pnpm 11.20.0

pnpm 11.20.0 was released on August 3, 2026. This release is primarily a security release addressing a package-substitution risk in projects using named registries, and introduces a new built-in registry alias.

Overview

Projects using namedRegistries on pnpm versions 11.1.0 through 11.19.x were affected by a lockfile ambiguity: packages were keyed by name@version alone, with no marker recording which registry a package originated from. When two registries served the same name and version, entries collapsed onto a single packages: entry, and the first-resolved tarball was used for every consumer — meaning a dependency expected from a private registry could be installed from a different registry publishing the same name and version.

Breaking Changes (Semi-Breaking for Named Registry Users)

Packages resolved from a named registry are now recorded under registry-qualified keys — for example foo@work:1.0.0 — ensuring each registry maintains its own entry and the lockfile explicitly pins the provenance of each dependency. The lockfile format version is unchanged, and projects that do not use namedRegistries see no difference.

• Lockfile diff on next install: A non-frozen install re-keys affected entries. This diff is the fix being applied and should be committed after review.
• Team coordination required: All contributors must run 11.20.0 or newer. Older pnpm versions read the re-keyed lockfile but write entries back to the old shape, leaving the project exposed again on subsequent installs.
• No opt-out: There is no setting to preserve the old behavior, as the old shape is the vulnerability.
• Tarball URL handling: Tarball URLs following the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the namedRegistries setting on demand.

New Features

A new built-in npmjs: alias resolves to https://registry.npmjs.org/ with no configuration, alongside the existing gh: alias for GitHub Packages. It pins a dependency to the public registry even when the global registry setting points elsewhere, such as an internal proxy:

{ "dependencies": { "left-pad": "npmjs:^1.3.0" } }

Note that npm: cannot perform this function — it is the alias protocol and resolves through whatever registry points at. For environments that mirror or proxy npmjs, the alias can be pointed at the mirror via namedRegistries. Built-in registry URLs also serve as the prefixes against which a lockfile's recorded tarball URL is matched during package verification; without an override, entries whose URLs do not match the expected prefix may fail verification.

Security Fixes

• Package-substitution risk in named registries resolved — registry-qualified lockfile keys now prevent a dependency declared against one registry from being satisfied by an entry resolved from another.

Migration Notes

For affected projects, upgrade pnpm to 11.20.0, run a non-frozen install, review the resulting lockfile diff for entries moved to unexpected registries, and commit it. Ensure all team members and CI environments are on this version or newer before proceeding.