Upgrade package manager from pnpm 10 to pnpm 11

Open

#146 opened on May 8, 2026 0 comments 0 reactions 1 assignee View on GitHub

@infeo is already working on this.

Since May 8, 2026.

Assessment

This issue has not been assessed yet.

This issue tracks the upgrade of the package manager from pnpm 10 to pnpm 11.

Blog post / release notes: https://pnpm.io/blog/releases/11.0
Migration guide (v10 → v11): https://pnpm.io/blog/releases/11.0#migrating-from-v10-to-v11
GitHub releases: https://github.com/pnpm/pnpm/releases

Node.js 22+ required — support for Node.js 18, 19, 20, and 21 is dropped. pnpm is now pure ESM.
Supply-chain protection on by default — minimumReleaseAge defaults to 1 day (1440 min) and blockExoticSubdeps defaults to true.
allowBuilds replaces legacy build-dependency settings — onlyBuiltDependencies, neverBuiltDependencies, ignoredBuiltDependencies, and ignoreDepScripts are removed.
Configuration split — .npmrc is now auth/registry only; all other pnpm settings must live in pnpm-workspace.yaml or the new global ~/.config/pnpm/config.yaml.
New SQLite-backed store index (store v11) — replaces JSON-per-package index for faster installs.
Native publish flow — pnpm publish, login, logout, etc. no longer delegate to npm CLI.
Isolated global installs via the global virtual store.
New commands — pnpm ci, pnpm sbom, pnpm clean, pnpm peers check, pnpm runtime set, and short pn/pnx aliases.
Environment variables use pnpm_config_* prefix instead of npm_config_*.

Update packageManager field in package.json to [email protected].
Migrate pnpm-workspace.yaml — replace allowBuilds: false entries with the new allowBuilds model; note that strictDepBuilds and related legacy fields are removed.
Ensure CI environment uses Node.js 22+.
Review any .npmrc settings and move non-auth config to pnpm-workspace.yaml.
Update the lockfile (pnpm-lock.yaml) by running pnpm install after the upgrade.
Update scripts/check-pm.js if needed (the npm_config_user_agent env var logic may need updating since pnpm 11 uses pnpm_config_* prefix for its own settings).

This issue was raised in the context of PR #145, which introduced pnpm 10 as the package manager.

Requested by: @infeo

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.