Khải cc7c0d22df refactor!: replace npm publish with libnpmpublish (#10591) ...

* chore(deps): add `libnpmpublish` to catalog

* chore(deps): install `libnpmpublish`

* feat: publishableManifest (wip)

* feat: publishableManifest (wip)

* chore(cspell): libnpmpublish

* test: fix

* feat: validate field and version

* chore: @npm/types

* chore: todo

* refactor: reorganize

* feat: transformRequiredFields

* chore(deps): patch `libnpmpublish`

* fix: `BaseManifest.config`

* fix: eslint

* chore(git): revert a patch that doesn't work

This reverts commit 45f2c6a6c2.

We will use type casting

* feat: `engines.runtime`

* feat: normalize bin

* fix: `bin === ''`

* test: fix

* refactor: inference friendly

* feat: `peerDependenciesMeta`

* refactor: group into a directory

* refactor: use `ramda.pipe`

* refactor: less intrusive type assertion

* feat!: returning `ExportedManifest`

* refactor: remove unnecessary file

* docs: add a todo

* refactor: getNetworkConfigs (#10458)

Some tests are added as a bonus

* feat: `publishPackedPkg` (wip)

* feat: replace `\t` with 4 spaces

* fix: newline

* fix: newline

* refactor: extract `FailedToPublishError`

* test: FailedToPublishError

* feat: registryConfigKeys

* feat: `publishPackedPkg` (wip)

* feat(config/getNetworkConfigs): load auth info

* feat(config/getNetworkConfigs): load auth info (#10491)

* feat: `publishPackedPkg` (wip)

* refactor: extract a `static` function

* fix: inheritance, override, and merge

* feat: `executeTokenHelper`

* fix: use the visible `globalWarn`

* feat: add options

* feat: add more options

* docs: more links

* fix: private packages

* fix: --dry-run

* feat: log more things

* fix: name

* fix: tag

* refactor: remove extraneous `assertPublicPackage`

* feat: use `publishPackedPkg` for directories

* refactor: require only necessary fields

* refactor: extractManifestFromPacked

* fix: extractManifestFromPacked

* test: extractManifestFromPacked

* feat: isTarballPath

* feat: use `publishPackedPkg` for tarballs

* style: add an empty line for clarity

* refactor: remove unnecessary works

* feat: --otp

* feat: PNPM_CONFIG_OTP

* feat: oidc

* test: fix name collision

* fix: eslint

* test: disable a false test

* feat: set `provenance`

* docs(todo): auto provenance

* refactor: run oidc in `createPublishOptions`

* fix: correct auth keys for `libnpmpublish`

* docs: changeset

* fix: incorrect `password` field

* fix: typo, grammar

* chore(git): resolve merge conflict ahead of time

In preparation for https://github.com/pnpm/pnpm/pull/10385

* fix: field name

* fix(config): decoding `_password`

* fix: edge case of partial `cert`/`key`

* fix: ensure `registry` always match its config key

* fix: `_password`

* test: correct a name

* test: more specific assertions

* fix: grammar

* docs(changeset): fix grammar

* docs: fix grammar

* fix: clean up after failure

* test: fix windows

* feat(provenance): auto detect

* refactor: consistent name

* fix: correct error names

* refactor: extract the `provenance` code

* feat: show code and body of an error

* refactor: use `encodeURIComponent`

* refactor: rename a type

* refactor: use the try-catch model

* refactor: move `normalizeBinObject`

* refactor: split `oidc` into `idToken` and `authToken`

* refactor: run `next` on `stream`'s `'end'`

* fix: use the correct encoding

* feat: guard against weird names

* test: `transform/engines`

Closes https://github.com/pnpm/pnpm/pull/10599

* test: `transformPeerDependenciesMeta`

Closes https://github.com/pnpm/pnpm/pull/10600

* refactor: dependency inject the `Date` too

* refactor: export an interface

* test: oidc

Closes https://github.com/pnpm/pnpm/pull/10598

* refactor: re-arrange imports

* refactor: remove unnecessary type casts

* refactor: improve test

2026-02-12 21:10:54 +01:00

..

