pnpm 11.21.0

OK PNPM 11.21.0 JUST DROPPED ☕️ The package manager that never sleeps is back with a fresh release, and it's all about fixing the stuff that actually breaks your day period.

Released August 9, 2026. Patch-heavy, but there's a shiny minor change in there too. Let's get into it.

What's New

Interactive group selection lands in pnpm update --global --interactive. Pick your packages in groups instead of scrolling through everything period.

And a warning for the sudo crowd ⚠️ Running pnpm setup, pnpm self-update, or pnpm add --global under sudo now yells at you. pnpm keeps globals in YOUR home dir, not root's — so those commands silently hit the wrong user's space.

Heads up: they become hard errors (ERR_PNPM_SUDO_NOT_SUPPORTED) in pnpm v12. Read-only global commands like pnpm bin --global are fine.

The Fixes You Actually Care About

pnpm no longer fails to start under async Node.js module loaders when there's no .pnpmfile.mjs pnpm/pnpm#11701. That one was weird to debug period.

Removing a dependency from package.json no longer re-resolves the whole dependency graph. Lockfile entry dropped, unreachable stuff pruned, catalog orphans cleaned — all without registry access 🚀

Same speed-up for catalog exact-version swaps and patchedDependencies edits. The lockfile gets rewritten in place, the store does the work, done.

CI Runners, This One's For You

The github:owner/repo install failure on SSH-less CI runners is squashed 🐛 No more Permission denied (publickey) for no reason. The git resolver tries anonymous HTTPS git ls-remote before SSH now, and retries transient 429s instead of assuming your repo is private pnpm/pnpm#13276.

Private git repos also fail fast now — no more hanging on an interactive credential prompt pnpm/pnpm#13522. CI won't freeze waiting for input that's never coming.

The auto packageManager version switch works again on mirrored registries (Artifactory-style feeds included) pnpm/pnpm#13619. And registries that strip npm signatures no longer break pnpm self-update — pnpm fetches the signature from the real registry instead pnpm/pnpm#13147.

The Little Things

ng build and nuxt build work under the global virtual store. Compatibility extensions now inject the tslib and unplugin deps those builders forget to declare.

Lockfile verification honors offline mode. No registry? No problem — cached metadata or a clean ERR_PNPM_NO_OFFLINE_META.

The held-back-update warning no longer lies about why a version wasn't picked when minimumReleaseAge is the real gate pnpm/pnpm#13071.

pnpm fetch and virtualStoreOnly installs stop writing a fake .pnp.cjs under nodeLinker: pnp. And pnpm physically can't delete your project files when modulesDir points at the project root anymore. Safety first period.

Upgrade Now?

Yes. Run pnpm self-update and be amazed at how many subtle lockfile bugs were hiding in plain sight.

Full changelog on GitHub 👉 pnpm/pnpm releases. Go get it rn 🔗