Zoltan Kochan ee3bb4b586 fix(lockfile): read a CRLF or BOM-prefixed multi-document lockfile (#13609) ...

`extract_main_document` / `extract_env_document` split the combined
`pnpm-lock.yaml` on literal `---\n` and `\n---\n`. A lockfile pacquet
did not write may carry CRLF line endings — a `core.autocrlf` checkout
on Windows — or a UTF-8 BOM, and neither marker then matches. The main
extractor fell through to returning the whole file, which serde rejected
as `multiple YAML documents detected`, so the lockfile was discarded and
every dependency re-resolved from the registry.

Normalize the whole file (strip BOM, CRLF to LF) inside both extractors,
which covers every caller. `save_value_to_path` already normalized the
same way inline and now shares the helper.

The TypeScript stack needs no counterpart change:
`pnpm11/lockfile/fs/src/yamlDocuments.ts` already normalizes CRLF in
`extractMainDocument` / `extractEnvDocument` and strips the BOM at each
read site.

Closes https://github.com/pnpm/pnpm/issues/13606

2026-08-03 22:18:22 +02:00

..

changelogs

chore(release): 11.20.0, pacquet 12.0.0-beta.4 (#13608)

2026-08-03 15:48:54 +02:00

add-keeps-all-dependency-groups.md

fix(pacquet): do not narrow a partial add's install to its save-target group (#13138)

2026-07-19 10:32:16 +02:00

add-moves-dependency-between-groups.md

test(pacquet): port the upstream optionalDependencies install suite (#13141)

2026-07-19 14:25:29 +02:00

add-updates-dependency-in-place.md

test(pacquet): port the remaining optionalDependencies and installSome suites (#13144)

2026-07-19 15:55:13 +02:00

aliased-jsr-dependency-importer.md

fix(resolving-deps-resolver): key an aliased dependency by its manifest name (#13407)

2026-07-27 10:45:29 +02:00

allow-builds-placeholder-is-parsable.md

fix(cli): close the six pnpm-12-on-n8n defects (#13375)

2026-07-25 20:34:26 +02:00

allow-git-tarball-builds-by-repo-url.md

fix: approve git-hosted tarball builds by repository url (#12985)

2026-07-30 12:07:02 +02:00

allow-symlinked-lockfile-reads.md

fix(lockfile): fix installs when pnpm-lock.yaml is a symlink (#13075)

2026-07-17 11:30:36 +02:00

amortize-hoist-round-workspace-scans.md

fix: stabilize pacquet dependency traversal order (#13584)

2026-08-02 14:48:02 +02:00

arch-change-invalidates-up-to-date.md

test(pacquet): port the remaining optionalDependencies and installSome suites (#13144)

2026-07-19 15:55:13 +02:00

astro-lockfile-resolution-parity.md

fix(deps-resolver): close two Astro lockfile divergences (#13374)

2026-07-25 20:36:22 +02:00

bound-pacquet-gzip-hints.md

fix(tarball): bound gzip size hints (#12993)

2026-07-17 15:16:44 +02:00

bounded-peer-chain-resolution.md

fix(resolving-deps-resolver): stop re-walking a recorded subtree (#13575)

2026-08-02 10:35:05 +02:00

bundled-dependencies-true.md

fix(package-manager): record and honor bundledDependencies (#13406)

2026-07-27 00:22:23 +02:00

calm-cats-report.md

fix(pacquet): align license report metadata (#13461)

2026-07-28 11:59:51 +02:00

calm-cats-resolve.md

fix(network): respect macOS scoped DNS (#12934)

2026-07-13 16:18:40 +02:00

calm-jars-smile.md

test(pacquet): complete Stage 10 long-tail ports (#13161)

2026-07-20 00:17:38 +02:00

calm-pugs-list.md

fix(cli): list scripts for filtered run (#13440)

2026-07-27 22:18:39 +02:00

calm-spiders-rebuild.md

fix: finish global virtual store behavior (#13170)

2026-07-20 14:14:07 +02:00

calm-spiders-smile.md

fix(cli): strip Unicode formatting characters (#13427)

2026-07-27 13:56:01 +02:00

calm-wolves-reuse-lockfile.md

fix(pacquet): preserve lockfile before scripts (#13469)

2026-07-28 14:48:17 +02:00

cleanup-legacy-homedir-shims.md

fix(setup): remove leftover v10-layout shims so self-update stops re-warning (#13140)

2026-07-19 14:45:58 +02:00

complete-runtime-installation-port.md

feat(pacquet): complete runtime installation parity (#13157)

2026-07-19 22:35:28 +02:00

concurrent-package-manager-switch.md

fix(cli): close the six pnpm-12-on-n8n defects (#13375)

2026-07-25 20:34:26 +02:00

config-warnings-stderr.md

fix(cli): print config-load warnings to stderr (#13416)

2026-07-27 11:46:08 +02:00

dedupe-check-reports-the-diff.md

fix(cli): report what dedupe --check would change, and accept peers check (#13395)

2026-07-26 09:55:40 +02:00

dedupe-injected-deps-unrelated-peer-suffix.md

fix(deps-resolver): dedupe injected deps despite unrelated peer-suffix mismatch (#12800)

2026-07-13 14:24:45 +02:00

dedupe-release-age-upgrade-fetch.md

fix(napi): deterministic overrides, hook-free install options, and large-workspace install fixes (#13492)

2026-07-30 10:10:39 +02:00

deploy-catalog-snapshots.md

fix(cli): support catalogs in deploy (#12931)

2026-07-13 16:21:16 +02:00

deploy-local-tarball-names.md

fix(deploy): preserve local tarball package names (#12864)

2026-07-13 15:13:33 +02:00

deprecated-and-ignored-build-lists.md

fix(cli): close the six pnpm-12-on-n8n defects (#13375)

