v7.0.0

[zkochan]

Major Changes

• Node.js 12 is not supported.

• The root package is excluded by default, when running pnpm -r exec|run|add #2769.

• Filtering by path is done by globs.

  In pnpm v6, in order to pick packages under a certain directory, the following filter was used: --filter=./apps

  In pnpm v7, a glob should be used: --filter=./apps/**

  For easier upgrade, we have also added a setting to turn back filtering as it was in v6. Just set legacy-dir-filtering=true in .npmrc.

• The NODE_PATH env variable is not set in the command shims (the files in node_modules/.bin). This env variable was really long and frequently caused errors on Windows.

  Also, the extend-node-path setting is removed.

  Related PR: #4253

• The embed-readme setting is false by default.

• When using pnpm run <script>, all command line arguments after the script name are now passed to the script's argv, even --. For example, pnpm run echo --hello -- world will now pass --hello -- world to the echo script's argv. Previously flagged arguments (e.g. --silent) were interpreted as pnpm arguments unless -- came before it.

• Side effects cache is turned on by default. To turn it off, use side-effects-cache=false.

• The npm_config_argv env variable is not set for scripts #4153.

• pnpx is now just an alias of pnpm dlx.

  If you want to just execute the command of a dependency, run pnpm <cmd>. For instance, pnpm eslint.

  If you want to install and execute, use pnpm dlx <pkg name>.

• pnpm install -g pkg will add the global command only to a predefined location. pnpm will not try to add a bin to the global Node.js or npm folder. To set the global bin directory, either set the PNPM_HOME env variable or the global-bin-dir setting.

• pnpm pack should only pack a file as an executable if it's a bin or listed in the publishConfig.executableFiles array.

• -W is not an alias of --ignore-workspace-root-check anymore. Just use -w or --workspace-root instead, which will also allow to install dependencies in the root of the workspace.

• Allow to execute a lifecycle script in a directory that doesn't match the package's name. Previously this was only allowed with the --unsafe-perm CLI option #3709.

• Local dependencies referenced through the file: protocol are hard linked (not symlinked) #4408. If you need to symlink a dependency, use the link: protocol instead.

• strict-peer-dependencies is true by default #4427.

• A prerelease version is always added as an exact version to package.json. If the next version of foo is 1.0.0-beta.1 then running pnpm add foo@next will add this to package.json:

  {
    "dependencies": {
      "foo": "1.0.0-beta.1"
    }
  }

  PR: #4435

• Dependencies of the root workspace project are not used to resolve peer dependencies of other workspace projects #4469.

• Don't hoist types by default to the root of node_modules #4459.

• Any package with "prettier" in its name is hoisted.

• Changed the location of the global store from ~/.pnpm-store to <pnpm home directory>/store

  On Linux, by default it will be ~/.local/share/pnpm/store
  On Windows: %LOCALAPPDATA%/pnpm/store
  On macOS: ~/Library/pnpm/store

  Related issue: #2574

• 4bed585: The next deprecated settings were removed:

  • frozen-shrinkwrap
  • prefer-frozen-shrinkwrap
  • shared-workspace-shrinkwrap
  • shrinkwrap-directory
  • lockfile-directory
  • shrinkwrap-only
  • store

• Use a base32 hash instead of a hex to encode too long dependency paths inside node_modules/.pnpm #4552.

• New setting added: git-shallow-hosts. When cloning repositories from "shallow-hosts", pnpm will use shallow cloning to fetch only the needed commit, not all the history #4548.

• Lockfile version bumped to v5.4.

• Exit with an error when running pnpm install in a directory that has no package.json file in it (and in parent directories) #4609.

