Open issues created in 2026: what still reproduces on pnpm 12

Continuing the passes that produced #15129, #15130, #15131, #15137 and #15143, this one covers every open issue created in 2026: 477 in total, from #10415 (2026-01-06) to #15141 (2026-09-19), leaving out the five umbrella issues themselves. Each was checked against pnpm 12.5.1 on Linux, with the linked reproduction wherever one was given, and in a container for the reports about Alpine and about self-update.

144 of them were closed, each with a comment saying why. The recurring reasons: the behavior reported is what pnpm 12 already does, from pnpm why listing every dependent to pnpm audit counting its own ignores; the setting or flag being asked for exists, among them --save-prefix, --allow-build, audit --registry and minimumReleaseAgeExcludePrune; the crash or hang was in the Node.js CLI and is gone with it; and a number of reports have no reproduction that survives.

This issue tracks the 333 that stand. The feature requests, the smaller findings and the work this repository opened for itself follow in comments.

Bugs that still reproduce

Confirmed against pnpm 12.5.1, unless the entry says the reproduction could not be run here.

• #10446 injectWorkspacePackages does not work with relative path (workspace:../package) A workspace dependency written as workspace:../b is linked rather than injected, where the same dependency written as workspace:* is injected: with a diverging peer context the first records link:../b and the second file:b([email protected]).
• #10450 Lockfile is missing significant workspace settings The lockfile records neither the supply-chain settings nor strictDepBuilds, so turning one on has no effect while node_modules is there and fails the install once it is cleared.
• #10486 pnpm update <package> cannot update dangling transitive peer dependencies pnpm update <package> --depth <n> does not move a transitive dependency that is reachable only as a peer. The reproduction depends on a version window that has passed, so it needs a fresh one.
• #10522 ignoredBuiltDependencies / allowBuilds: false does not work for git-hosted packages A git-hosted dependency whose prepare script is not allowed fails the install with ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED, and setting allowBuilds to false for it, by name or by the key the hint prints, does not make the install proceed.
• #10551 ERR_PNPM_LOCKFILE_CONFIG_MISMATCH when lockfile has catalogs but no pnpm-workspace.yaml exists A frozen install fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH when the lockfile records catalogs and the directory holds only package.json and the lockfile, which is what a production build stage copies.
• #10635 pnpm list --only-projects doesn't work with pulishConfig.directory pnpm list --only-projects leaves out a workspace project whose manifest sets publishConfig.directory.
• #10699 Standalone binary bootstrap fails due to minimumReleaseAge blocking the latest @pnpm/macos-arm64 minimumReleaseAge is applied to pnpm's own binary packages, so a project that pins a recent pnpm cannot get it: pnpm 12.5.1 warns that it cannot use the pinned version and carries on with the running one.
• #10715 pnpm install with --offline should only consider versions with cached tarballs, not all versions in metadata pnpm install --offline resolves to the newest version in the cached metadata and then fails because that version's tarball was never fetched, instead of picking the version the store holds.
• #10944 ignore-pnpmfile should not remove checksum in lockfile pnpm install --ignore-pnpmfile removes pnpmfileChecksum from the lockfile, so a command meant to skip the pnpmfile once changes the lockfile.
• #10981 pnpm deploy creates extra directories and breaks project's node_modules Deploying one project of a workspace with the hoisted linker creates directories under the other projects and damages the workspace's own node_modules. It does not happen on pnpm 12, and a fix for pnpm 11 is open in pnpm/pnpm#11006.
• #10982 Unexpected error when filtering audit to a commit range (unsupported? incorrect error?) pnpm audit accepts --filter and ignores it: filtering to a project whose dependencies have no advisories still reports the whole workspace's.
• #11028 Bug: Potential prototype pollution in lockfile converter via Object.assign The lockfile converter merges entries with Object.assign, so a lockfile key such as __proto__ reaches a property setter. Only the TypeScript CLI reads lockfiles this way.
• #11068 pnpm resolves versions whose transitive deps violate minimumReleaseAge A package listed in minimumReleaseAgeExclude resolves to a version whose own dependency the policy then rejects, and the install fails instead of picking a version whose tree passes.