afraid-mammals-battle.md

fix: install absolute path pkg failed (#9888)

2025-12-22 14:57:45 +01:00

all-tables-speak.md

feat: allow loading certificates from scoped cert, ca and key (#10230)

2025-11-29 11:37:57 +01:00

angry-streets-bow.md

perf: always link runtimes from the global virtual store directory (#10233)

2025-12-01 14:27:18 +01:00

better-parents-tell.md

feat: support blockExoticSubdeps option to disallow non-trusted dep sources in subdeps (#10265)

2025-12-10 12:14:16 +01:00

big-lies-pump.md

feat: add trustPolicyIgnoreAfter (#10359)

2025-12-28 02:01:09 +01:00

bold-words-give.md

fix: disable global virtual store during pnpm deploy (#10577)

2026-02-11 02:19:43 +01:00

brave-bears-worry.md

feat: enable injected local packages to work with global virtual store (#10366)

2025-12-27 12:21:19 +01:00

brave-ties-move.md

feat(init): --bare (#10228)

2025-11-29 14:55:02 +01:00

breezy-zebras-smile.md

fix(list): correct dependency paths with global virtual store (#10375)

2026-01-27 16:25:58 +01:00

bright-digests-store.md

perf: optimize how the integrities of files in the CAFS are stored (#10504)

2026-01-24 21:41:11 +01:00

bump-store-version.md

feat!: bump store version to v11 (#10506)

2026-01-24 21:36:39 +01:00

chubby-garlics-sort.md

feat: add validation to tokenHelper settings to disallow environment variables

2025-12-30 17:04:05 +01:00

chubby-rockets-see.md

fix(dlx): respect minimumReleaseAgeExclude (#10572)

2026-02-11 02:32:54 +01:00

clear-minimum-release-age-error.md

feat: improve error message for versions not meeting minimumReleaseAge (#10350)

2025-12-22 17:28:52 +01:00

cold-weeks-work.md

feat: create a new field for allowing/disallowing builds (#10311)

2025-12-13 22:14:27 +01:00

config.json

ci: change base branch to v8

2024-01-09 23:43:00 +01:00

correct-tarball-url.md

fix: use tarball URL returned in package metadata (#10431)

2026-01-16 17:31:04 +01:00

crazy-swans-retire.md

feat(cli/config)!: config command outputs changed from INI to JSON with camelCase keys (#10142)

2025-10-30 11:34:48 +01:00

crazy-toes-join.md

fix: prevent circular symlinks in projects registry (#10432)

2026-01-09 18:04:57 +01:00

cruel-colts-smoke.md

feat(config)!: project-specific packageConfigs (#10304)

2025-12-21 12:01:18 +01:00

cruel-seas-leave.md

fix: WMIC is being removed (#10223)

2025-11-27 14:08:12 +01:00

cuddly-rooms-check.md

fix: reference @pnpm/fs.packlist from the workspace (#10477)

2026-01-17 14:35:41 +01:00

curly-dryers-cheese.md

feat: dlx timeout & retry (#10512)

2026-01-27 01:37:26 +01:00

curly-dryers-jam.md

feat: add support for catalogs with dlx (#10434)

2026-01-26 07:06:36 +01:00

curly-rings-live.md

fix: linking commands of engines (#10354)

2025-12-23 12:26:59 +01:00

curvy-baboons-refuse.md

perf: save node_modules/.modules.yaml in JSON format (#10406)

2026-02-06 15:59:22 +01:00

cute-cars-mix.md

fix: handle ENOENT errors in containerized environments by falling back to copy (#10218)

2025-11-22 16:27:15 +01:00

cyan-moons-drive.md

feat!: change the default values of blockExoticSubdeps and strictDepBuilds (#10332)

