pnpm 12.9.1

Package manager pnpm has released version 12.9.1, a patch update published October 3, 2026. The standout change is a substantial reduction in package size and a fix for publishing with provenance from GitLab CI.

What Changed

The WebAssembly build for StackBlitz WebContainers now ships as a separate @pnpm/wasm package. The main pnpm and @pnpm/exe packages no longer include it, shrinking their unpacked size from roughly 55 MB to about 4 MB. Developers running inside a WebContainer should install @pnpm/wasm with npm to get the pnpm command.

Why It Matters

• Smaller installs - The core package drops from about 55 MB to 4 MB unpacked.
• GitLab provenance - pnpm publish with provenance from GitLab CI is no longer rejected by the npm registry with a 422 error. The provenance statement now includes GitLab CI variables in invocation.parameters.
• Registry redirects - pnpm audit signatures now respects the TLS settings of the redirect target, such as when a request redirects to registry.npmjs.org.
• Lockfile fix - pnpm install --frozen-lockfile accepts an up-to-date lockfile when an injected workspace package uses a catalog entry in peerDependencies.
• Git filter - The [since] filter selector works again with Git 2.24 through 2.27.

What is Next

Existing users can upgrade through pnpm itself. The size reduction alone is reason enough to move for anyone managing containerized or restricted environments.