pnpm

In version 10.16, PNPM introduced the minimumReleaseAge setting. This allows you to specify a minimum age that a published package must have before PNPM will install it. The idea behind delayed dependency updates is that most compromised packages are taken down quickly.

Minor Changes

• New setting called virtual-store-dir-max-length added to modify the maximum allowed length of the directories inside node_modules/.pnpm. The default length is set to 120 characters. This setting is particularly useful on Windows, where there is a limit to the maximum length of a file path #7355.

Patch Changes

• A dependency is hoisted to resolve an optional peer dependency only if it satisfies the range provided for the optional peer dependency #8028.
• Details in the pnpm outdated output are wrapped correctly #8037.
• Fix Cannot read properties of undefined (reading 'missingPeersOfChildren') exception that happens on install #8041.
• Explicitly throw an error when user attempts to run publish or pack when bundledDependencies is set but node-linker isn't hoisted.
• pnpm update should not fail when there's an aliased local workspace dependency #7975.

Patch Changes

• The exit code of the child process should be preserved on pnpm run
• When sorting packages in a workspace, take into account workspace dependencies specified as peerDependencies
• Add --ignore-scripts argument to prune command