pnpm 11.27

Official pnpm changelog summary with source attribution, release tags, and community reactions.

Track this pnpm release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

pnpm·Sep 12, 2026, 09:22 PMFixSecurity-relevantAI-assisted summary

Summary

Added global nodeDownloadMirrors config and new trustPolicyExcludePrune setting to prune unused trust‑policy entries.
Fixed many bugs: safe global add/update/remove, fetch timeout with progress, peer‑dependency checks, readPackage hook side‑effects, auto‑install of missing transitive peers, GitHub Actions reference handling, registry precedence, build‑s...
Adjusted devEngines pin handling, license listing, SBOM author omission, SPDX timestamp format, cache view labeling, and nodeExperimentalPackageMap file generation.