• #11203 minimumReleaseAge: doesn't fall back to eligible intermediate version when latest is too young minimumReleaseAge does not fall back to an intermediate version that is old enough: with a cutoff between two releases, pnpm keeps the older version instead of the newest one the policy allows.
• #11225 pnpm resolves wrong version of peer dependency when adding a new dependency with transitive peers in a monorepo Adding a dependency with transitive peers in a workspace where two projects pin different versions of the peer resolves the wrong version for one of them.
• #11351 Phantom deps accessible via node_modules/.bin scripts A package the project does not declare can be imported by a script started through a workspace package's command, while the same script run with node cannot import it.
• #11385 pnpm install --force does not rebuild incomplete global virtual store link projections When a file is missing from a package's copy in the global virtual store, pnpm install --force does not put it back and the package can no longer be loaded.
• #11454 pnpm publish fails with "Failed to save packument." if run too quickly after pnpm publish --dry-run pnpm publish fails with "Failed to save packument" when it runs right after pnpm publish --dry-run, and succeeds after a short wait.
• #11456 Adding an unrelated dep churns [email protected]'s resolved string-width version Adding an unrelated dependency changes the version another package's dependency resolves to, although nothing in its range changed.
• #11522 pnpm audit --fix override adds multiple overrides for the same dependency pnpm audit --fix writes one override per advisory range, so a single package ends up with several overlapping entries.
• #11528 upgrading to pnpm 11 does not migrate global bins An upgrade does not move the commands already installed globally into the directory the new version uses, so they stop working until each package is installed again.
• #11574 allowBuilds placeholders written to pnpm-workspace.yaml during non-interactive installs An install with no terminal attached adds allowBuilds entries reading "set this to true or false" to the workspace file that is under version control.
• #11591 pnpm update --recursive --lockfile-only removes catalog entry when target is in catalog pnpm update -r <package>@<version> drops the catalogs section from the lockfile, and the lockfile then records a version the catalog does not declare while a frozen install accepts it.
• #11614 Env Var Placeholder Prevents Fallback to Stored Credentials When .npmrc names an environment variable that is not set for a registry's token, pnpm sends no credentials instead of falling back to the ones pnpm login stored.
• #11617 pnpm 11 defaults make running in read-only filesystems fail Running a script in a deployed directory that is read-only fails, because pnpm writes node_modules/.modules.yaml before running it.
• #11644 Adding a configDependencies with pnpm add --config doesn't add the required checksum pnpm add --config <package>@<version> records the configuration dependency without the integrity hash, so nothing pins what will be fetched later.
• #11656 Ignore (nearest) pnpm-workspace.yaml file if it does not include the active package pnpm install inside a project that the workspace's patterns do not match installs the workspace instead, and leaves that project without node_modules and without a word about it.
• #11700 update adds dependencies out of nowhere pnpm update in a project with no dependencies installs packages: a project named after a published package gets that package's peer dependencies added.
• #11724 patchedDependencies in a nested workspace's pnpm-workspace.yaml is silently ignored when the inner packag patchedDependencies declared in a nested workspace's own pnpm-workspace.yaml is ignored when the install runs from the workspace that contains it, and nothing is printed about it.
• #11800 Resolved peer dependencies do not update in workspace In a workspace, a package's resolved peer keeps pointing at the old version after the peer is updated, so two copies end up in the tree.
• #11808 Offline install with pnpm fetch breaks on pnpm upgrade An offline install from a store filled by pnpm fetch fails after pnpm is upgraded in another branch of the same repository.
• #11834 dedupePeerDependents doesn't deduplicate when there's a cyclic relationship between packages dedupePeerDependents does not merge two snapshots of the same package when its dependency declares a peer back on it and an optional peer that only some consumers activate.
• #11859 pnpm install shrinks pnpm-lock.yaml and re-resolves transitive dependencies (v11) An install re-resolves transitive dependencies and rewrites the lockfile on each run after a migration to pnpm 11, so the lockfile does not settle.