2025-12-22 14:36:46 +01:00

dark-monkeys-peel.md

fix(plugin-commands-store): support relative storeDir in store commands (#10490)

2026-02-06 16:31:47 +01:00

deploy-preserve-allow-builds.md

feat!: deprecate old settings that were replaced by allowBuilds (#10382)

2026-01-02 12:22:42 +01:00

dirty-cases-scream.md

fix: the add command should not fail, when blockExoticSubdeps is true (#10327)

2025-12-17 11:24:32 +01:00

dirty-foxes-invite.md

fix: self-update should not install @pnpm/exe >= 11 (#10190)

2025-11-14 15:19:36 +01:00

eager-camels-appear.md

feat(cli/config)!: breaking changes (#9854)

2025-10-28 17:09:15 +01:00

early-numbers-look.md

fix: git dependencies respect dangerouslyAllowAllBuilds (#10387)

2025-12-30 19:02:27 +01:00

early-taxis-carry.md

feat(hooks): add beforePacking hook (#10303)

2025-12-21 15:49:47 +01:00

easy-toys-design.md

fix: reporting ignored dependency builds (#10276)

2025-12-06 16:32:19 +01:00

eighty-clowns-shave.md

fix(cli/config): phantom keys (#10323)

2025-12-22 12:26:14 +01:00

empty-paws-march.md

fix(publish): respect --force flag in recursive publish (#10277)

2025-12-08 11:33:30 +01:00

every-impalas-change.md

feat(workspace filtering): add support for filtering packages since last commit under git worktree (#10542)

2026-02-11 02:05:45 +01:00

every-jars-own.md

feat: install js runtime as prod dependency (#10141)

2025-10-31 17:12:50 +01:00

every-trains-shake.md

fix(update): prevent package.json updates when updating indirect dependencies (#5118) (#10155)

2025-11-06 15:13:51 +01:00

evil-boats-do.md

feat!: change the default values of blockExoticSubdeps and strictDepBuilds (#10332)

2025-12-22 14:36:46 +01:00

evil-llamas-show.md

feat: install js runtime as prod dependency (#10141)

2025-10-31 17:12:50 +01:00

fair-nights-grow.md

fix: don't silently skip an optional dependency if it cannot be resolved from a mature version (#10289)

2025-12-08 11:18:24 +01:00

famous-plums-fix.md

fix: linking commands of engines (#10354)

2025-12-23 12:26:59 +01:00

fifty-mangos-arrive.md

fix: allow pnpm run -r to work with empty pnpm-workspace.yaml (#10520)

2026-02-06 17:13:15 +01:00

five-lies-travel.md

feat: use ESM instead of commonjs (#9870)

2025-08-25 10:02:00 +02:00

five-teams-find.md

feat(pack): add support for --dry-run (#10306)

2025-12-12 14:00:54 +01:00

fix-annotated-git-tags.md

fix(git-resolver): installing git-hosted dependency using annotated tags (#10349)

2025-12-22 23:05:40 +01:00

fix-binary-fetcher-path-traversal.md

fix: prevent path traversal vulnerabilities during ZIP extraction

2026-01-16 20:36:40 +01:00

fix-catalog-strict-mode-write.md

fix: prevent catalog: from leaking into pnpm-workspace.yaml (#10476)

2026-01-27 15:52:31 +01:00

fix-completion-help-url.md

fix(completion): correct documentation URL in help output (#10511)

2026-01-26 01:30:08 +01:00

fix-directories-bin-path-traversal.md

fix: prevent path traversal in directories.bin (#10495)

2026-01-21 15:46:41 +01:00

fix-git-url-detection.md

feat: improve git URL detection to recognize plain HTTP/HTTPS URLs

2026-01-16 19:38:02 +01:00

fix-import-race-condition.md

fix: virtual store race condition (#10589)

2026-02-10 12:05:17 +01:00

fix-injected-deps-global-vstore.md

feat: enable injected local packages to work with global virtual store (#10366)