2026-07-25 20:34:26 +02:00

deterministic-gvs-hashes-for-cycles.md

fix(package-manager): derive global-virtual-store slots deterministically (#13368)

2026-07-25 18:29:13 +02:00

deterministic-peer-hoist-candidates.md

fix(resolving-deps-resolver): derive peer-hoist version candidates from the settled tree (#13570)

2026-08-01 22:07:49 +02:00

deterministic-workspace-resolution.md

fix(resolving-deps-resolver): resolve importers' initial waves one at a time (#13594)

2026-08-02 21:33:59 +02:00

empty-proxy-values-are-unset.md

fix(config): treat empty proxy values as unset, matching the TypeScript CLI (#13597)

2026-08-03 13:36:34 +02:00

engine-lock-failure-is-reported.md

fix(fs): distinguish an unavailable lock from a busy one (#13377)

2026-07-26 01:02:31 +02:00

env-lockfile-skips-pnpm-exe-from-v12.md

fix(env-installer): stop pinning the exe package from pnpm v12 (#13599)

2026-08-03 10:23:06 +02:00

epics-monorepo-versioning.md

feat(versioning): add versioning.epics for banded monorepo versioning (#12979)

2026-07-13 22:02:04 +02:00

exclude-links-keeps-workspace-internal-links.md

fix(pacquet): keep workspace-internal links out of the excludeLinksFromLockfile remap (#13563)

2026-08-01 18:15:17 +02:00

fair-warnings-report.md

fix(pacquet): align deprecated package reporting (#13490)

2026-07-29 14:29:57 +02:00

fast-catalog-ranges.md

perf: reuse lockfile for compatible dependency ranges (#13477)

2026-07-29 09:25:13 +02:00

fast-exact-overrides.md

perf: reuse lockfile entries for safe override updates (#13464)

2026-07-28 23:51:22 +02:00

faster-peer-dep-path-finalization.md

perf(resolving-deps-resolver): order node ids without rendering a sort key (#13568)

2026-08-01 20:09:57 +02:00

faster-peer-resolution.md

perf(resolver): cut large-workspace peer resolution roughly in half (#13506)

2026-07-30 19:47:43 +02:00

first-release-verbatim.md

feat(releasing): publish a new package's first release at its manifest version (#13207)

2026-07-22 08:57:38 +02:00

fix-git-resolver-prompt.md

fix(git-resolver): pass GIT_TERMINAL_PROMPT=0 to prevent interactive prompts in git ls-remote (#13471)

2026-07-30 20:13:51 +02:00

fix-git-side-effects-cache-index-key.md

fix(package-manager): reuse git side-effects cache keys (#13426)

2026-07-27 13:29:30 +02:00

fix-napi-in-memory-repeat-install.md

fix(napi): respect in-memory manifest changes (#13488)

2026-07-29 12:14:57 +02:00

fluffy-snakes-complain.md

chore(release): don't re-lint the pnpm CLI at publish time (#12987)

2026-07-13 23:05:14 +02:00

fresh-gits-agree.md

fix(lockfile): compare equivalent git specifiers (#13056)

2026-07-17 23:34:05 +02:00

friendly-dedupes-report.md

fix(cli): align dedupe check reporting (#13462)

2026-07-28 12:01:20 +02:00

friendly-spiders-smile.md

fix: stabilize pacquet dependency traversal order (#13584)

2026-08-02 14:48:02 +02:00

frozen-install-checks-drifted-settings.md

fix(lockfile): fail a frozen install when a recorded setting drifts (#13386)

2026-07-26 02:00:29 +02:00

frozen-noop-with-skipped-optionals.md

fix: repeat --frozen-lockfile install is a no-op again when an optional dependency was skipped (#13350)

2026-07-27 11:17:16 +02:00

frozen-pnpmfile-checksum.md

fix(package-manager): validate pnpmfile checksum (#13418)

2026-07-27 12:45:19 +02:00

fuzzy-dodos-report.md

fix(pacquet): align licenses with TypeScript pnpm (#13441)

2026-07-27 22:35:48 +02:00

gate-peer-hoist-on-dedupe-peer-dependents.md

fix(deps-resolver): gate peer hoisting on dedupePeerDependents too (#13381)

2026-07-26 01:30:10 +02:00

git-dep-importer-version.md

test(pacquet): port the git-hosted install suite (stage 9) (#13160)

2026-07-19 23:23:16 +02:00

git-hosted-dependency-parity.md

feat(pacquet): complete git dependency parity (#13169)

2026-07-20 14:27:17 +02:00

git-importer-lockfile.md

fix(resolving-git-resolver): read git package names during resolution (#13059)

2026-07-17 11:36:22 +02:00

git-private-repo-keeps-auth-url.md

test(pacquet): port the git-hosted install suite (stage 9) (#13160)

2026-07-19 23:23:16 +02:00

github-actions-server-setting.md

feat: configurable GitHub server for GitHub Actions dependencies (#13230)

2026-07-23 13:38:25 +02:00

gvs-build-failure-cleanup.md

test(pacquet): port the global virtual store suites (stage 5) (#13156)

2026-07-19 22:48:18 +02:00

gvs-local-directory-deps.md

fix(deps-graph-hasher): give local directory deps their own global-virtual-store slot (#13383)

2026-07-26 09:25:03 +02:00

gvs-windows-separators.md

fix: create global virtual store symlinks with native path separators on Windows (#12976)

2026-07-13 18:30:33 +02:00

harden-web-auth-poll-body.md

feat(network/web-auth): bound the token-poll body and make QR failure non-fatal (#13191)

2026-07-23 07:55:55 +02:00

hoist-peers-include-prerelease.md

fix(resolving-deps-resolver): match npm's includePrerelease when hoisting peers (#13391)

