen CI fallback
    behavior.
  - When package metadata is malformed or can't be fetched, the
    error thrown will now show the originating error.
  - Fixed intermittent failures when multiple pnpm dlx calls run
    concurrently for the same package. When the global virtual
    store is enabled, the importer now verifies file content
    before skipping a rename, avoiding destructive swap-renames
    that break concurrent processes. Also tolerates EPERM during
    bin creation on Windows and properly propagates
    enableGlobalVirtualStore through the install pipeline.
  - Fixed handling of non-string version selectors in hoistPeers,
    preventing invalid peer dependency specifiers.
  - Improve the non-interactive modules purge error hint to
    include the confirmModulesPurge=false workaround.
  - When pnpm needs to recreate node_modules but no TTY is
    available, the error now suggests either setting CI=true or
    disabling the purge confirmation prompt via
    confirmModulesPurge=false.
  - Adds a regression test for the non-TTY flow.
  - Fixed false "Command not found" errors on Windows when a
    command exists in PATH but exits with a non-zero code. Also
    fixed path resolution for --filter contexts where the command
    runs in a different package directory.
  - When a pnpm-lock.yaml contains two documents, ignore the
    first one. pnpm v11 will write two lockfile documents into
    pnpm-lock.yaml in order to store pnpm version integrities and
    config dependency resolutions.
  - Fixed a bug preventing the clearCache function returned by
    createNpmResolver from properly clearing metadata cache.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777204800">- update to 10.33.2:
  * Patch Changes
  - Globally-installed bins no longer fail with
    ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND when pnpm was installed
    via the standalone @pnpm/exe binary (e.g. curl -fsSL
    https://get.pnpm.io/install.sh | sh -) on a system without a
    separate Node.js installation. Previously, when which('node')
    failed during pnpm add --global, pnpm fell back to
    process.execPath, which in @pnpm/exe is the pnpm binary
    itself — and that path was baked into the generated bin shim,
    causing the shim to invoke pnpm instead of Node #11291,
    [#4645].
  - Fix an infinite fork-bomb that could happen when pnpm was
    installed with one version (e.g. npm install -g pnpm@A) and
    run inside a project whose package.json selected a different
    pnpm version via the packageManager field (e.g. pnpm@B),
    while a pnpm-workspace.yaml also existed at the project root.
  - The child's environment is now forced to
    manage-package-manager-versions=false (v10) and
    pm-on-fail=ignore (v11+), which disables the
    package-manager-version handling in whichever pnpm runs as
    the child.
  - Fixes #11337.
- update to 10.33.1:
  * Patch Changes
  - When a project's packageManager field selects pnpm v11 or
    newer, commands that v10 would have passed through to npm
    (version, login, logout, publish, unpublish, deprecate,
    dist-tag, docs, ping, search, star, stars, unstar, whoami,
    etc.) are now handed over to the wanted pnpm, which
    implements them natively. Previously they silently shelled
    out to npm — making, for example, pnpm version --help print
    npm's help on a project with packageManager: pnpm@11.0.0-rc.3
    [#11328].</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778068800">- update to 10.33.4:
  * Patch Changes
  - Pin the integrity of git-hosted tarballs
    (codeload.github.com, gitlab.com, bitbucket.org) in the
    lockfile so that subsequent installs detect a tampered or
    substituted tarball and refuse to install it. Previously the
    lockfile only stored the tarball URL for git dependencies, so
    a compromised git host or a man-in-the-middle could serve
    arbitrary code on later installs without lockfile changes.
  - A new gitHosted: true field is recorded on git-hosted tarball
    resolutions in the lockfile, letting every reader/writer
    route them by a single typed check instead of
    pattern-matching the tarball URL in each call site. Lockfiles
    written by older pnpm versions are enriched on load (URL
    fallback) so the field can be relied on uniformly across the
    codebase.
  - Fix a regression where pnpm --recursive --filter '!&lt;pkg&gt;'
    run/exec/test/add would include the workspace root in the
    matched projects. The workspace root is now correctly
    excluded by default when only negative --filter arguments are
    provided, matching the documented behavior. To include the
    root, pass --include-workspace-root #11341.
- update to 10.33.3:
  * Patch Changes
  - When self-updating from v10's @pnpm/exe to v11+ on Intel
    macOS (darwin-x64), pnpm self-update now transparently
    switches to the JS-only pnpm package on npm instead of
    installing @pnpm/exe@v11+ (which doesn't ship a working
    binary for Intel Macs because of an upstream Node.js SEA bug
    — see #11423 and nodejs/node#62893). Without this, the
    self-update would silently leave the user with no working
    pnpm binary. The new install requires Node.js to be available
    on PATH; a warning is printed when the swap happens. All
    other host/version combinations are unchanged.
  - pnpm self-update (with no version argument) no longer
    downgrades pnpm when the registry's latest dist-tag points to
    an older release than the currently active version. Run pnpm
    self-update latest to force a downgrade #11418.</changelog>
  <changelog author="Elisei Roca &lt;eroca@suse.com&gt;" date="1779451200">- update to 11.2.2:
  * Find the full changelog and breaking changes at:
    https://github.com/pnpm/pnpm/blob/v11.2.2/pnpm/CHANGELOG.md
  * Automated migration steps:
    https://pnpm.io/migration
  - cd /path/to/your/project
  - pnpx codemod run pnpm-v10-to-v11
  * Non-automated steps you might have to do:
    https://pnpm.io/migration#manual-follow-ups
  * Requires at least Node.js v22.13</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1780660800">- Update to 11.5.2:
  * Find the full changelog and breaking changes at:
    https://github.com/pnpm/pnpm/blob/v11.5.2/pnpm/CHANGELOG.md</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1781179200">- Update to 11.5.3:
  * ⚠️ Security fix — environment variables in a project .npmrc
  * Stopped expanding environment variables in repository-
    controlled registry/proxy request destinations and registry
    credential values from .npmrc, and in workspace registry URLs
    from pnpm-workspace.yaml. Move dynamic registry URL and token
    configuration to trusted user, global, CLI, or environment config.