2025-12-27 12:21:19 +01:00

fix-list-oom.md

fix: list command should not fail with an OOM error (#10586)

2026-02-11 00:38:35 +01:00

fix-outdated-deprecation-display.md

fix: show deprecation in outdated table/list formats (#10207)

2025-12-12 17:08:06 +01:00

fix-pnpm-fetch-file-protocol.md

fix: skip local file: protocol dependencies during pnpm fetch (#10514)

2026-02-06 17:28:39 +01:00

fix-recursive-run-no-script.md

fix(run): fail when no packages have script in filtered recursive run (#10437)

2026-01-16 01:49:24 +01:00

fix-symlink-path-traversal.md

fix: skip symlinks pointing outside package root in git and file deps (#10493)

2026-01-21 15:45:56 +01:00

fix-windows-tarball-path-traversal.md

fix: normalize Windows backslash path traversal attempts in tarball entry filenames

2026-01-15 17:10:17 +01:00

flat-clowns-type.md

fix: don't silently skip an optional dependency if it cannot be resolved from a mature version (#10289)

2025-12-08 11:18:24 +01:00

floppy-socks-rest.md

fix(audit): respect --audit-level in JSON output (#10547)

2026-02-06 18:53:10 +01:00

fluffy-bugs-knock.md

revert: fix(reviewing): fix memory error in pnpm why (#10582)

2026-02-09 15:05:09 +01:00

fruity-lands-laugh.md

fix: concurrently hard linking a directory (#10181)

2025-11-12 14:07:18 +01:00

funny-melons-pay.md

fix: installation failed due to installation link redirection (v11) (#10286)

2025-12-12 20:19:36 +01:00

fuzzy-cups-float.md

fix: preserve reference overrides in pnpm audit --fix (#10478)

2026-02-06 14:03:08 +01:00

giant-pots-think.md

feat(config): load env pnpm_config_* (#10029)

2025-10-13 14:38:40 +02:00

global-install-allow-builds.md

feat!: deprecate old settings that were replaced by allowBuilds (#10382)

2026-01-02 12:22:42 +01:00

global-option-skip-pm-check.md

feat(cli): skip package manager check when using --global option (#10368)

2025-12-29 02:06:31 +01:00

global-virtual-store-prune.md

feat!: bump store version to v11 (#10506)

2026-01-24 21:36:39 +01:00

gold-clubs-enjoy.md

feat!: remove the server command (#10463)

2026-01-15 11:32:07 +01:00

great-trams-drop.md

feat(config): global yaml (#10145)

2025-11-11 11:24:06 +01:00

happy-paws-walk.md

fix(exec): preserve user execution cwd (#10445)

2026-01-12 15:41:17 +01:00

heavy-dragons-start.md

fix(git-fetcher): ensure the specified commit is used after checkout (#10310)

2025-12-17 03:26:18 +01:00

hip-jars-boil.md

fix: update unscoped package storage location in virtual global store (#10363)

2025-12-25 21:13:41 +01:00

honest-radios-cut.md

feat: support check more invalid workspace file (#10319)

2026-01-27 17:28:14 +01:00

itchy-humans-love.md

feat(cli/config)!: breaking changes (#9854)

2025-10-28 17:09:15 +01:00

itchy-teeth-kick.md

fix(deps): update tar version to 7.5.7 to fix security vulnerability (pnpm#10530) (#10539)

2026-02-03 01:47:37 +01:00

kind-boxes-shake.md

fix: prevent path traversal by validating bin names

2026-01-15 17:07:09 +01:00

kind-moments-do.md

feat: create new @pnpm/yaml.document-sync package (#10405)

2026-01-05 12:14:56 +01:00

large-suits-scream.md

fix: node runtime is not moved to dependencies on pnpm add (#10210)

2025-11-20 02:35:46 +01:00

lazy-eggs-jam.md

fix: linking commands of engines (#10354)

