pnpm 12.19.0 shipped on 10 November 2026 with a new pnpm fund command, a much less fiddly loaded node linker, a new peer-dependency setting for monorepos, an experimental diff-friendly lockfile format and a security fix that stops credentials leaking into error messages. If your Node.js projects use pnpm, this guide shows what each change does and how to try it safely.

Upgrade

If you pin pnpm through the packageManager field in package.json, update that field. Otherwise use pnpm’s own updater:

pnpm self-update
pnpm --version   # should print 12.19.0 or later

Commit the change so CI and teammates get the same version. The release also fixes pnpm self-update behind proxies that close TLS connections without a close_notify alert, which previously failed with ERR_PNPM_PNPM_ENGINE_IDENTITY_UNVERIFIABLE.

1. pnpm fund: see who you depend on

npm has had npm fund for years. pnpm 12.19 adds the equivalent, listing the funding URLs declared by installed dependencies in the same tree format:

# Funding links for the current project
pnpm fund

# npm-compatible JSON, e.g. for a sponsorship dashboard
pnpm fund --json > funding.json

# Every project in a workspace, or a filtered subset
pnpm fund --recursive
pnpm fund --filter "./apps/*"

# Open one package's funding URL; pick one if it lists several
pnpm fund react --which=github

A practical use: run pnpm fund --json in CI once a month and feed the output to whoever manages your open-source sponsorship budget. Because the JSON matches npm fund --json, existing scripts written for npm should keep working.

2. The loaded linker no longer needs a build list

The loaded node linker loads packages from the store instead of copying them into node_modules. Before 12.19, packages that needed a build step (native addons, postinstall scripts) had to be listed manually in nodeLinker.excluded. That list was easy to get wrong.

Now, according to the release notes:

  • A package with a matching side-effects cache entry loads straight from the store.
  • With side-effects cache reads and writes enabled, pnpm builds an approved package once, saves the result, and loads it from the store afterwards, even in other projects that share the store. Its build script does not run again.
  • Other cache misses, packages with native .node addons and their dependencies are materialised automatically.
  • pnpm scans JavaScript sources for filesystem imports and for __dirname or import.meta, and materialises matching packages. It cannot detect computed imports, so those packages still belong in nodeLinker.excluded.

Linker settings live in pnpm-workspace.yaml. A minimal setup looks like this:

# pnpm-workspace.yaml
packages:
  - "apps/*"
  - "packages/*"

nodeLinker:
  type: loaded
  # Only for packages using computed/dynamic file imports:
  excluded:
    - some-plugin-loader

sideEffectsCache:
  # Builds that must run in every project, e.g. a git hook installer
  exclude:
    - husky

If you already maintain a long excluded list, try removing it on a branch, run pnpm install and your test suite, and add back only the packages that actually fail.

3. projectScopedOptionalPeers for monorepos

In a workspace, one project’s devDependencies could satisfy another project’s optional peer dependency, which hides real missing dependencies until you deploy that project alone. The new projectScopedOptionalPeers setting fixes that. When it is true, a project gets a missing optional peer only if its own dependencies install a version of it. dedupePeerDependents continues to deduplicate everything else.

# pnpm-workspace.yaml
projectScopedOptionalPeers: true

Turn it on, reinstall, and check that each app still builds and starts. Anything that breaks was relying on a neighbour’s dependency.

4. Experimental v13 lockfile format

Lockfile merge conflicts are a common monorepo pain. The experimental lockfile.format: v13 setting writes pnpm-lock.yaml in a JSON-like syntax, indented with tabs and with a trailing comma after every entry. It is still valid YAML. Each package version gets one entry, replacing the separate packages and snapshots sections, and peer versions are recorded as properties, so updating a peer changes only the lines that record its version.

# pnpm-workspace.yaml
lockfile:
  format: v13

pnpm reads both formats regardless of the setting, but every machine that writes the lockfile must run 12.19 or later. Because the feature is experimental, try it in one repository first.

5. Security and reliability fixes

  • Credentials: when a tarball is missing from the store in offline mode, the error no longer prints the credentials or token in the tarball URL. If your CI logs are public, that is reason enough to upgrade.
  • Registry placeholders: a ${VAR} placeholder in a registry URL in pnpm-workspace.yaml or the project .npmrc now fails the command. Before, pnpm ignored such a URL and could resolve packages from another registry such as npmjs.org.
  • No accidental files: pnpm install outside a workspace now fails with ERR_PNPM_NO_PKG_MANIFEST when there is no manifest, instead of creating a package.json, lockfile and node_modules.
  • Engine checks: install, add, update and remove now check engines, os, cpu and libc for every workspace project, including the root. An incompatible engines.node prints a warning, or fails with engineStrict.
  • Hangs fixed: including a case where running node in a project that pins its Node.js version kept spawning processes until memory ran out.

Check your engines field

Because every workspace project is now checked, an outdated engines entry in a forgotten package may start producing warnings. Make the expectation explicit in the root package.json:

{
  "packageManager": "[email protected]",
  "engines": {
    "node": ">=22"
  }
}

Takeaway

pnpm 12.19 is an easy upgrade with real benefits: an npm-compatible fund command, a loaded linker that no longer needs a hand-maintained build list, stricter optional peers for monorepos, and a credential-leak fix. Upgrade, look at the new engine warnings, and try projectScopedOptionalPeers and the v13 lockfile on a branch before rolling them out.

Source: pnpm v12.19.0 release notes.