2026-07-26 02:42:22 +02:00

hoist-scope-suffix-memo.md

perf(resolving-deps-resolver): answer the hoist scope's ancestor queries per shared suffix (#13587)

2026-08-02 15:42:36 +02:00

hoist-tolerates-skipped-optional-snapshots.md

test(pacquet): port the upstream optionalDependencies install suite (#13141)

2026-07-19 14:25:29 +02:00

hoisted-patch-every-nested-copy.md

test(pacquet): complete the patchedDependencies port (stage 4) (#13149)

2026-07-19 19:10:56 +02:00

honor-save-exact-setting.md

fix(resolver): keep the explicit = operator when updating an exact pin (#13184)

2026-07-30 13:37:36 +02:00

huge-lockfiles-scalar-budget.md

fix(lockfile): parse lockfiles above the default YAML scalar budget (#13497)

2026-07-30 13:24:36 +02:00

hungry-donkeys-repeat.md

test(pacquet): port the Stage 2 workspace subset and multi-importer suites (#13152)

2026-07-19 20:57:39 +02:00

if-modified-since-http-date.md

fix(resolving-npm-resolver): send If-Modified-Since as an HTTP-date (#13121)

2026-07-18 22:45:28 +02:00

ignore-broken-wanted-lockfile.md

fix(pacquet): ignore a broken wanted lockfile on regular installs (#13511)

2026-07-30 23:33:35 +02:00

incremental-discovery-tree-sync.md

perf(resolving-deps-resolver): sync the discovery view from a write log (#13571)

2026-08-02 00:09:32 +02:00

inline-string-and-npmrc-key-utils.md

refactor(text): move lexCompare and nerfDart into the monorepo (#13535)

2026-07-31 23:00:10 +02:00

install-tarballs-without-integrity.md

fix(package-manager): install git-hosted tarballs that pin no integrity (#13349)

2026-07-25 16:03:55 +02:00

install-without-system-ca-certificates.md

fix(network): fall back to bundled CA roots when the system trust store is empty (#13593)

2026-08-02 17:55:31 +02:00

interactive-update-blank-workspace-name.md

fix(update): treat a whitespace-only project name as no name (#13354)

2026-07-25 16:10:56 +02:00

interactive-update-github-actions-opt-in.md

fix: make GitHub Actions checks opt-in for outdated and update (#13259)

2026-07-24 01:06:35 +02:00

interactive-update-groups-choices.md

feat(update): group the interactive update list by dependency type (#13298)

2026-07-25 12:10:31 +02:00

interactive-update-wide-character-columns.md

fix(update-interactive): measure the choice table in terminal columns (#13415)

2026-07-27 11:39:15 +02:00

interactive-update-workspace-column.md

feat(update): name the workspace projects each interactive row came from (#13337)

2026-07-25 15:30:47 +02:00

known-registries-single-owner.md

refactor(registries): give the known-registry set one owner (#13591)

2026-08-02 19:40:34 +02:00

large-lockfiles-parse.md

fix(lockfile): parse large lockfiles (#13485)

2026-07-29 12:12:41 +02:00

ledger-empty-intents-roundtrip.md

fix(releasing): round-trip ledger entries with no consumed intents (#13125)

2026-07-18 14:16:41 +02:00

ledger.yaml

chore(release): 11.20.0, pacquet 12.0.0-beta.4 (#13608)

2026-08-03 15:48:54 +02:00

libc-lockfile-scalar.md

fix(pacquet): align n8n lockfile with pnpm 11 (#13432)

2026-07-27 16:42:16 +02:00

list-why-parity.md

feat(pacquet): make list and why feature complete with the TypeScript CLI (#13178)

2026-07-20 21:13:07 +02:00

local-tarball-dependency-install.md

fix(resolving-local-resolver): install local file: tarball dependencies (#13409)

2026-07-27 10:55:00 +02:00

lockfile-config-mismatch-code.md

fix(cli): close the six pnpm-12-on-n8n defects (#13375)

2026-07-25 20:34:26 +02:00

lockfile-only-records-tarball-integrity.md

fix(pacquet): always record a tarball integrity in the lockfile (#13549)

2026-08-01 12:37:10 +02:00

login-non-interactive-web-auth.md

feat(login): support web login without an interactive terminal (#13479)

2026-07-29 12:12:10 +02:00

long-snapshot-keys-explicit.md

fix(lockfile): emit over-long dependency-path keys in explicit form (#13500)

2026-07-30 14:57:00 +02:00

manifestless-package-lockfile-entry.md

fix(resolving-deps-resolver): key a package with no bundled manifest by its alias (#13419)

2026-07-27 12:57:39 +02:00

meta-only-optional-peer-hoist.md

feat(peers): hoist optional peers implied by peerDependenciesMeta (#13120)

2026-07-18 13:22:01 +02:00

minimum-release-age-latest-bound.md

fix(resolver): bound minimumReleaseAge latest fallback (#13044)

2026-07-30 13:26:31 +02:00

modules-yaml-package-manager-pnpm.md

fix(install): record pnpm@<release version> in .modules.yaml (#13087)

2026-07-16 23:28:47 +02:00

mui-optional-peer-parity.md

fix(pacquet): align MUI resolution and dedupe (#13431)

2026-07-27 16:29:40 +02:00

named-registries-lockfile-format.md

feat(lockfile): key named-registry packages by their registry (#13528)

2026-08-02 16:52:28 +02:00

napi-explicit-settings.md

feat(napi): report explicitly set settings from readConfig (#13518)

2026-08-01 13:15:34 +02:00

napi-hook-free-install.md

fix(napi): deterministic overrides, hook-free install options, and large-workspace install fixes (#13492)