• #11865 verifyDepsBeforeRun triggers full install with pnpm --filter ... exec pnpm --filter <project> exec <command> installs the whole workspace before running the command, restoring node_modules of projects the filter leaves out.
• #11935 Pacquet delegated frozen install skips root lifecycle scripts A frozen install handed to pnpm v12 through a configuration dependency does not run the workspace root's lifecycle scripts.
• #11936 Pacquet delegated frozen install rejects --ignore-scripts and --silent A frozen install handed to pnpm v12 through a configuration dependency rejects --ignore-scripts and --silent instead of honouring them.
• #12006 pnpm self-update has confusing messaging when minimumReleaseAge is causing no update pnpm self-update describes the move to the newest version as a downgrade when the release-age policy is what holds the update back.
• #12031 trustPolicy: no-downgrade and error tolerance Lockfile verification under trustPolicy: no-downgrade fails intermittently on a large workspace, reporting trust downgrades and release-age violations that a rerun does not.
• #12055 pnpm login to existing user doesn't work pnpm login does not sign in an account that already exists on the registry.
• #12071 Native publishing no longer respects publishConfig.@scope:registry publishConfig with a scoped registry entry is ignored: the package is published to the default registry, while an unscoped publishConfig.registry is honoured.
• #12098 Shared peer still resolved inconsistently after #12081 when the consumer is a grandchild of the shadow A peer that two projects share is still resolved to different versions when the consumer sits two levels below the package that shadows it.
• #12116 pnpm 11 breaks React 19 hooks in vitest/jsdom (identical lockfile, different behavior) A test suite that passes under pnpm 10 fails under pnpm 11 with the same lockfile, which points at the shape of node_modules rather than at the versions.
• #12159 pnpm update: an active override referencing a catalog is applied with the pre-update catalog during resolution (graph stays stale) During an update, an override that points at a catalog entry is applied with the catalog's previous value, so the resolved graph keeps the old version.
• #12176 pnpm deploy should not hard-link workspace packages pnpm deploy hard-links a workspace dependency's files instead of copying them, so the deployed copy and the source are the same file.
• #12200 Missing Audit Vulnerabilities Paths The paths pnpm audit reports for a finding are incomplete in a workspace, so a vulnerable package's dependents are not all named.
• #12282 bug: pnpm setup --force deletes shell config content between duplicate pnpm blocks (greedy regex) pnpm setup --force replaces everything between the first # pnpm marker and the last # pnpm end in the shell configuration, so a second block costs whatever sits between them. pnpm 12 matches from the first opening marker to the last closing one.
• #12319 [ERROR] The configured global bin directory "/home/iamhugh/.local/share/pnpm/bin" is not in PATH pnpm root --global, which only prints a path, fails when the global bin directory is not in PATH.
• #12437 Global virtual store: packages that execute from the links store can't resolve transitive deps (Angular build, Nuxt install) With the global virtual store, a package that runs its own code from the store cannot resolve a dependency that is only wired into the project's virtual store.
• #12450 dependabot updating pnpm-lock.yaml without respecting minimumReleaseAge leads to  ERR_PNPM_NO_MATURE_MATCHING_VERSION A lockfile that another tool updated resolves fine with --frozen-lockfile and then fails a plain install, because the release-age policy rejects the version the lockfile already pins.
• #12451 pacquet: fails to apply patchedDependencies patches (line-ending sensitivity and no-newline parse error) pnpm v12 fails to apply a patch whose line endings differ from the file's, or whose last line has no newline, where the TypeScript CLI applies it.
• #12468 deploy --node-linker=hoisted includes node when used with engines.runtime.onFail=download A deploy with --node-linker=hoisted puts the downloaded runtime into the deployed node_modules.
• #12487 pnpm update <pkg> does not upgrade an auto-installed peer dependency to a newer in-range version pnpm update <package> does nothing, and says nothing, when the package is an automatically installed peer rather than a declared dependency.
• #12490 pacquet: auto-frozen installs don't persist the current lockfile (<virtual_store_dir>/lock.yaml) pnpm v12 writes the current lockfile into the virtual store only for an explicit --frozen-lockfile, not when the install takes the frozen path on its own.
