pnpm 12.0.0

pnpm 12.0.0 was released on August 26, 2026 as the latest major version of the fast, disk-space-efficient package manager for JavaScript. This release introduces three significant changes around Git dependencies, workspace configuration validation, and deterministic dependency resolution. Version 12.0.0 is the current stable line; installation can be completed through npm, Corepack, or the standalone setup script.

Git Dependencies as Identities

Git dependencies on known hosts, including GitHub, GitLab, and Bitbucket, are now treated as identities rather than transport choices. Every representation of the same repository, such as github:owner/repo, owner/repo, git+https, and git+ssh, resolves through the host canonical HTTPS URL, and the lockfile never records an SSH URL for them. Repositories whose archive endpoint is reachable anonymously resolve to the host archive for fast tarball downloads; all others resolve to a git clone of the canonical HTTPS URL, which any machine with access to the repository can fetch. This removes the network probing that previously decided between HTTPS and SSH at resolution time, a step that could record a transport working only on the machine that happened to run the resolution.

For private hosted repositories that require SSH, users configure the machine with git own URL rewriting, such as git config --global url."[email protected]:".insteadOf https://github.com/, and pnpm shells out to git so the rewrite applies to all pnpm git operations automatically.

Workspace Configuration Validation

The pnpm-workspace.yaml file may no longer carry a setting pnpm does not recognize. Previously such a setting was ignored silently, which meant a misspelled minimumReleaseAge could drop the policy it intended to set. Now the file is reported, with pnpm suggesting the closest real setting name when a key looks like a typo. When a project pins a pnpm version that the running pnpm satisfies, the command fails with ERR_PNPM_UNRECOGNIZED_WORKSPACE_SETTINGS because the setting cannot be meant for a different version. Everywhere else the unknown key becomes a warning, so projects awaiting cleanup keep working. The pnpm config subcommands never fail on such a setting, allowing an broken file to be inspected and repaired.

Canonical Dependency Cycle Breaking

Dependency cycles are now broken canonically during peer resolution. Members of each cycle are ordered by package id, and the edges that close a cycle are always cut at the same place regardless of where the installation walks into the cycle from. Previously the cut depended on the walk path, so installing the same dependencies could produce different lockfiles depending on importer order or resolution order. This change makes lockfile generation more reproducible and predictable across machines and setups.

Migration Notes

Teams upgrading from pnpm 11 should review the breaking change around workspace settings, since a previously ignored invalid key will now surface as a warning or error. The changes to Git dependency handling are largely transparent, but projects relying on SSH URLs recorded in lockfiles should verify their hosts are configured correctly before switching. Attributions to the pnpm maintainers and contributors apply per the project changelog.