--- title: pnpm 11.1 | daily.dev description: pnpm 11.1 introduces three new commands: pnpm audit signatures (verifies ECDSA registry signatures for installed packages), pnpm bugs (opens a package's bug... canonical: https://daily.dev/posts/pnpm-11-1-avhsaapjp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: pnpm 11.1 | daily.dev og:description: pnpm 11.1 introduces three new commands: pnpm audit signatures (verifies ECDSA registry signatures for installed packages), pnpm bugs (opens a package's bug... og:url: https://daily.dev/posts/pnpm-11-1-avhsaapjp og:image: https://api.daily.dev/og/posts/AvHsAApjP.png og:image:alt: pnpm 11.1 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # pnpm 11.1 **[Fast, disk space efficient package manager \| pnpm](https://daily.dev/sources/pnpm-blog)** · 4 min read · 0 upvotes · 0 comments ## Summary pnpm 11.1 introduces three new commands: pnpm audit signatures (verifies ECDSA registry signatures for installed packages), pnpm bugs (opens a package's bug tracker), and pnpm owner (manages registry package owners). It adds support for installing from arbitrary named registries, including a built-in gh: alias for GitHub Packages, plus a --sbom-spec-version flag for CycloneDX SBOM generation and a --no-runtime flag to skip runtime installation in CI matrices while keeping the lockfile intact. Patch fixes include proxy support during publish authentication, isolated global installs by default, a fix for runtime set failing at workspace roots, and a fix for pnpm --version hanging due to an undestroyed worker pool. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I install a package from the GitHub Packages npm registry using pnpm? pnpm 11.1 adds a built-in gh: prefix alias, so you can run a command like pnpm add gh:@acme/private to install directly from the GitHub Packages npm registry. Authentication is picked up automatically from existing per-URL .npmrc entries such as //npm.pkg.github.com/:_authToken=..., so no separate auth setup is needed. Additional named registries can be configured under namedRegistries in pnpm-workspace.yaml. _daily.dev helps developers track new pnpm registry features like this before adopting them in CI._ ### How can I skip installing a Node.js runtime in CI when using pnpm workspaces? pnpm 11.1 adds a --no-runtime flag (or runtime=false config) that skips fetching runtime entries like Node.js declared via devEngines.runtime, without touching the lockfile, so frozen-lockfile checks still pass. This is meant for CI matrices where the runtime is provisioned externally, for example via pnpm runtime -g set node , before pnpm install runs. _Teams optimizing CI pipelines track release notes like this pnpm change on daily.dev._ ### Why does pnpm add -g foo bar install two separate globals instead of sharing dependencies? As of pnpm 11.1, pnpm add -g installs each space-separated package into its own isolated directory by default, so foo and bar become independent globals where removing one does not affect the other. To bundle packages into a single shared isolated install instead, pass them as a comma-separated list, such as pnpm add -g foo,bar qar. _daily.dev keeps developers current on CLI behavior changes like pnpm's global install isolation._ ## Similar posts on daily.dev - [pnpm 11.23](https://daily.dev/posts/pnpm-11-23-migxmswxe) · Fast, disk space efficient package manager \| pnpm · 3 upvotes · 0 comments - [pnpm 11 cuts the npm umbilical cord](https://daily.dev/posts/pnpm-11-cuts-the-npm-umbilical-cord-vhucinbuf) · Bytes by ui.dev · 50 upvotes · 5 comments - [pnpm 11 Adds Supply Chain Protection Defaults for Minimum Re...](https://daily.dev/posts/pnpm-11-adds-supply-chain-protection-defaults-for-minimum-re--wxgk3vhhu) · Socket · 101 upvotes · 6 comments - [pnpm 11.28.5](https://daily.dev/posts/pnpm-11-28-5-cwufxwdeo) · Fast, disk space efficient package manager \| pnpm · 4 upvotes · 0 comments - [pnpm 11 Release Candidate: ESM Distribution, Supply Chain Defaults and a New Store Format](https://daily.dev/posts/pnpm-11-release-candidate-esm-distribution-supply-chain-defaults-and-a-new-store-format-0aocvtgnx) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#npm](https://daily.dev/tags/npm), [#pnpm](https://daily.dev/tags/pnpm) [View this post on daily.dev](https://daily.dev/posts/pnpm-11-1-avhsaapjp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"pnpm 11.1","url":"https://daily.dev/posts/pnpm-11-1-avhsaapjp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pnpm-11-1-avhsaapjp"},"datePublished":"2026-08-23T12:17:52.006Z","dateModified":"2026-08-23T12:24:17.858Z","description":"pnpm 11.1 introduces three new commands: pnpm audit signatures (verifies ECDSA registry signatures for installed packages), pnpm bugs (opens a package's bug...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Fast, disk space efficient package manager | pnpm","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Fast, disk space efficient package manager | pnpm","logo":"https://media.daily.dev/image/upload/s--JKuzGOiX--/f_auto,q_auto/v1787487440/logos/pnpm-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/pnpm-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pnpm-11-1-avhsaapjp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,npm,pnpm","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Fast, disk space efficient package manager | pnpm","item":"https://daily.dev/sources/pnpm-blog"},{"@type":"ListItem","position":3,"name":"pnpm 11.1"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pnpm-11-1-avhsaapjp#faq","mainEntity":[{"@type":"Question","name":"How do I install a package from the GitHub Packages npm registry using pnpm?","acceptedAnswer":{"@type":"Answer","text":"pnpm 11.1 adds a built-in gh: prefix alias, so you can run a command like pnpm add gh:@acme/private to install directly from the GitHub Packages npm registry. Authentication is picked up automatically from existing per-URL .npmrc entries such as //npm.pkg.github.com/:_authToken=..., so no separate auth setup is needed. Additional named registries can be configured under namedRegistries in pnpm-workspace.yaml. daily.dev helps developers track new pnpm registry features like this before adopting them in CI."}},{"@type":"Question","name":"How can I skip installing a Node.js runtime in CI when using pnpm workspaces?","acceptedAnswer":{"@type":"Answer","text":"pnpm 11.1 adds a --no-runtime flag (or runtime=false config) that skips fetching runtime entries like Node.js declared via devEngines.runtime, without touching the lockfile, so frozen-lockfile checks still pass. This is meant for CI matrices where the runtime is provisioned externally, for example via pnpm runtime -g set node , before pnpm install runs. Teams optimizing CI pipelines track release notes like this pnpm change on daily.dev."}},{"@type":"Question","name":"Why does pnpm add -g foo bar install two separate globals instead of sharing dependencies?","acceptedAnswer":{"@type":"Answer","text":"As of pnpm 11.1, pnpm add -g installs each space-separated package into its own isolated directory by default, so foo and bar become independent globals where removing one does not affect the other. To bundle packages into a single shared isolated install instead, pass them as a comma-separated list, such as pnpm add -g foo,bar qar. daily.dev keeps developers current on CLI behavior changes like pnpm's global install isolation."}}]} ```