pnpm 11.28

Official pnpm changelog summary with source attribution, release tags, and community reactions.

Track this pnpm release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

pnpm·Sep 25, 2026, 10:39 AMFixSecurity-relevantAI-assisted summary

Summary

Introduces the forceIgnoresPlatform setting, allowing pnpm to skip optional dependencies that don't match the host OS/CPU/libc when disabled.
Adds multiple security hardenings: stops expanding env vars in workspace userAgent, fixes Nix bin shim vulnerabilities, sanitizes shell completion entries, and enforces immediate TLS certificate validation errors.
Fixes a wide range of bugs in install, update, deploy, peer resolution, custom modulesDir handling, git submodule fetching, tarball integrity, lockfile updates, and readPackage hook processing.