2026-07-30 10:10:39 +02:00

napi-install-engine-perf.md

fix(napi): deterministic overrides, hook-free install options, and large-workspace install fixes (#13492)

2026-07-30 10:10:39 +02:00

napi-overrides-order-stable.md

fix(napi): deterministic overrides, hook-free install options, and large-workspace install fixes (#13492)

2026-07-30 10:10:39 +02:00

napi-read-config.md

feat(napi): expose readConfig for embedders (#13513)

2026-07-31 00:43:23 +02:00

napi-trace-env.md

fix(napi): deterministic overrides, hook-free install options, and large-workspace install fixes (#13492)

2026-07-30 10:10:39 +02:00

napi-trust-lockfile.md

fix(napi): support trustLockfile option (#13489)

2026-07-29 13:20:56 +02:00

neat-taxis-report.md

fix(pacquet): align remaining parity output (#13472)

2026-07-28 18:21:58 +02:00

nested-file-dep-declaring-manifest.md

fix(resolving-deps-resolver): resolve nested file: deps against the declaring manifest (#13384)

2026-07-26 01:30:42 +02:00

no-cross-importer-peer-provider-replay.md

fix(resolver): stop replaying cached subtrees' peer providers across importers (#13502)

2026-07-30 17:11:36 +02:00

no-runtime-fresh-install.md

fix(pacquet): honor --no-runtime on the fresh-lockfile install path (#13225)

2026-07-23 11:47:44 +02:00

no-unrelated-lockfile-churn.md

fix(deps-resolver): stop partial installs from rewriting unrelated lockfile entries (#13196)

2026-07-21 17:36:35 +02:00

normalize-empty-bundled-dependencies.md

fix(lockfile): omit empty bundled dependencies (#13148)

2026-07-30 12:08:31 +02:00

npm-config-user-agent-in-scripts.md

fix(cli): close the six pnpm-12-on-n8n defects (#13375)

2026-07-25 20:34:26 +02:00

optional-peer-hoist-respects-workspace-root.md

fix(resolving-deps-resolver): apply overrides and the workspace root's pin to hoisted peers (#13369)

2026-07-25 20:37:28 +02:00

optional-peer-prerelease-strictness.md

fix(resolving-deps-resolver): hoist peers against the workspace root's deps (#13343)

2026-07-25 15:35:18 +02:00

optional-peers-stay-out-of-importers.md

fix(package-manager): keep peer-only aliases out of importers without auto-install-peers (#13372)

2026-07-25 19:27:17 +02:00

optional-platform-prefetch.md

fix(deps-resolver): don't download unsupported-platform optional deps on fresh install (#13510)

2026-07-30 22:33:29 +02:00

order-workspace-lifecycle.md

fix(pacquet): complete workspace lifecycle parity (#13171)

2026-07-20 14:46:09 +02:00

outdated-table-ansi-alignment.md

fix(pacquet-cli): align outdated table borders when output is colorized (#13227)

2026-07-23 11:46:54 +02:00

overrides-reach-auto-installed-peers.md

fix(resolving-deps-resolver): apply overrides and the workspace root's pin to hoisted peers (#13369)

2026-07-25 20:37:28 +02:00

packlist-files-field-workspace-ignores.md

fix(fs-packlist): let the files allowlist override workspace-inherited ignores (#13231)

2026-07-23 14:50:35 +02:00

pacquet-add-multiple-packages.md

fix(add): support multiple package selectors (#12995)

2026-07-16 23:58:33 +02:00

pacquet-approve-builds-short-global.md

fix(cli): accept -g for approve-builds (#13329)

2026-07-25 14:10:33 +02:00

pacquet-auto-install-peer-intersection.md

fix(pacquet): close the Resolution / verification install-parity gaps (#13172)

2026-07-20 14:04:57 +02:00

pacquet-before-packing-hook.md

fix: keep bundled dependency fields out of the published pnpm manifest (#12964)

2026-07-13 12:39:54 +02:00

pacquet-beta-release.md

chore(release): move pacquet to the beta lane (#13458)

2026-07-28 22:33:29 +02:00

pacquet-catalog-name-control-chars.md

feat: support frozenLockfile, savePrefix, savePeer and saveCatalogName settings in the Rust engine (#13283)

2026-07-25 10:41:58 +02:00

pacquet-clap-help-markdown.md

docs(rust/cli): clean up --help texts (#13008)

2026-07-15 11:36:34 +02:00

pacquet-cleanup-unused-catalogs.md

fix(pacquet): close the Resolution / verification install-parity gaps (#13172)

2026-07-20 14:04:57 +02:00

pacquet-concurrent-add-resolution.md

perf(pacquet): resolve add selectors concurrently (#13097)

2026-07-17 16:55:44 +02:00

pacquet-dedupe-importer-peer-pins.md

fix(pacquet): preserve locked peer contexts during dedupe (#13473)

2026-07-28 22:31:05 +02:00

pacquet-dedupe-locked-peers.md

fix(pacquet): preserve locked peers during dedupe (#13459)

2026-07-28 10:38:59 +02:00

pacquet-deprecate-undeprecate.md

feat(cli): implement deprecate and undeprecate commands natively in Rust (#12884)

2026-07-13 14:16:10 +02:00

pacquet-deprecation-warnings.md

feat(resolver): emit pnpm:deprecation events for deprecated packages (#13135)

2026-07-19 14:09:21 +02:00

pacquet-edge-aware-engine-strict.md

fix(pacquet): close the Resolution / verification install-parity gaps (#13172)

2026-07-20 14:04:57 +02:00

pacquet-enable-modules-dir.md

feat(pacquet): close the CLI / config surface install-parity gaps (#13177)

2026-07-20 21:12:03 +02:00

pacquet-engine-prerelease-bounds.md

fix(pacquet): close the Resolution / verification install-parity gaps (#13172)

