Part of pnpm/tasks#191. Wrong claims: - npmrc: `ca` defaults to the system trust store (v12) or the Node.js CA set (v11), not "the npm CA certificate". - pnpm-cli: `--config.<key>` does not populate `npm_config_*` for scripts (v11 and v12). - pnpm-vs-npm, package-sources: `file:` directories are copied into the virtual store and installed; only `link:` is a symlink. - pnpmfile: `importPackage` is removed in v12; changing the pnpmfile re-resolves, so the lockfile need not be deleted (v11 and v12). - scripts: list every environment variable a script receives (v11 and v12), and the full set of built-ins a script can shadow. - supply-chain-security: build scripts are blocked by `allowBuilds` and `strictDepBuilds`, and `blockExoticSubdeps` is on by default. - workspaces: pnpm has built-in release management (v11 and v12). Missing: - npmrc: `NODE_EXTRA_CA_CERTS`. - pnpm-cli: `--workspace-packages`, `-y`, and the `NO_COLOR`, `pnpm_config_*`, `PNPM_HOME`, `PNPM_SHIM_BYPASS` variables. - package_json: a `packageManager` section, `@<scope>:registry` in the `publishConfig` list, the built-in injected-deps sync. - pnpmfile: `beforePacking(pkg, dir, context)`, TL;DR rows for `updateConfig`, `preResolution`, `finders`, the `.cjs` fallback. - typescript: `addMissingPeerTypes`; uninstall: cache, state, and config directories; scripts: project lifecycle stages; workspaces: a minimal `packages` example and live sync while a script runs. - sidebar: `only-allow-pnpm`, `production`, and `cli/cache`. Clarity and duplication: - One home for git-dependency preparation (package-managers), Python index rules (registries), finders (finders.md). - motivation, symlinked-node-modules-structure: files are hard-linked or cloned; package directories are real directories; Node resolves symlinks to real paths. - podman copies the lockfile and workspace manifest; webcontainers leads with `pmOnFail: ignore`; task priority applies within a concurrency group; logos get alt text; store-loader spells out CAS. - using-changesets workflow uses the same action versions and Node.js 24 as the CI guide (v11 and v12). Stale history on v12 pages: - Removed "Added in" markers for v11 and older, and rewrote "Since v11..." and pnpm 10/11 narration as current behavior. Review follow-up: the script environment notes say which npm_config_* keys are filtered (auth, scope registry, per-registry) and that pnpm sets npm_config_user_agent and npm_config_node_gyp; a string `bin` sets npm_package_bin; NODE_EXTRA_CA_CERTS adds to whichever CA set applies; the v10 codemod command notes pnpx; motivation notes that pnpm copies files when neither hard links nor clones work; production says `pnpm fetch` reads the lockfile, not the package manifests.
19 KiB
id, title
| id | title |
|---|---|
| workspaces | Workspace |
pnpm has built-in support for monorepositories (AKA multi-package repositories, multi-project repositories, or monolithic repositories). You can create a workspace to unite multiple projects inside a single repository.
A workspace must have a pnpm-workspace.yaml file in its
root.
:::tip
If you are looking into monorepo management, you might also want to look into Bit.
Bit uses pnpm under the hood but automates a lot of the things that are currently done manually in a traditional workspace managed by pnpm/npm/Yarn. There's an article about bit install that talks about it: Painless Monorepo Dependency Management with Bit.
:::
Workspace protocol (workspace:)
If linkWorkspacePackages is set to true, pnpm will link packages from the workspace if the available packages
match the declared ranges. For instance, foo@1.0.0 is linked into bar if
bar has "foo": "^1.0.0" in its dependencies and foo@1.0.0 is in the workspace. However, if bar has
"foo": "2.0.0" in dependencies and foo@2.0.0 is not in the workspace,
foo@2.0.0 will be installed from the registry. This behavior introduces some
uncertainty.
Luckily, pnpm supports the workspace: protocol. When
this protocol is used, pnpm will refuse to resolve to anything other than a
local workspace package. So, if you set "foo": "workspace:2.0.0", this time
installation will fail because "foo@2.0.0" isn't present in the workspace.
This protocol is especially useful when the linkWorkspacePackages option is
set to false. In that case, pnpm will only link packages from the workspace if
the workspace: protocol is used.
Referencing workspace packages through aliases
Let's say you have a package in the workspace named foo. Usually, you would
reference it as "foo": "workspace:*".
If you want to use a different alias, the following syntax will work too:
"bar": "workspace:foo@*".
Before publish, aliases are converted to regular aliased dependencies. The above
example will become: "bar": "npm:foo@1.0.0".
Referencing workspace packages through their relative path
In a workspace with 2 packages:
+ packages
+ foo
+ bar
bar may have foo in its dependencies declared as
"foo": "workspace:../foo". Before publishing, these specs are converted to
regular version specs supported by all package managers.
Publishing workspace packages
When a workspace package is packed into an archive (whether it's through
pnpm pack or one of the publish commands like pnpm publish), we dynamically
replace any workspace: dependency by:
- The corresponding version in the target workspace (if you use
workspace:,workspace:*,workspace:~, orworkspace:^) - The associated semver range (for any other range type)
A bare workspace: without a version range is treated as workspace:*.
So for example, if we have foo, bar, qar, zoo in the workspace and they all are at version 1.5.0, the following:
{
"dependencies": {
"foo": "workspace:*",
"bar": "workspace:~",
"qar": "workspace:^",
"zoo": "workspace:^1.5.0"
}
}
Will be transformed into:
{
"dependencies": {
"foo": "1.5.0",
"bar": "~1.5.0",
"qar": "^1.5.0",
"zoo": "^1.5.0"
}
}
This feature allows you to depend on your local workspace packages while still being able to publish the resulting packages to the remote registry without needing intermediary publish steps - your consumers will be able to use your published workspaces as any other package, still benefitting from the guarantees semver offers.