• #12533 pnpm up -g fails because "/tmp/tmp.YtjUgfzMkp" does not exist. pnpm update --global fails because it looks for a linked package's directory in a temporary path that no longer exists.
• #12562 Store-index key mismatch for tarballs whose integrity is computed during fetch A tarball whose integrity is computed while it is fetched is stored under a key the later lookup does not use, so the store index misses it.
• #12564 pnpr: resolver fetches against client-supplied registries are an SSRF primitive when exposed to untrusted clients The pnpr registry's resolver fetches from whatever registry a request names, with no restriction, so an exposed instance can be pointed at internal addresses.
• #12651 PNPM invents a dependency version when running "audit fix" pnpm audit --fix writes an override naming a version that does not exist when the advisory has no patched version.
• #12704 pnpm v11 publish vs npm publish behave differently The request pnpm publish sends differs from npm's in a way a third-party registry notices: the published package has no README.
• #12705 pnpr: connect-time guard for transitive-dependency / DNS-rebinding SSRF The pnpr registry needs a check at connect time so a name that resolves to an internal address cannot be reached through a redirect or a rebind.
• #12727 pnpr: handle proxied tarballs whose packument has no usable dist.integrity The pnpr registry cannot serve a proxied tarball whose metadata carries no usable integrity, such as an old package that publishes only a legacy checksum.
• #12731 Don't ignore updateNotifier The update notice is shown because the state file is missing, rather than because a newer version is available.
• #12765 pnpm edits permissions on shared filesystem The store's index database and files are written readable only by the user who created them, so a store shared between accounts stops working for the next user.
• #12828 Expand ${ENV} variables in _auth values loaded from trusted sources (global config.yaml / env var) An _auth value in the global configuration is used literally, so a token cannot be kept in an environment variable the way other settings allow.
• #12859 side-effects cache does not preserve symlinks, silently inflating package size on reinstall The side effects cache stores a symlink a build script created as a full copy, so every install that restores from the cache inflates the package.
• #12865 When pnpm self-update concatenates paths, it adds ".." to the path. pnpm self-update builds a path containing .. while switching versions.
• #12892 Optimistic repeat install doesn't respect overrides A project with a file: dependency never takes the fast repeat-install path, even when an override replaces that dependency with a registry package.
• #12942 node-gyp install script not called on reinstall from a populated store (workspace + sharedWorkspaceLockfile: false) In a workspace with a lockfile per project, a native addon's build runs on the first install and is neither run nor restored on a later install from a populated store.
• #13033 pnpm audit is no longer working (ERR_PNPM_AUDIT_BAD_RESPONSE) pnpm audit uses an endpoint that registries are retiring, so the command fails where that endpoint is already gone.
• #13106 resolve-pr-conflicts.sh: --continue is unusable from a paused rebase, and there is no way to resolve without force-pushing The conflict-resolution script cannot continue a rebase that paused, and offers no way to finish without a force push.
• #13210 enableGlobalVirtualStore breaks resolution of a package's own devDependency-as-implicit-peer (works fine with the default virtual store) With the global virtual store, a package cannot resolve a dependency it declares as a development dependency and relies on at runtime, which the default layout resolves through its fallback directory.
• #13265 pnpm publish installs dependencies bringing risks pnpm publish in a workspace requires the dependencies to be installed before it will publish.
• #13338 pnpm import lockfile for git-hosted tarballs depends on store state: integrity emitted on cold store, stripped on warm pnpm import writes an integrity hash for a git-hosted tarball when the store is cold and leaves it out when the store is warm, so the lockfile depends on machine state.
• #13345 Parked changelog sections are never garbage-collected for renamed or unpublished packages Changelog sections held back for a package that was renamed or never published are never cleaned up.
• #13399 pnpm update package@beta should update the catalogue too pnpm update <package>@<tag> leaves a catalog entry untouched, so a catalog cannot be moved to a tagged release.
• #13487 **pnpm store prune is the only way to clear stale metadata from index.db when usin