Sourced from pnpm's releases.

pnpm 10.21

Minor Changes

• Node.js Runtime Installation for Dependencies. Added support for automatic Node.js runtime installation for dependencies. pnpm will now install the Node.js version required by a dependency if that dependency declares a Node.js runtime in the "engines" field. For example:

  {
    "engines": {
      "runtime": {
        "name": "node",
        "version": "^24.11.0",
        "onFail": "download"
      }
    }
  }
  

  If the package with the Node.js runtime dependency is a CLI app, pnpm will bind the CLI app to the required Node.js version. This ensures that, regardless of the globally installed Node.js instance, the CLI will use the compatible version of Node.js.

  If the package has a postinstall script, that script will be executed using the specified Node.js version.

  Related PR: #10141

• Added a new setting: trustPolicy.

  When set to no-downgrade, pnpm will fail installation if a package’s trust level has decreased compared to previous releases — for example, if it was previously published by a trusted publisher but now only has provenance or no trust evidence. This helps prevent installing potentially compromised versions of a package.

  Related issue: #8889.

• Added support for pnpm config get globalconfig to retrieve the global config file path #9977.

Patch Changes

• When a user runs pnpm update on a dependency that is not directly listed in package.json, none of the direct dependencies should be updated #10155.
• Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #10160.
• Setting gitBranchLockfile and related settings via pnpm-workspace.yaml should work #9651.

Platinum Sponsors

... (truncated)

Sourced from pnpm's changelog.

10.21.0

Minor Changes

• Node.js Runtime Installation for Dependencies. Added support for automatic Node.js runtime installation for dependencies. pnpm will now install the Node.js version required by a dependency if that dependency declares a Node.js runtime in the "engines" field. For example:

  {
    "engines": {
      "runtime": {
        "name": "node",
        "version": "^24.11.0",
        "onFail": "download"
      }
    }
  }
  

  If the package with the Node.js runtime dependency is a CLI app, pnpm will bind the CLI app to the required Node.js version. This ensures that, regardless of the globally installed Node.js instance, the CLI will use the compatible version of Node.js.

  If the package has a postinstall script, that script will be executed using the specified Node.js version.

  Related PR: #10141

• Added a new setting: trustPolicy.

  When set to no-downgrade, pnpm will fail installation if a package’s trust level has decreased compared to previous releases — for example, if it was previously published by a trusted publisher but now only has provenance or no trust evidence. This helps prevent installing potentially compromised versions of a package.

  Related issue: #8889.

• Added support for pnpm config get globalconfig to retrieve the global config file path #9977.

Patch Changes

• When a user runs pnpm update on a dependency that is not directly listed in package.json, none of the direct dependencies should be updated #10155.
• Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #10160.
• Setting gitBranchLockfile and related settings via pnpm-workspace.yaml should work #9651.

• c1ec45b chore: fix repository URLs in package.json files of utils
• 2e2dc27 chore(release): 10.21.0
• 68ad086 feat: add support for npm package trust evidence check via a new trustPolicy ...
• 17344ca fix(update): prevent package.json updates when updating indirect dependencies...
• 5847af4 feat: install js runtime as prod dependency (#10141)
• See full diff in compare view

• a6d9e7d 1.5.249
• 75bcf1f generate new version
• See full diff in compare view

• 810d416 2.0.1
• fb58069 Limit size of path normalization caches
• f02c74f test: fix that some Stats fields are no longer iterable
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions