pnpm 7.0.0-alpha.2

v7.0.0-alpha.2

on Node.js NPM

Major Changes

• The root package is excluded by default, when running pnpm -r exec|run|add #2769.

• Filtering by path is done by globs.

  In pnpm v6, in order to pick packages under a certain directory, the following filter was used: --filter=./apps

  In pnpm v7, a glob should be used: --filter=./apps/**

• The NODE_PATH env variable is not set in the command shims (the files in node_modules/.bin). This env variable was really long and frequently caused errors on Windows.

  Also, the extend-node-path setting is removed.

  Related PR: #4253

• The embed-readme setting is false by default.

• When using pnpm run <script>, all command line arguments after the script name are now passed to the script's argv, even --. For example, pnpm run echo --hello -- world will now pass --hello -- world to the echo script's argv. Previously flagged arguments (e.g. --silent) were intepreted as pnpm arguments unless -- came before it.

• Side effects cache is turned on by default. To turn it off, use side-effects-cache=false.

• The npm_config_argv env variable is not set for scripts #4153.

• pnpx is now just an alias of pnpm dlx.

  If you want to just execute the command of a dependency, run pnpm <cmd>. For instance, pnpm eslint.

  If you want to install and execute, use pnpm dlx <pkg name>.

• pnpm install -g pkg will add the global command only to a predefined location. pnpm will not try to add a bin to the global Node.js or npm folder. To set the global bin directory, either set the PNPM_HOME env variable or the global-bin-dir setting.

• pnpm pack should only pack a file as an executable if it's a bin or listed in the publishConfig.executableFiles array.

• -W is not an alias of --ignore-workspace-root-check anymore. Just use -w or --workspace-root instead, which will also allow to install dependencies in the root of the workspace.

Minor Changes

• -F is a short alias of --filter #3467.

• A new setting is supported in the pnpm section of the package.json file #4001. onlyBuiltDependencies is an array of package names that are allowed to be executed during installation. If this field exists, only mentioned packages will be able to run install scripts.

  {
    "pnpm": {
      "onlyBuiltDependencies": ["fsevents"]
    }
  }

• When adding a new dependency, use the version specifier from the overrides, when present #4313.

  Normally, if the latest version of foo is 2.0.0, then pnpm add foo installs foo@^2.0.0. This behavior changes if foo is specified in an override:

  {
    "pnpm": {
      "overrides": {
        "foo": "1.0.0"
      }
    }
  }

  In this case, pnpm add foo will add foo@1.0.0 to the dependency. However, if a version is explicitly specifying, then the specified version will be used and the override will be ignored. So pnpm add foo@0 will install v0 and it doesn't matter what is in the overrides.

What's Changed

• feat!: breaking config changes for v7 by @zkochan in #4253
• feat(pack)!: limit what files are packed as executables by @zkochan in #4266
• feat!: pnpx is an alias of pnpm dlx by @zkochan in #4267
• feat: run scripts without -- by @gluxon in #4290
• fix: revert backwards compatible handling of -- for run by @gluxon in #4291
• feat!: global bins should be created only in predefined locations by @zkochan in #4280
• ci: use pnpm v7 by @zkochan in #4307
• feat!: remove -W option by @zkochan in #4308
• test(audit): fix for 2022-02-15 by @gluxon in #4340
• feat: -F is a short alias of --filter by @zkochan in #4342
• feat: onlyBuiltDependencies by @zkochan in #4014
• fix(make-dedicated-lockfile): don't re-resolve dependency versions in dedicated lockfile by @David-Collins in #4350
• test(audit): mock responses from audit endpoint by @zkochan in #4354
• fix: bad packageManager field by @Jack-Works in #4356
• feat: use the versions from overrides when adding deps without specs by @zkochan in #4355

New Contributors

• @Jack-Works made their first contribution in #4356

Full Changelog: v6.31.0...v7.0.0-alpha.2