2026-07-20 14:04:57 +02:00

pacquet-err-pnpm-error-codes.md

fix(diagnostics): report ERR_PNPM_* error codes, never pacquet ones (#13091)

2026-07-17 11:09:01 +02:00

pacquet-extend-node-path.md

feat(pacquet): close the CLI / config surface install-parity gaps (#13177)

2026-07-20 21:12:03 +02:00

pacquet-fresh-engine-strict.md

fix(package-manager): enforce engines on fresh installs (#12994)

2026-07-16 22:55:58 +02:00

pacquet-frozen-auto-install-peers.md

fix(lockfile): fold auto-installed peers into the frozen-lockfile check (#13117)

2026-07-18 10:39:58 +02:00

pacquet-gvs-slot-state.md

test(pacquet): port the global virtual store suites (stage 5) (#13156)

2026-07-19 22:48:18 +02:00

pacquet-hoisted-no-duplicate-root-version.md

fix(package-manager): stop nesting hoisted deps that won the root slot (#13306)

2026-07-25 13:52:57 +02:00

pacquet-injected-workspace-catalogs.md

fix(pacquet): resolve catalogs in injected workspace packages (#12941)

2026-07-13 16:27:17 +02:00

pacquet-install-filters.md

fix(pacquet): honor workspace install filters (#13030)

2026-07-18 13:06:37 +02:00

pacquet-install-force-flag.md

feat(pacquet): close the CLI / config surface install-parity gaps (#13177)

2026-07-20 21:12:03 +02:00

pacquet-install-save-settings.md

feat: support frozenLockfile, savePrefix, savePeer and saveCatalogName settings in the Rust engine (#13283)

2026-07-25 10:41:58 +02:00

pacquet-install-test.md

feat(pacquet): implement install-test command (#13127)

2026-07-18 22:34:41 +02:00

pacquet-legacy-pnpm-field-warning.md

feat(cli): warn about install settings left under package.json's pnpm field (#13359)

2026-07-25 20:46:08 +02:00

pacquet-licenses-global-store.md

fix(pacquet): repair licenses command (#13347)

2026-07-25 16:45:15 +02:00

pacquet-licenses.md

feat: implement pnpm licenses command in pacquet (#13090)

2026-07-18 09:42:06 +02:00

pacquet-list-unsaved-deps.md

feat(pacquet): report extraneous packages in pnpm list (#12967)

2026-07-13 14:28:05 +02:00

pacquet-login-scope-setting.md

fix(pacquet/login): honor the scope setting (#13255)

2026-08-03 15:46:11 +02:00

pacquet-minimum-release-age-add-update.md

fix(pacquet): resolve latest through the maturity-aware picker (#13102)

2026-07-17 15:14:01 +02:00

pacquet-missing-workspace-glob-dir.md

fix(workspace): treat a missing pattern directory as no matches (#13304)

2026-07-25 12:37:49 +02:00

pacquet-npm-style-version.md

feat(pacquet): implement the npm-style pnpm version bump (#13200)

2026-07-21 21:55:12 +02:00

pacquet-owner.md

feat(cli): implement native owner/owners command in Rust (#13000)

2026-07-16 11:46:15 +02:00

pacquet-pnpr-catalogs.md

fix(pnpr): send the full request both clients owe the server (policy, catalogs, resolution mode) (#13279)

2026-07-25 10:56:36 +02:00

pacquet-pre-command-checks.md

feat(cli): check the pinned package manager and runtimes before a command (#13287)

2026-07-25 11:17:53 +02:00

pacquet-preclap-escape-boundary.md

fix(cli): stop the pre-clap argv passes at the escape boundary (#13309)

2026-07-25 13:55:11 +02:00

pacquet-preserve-string-libc.md

fix(package-manager): preserve scalar libc metadata (#13346)

2026-07-25 15:44:48 +02:00

pacquet-preserve-tmpdir.md

fix(executor): preserve inherited TMPDIR (#13445)

2026-07-27 23:52:32 +02:00

pacquet-progress-reporting-parity.md

test(pacquet): complete progress reporting port (stage 7) (#13155)

2026-07-19 22:20:50 +02:00

pacquet-publish-config-name.md

feat: support publishConfig.name to publish under a different name (#13353)

2026-07-26 02:20:54 +02:00

pacquet-recursive.md

feat(pacquet): implement native recursive command (#13129)

2026-07-18 22:36:41 +02:00

pacquet-registry-allow-build-dir-parity.md

fix(cli): close three CLI parity gaps found moving the Tag workflow to v12 (#13246)

2026-07-23 19:29:01 +02:00

pacquet-render-stats-once.md

fix(default-reporter): render install stats once (#13103)

2026-07-17 15:15:19 +02:00

pacquet-run-forwards-script-args.md

fix(run): forward every argument after the script name verbatim (#13300)

2026-07-25 12:35:58 +02:00

pacquet-save-workspace-protocol.md

feat: support the saveWorkspaceProtocol setting in the Rust engine (#13299)

2026-07-25 14:10:06 +02:00

pacquet-scoped-symlink-windows-separators.md

fix(fs): rewrite symlink paths to native separators on Windows (#12991)

2026-07-14 19:53:10 +02:00

pacquet-script-shortcut-args.md

fix(cli): forward every argument of test, start, and stop to the script (#13344)

2026-07-25 15:05:16 +02:00

pacquet-self-update-pin-specifier.md

fix(self-update): store the resolved pnpm pin as the packageManagerDependencies specifier (#12992)

2026-07-14 20:42:17 +02:00

pacquet-shared-workspace-lockfile-false.md

feat(pacquet): close the CLI / config surface install-parity gaps (#13177)

2026-07-20 21:12:03 +02:00

pacquet-star-stars-unstar.md

feat: implement star, stars, unstar natively in pacquet (#12917)

