Releases of pnpm
1030 stable releases, newest first. Release notes are kept for the last 90 days; older ones link to where they were published.
11.15.1
19 July 202611.15.0
18 July 202611.14.0
17 July 202611.13.1
16 July 202611.13.0
13 July 202611.12.0
11 July 202611.11.0
9 July 202611.10.0
4 July 202611.9.0
23 June 202611.8.0
18 June 202611.7.0
15 June 202611.6.0
11 June 202611.5.3
10 June 202611.5.2
5 June 202611.5.1
2 June 202611.5.0
29 May 202611.4.0
27 May 202611.3.0
24 May 202611.2.2
21 May 202611.2.1
20 May 202611.2.0
20 May 202611.1.3
18 May 202611.1.2
14 May 202611.1.1
12 May 202611.1.0
11 May 202611.0.9
9 May 202611.0.8
7 May 202611.0.7
6 May 202611.0.6
5 May 202611.0.5
4 May 202611.0.4
2 May 202611.0.3
30 April 202611.0.2
30 April 202611.0.1
29 April 202611.0.0
28 April 202610.34.7
12 October 2026Patch Changes
97f550c: Switching to the pnpm version in
packageManagernow works through registry mirrors that strip npm's signatures or re-sign packages with their own key. pnpm then reads the signature fromhttps://registry.npmjs.org/and verifies it against the integrity of the downloaded pnpm #16778.b11d7bb: The update notification now suggests the standalone install script instead of
pnpm self-updatewhenPNPM_HOMEis not set, such as when another package manager installed pnpm.pnpm self-updateinstalls intoPNPM_HOME, so in that case it cannot replace the pnpm in use.
10.34.6
28 September 2026Generated from commits
Patch Changes
e7888e5:
pnpm self-updatenow resolves and verifies pnpm through registry, authentication, proxy, and TLS settings from trusted non-project configuration. Project configuration and the default project pnpmfile can no longer redirect the pnpm download or disable engine identity verification.46bc7c9: pnpm no longer tells you to update itself with Corepack or with
pnpm add -g:The update notification now suggests
pnpm self-update, or the standalone install script when pnpm is running under Corepack. It used to suggestcorepack use pnpm@<version>, orpnpm add -g pnpm/pnpm add -g @pnpm/exewhen pnpm was not installed by the standalone script — butpnpm add -grefuses to install pnpm and points atpnpm self-updateanyway, and@pnpm/exeis not published for pnpm v12 or newer, where the unscopedpnpmpackage is itself the native executable.pnpm self-updateunder Corepack now points at the standalone install script too, instead of telling you to update pnpm with Corepack.
- security
46bc7c9: Updated
adm-zipto v0.6.0, which fixes a memory-exhaustion vulnerability where a crafted ZIP file could make it allocate 4 GB of memory.adm-zipis used to extract the Node.js, Bun, and Deno archives that pnpm downloads on Windows.
10.34.5
10 July 202610.34.4
18 June 202610.34.3
11 June 202610.34.2
10 June 202610.34.1
27 May 202610.34.0
27 May 202610.33.4
6 May 202610.33.3
4 May 202610.33.2
23 April 202610.33.1
22 April 202610.33.0
24 March 202610.32.1
11 March 202610.32.0
9 March 2026