pnpm 11.22.0

pnpm 11.22.0 has been released — the latest stable version of the fast, disk-efficient package manager for JavaScript. The August 15, 2026 release focuses on config hardening, faster Node.js runtime resolution, and safer global installs.

What Changed

The headline addition is pnpm cache path, a new command that prints the directory pnpm uses for its metadata cache. CI setups can use it to cache that directory — including the lockfile verification log — which lets a job skip re-checking an unchanged lockfile against the configured supply-chain policies.

Node.js runtime resolution is now noticeably faster. The per-version release metadata is cached in the pnpm cache directory after its signature is verified, and an exact stable version such as runtime:22.23.2 no longer downloads the Node.js release index. A pinned runtime whose metadata was fetched once resolves without any network access.

Why It Matters

The release closes a config-hygiene gap that has bothered security-conscious teams for a while. --config.config-dir no longer reaches the config through a project's pnpm-workspace.yaml, and neither do the --config. spellings of other machine-level settings. None of them was ever a supported way to set those directories — the flags took effect only because the project-manifest merge re-applied the command line afterwards.

Similarly, pnpm config set now refuses to write a setting to a project's pnpm-workspace.yaml that pnpm does not read from there, failing with ERR_PNPM_CONFIG_SET_NOT_A_PROJECT_SETTING and naming where the setting does belong.

New Setting and Rename

A new setting, minimumReleaseAgeExcludePrune, prunes the entries of minimumReleaseAgeExclude in pnpm-workspace.yaml that the freshly written lockfile no longer resolves. Versions that are gone are dropped, and entries for packages no longer in the lockfile are removed too. The release also renames cleanupUnusedCatalogs to catalogPrune; the old name still works, but catalogPrune wins when both are set.

Fixes and Install Improvements

• Atomic global installs — shims point at a stable per-package link, so pnpm add -g and pnpm update -g activate a new version by moving one link instead of rewriting every shim.
• Smarter pnpm add — no longer re-resolves the dependency graph when pnpm-lock.yaml already holds a satisfying version.
• Intermittent ENOENT/ENOTEMPTY fixed — errors while renaming _tmp_* directories during installs with nodeLinker: hoisted in workspaces using patchedDependencies are resolved.
• Cleaner pnpm audit --fix — no longer adds minimumReleaseAgeExclude entries for patched versions published before the cutoff.

What's Next

Update with pnpm add -g pnpm@latest or your package manager of choice. The config-behavior changes only affect unsupported spellings, so most projects can upgrade without touching their workspace files.