2025-12-23 12:26:59 +01:00

light-carrots-fetch.md

fix(git-fetcher): block git dependencies from running prepare scripts unless allowed (#10288)

2025-12-09 18:25:07 +01:00

long-radios-cross.md

fix: linking commands of engines (#10354)

2025-12-23 12:26:59 +01:00

loud-tables-teach.md

feat: added engines.runtime to pnpm CLI

2025-11-10 01:24:00 +01:00

lucky-bikes-nail.md

feat: support auditLevel (#10554)

2026-02-06 19:54:59 +01:00

many-showers-beg.md

fix: trustPolicy should ignore trust evidences of prerelease versions (#10227)

2025-11-24 14:53:47 +01:00

msgpack-store-format.md

perf: migrate internal cache and index files to MessagePack serialization (#10500)

2026-01-23 01:31:09 +01:00

nine-areas-glow.md

feat: treat bare workspace: protocol as workspace:* (#10436)

2026-01-26 07:06:01 +01:00

nine-pillows-travel.md

Revert "fix: try not to make network requests with prefer offline" (#10423)

2026-01-12 13:39:59 +01:00

ninety-poets-shake.md

feat: improve filtered install performance with an optimistic lookup of package metadata from store (#10408)

2026-01-08 00:36:00 +01:00

odd-keys-judge.md

fix: use esm import for @pnpm/patch-package in @pnpm/apply-patch (#10191)

2025-11-16 23:35:25 +01:00

open-animals-speak.md

fix: don't silently skip an optional dependency if if fails trust policy check (#10211)

2025-11-20 12:51:31 +01:00

open-trams-take.md

feat: add --lockfile-only option to pnpm list (#10066)

2025-11-17 16:57:29 +01:00

open-zoos-sniff.md

fix: don't fail with ERR_PNPM_MISSING_TIME on packages that are excluded from trust checks (#10292)

2025-12-08 15:21:25 +01:00

optional-deps-full-metadata.md

fix(npm-resolver): request full metadata for optional dependencies (#10455)

2026-01-26 01:13:06 +01:00

patch-brace-expansion.md

fix(deps): add override for @isaacs/brace-expansion@5.0.1 (#10545)

2026-02-05 23:00:53 +01:00

pink-dragons-sing.md

fix: preserve reference overrides in pnpm audit --fix (#10478)

2026-02-06 14:03:08 +01:00

pink-parks-begin.md

fix(deploy): omit inject workspace packages setting in deploy lockfiles (#10294)

2025-12-12 14:33:37 +01:00

pink-webs-clap.md

perf: optimize how the integrities of files in the CAFS are stored (#10504)

2026-01-24 21:41:11 +01:00

polite-carpets-relax.md

feat!: drop Node.js 20 and 21 support (#10569)

2026-02-08 19:16:24 +01:00

pretty-readers-know.md

fix: explicitly tell npm the config file path (#10154)

2025-11-05 23:46:20 +01:00

prune-global-virtual-store.md

feat: enhance store prune to clean global virtual store (#10360)

2025-12-26 01:35:35 +01:00

public-buckets-worry.md

refactor!: replace npm publish with libnpmpublish (#10591)

2026-02-12 21:10:54 +01:00

public-feet-hide.md

fix: improve the error messages related to trustPolicy mismatch (#10203)

2025-11-22 02:35:19 +01:00

puny-cycles-care.md

feat: install js runtime as prod dependency (#10141)

2025-10-31 17:12:50 +01:00

quick-rice-hang.md

feat: add support for pnpm config get globalconfig (#10090)

2025-11-08 14:14:36 +01:00

ready-cobras-jump.md

feat(cli/config)!: breaking changes (#9854)

2025-10-28 17:09:15 +01:00

real-papers-cut.md

feat: loading ESM pnpmfiles (#9730)

2025-10-10 09:50:21 +02:00

red-months-bathe.md

fix: setting requiredScripts in pnpm-workspace.yaml (#10404)