Our Sponsors

What's Changed

• feat!: breaking config changes for v7 by @zkochan in feat!: breaking config changes for v7 #4253
• feat(pack)!: limit what files are packed as executables by @zkochan in feat(pack)!: limit what files are packed as executables #4266
• feat!: pnpx is an alias of pnpm dlx by @zkochan in feat!: pnpx is an alias of pnpm dlx #4267
• feat: run scripts without -- by @gluxon in feat: run scripts without -- #4290
• fix: revert backwards compatible handling of -- for run by @gluxon in fix: revert backwards compatible handling of -- for run #4291
• feat!: global bins should be created only in predefined locations by @zkochan in feat!: global bins should be created only in predefined locations #4280
• ci: use pnpm v7 by @zkochan in ci: use pnpm v7 #4307
• feat!: remove -W option by @zkochan in feat!: remove -W option #4308
• test(audit): fix for 2022-02-15 by @gluxon in test(audit): fix for 2022-02-15 #4340
• feat: -F is a short alias of --filter by @zkochan in feat: -F is a short alias of --filter #4342
• feat: onlyBuiltDependencies by @zkochan in feat: onlyBuiltDependencies #4014
• fix(make-dedicated-lockfile): don't re-resolve dependency versions in dedicated lockfile by @David-Collins in fix(make-dedicated-lockfile): don't re-resolve dependency versions in dedicated lockfile #4350
• test(audit): mock responses from audit endpoint by @zkochan in test(audit): mock responses from audit endpoint #4354
• fix: bad packageManager field by @Jack-Works in fix: bad packageManager field #4356
• feat: use the versions from overrides when adding deps without specs by @zkochan in feat: use the versions from overrides when adding deps without specs #4355
• chore: document the interface of command packages by @illright in chore: document the interface of command packages #3828
• fix: print an info message when NODE_ENV is set to production by @zkochan in fix: print an info message when NODE_ENV is set to production #4362
• test: ignore override if a version is specified at install by @nikoladev in test: ignore override if a version is specified at install #4366
• fix: ignore case, when verifying package name in the store by @zkochan in fix: ignore case, when verifying package name in the store #4368
• fix: peerDependencyRules with * as range by @zkochan in fix: peerDependencyRules with * as range #4370
• feat: run scripts without --unsafe-perm by @zkochan in feat: run scripts without --unsafe-perm #4369
• chore(github): add welcome bot app by @BlackHole1 in chore(github): add welcome bot app #4373
• fix: onlyBuiltDependencies should work by @zkochan in fix: onlyBuiltDependencies should work #4377
• fix: pnpm i should work on virtual drives by @kazuare in fix: pnpm i should work on virtual drives #4386
• fix: throw a meaningful error message on broken lockfile by @zkochan in fix: throw a meaningful error message on broken lockfile #4387
• fix: don't write data from the lockfile to the global store by @zkochan in fix: don't write data from the lockfile to the global store #4395
• fix(resolve-dependencies): a sequence of injected deps via the file protocol by @zkochan in fix(resolve-dependencies): a sequence of injected deps via the file protocol #4415
• feat: the file protocol should always inject the dependency by @zkochan in feat: the file protocol should always inject the dependency #4408
• feat: add own implementation of the init command by @zkochan in feat: add own implementation of the init command #4422
• feat: strict-peer-dependencies is true by default by @zkochan in feat: strict-peer-dependencies is true by default #4427
• feat: respect the npmrc by @spencer17x in feat: respect the npmrc #4425
• feat: a prerelease version is always saved as an exact version by @zkochan in feat: a prerelease version is always saved as an exact version #4435
• feat: prevent deep imports using exports by @zkochan in feat: prevent deep imports using exports #4440
• fix: use @pnpm/graph-sequencer instead of graph-sequencer by @zkochan in fix: use @pnpm/graph-sequencer instead of graph-sequencer #4458
• fix: fetch should allow the same options as install by @zkochan in fix: fetch should allow the same options as install #4460
• fix: typo by @HomyeeKing in fix: typo #4462
• fix(lockfile-utils): checking dependenciesMeta by @zkochan in fix(lockfile-utils): checking dependenciesMeta #4463
• fix: types should not be hoisted to the root of node_modules by @zkochan in fix: types should not be hoisted to the root of node_modules #4459
• chore: replace deprecated String.prototype.substr() by @CommanderRoot in chore: replace deprecated String.prototype.substr() #4479
• Chore/friendly git error by @lawvs in Chore/friendly git error #4488
• fix: handle undefined version spec by @tmkx in fix: handle undefined version spec #4487
• lint: remove duplicate code by @milahu in lint: remove duplicate code #4496
• fix: typo by @HomyeeKing in fix: typo #4499
• feat: don't resolve peer dependencies from workspace root by @zkochan in feat: don't resolve peer dependencies from workspace root #4469
• chore: fix typo by @sudongyuer in chore: fix typo #4516
• fix: set root by @HomyeeKing in fix: set root #4515
• fix(cmd-shim): extend NODE_PATH with path to hidden hoisted dir by @zkochan in fix(cmd-shim): extend NODE_PATH with path to hidden hoisted dir #4513
• chore: public-hoist-pattern prettier config by @fupengl in chore: public-hoist-pattern prettier config #3954
• feat: remove deprecated settings by @zkochan in feat: remove deprecated settings #4519
• feat: the global store location should be inside the pnpm home directory by @zkochan in feat: the global store location should be inside the pnpm home directory #4522
• fix: the file protocol should link all files by default by @zkochan in fix: the file protocol should link all files by default #4532
• fix: dependenciesMeta should be saved into the lockfile by @zkochan in fix: dependenciesMeta should be saved into the lockfile #4538
• fix: resolve peers from linked in dependencies by @zkochan in fix: resolve peers from linked in dependencies #4541
• fix: peer dependency has workspace protocol by @zkochan in fix: peer dependency has workspace protocol #4540
• feat: use a shorter hash for dep path by @zkochan in feat: use a shorter hash for dep path #4552
• feat(git-fetcher): shallow clone when fetching git resource by @kenrick95 in feat(git-fetcher): shallow clone when fetching git resource #4548
• style(*): remove duplicate declarations in TypeScript types by @dev-itsheng in style(*): remove duplicate declarations in TypeScript types #4570
• docs(*): fix problems with sample code in documentation by @dev-itsheng in docs(*): fix problems with sample code in documentation #4572
• fix(exe): use the strict equality operator, and make JSON.parse execute correctly by @dev-itsheng in fix(exe): use the strict equality operator, and make JSON.parse execute correctly #4571
• Improve spnpm to use esbuild by @jondlm in Improve spnpm to use esbuild #4574
• style(*): typo by @dev-itsheng in style(*): typo #4573
• fix(core): prevent duplication of peerDependencyRules in the lockfile by @kamsar in fix(core): prevent duplication of peerDependencyRules in the lockfile #4576
• fix: store integrity check when the lockfile is updated by @zkochan in fix: store integrity check when the lockfile is updated #4580
• Fix add bug with overlapping workspace packages by @jondlm in Fix add bug with overlapping workspace packages #4575
• fix(exec): commands of workspace project should be in PATH by @zkochan in fix(exec): commands of workspace project should be in PATH #4583
• fix(default-reporter): use loglevel to filter deprecation warnings (loglevel=error doesn't supress warnings, such as WARN deprecated and  WARN  Issues with peer dependencies found. #4343) by @milahu in fix(default-reporter): use loglevel to filter deprecation warnings (#4343) #4507
• fix: an edge case with peer resolutions and circular deps by @zkochan in fix: an edge case with peer resolutions and circular deps #4588
• feat: shrink path to the global directory (to reduce chance of too long names on Windows) by @zkochan in feat: shrink path to the global directory (to reduce chance of too long names on Windows) #4591
• fix(filter-workspace-packages): filter not working if the path contains Korean characters by @WhiteKiwi in fix(filter-workspace-packages): filter not working if the path contains Korean characters #4595
• chore: Set permissions for GitHub actions by @neilnaveen in chore: Set permissions for GitHub actions #4607
• fix: only pnpm install should fail on peer dep issues by @zkochan in fix: only pnpm install should fail on peer dep issues #4596
• feat: add legacy-dir-filtering by @zkochan in feat: add legacy-dir-filtering #4610
• fix(init): don't fail if a parent dir has a package.json by @zkochan in fix(init): don't fail if a parent dir has a package.json #4615
• fix: dlx should work without a configured global directory by @zkochan in fix: dlx should work without a configured global directory #4612
• fix(install): exit with an error when no package.json is found by @zkochan in fix(install): exit with an error when no package.json is found #4614
• fix: a file dep has a file dep by @zkochan in fix: a file dep has a file dep #4618
• fix: publish in workspace by @zkochan in fix: publish in workspace #4627
• fix: don't fail when moving packages to node_modules/.ignored by @zkochan in fix: don't fail when moving packages to node_modules/.ignored #4626
• fix: global linking by @zkochan in fix: global linking #4641
• fix(exportable-manifest, types): add typesVersions field to PUBLISH_CONFIG_WHITELIST by @WhiteKiwi in fix(exportable-manifest, types): add typesVersions field to PUBLISH_CONFIG_WHITELIST #4637

