v7.4.0

Compare Source

Minor Changes

• Dependencies patching is possible via the pnpm.patchedDependencies field of the package.json.
  To patch a package, the package name, exact version, and the relative path to the patch file should be specified. For instance:

  {
    "pnpm": {
      "patchedDependencies": {
        "eslint@1.0.0": "./patches/eslint@1.0.0.patch"
      }
    }
  }

• Two new commands added: pnpm patch and pnpm patch-commit.

  pnpm patch <pkg> prepares a package for patching. For instance, if you want to patch express v1, run:

  pnpm patch express@1.0.0
  

  pnpm will create a temporary directory with express@1.0.0 that you can modify with your changes.
  Once you are read with your changes, run:

  pnpm patch-commit <path to temp folder>
  

  This will create a patch file and write it to <project>/patches/express@1.0.0.patch.
  Also, it will reference this new patch file from the patchedDependencies field in package.json:

  {
    "pnpm": {
      "patchedDependencies": {
        "express@1.0.0": "patches/express@1.0.0.patch"
      }
    }
  }

• A new experimental command added: pnpm deploy. The deploy command takes copies a project from a workspace and installs all of its production dependencies (even if some of those dependencies are other projects from the workspace).

  For example, the new command will deploy the project named foo to the dist directory in the root of the workspace:

  pnpm --filter=foo deploy dist
  

• package-import-method supports a new option: clone-or-copy.

• New setting added: include-workspace-root. When it is set to true, the run, exec, add, and test commands will include the root package, when executed recursively #​4906

Patch Changes

• Don't crash when pnpm update --interactive is cancelled with Ctrl+c.

• The use-node-version setting should work with prerelease Node.js versions. For instance:

  use-node-version=18.0.0-rc.3
  

• Return early when the lockfile is up-to-date.

• Resolve native workspace path for case-insensitive file systems #​4904.

• Don't link local dev dependencies, when prod dependencies should only be installed.

• pnpm audit --fix should not add an override for a vulnerable package that has no fixes released.

• Update the compatibility database.

Our Gold Sponsors

Full Changelog: pnpm/pnpm@v7.3.0...v7.4.0

v7.3.0

Compare Source

Minor Changes

• A new setting added: pnpm.peerDependencyRules.allowAny. allowAny is an array of package name patterns, any peer dependency matching the pattern will be resolved from any version, regardless of the range specified in peerDependencies. For instance:

  {
     "pnpm": {
       "peerDependencyRules": {
         "allowAny": ["@​babel/*", "eslint"]
       }
     }
  }

  The above setting will mute any warnings about peer dependency version mismatches related to @babel/ packages or eslint.

• The pnpm.peerDependencyRules.ignoreMissing setting may accept package name patterns. So you may ignore any missing @babel/* peer dependencies, for instance:

  {
    "pnpm": {
      "peerDependencyRules": {
        "ignoreMissing": ["@​babel/*"]
      }
    }
  }

• Experimental. New settings added: use-git-branch-lockfile, merge-git-branch-lockfiles, merge-git-branch-lockfiles-branch-pattern #​4475.

Patch Changes

• Packages that should be built are always cloned or copied from the store. This is required to prevent the postinstall scripts from modifying the original source files of the package.

Our Sponsors

Full Changelog: pnpm/pnpm@v7.2.1...v7.3.0