pnpm 9.0.0-rc.0 on Node.js NPM

Installation instructions: https://pnpm.io/9.x/installation

Major Changes

Node.js v16 support dropped. Use at least Node.js v18.12.
Lockfile version bumped to v9.
Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 #7470.
The dedupe-injected-deps setting is true by default.
The default value of the link-workspace-packages setting changed from true to false. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol.
The default value of the hoist-workspace-packages is true.
pnpm licenses list prints license information of all versions of the same package in case different versions use different licenses. The format of the pnpm licenses list --json output has been changed #7528.
A new command added for printing completion code to the console: pnpm completion [shell]. The old command that modified the user's shell dotfiles has been removed #3083.
pnpm will now check the package.json file for a packageManager field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.
enable-pre-post-scripts is set to true by default. This means that when you run a script like start, prestart and poststart will also run.
When installing git-hosted dependencies, only pick the files that would be packed with the package #7638.
Use the same directory for state files on macOS as on Linux (~/.local/state/pnpm).

Peer dependencies of peer dependencies are now resolved correctly. When peer dependencies have peer dependencies of their own, the peer dependencies are grouped with their own peer dependencies before being linked to their dependents.

For instance, if card has react in peer dependencies and react has typescript in its peer dependencies, then the same version of react may be linked from different places if there are multiple versions of typescript. For instance:

project1/package.json
{
  "dependencies": {
    "card": "1.0.0",
    "react": "16.8.0",
    "typescript": "7.0.0"
  }
}
project2/package.json
{
  "dependencies": {
    "card": "1.0.0",
    "react": "16.8.0",
    "typescript": "8.0.0"
  }
}
node_modules
  .pnpm
    card@1.0.0(react@16.8.0(typescript@7.0.0))
      node_modules
        card
        react --> ../../react@16.8.0(typescript@7.0.0)/node_modules/react
    react@16.8.0(typescript@7.0.0)
      node_modules
        react
        typescript --> ../../typescript@7.0.0/node_modules/typescript
    typescript@7.0.0
      node_modules
        typescript
    card@1.0.0(react@16.8.0(typescript@8.0.0))
      node_modules
        card
        react --> ../../react@16.8.0(typescript@8.0.0)/node_modules/react
    react@16.8.0(typescript@8.0.0)
      node_modules
        react
        typescript --> ../../typescript@8.0.0/node_modules/typescript
    typescript@8.0.0
      node_modules
        typescript

In the above example, both projects have card in dependencies but the projects use different versions of typescript. Hence, even though the same version of card is used, card in project1 will reference react from a directory where it is placed with typescript@7.0.0 (because it resolves typescript from the dependencies of project1), while card in project2 will reference react with typescript@8.0.0.

Related issue: #7444.

Related PR: #7606.

Optional peer dependencies may be resolved from any packages in the dependency graph #7830.

Minor Changes

It is now possible to install only a subdirectory from a Git repository.
For example, pnpm add github:user/repo#path:packages/foo will add a dependency from the packages/foo subdirectory.
This new parameter may be combined with other supported parameters separated by &. For instance, the next command will install the same package from the dev branch: pnpm add github:user/repo#dev&path:packages/bar.
Related issue: #4765.
Related PR: #7487.
node-gyp updated to version 10.
PowerShell completion support added #7597.
Support node-options option inside .npmrc file when running scripts #7596.
Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported: <registryURL>:certfile, <registryURL>:keyfile, and <registryURL>:ca. For instance:
```
//registry.mycomp.com/:certfile=server-cert.pem
//registry.mycomp.com/:keyfile=server-key.pem
//registry.mycomp.com/:cafile=client-cert.pem
```
Related issue: #7427.
Related PR: #7626.
Add a field named ignoredOptionalDependencies. This is an array of strings. If an optional dependency has its name included in this array, it will be skipped #7714.
The checksum of the .pnpmfile.cjs is saved into the lockfile. If the pnpmfile gets modified, the lockfile is reanalyzed to apply the changes #7662.
Added cache for pnpm dlx #5277.

Patch Changes

Package tarballs are not downloaded during --lockfile-only installation #1328.
Peer dependency rules should only affect reporting, not data in the lockfile #7758.
Link overrides should be able to use absolute path #7749.