2026-01-04 16:43:08 +01:00

red-shirts-take.md

fix(worker): inconsistent store structure due to race condition (#10536)

2026-01-31 01:49:35 +01:00

refactor-fullmetadata-options.md

fix(npm-resolver): request full metadata for optional dependencies (#10455)

2026-01-26 01:13:06 +01:00

remove-deprecated-build-settings0.md

feat!: deprecate old settings that were replaced by allowBuilds (#10382)

2026-01-02 12:22:42 +01:00

remove-deprecated-build-settings.md

feat!: deprecate old settings that were replaced by allowBuilds (#10382)

2026-01-02 12:22:42 +01:00

remove-deprecated-patch-options.md

feat!: remove deprecated patch options (#10505)

2026-01-27 17:08:45 +01:00

salty-beds-sell.md

fix: throw a frozen lockfile error when catalogs change (#10231)

2025-11-26 01:09:37 +01:00

seven-turtles-attack.md

chore: enable TypeScript's erasableSyntaxOnly config (#10365)

2025-12-27 11:23:49 +01:00

shaggy-peaches-shop.md

feat(init): initType default value is set to module (#9486)

2025-08-17 10:58:03 +02:00

shaky-emus-notice.md

fix: shamefullyHoist set via updateConfig in .pnpmfile.cjs (#10519)

2026-02-05 22:45:20 +01:00

shaky-lines-sit.md

fix: display npm: protocol for aliased packages in list and why (#10084)

2025-11-20 01:08:53 +01:00

sharp-birds-rest.md

feat(cli/config)!: breaking changes (#9854)

2025-10-28 17:09:15 +01:00

sharp-insects-joke.md

feat: preserve comments when updating pnpm-workspace.yaml (#10402)

2026-01-06 01:11:17 +01:00

sharp-planes-boil.md

fix(manifest-utils): normalize peer specs for protocol deps (#10442)

2026-01-17 14:44:51 +01:00

sharp-snakes-love.md

fix: reporting ignored dependency builds (#10276)

2025-12-06 16:32:19 +01:00

shy-weeks-raise.md

fix(store): return only directory names when clean expired cache (#10384)

2025-12-30 18:01:53 +01:00

silver-geckos-hunt.md

fix: remove redundant mirror slash (#10204)

2025-11-19 21:46:03 +01:00

silver-ties-jog.md

feat!: upgrade pkg

2025-08-19 17:40:11 +02:00

sixty-results-end.md

feat(cli/config)!: config command outputs changed from INI to JSON with camelCase keys (#10142)

2025-10-30 11:34:48 +01:00

small-numbers-joke.md

feat!: remove use-node-version CLI option and pnpm.executionEnv.nodeVersion manifest field (#10373)

2025-12-27 22:41:53 +01:00

small-results-hunt.md

perf: increase the default network concurrency on machines with many CPU cores (#10215)

2025-11-21 15:29:56 +01:00

smooth-llamas-pick.md

feat: add support for npm package trust evidence check via a new trustPolicy setting (#10103)

2025-11-09 23:23:58 +01:00

social-peas-juggle.md

fix: concurrently hard linking a directory (#10163)

2025-11-09 12:07:11 +01:00

soft-trains-prove.md

fix: update parse-npm-tarball-url to v4 (#10182)

2025-11-12 14:06:56 +01:00

solid-eagles-mate.md

fix(workspace.manifest-writer): preserve formatting in pnpm-workspace.yaml when updating catalogs (#10430)

2026-01-26 07:07:28 +01:00

solid-memes-punch.md

fix: pnpm help should correctly show if pnpm is bundled with Node.js (#10563)

2026-02-07 02:09:45 +01:00

solid-regions-ring.md

fix: normalize tarball URLs by removing default HTTP/HTTPS ports (#10273)

2025-12-11 08:04:39 +01:00

solid-suns-wear.md

fix: sync --allow-build flag value to allowBuilds (#10343)

