|
| 1 | +--- |
| 2 | +date: 2026-05-02 |
| 3 | +repo: pnpm/pnpm |
| 4 | +size: L |
| 5 | +title: "pnpm fixes self-update, ci, and security defaults" |
| 6 | +excerpt: "Major fixes stop accidental pnpm downgrades, make `pnpm ci` reinstall workspace packages, and tighten release-age handling." |
| 7 | +commits: 20 |
| 8 | +authors: [zkochan, cyphercodes, Saturate] |
| 9 | +commit_authors: {"42a8f29": zkochan, "c1d29d2": zkochan, "b1eccd8": zkochan, "654f575": cyphercodes, "9c7c438": zkochan, "315e59b": zkochan, "c5dd6b5": Saturate} |
| 10 | +--- |
| 11 | + |
| 12 | +### **Self-update no longer downgrades by accident** (c1d29d2) |
| 13 | +`pnpm self-update` now refuses to move backward when the registry's implicit `latest` tag is older than the currently installed version. It also checks the project-pinned version more accurately using the env lockfile, so range-based pins don't trigger false downgrades. |
| 14 | + |
| 15 | +### **`pnpm ci` now reinstalls workspace package dependencies** (b1eccd8) |
| 16 | +`pnpm ci` was missing `recursiveByDefault`, so the clean-install flow only ran at the workspace root and skipped linked workspace package `node_modules`. This fixes broken workspace installs after CI cleanup. |
| 17 | + |
| 18 | +### **User-set `minimumReleaseAge` now defaults to strict mode** (42a8f29) |
| 19 | +When `minimumReleaseAge` is explicitly configured, `minimumReleaseAgeStrict` now defaults to `true` unless the user sets it otherwise. That prevents pnpm from silently falling back to immature versions and makes the setting behave as users expect. |
| 20 | + |
| 21 | +### **`pnpm clean` ignores workspace lockfile config unless asked** (654f575) |
| 22 | +`pnpm clean` now only removes `pnpm-lock.yaml` when the `--lockfile` CLI flag is passed, instead of honoring `lockfile: true` from workspace config. This avoids deleting the lockfile during routine cleanup. |
| 23 | + |
| 24 | +### **Release artifacts now build on macOS for correct signing** (9c7c438) |
| 25 | +The release workflow switched from Ubuntu to macOS so darwin binaries are signed with native `codesign` instead of Linux cross-signing. This fixes broken darwin-x64 signing on newer Node.js fixup layouts and prevents startup crashes in released binaries. |
| 26 | + |
| 27 | +### **Pacquet now emits pnpm progress channels** (315e59b) |
| 28 | +The Rust port added `pnpm:progress` `imported` events and `pnpm:fetching-progress` reporting, wiring package-manager internals through the reporter. This brings pacquet closer to pnpm's observable install behavior and unlocks richer progress output. |
| 29 | + |
| 30 | +### **Pacquet test layout was refactored to external files** (c5dd6b5) |
| 31 | +A large refactor moved inline Rust test modules into dedicated `tests.rs` files and updated the style guide to require that layout. It's mostly structural, but it makes the codebase easier to maintain and aligns tests with the repo's preferred organization. |
| 32 | + |
| 33 | +### Other misc changes |
| 34 | +- Release merge / version bump metadata and generated changelogs |
| 35 | +- Security policy date/version wording updates |
| 36 | +- Docs moved changesets to the correct location |
| 37 | +- Minor maintenance around build/package metadata |
0 commit comments