  * Resolve package-manager bootstrap dependencies with trusted
    user or CLI registry and network config, and reject package-
    manager env-lockfile records that do not use registry package
    paths with integrity-only resolutions before auto-switch execution.
  * Avoid writing packageManagerDependencies to pnpm-lock.yaml
    when package manager policy is set to onFail: ignore or
    pmOnFail: ignore #12228.
  * Avoid running dependency-status auto-install when the
    dependency status is unavailable without a project manifest.
  * Using the $ version reference syntax in overrides (e.g. "react": "$react")
    now prints a deprecation warning. The syntax still works, but
    catalogs are the recommended way to keep an overridden
    version in sync with the rest of the workspace. Reference a
    catalog entry with the catalog: protocol instead.
  * Fixed pnpm config get globalconfig to return the global config
    .yaml path again pnpm/pnpm#11962.
  * Fixed bare --color so it does not consume the following CLI
    flag, allowing command shorthands like --parallel to expand
    correctly and forms like pnpm --color with current &lt;command&gt;
    to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.
  * Fix pnpm install ignoring enableGlobalVirtualStore toggle by
    including it in the workspace state settings check #12142.
  * Security: pnpm now verifies the npm registry signature of a
    package-manager binary before spawning it, so a cloned
    repository cannot make pnpm download and execute an arbitrary native binary.
  * Made peer-dependent deduplication deterministic. When a peer-
    suffixed package variant was a subset of two or more mutually
    incompatible larger variants, the variant it collapsed into
    depended on the order importers were resolved in, which
    varies between machines. This could resolve the same
    workspace to different lockfiles on different platforms and
    make pnpm dedupe --check alternate between passing and failing.
  * Reject invalid package names and versions from staged tarball
    manifests before deriving filenames for pnpm stage download.
  * Clarified in CLI help that the pnpm store is trusted shared
    state and store integrity checks are corruption detection,
    not a tamper boundary for untrusted store writers.
  * Reject reserved manifest bin names ("", ".", "..", and scoped
    forms such as @scope/..) when resolving a package's bins.
    These names previously passed the bin-name guard and, when
    joined to the global bin directory during global remove/update
    /add operations, could resolve to the global bin directory
    itself or its parent and have it recursively deleted.
  * Require trusted package identity before package-name
    allowBuilds entries can approve lifecycle scripts for git, git
  - hosted tarball, direct tarball, and local directory artifacts.
    To approve one of those artifacts explicitly, use its peer-
    suffix-free lockfile depPath as the allowBuilds key. Lockfile
    verification now rejects lockfiles where a registry-style
    dependency path (name@semver) is backed by a git, directory,
    or git-hosted tarball resolution (
    ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path
    is a reliable artifact identity by the time scripts can run.
  * Security: pnpm now verifies the OpenPGP signature of a
    downloaded Node.js runtime's SHASUMS256.txt before trusting
    its integrity hashes.</changelog>
  <changelog author="Avindra Goolcharan &lt;avindra@opensuse.org&gt;" date="1781265600">- Update to 11.6.0:
  * pnpm install completes without re-resolving when pnpm-lock.
    yaml was deleted but node_modules is intact: the up-to-date
    check now treats the current lockfile (node_modules/.pnpm/lock.
    yaml) — the record of what the previous install materialized —
    as the wanted lockfile, verifies the manifests still match it,
    restores pnpm-lock.yaml from it, and reports "Already up to date".
    Previously this scenario triggered a full resolution and a re-
    verification of every locked package against the registry.
  * 615c669: Added support for configuring URL-scoped registry
    settings through npm_config_//… and pnpm_config_//…
    environment variables, for example:
  * Improved the warning printed when a project .npmrc uses an
    environment variable in a registry/proxy URL or in registry
    credentials. The message now explains why the setting was
    ignored and how to migrate it to a trusted source — for example
    by moving the line to the user-level ~/.npmrc or running pnpm
    config set "&lt;key&gt;" &lt;value&gt; — with a link to https://pnpm.io/npmrc.
    The pnpm config set example is only suggested when the key has
    no ${...} placeholder, so the snippet is always safe to copy-paste.
  * Print a "Lockfile passes supply-chain policies (verified 2h
    ago)" message when lockfile verification is skipped because a
    cached verdict for the same lockfile content and policy is reused.
    Previously the cached short-circuit was completely silent,
    which made it look like the policy gate never ran #12324.
  * Platform-specific optional dependencies are now skipped even
    when their os/cpu/libc fields are missing from the registry
    metadata or the lockfile. Some registries strip these fields
    from the package metadata, which made pnpm download and install
    the binaries of every platform regardless of
    supportedArchitectures. The missing platform fields of an
    optional dependency are now inferred from its name (e.g. @nx/nx-
    win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform
    binaries are skipped without even downloading them #11702.</changelog>
</package>
</otherdata>