2025-12-30 00:35:08 +01:00

sour-hoops-allow.md

feat: add custom resolvers and fetchers (#10246)

2025-11-30 14:19:04 +01:00

spotty-gifts-chew.md

feat: enable injected local packages to work with global virtual store (#10366)

2025-12-27 12:21:19 +01:00

stale-bars-tan.md

fix: dependency graph hash calculation (#10236)

2025-11-25 20:36:52 +01:00

stale-cats-judge.md

feat(cli/config)!: breaking changes (#9854)

2025-10-28 17:09:15 +01:00

strong-readers-think.md

fix: filter on pnpm-workspace.yaml (#10127)

2025-10-27 13:36:35 +01:00

stupid-grapes-press.md

fix: don't reimport node.js on every install (#10239)

2025-11-26 01:10:36 +01:00

stupid-wasps-turn.md

fix: prevent implicit root exclusion when user filters are provided (#10465)

2026-01-16 16:12:33 +01:00

tangy-geckos-fry.md

feat!: support lowercase options in pnpm add (-d, -p, -o, -e) (#10079)

2025-11-17 23:52:11 +01:00

tangy-pans-pull.md

refactor!: replace npm publish with libnpmpublish (#10591)

2026-02-12 21:10:54 +01:00

tasty-eyes-retire.md

feat: skip confirm modules purge prompt if --yes is passed (#10383)

2026-02-11 02:39:23 +01:00

tender-socks-show.md

fix: reporting ignored dependency builds (#10276)

2025-12-06 16:32:19 +01:00

tender-times-hug.md

perf: save node_modules/.modules.yaml in JSON format (#10406)

2026-02-06 15:59:22 +01:00

thin-crabs-smoke.md

fix: pnpm add incorrectly modifies a catalog entry in pnpm-workspace.yaml to its exact version (#10370)

2025-12-29 02:05:54 +01:00

three-gifts-try.md

feat(cli/config)!: breaking changes (#9854)

2025-10-28 17:09:15 +01:00

tidy-teeth-accept.md

fix: store prune should not fail if the store contains Node.js (#10193)

2025-11-17 23:45:48 +01:00

tiny-ads-tickle.md

fix: update @pnpm/npm-conf to v3.0.1

2025-11-21 01:48:20 +01:00

tiny-rivers-crash.md

feat: add support for trustPolicyExclude (#10168)

2025-11-11 13:00:20 +01:00

tired-fans-invent.md

fix: npm compat on installing redirecting tarballs (#10197)

2025-12-11 11:55:02 +01:00

tricky-ravens-obey.md

fix(tarball-resolver): add integrity hash to HTTP tarball dependencies (#10287)

2025-12-08 23:38:27 +01:00

two-candies-train.md

feat: install js runtime as prod dependency (#10141)

2025-10-31 17:12:50 +01:00

two-colts-talk.md

feat: support engines in publishConfig (#10169)

2025-11-11 01:18:23 +01:00

violet-spiders-write.md

feat: add support for npm package trust evidence check via a new trustPolicy setting (#10103)

2025-11-09 23:23:58 +01:00

violet-trains-rescue.md

feat: install js runtime as prod dependency (#10141)

2025-10-31 17:12:50 +01:00

warn-path-delimiter.md

fix: warn when directory contains PATH delimiter character (#10487)

2026-02-06 16:04:19 +01:00

wet-rabbits-reply.md

feat: preserve comments when updating pnpm-workspace.yaml (#10402)

2026-01-06 01:11:17 +01:00

whole-jobs-return.md

feat!: remove old API for custom fetchers (#10464)

2026-01-15 11:57:48 +01:00

witty-tigers-tell.md

fix: gitBranchLockfile/mergeGitBranchLockfilesBranchPattern set in workspace file (#10139)

2025-11-06 15:42:21 +01:00

yellow-beds-wear.md

fix: dependencies that were added to onlyBuiltDependencies should be built on install (#10256)

2025-12-02 15:31:52 +01:00