Release workflow
pnpm versions and releases workspace packages with
pnpm change and pnpm version -r. See
Release management.
These external tools also handle versioning and support pnpm:
For how to set up a repository using Rush, read this page.
For using Changesets with pnpm, read this guide.
Troubleshooting
pnpm cannot guarantee that scripts will be run in topological order if there are cycles between workspace dependencies. If pnpm detects cyclic dependencies during installation, it will produce a warning. If pnpm can find out which dependencies are causing the cycles, it will display them too.
If you see the message There are cyclic workspace dependencies, inspect workspace dependencies declared in dependencies, optionalDependencies and devDependencies.
Workspaces in the wild
Here are a few of the most popular open source projects that use the workspace feature of pnpm:
Configuration
linkWorkspacePackages
- Default: false
- Type: true, false, deep
If this is enabled, locally available packages are linked to node_modules
instead of being downloaded from the registry. This is very convenient in a
monorepo. If you need local packages to also be linked to subdependencies, you
can use the deep setting.
Else, packages are downloaded and installed from the registry. However,
workspace packages can still be linked by using the workspace: range protocol.
Packages are only linked if their versions satisfy the dependency ranges.
injectWorkspacePackages
- Default: false
- Type: Boolean
Enables hard-linking of all local workspace dependencies instead of symlinking them. Alternatively, this can be achieved using dependenciesMeta[].injected, which allows to selectively enable hard-linking for specific dependencies.
:::note
Even if this setting is enabled, pnpm will prefer to deduplicate injected dependencies using symlinks, unless multiple dependency graphs are required due to mismatched peer dependencies. This behaviour is controlled by the dedupeInjectedDeps setting.
:::
dedupeInjectedDeps
- Default: true
- Type: Boolean
When this setting is enabled, dependencies that are injected will be symlinked from the workspace whenever possible. If the dependent project and the injected dependency reference the same peer dependencies, then it is not necessary to physically copy the injected dependency into the dependent's node_modules; a symlink is sufficient.
syncInjectedDepsAfterScripts
Added in: v10.5.0
- Default: undefined
- Type: String[]
Injected workspace dependencies are collections of hardlinks, which don't add or remove the files when their sources change. This causes problems in packages that need to be built (such as in TypeScript projects).
This setting is a list of script names. When any of these scripts are executed in a workspace package, the injected dependencies inside node_modules will also be synchronized.
preferWorkspacePackages
- Default: false
- Type: Boolean
If this is enabled, local packages from the workspace are preferred over packages from the registry, even if there is a newer version of the package in the registry.
This setting is only useful if the workspace doesn't use
saveWorkspaceProtocol.
sharedWorkspaceLockfile
- Default: true
- Type: Boolean
If this is enabled, pnpm creates a single pnpm-lock.yaml file in the root of
the workspace. This also means that all dependencies of workspace packages will
be in a single node_modules (and get symlinked to their package node_modules
folder for Node's module resolution).
Advantages of this option:
- every dependency is a singleton
- faster installations in a monorepo
- fewer changes in code reviews as they are all in one file
:::note
Even though all the dependencies will be hard linked into the root
node_modules, packages will have access only to those dependencies
that are declared in their package.json, so pnpm's strictness is preserved.
This is a result of the aforementioned symbolic linking.
:::
saveWorkspaceProtocol
- Default: rolling
- Type: true, false, rolling
This setting controls how dependencies that are linked from the workspace are added to package.json.
If foo@1.0.0 is in the workspace and you run pnpm add foo in another project of the workspace, below is how foo will be added to the dependencies field. The savePrefix setting also influences how the spec is created.
| saveWorkspaceProtocol | savePrefix | spec |
|---|---|---|
| false | '' |
1.0.0 |
| false | '~' |
~1.0.0 |
| false | '^' |
^1.0.0 |
| true | '' |
workspace:1.0.0 |
| true | '~' |
workspace:~1.0.0 |
| true | '^' |
workspace:^1.0.0 |
| rolling | '' |
workspace:* |
| rolling | '~' |
workspace:~ |
| rolling | '^' |
workspace:^ |
includeWorkspaceRoot
- Default: false
- Type: Boolean
When executing commands recursively in a workspace, execute them on the root workspace project as well.
ignoreWorkspaceCycles
- Default: false
- Type: Boolean
When set to true, no workspace dependency cycle warnings will be printed.
It also downgrades an ERR_PNPM_TASK_CYCLE from a recursive run to a warning.
The tasks in that cycle then have no guaranteed order relative to each other.
See Workspace task orchestration.
disallowWorkspaceCycles
- Default: false
- Type: Boolean
When set to true, installation will fail if the workspace has cycles.
workspaceConcurrency
- Default: the smaller of 4 and the number of available CPU cores
- Type: Number
Controls how many workspace tasks run at once. See
--workspace-concurrency for details.
ignoreWorkspaceRootCheck
- Default: false
- Type: Boolean
Allow adding dependencies to the workspace root without passing
--ignore-workspace-root-check or -w.
ignoreWorkspaceRootCheck: true
failIfNoMatch
- Default: false
- Type: Boolean
When set to true, the CLI will exit with a non-zero code if no packages match the provided filters.
For example, the following command will exit with a non-zero code because bad-pkg-name is not present in the workspace:
pnpm --filter=bad-pkg-name test