2026-07-13 16:06:31 +02:00

pacquet-strict-age-prompt.md

fix(pacquet): prompt for strict minimum release age approval (#13062)

2026-07-16 22:37:35 +02:00

pacquet-symlink-dangling-junction-parent.md

fix(fs): repair dangling junction parent before symlinking on Windows (#13020)

2026-07-15 11:37:16 +02:00

pacquet-token-helper.md

fix(config): allow tokenHelper to be set in the global auth.ini (#12833)

2026-07-13 16:05:48 +02:00

pacquet-unpublish.md

feat(pacquet): implement the pnpm unpublish command (#13219)

2026-07-23 11:40:23 +02:00

pacquet-update-workspace-and-depth.md

feat(update): support --workspace in pacquet and honor --depth per dependency (#13288)

2026-07-25 11:13:51 +02:00

pacquet-user-facing-pnpm-naming.md

fix(cli): call the CLI pnpm, not pacquet, in user-facing text (#13086)

2026-07-16 23:44:35 +02:00

pacquet-versionless-workspace-packages.md

fix(pacquet): resolve versionless workspace packages (#12940)

2026-07-13 16:28:24 +02:00

pacquet-virtual-store-only.md

test(pacquet): port the global virtual store suites (stage 5) (#13156)

2026-07-19 22:48:18 +02:00

pacquet-workspace-lockfile-freshness.md

fix(pacquet): validate workspace lockfile importers (#13081)

2026-07-16 21:25:15 +02:00

pacquet-workspace-root-flag.md

feat(cli): support the --workspace-root (-w) flag (#13281)

2026-07-25 11:21:01 +02:00

patch-applier-tolerances.md

fix(cli): close the six pnpm-12-on-n8n defects (#13375)

2026-07-25 20:34:26 +02:00

peer-cycle-graph-name-once.md

perf(resolving-deps-resolver): derive each package's name once for the peer-name cycle graph (#13589)

2026-08-02 17:34:19 +02:00

peer-edge-keeps-the-providers-suffix.md

fix(resolving-deps-resolver): key a peer edge to the provider's own depPath (#13401)

2026-07-26 11:28:50 +02:00

peer-hoist-reads-workspace-root-deps.md

fix(resolving-deps-resolver): hoist peers against the workspace root's deps (#13343)

2026-07-25 15:35:18 +02:00

peer-hoist-skips-project-relative-root-deps.md

fix(resolving-deps-resolver): hoist a local root dep by its version, not its path (#13387)

2026-07-26 03:06:01 +02:00

peer-scheme-specifiers.md

feat(peers): accept scheme-carrying specifiers in peerDependencies (#13110)

2026-07-17 23:47:34 +02:00

peer-shadowed-deps-in-parent-scope.md

fix(deps-resolver): close the peer-context divergences on large workspaces (#13388)

2026-07-26 02:23:23 +02:00

peer-walker-map-churn.md

fix(napi): deterministic overrides, hook-free install options, and large-workspace install fixes (#13492)

2026-07-30 10:10:39 +02:00

perf-resolver-caches.md

perf(resolver): avoid repeated packument filtering and semver parsing during version picking (#13504)

2026-08-01 14:09:02 +02:00

pin-unscoped-npmrc-settings-follow-up.md

fix(pacquet): pin every unscoped .npmrc setting to its own source's registry (#13285)

2026-07-25 10:45:27 +02:00

pnpm-doctor-command.md

ci(release): gate releases on a publishable manifest, a real upgrade, and pnpm doctor (#13072)

2026-07-17 09:54:10 +02:00

pnpm-setup-github-actions.md

fix(setup): persist GitHub Actions env files (#12841)

2026-07-24 02:42:40 +02:00

pnpr-catalog-overrides.md

fix: resolve catalog references when installing via a pnpr server (#13233)

2026-07-23 16:04:43 +02:00

pnpr-hoist-readme.md

fix(publish): send README to the registry as metadata (#12968)

2026-07-13 18:27:50 +02:00

pnpr-workspace-identity.md

fix(pacquet): honor workspace install filters (#13030)

2026-07-18 13:06:37 +02:00

policy-aware-install-summary-latest.md

fix(install-summary): suppress '(X is available)' when latest is held back by minimumReleaseAge (#13214)

2026-07-30 20:00:23 +02:00

prefix-alias-of-dir.md

fix(cli): accept npm's --prefix and --store spellings (#13592)

2026-08-02 18:37:34 +02:00

preserve-equals-pin-operator.md

fix(resolver): keep the explicit = operator when updating an exact pin (#13184)

2026-07-30 13:37:36 +02:00

preserve-workspace-link-on-partial-update.md

fix(deps-resolver): preserve workspace link: on re-resolution (fixes pnpm/pnpm#10433) (#13112)

2026-07-30 12:34:52 +02:00

prod-spec-wins-over-dev.md

fix(resolver): let the dependencies range win over devDependencies (#13501)

2026-07-30 14:47:38 +02:00

project-lifecycle-scripts-follow-the-mutated-projects.md

fix(package-manager): pick the projects that run their own lifecycle scripts pnpm's way (#13398)

2026-07-26 09:20:46 +02:00

publish-readme-metadata.md

fix(publish): send README to the registry as metadata (#12968)

2026-07-13 18:27:50 +02:00

quick-plums-hoist.md

perf(pacquet): bound memory in peer-heavy hoisted installs (#13545)

2026-08-01 14:29:24 +02:00

quiet-beans-sing.md

fix(cli): print filtered script command (#13460)

2026-07-28 11:59:22 +02:00

quiet-dodos-verify.md

fix(pacquet): verify dependencies before run (#13463)

