pnpm 12.4.2

pnpm 12.4.2 just dropped, and I spent the morning stress-testing it against workspaces with heavy node_modules setups. The headline here is security: this release ships fixes for executable shims and GitHub Actions link generation, along with slower-to-see reliability work that makes installs and peer dependency checks noticeably steadier in large monorepos.

If you have been hitting the dreaded ERR_PNPM_PACKAGE_MANAGER_REMOVE_MODULES_DIR on Windows when clearing a node_modules folder that holds linked dependencies, that failure is gone. Switching nodeLinker on Windows no longer trips over the leftover linked packages, which removes a whole class of flaky no-op installs.

What got fixed

• Invalid peer dependency specifiers rejected: a value like "foo": "[email protected]" previously created a broken directory link; it now fails fast with ERR_PNPM_INVALID_PEER_DEPENDENCY_SPECIFICATION.
• Single-pass lockfile updates: pnpm update settles the lockfile in one run when an upgrade removes the package providing an optional peer dependency.
• pnpm update --no-save fixes: override-applied specifiers are preserved, so subsequent frozen installs no longer blow up with ERR_PNPM_OUTDATED_LOCKFILE, and the command now works under minimumReleaseAgeStrict once every resolved version is old enough.
• Faster peer checks in workspaces: dependency resolution in large workspaces is snappier because pnpm no longer waits around for repeated lifecycle-script execution before pnpm run and pnpm exec.

Python lockfiles, one step further

The release notes also highlight Python lockfiles that now work across compatible targets. For teams mixing Node and Python in the same repo, pnpm is quietly becoming the one tool that keeps both sides of the dependency graph consistent.

Should you upgrade?

Short answer: yes, and soon. Most of this release is defense-in-depth plus elimination of edge-case failures rather than new features, but the security angle on shims and Actions links is the kind of thing you do not want to sit on. The upgrade is a drop-in swap for anyone already on the 12.x line; the lockfile format did not change.

Verdict: update now. The install-time reliability wins and the security fixes justify it on their own.