New Contributors

• @Jack-Works made their first contribution in fix: bad packageManager field #4356
• @kazuare made their first contribution in fix: pnpm i should work on virtual drives #4386
• @spencer17x made their first contribution in feat: respect the npmrc #4425
• @HomyeeKing made their first contribution in fix: typo #4462
• @CommanderRoot made their first contribution in chore: replace deprecated String.prototype.substr() #4479
• @lawvs made their first contribution in Chore/friendly git error #4488
• @tmkx made their first contribution in fix: handle undefined version spec #4487
• @sudongyuer made their first contribution in chore: fix typo #4516
• @fupengl made their first contribution in chore: public-hoist-pattern prettier config #3954
• @dev-itsheng made their first contribution in style(*): remove duplicate declarations in TypeScript types #4570
• @jondlm made their first contribution in Improve spnpm to use esbuild #4574
• @kamsar made their first contribution in fix(core): prevent duplication of peerDependencyRules in the lockfile #4576
• @WhiteKiwi made their first contribution in fix(filter-workspace-packages): filter not working if the path contains Korean characters #4595
• @neilnaveen made their first contribution in chore: Set permissions for GitHub actions #4607

Full Changelog: v6.31.0...v7.0.0

---

This discussion was created from the release v7.0.0.

[melMass]

One breaking change that cause me quite some headache so to avoid others the same:

pnpx which is now aliased to pnpm dlx has broken the lock file of all my projects.
I was using it as part of a git hook pnpx commitlint & pnpx lint-staged.
It now adds ../../../../Library/pnpm/store/v3/tmp/dlx-<random-id> as part of the lock file importers breaking pretty much everything.

I'm not sure to understand the use case for this behaviour or dlx, but my solution was to install those dev deps to my workspace root and use pnpm in-place of pnpx.

[zkochan]

I couldn't reproduce this. Tried with v7.1.0. Created an empty project, installed express. Executed pnpx eslint. The lockfile did not change.

[melMass]

I couldn't reproduce this. Tried with v7.1.0. Created an empty project, installed express. Executed pnpx eslint. The lockfile did not change.

Ah interesting, sorry I thought it was supposed to be like that. I'll make a repro folder now and open an issue with it that I'll reference here!