2026-07-28 12:01:50 +02:00

quiet-policy-order.md

fix(pacquet): align deprecated package reporting (#13490)

2026-07-29 14:29:57 +02:00

quiet-ravens-hoist.md

fix(pacquet): align hoisted dependency metadata (#13455)

2026-07-28 02:31:36 +02:00

quiet-wolves-remember.md

fix(pacquet): preserve libc metadata shape (#13436)

2026-07-27 22:01:42 +02:00

read-bom-prefixed-manifests.md

fix(package-manifest): read package.json files that start with a UTF-8 BOM (#13327)

2026-07-25 14:07:43 +02:00

read-crlf-multi-document-lockfile.md

fix(lockfile): read a CRLF or BOM-prefixed multi-document lockfile (#13609)

2026-08-03 22:18:22 +02:00

read-pnpm-10-patched-dependencies.md

fix(lockfile): read patchedDependencies written by pnpm 10 (#13330)

2026-07-25 13:56:50 +02:00

rebuild-depath-name-traversal.md

fix(security): contain the rebuild pkg root against a traversal depPath name (#13596)

2026-08-03 02:35:47 +02:00

reconcile-existing-node-modules-on-repeat-install.md

feat(pacquet): reconcile an existing node_modules on repeat installs (Stage 1) (#13151)

2026-07-19 21:53:56 +02:00

record-pending-builds.md

test(pacquet): port the current-lockfile and pendingBuilds suites (#13150)

2026-07-19 23:20:20 +02:00

recover-metadata-cache-race.md

fix(resolver): recover after metadata cache loss (#13014)

2026-07-17 22:05:03 +02:00

recursive-install-family-dedicated-lockfiles.md

feat(cli): support recursive install family with dedicated lockfiles (#13208)

2026-07-22 07:32:40 +02:00

recursive-outdated-queries.md

feat(pacquet): support recursive outdated queries (#13202)

2026-07-22 00:13:58 +02:00

recursive-rebuild.md

feat(pacquet): add recursive rebuild selection (#13206)

2026-07-22 07:50:41 +02:00

recursive-run-keeps-failures.md

fix(cli): close the six pnpm-12-on-n8n defects (#13375)

2026-07-25 20:34:26 +02:00

recursive-why-peers.md

feat(pacquet): align recursive why and peers (#13205)

2026-07-22 00:43:52 +02:00

reevaluate-skipped-optionals-on-arch-change.md

test(pacquet): port the upstream optionalDependencies install suite (#13141)

2026-07-19 14:25:29 +02:00

refuse-broken-release-on-version-switch.md

fix: refuse a broken pnpm release when switching versions, not only on self-update (#13082)

2026-07-16 21:29:48 +02:00

regexp-script-selectors.md

fix(cli): close the six pnpm-12-on-n8n defects (#13375)

2026-07-25 20:34:26 +02:00

repeat-install-clock-skew.md

fix(pacquet): base repeat-install freshness on filesystem mtime at nanosecond precision (#12981)

2026-07-13 22:06:22 +02:00

repeat-install-coarse-mtime.md

fix: honor same-second edits on whole-second-mtime filesystems (#12975)

2026-07-13 18:32:16 +02:00

report-missing-versions-and-packages.md

fix(resolving-npm-resolver): report missing versions and packages with pnpm's error codes (#13371)

2026-07-25 20:48:12 +02:00

resolve-bare-workspace-adds.md

fix(add): resolve bare workspace packages (#13424)

2026-07-27 13:40:50 +02:00

resolve-override-version-references.md

fix(config): resolve $dep-name self-references in overrides (#13404)

2026-07-26 16:42:17 +02:00

resolver-overrides-after-hook.md

fix(napi): deterministic overrides, hook-free install options, and large-workspace install fixes (#13492)

2026-07-30 10:10:39 +02:00

retry-invalid-304.md

fix(resolver): recover from unsolicited 304 responses (#12888)

2026-07-13 15:56:52 +02:00

retry-provenance-signing.md

fix(publish): retry the sigstore signing exchange and cap it with fetch-timeout (#13245)

2026-07-23 19:24:25 +02:00

reuse-denied-edge-empty-snapshot.md

fix(resolving-deps-resolver): keep synthesized reuse results out of the wanted-dep cache (#13122)

2026-07-18 13:22:35 +02:00

revoked-build-approval-is-re-evaluated.md

test(pacquet): port the current-lockfile and pendingBuilds suites (#13150)

2026-07-19 23:20:20 +02:00

run-regex-and-sequential.md

feat(exec): restore --sequential flag and sort regex-matched scripts lexicographically (#13074)

2026-07-17 13:20:26 +02:00

run-the-dev-preinstall-hook.md

fix(package-manager): run the pnpm:devPreinstall hook (#13403)

2026-07-27 00:21:34 +02:00

rust-engine-dates-cached-verification.md

fix(cli): close the remaining pnpm 12 CLI-surface parity gaps (#13376)

2026-07-26 02:24:03 +02:00

rust-engine-reports-scope.md

fix(cli): close the remaining pnpm 12 CLI-surface parity gaps (#13376)

2026-07-26 02:24:03 +02:00

rust-engine-scaffolds-allow-builds.md

fix(cli): close the remaining pnpm 12 CLI-surface parity gaps (#13376)

2026-07-26 02:24:03 +02:00

rust-parallel-recursive-run.md

fix(cli): support parallel recursive runs (#13448)

2026-07-28 00:15:51 +02:00

rust-wrapper-dev-checkout-guard.md

feat(release): unify the TypeScript, Rust and pnpr release flows on pnpm's native versioning (#12949)

2026-07-13 11:11:41 +02:00

safe-broken-lockfile-errors.md

fix(lockfile): hide content from parse errors (#13101)

2026-07-17 15:14:43 +02:00

save-prefix-equals.md

fix(resolver): keep the explicit = operator when updating an exact pin (#13184)

2026-07-30 13:37:36 +02:00

script-shell-for-lifecycle-scripts.md

fix(package-manager): honor scriptShell for lifecycle scripts (#13453)

2026-07-28 01:27:49 +02:00

self-update-release-age.md

fix(self-update): stop the project config from steering the pnpm download (#12813)

2026-07-25 01:34:27 +02:00

self-update-verify-installed-pnpm.md

fix(self-update): discard an installed pnpm that cannot run (#13076)

2026-07-16 14:38:22 +02:00

setup-action-cli-parity.md

fix(pacquet): create the global bin dir and accept the silent shorthands (#13194)

2026-07-21 14:17:17 +02:00

shamefully-hoist-root-links.md

fix(config): derive public hoisting from shamefullyHoist (#13447)

2026-07-28 00:12:32 +02:00

shared-peer-owner-barrier.md

fix(pacquet): align n8n lockfile with pnpm 11 (#13432)

2026-07-27 16:42:16 +02:00

shared-preferred-versions-fold.md

fix(napi): deterministic overrides, hook-free install options, and large-workspace install fixes (#13492)

2026-07-30 10:10:39 +02:00

ship-node-gyp-with-the-rust-cli.md

feat(pacquet): ship node-gyp beside the native binary (#13586)

2026-08-02 15:37:41 +02:00

skipped-optional-dependency-closure.md

test(pacquet): port the upstream optionalDependencies install suite (#13141)

2026-07-19 14:25:29 +02:00

steady-install-state.md

feat(package-manager): complete install-state repair paths (#13173)

2026-07-20 15:02:00 +02:00

store-index-keys-non-registry-deps-by-resolution-id.md

fix(store-dir): key non-registry store-index rows by the bare resolution id (#13417)

2026-07-27 12:48:52 +02:00

sync-package-manager-deps-on-every-command.md

fix(cli): record packageManagerDependencies from every command (#13382)

2026-07-26 01:56:11 +02:00

tarball-mem-cache-lost-wakeup.md

fix(tarball): fix a lost-wakeup hang in the tarball mem cache (#13166)

2026-07-20 10:48:38 +02:00

tidy-deploy-graphs.md

fix(deploy): prune unreachable package graph (#12935)

2026-07-13 15:55:25 +02:00

tidy-moles-list.md

fix(pacquet): complete licenses report parity (#13454)

2026-07-28 01:36:38 +02:00

tidy-moons-repeat.md

feat(napi): add returnListOfDepsRequiringBuild install option (#13532)

2026-07-31 16:29:23 +02:00

tidy-wolves-proxy.md

fix(pacquet): complete auth and proxy parity (#13158)

2026-07-19 22:53:01 +02:00

unlink-recursive-install-family.md

feat(cli): route unlink through the recursive install pipeline (#13212)

2026-07-22 08:07:43 +02:00

update-changeset-flag.md

feat(update): generate changesets for dependency updates (#13195)

2026-07-21 23:48:46 +02:00

update-github-actions.md

feat(update): update GitHub Actions dependencies (#13198)

2026-07-22 00:41:30 +02:00

update-latest-non-registry-specs.md

fix(package-manager): let the resolvers decide what update --latest writes (#13250)

2026-07-24 02:07:11 +02:00

update-latest-npm-alias-target.md

fix(package-manager): resolve npm: alias targets under update --latest (#13244)

2026-07-23 19:24:03 +02:00

update-latest-rewrites-jsr-specifiers.md

fix(resolving-npm-resolver): rewrite jsr: specifiers on update --latest (#13394)

2026-07-26 09:21:24 +02:00

update-latest-rewrites-named-registry-specifiers.md

fix(resolving-npm-resolver): rewrite named-registry specifiers on update --latest (#13402)

2026-07-27 10:58:10 +02:00

update-latest-workspace-deps.md

fix(pacquet): don't resolve workspace/link/file deps against the registry under update --latest (#13234)

2026-07-23 17:01:51 +02:00

update-preserve-exact-pins.md

fix(resolver): preserve exact version pins during update (#13027)

2026-07-17 19:32:16 +02:00

update-settings-section.md

feat(config): add update and audit settings sections superseding updateConfig, auditConfig, and auditLevel (#13197)

2026-07-21 22:28:44 +02:00

v12-engine-strict-optional-subtree.md

fix: an installed optional dependency could be left without its own required dependency (#13289)

2026-07-25 12:49:56 +02:00

verifier-rejects-integrity-less-tarballs.md

fix(lockfile-verification): reject integrity-less tarballs at the gate (#13408)

2026-07-27 10:43:22 +02:00

verify-unused-patches-on-install.md

feat(patching): wire verify_patches into the fresh-lockfile install path (#13139)

2026-07-19 15:21:50 +02:00

view-registry-flag.md

fix(pacquet-cli): accept --registry in pnpm view; make recursive-publish probe hermetic (#13218)

2026-07-23 00:58:59 +02:00

web-auth-qr-code-fallback.md

feat(network/web-auth): bound the token-poll body and make QR failure non-fatal (#13191)

2026-07-23 07:55:55 +02:00

wise-wolves-report.md

fix(pacquet): read legacy license fields (#13446)

2026-07-27 23:26:13 +02:00

workspace-hoist-discovery-linear.md

perf(resolver): make multi-importer peer-hoist discovery linear (#13491)

2026-07-29 17:06:51 +02:00

workspace-pack-gitignore.md

fix: respect workspace root ignores when packing (#12878)

2026-07-13 16:32:21 +02:00

workspace-root-dir-outside-workspace.md

fix(cli): reject a --workspace-root --dir that points outside the workspace (#13297)

2026-07-25 12:16:55 +02:00