--- title: pnpm 11.10 | daily.dev description: pnpm 11.10 introduces a new _auth setting that stores registry authentication as a single structured, URL-keyed value, solving problems with special characters... canonical: https://daily.dev/posts/pnpm-11-10-5t4urxmll twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: pnpm 11.10 | daily.dev og:description: pnpm 11.10 introduces a new _auth setting that stores registry authentication as a single structured, URL-keyed value, solving problems with special characters... og:url: https://daily.dev/posts/pnpm-11-10-5t4urxmll og:image: https://api.daily.dev/og/posts/5t4URXmLL.png og:image:alt: pnpm 11.10 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # pnpm 11.10 **[Fast, disk space efficient package manager \| pnpm](https://daily.dev/sources/pnpm-blog)** · 6 min read · 0 upvotes · 0 comments ## Summary pnpm 11.10 introduces a new _auth setting that stores registry authentication as a single structured, URL-keyed value, solving problems with special characters in environment variable names on CI systems like GitHub Actions. It adds pnpm prefix and pnpm issues commands, and lets pnpm self-update install pnpm v12, the upcoming Rust port with no Node.js launcher overhead. The release also improves pnpm up accuracy so unrelated packages no longer get bumped, speeds up resolution against registries returning full (non-abbreviated) metadata, and hardens global package management, pnpm deploy, and pnpm pack-app against path traversal and symlink hijacking issues. Additional fixes cover prototype pollution in preferred-version seeding, patch file path resolution, topological filter ordering, and Node.js release key verification. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I set up pnpm registry authentication in GitHub Actions without the token being silently dropped? Use the new _auth setting via the pnpm_config__auth environment variable instead of the older pnpm_config_//host/:_authToken form. GitHub Actions, bash, and zsh silently drop environment variable names containing slashes, colons, or periods, which broke the old syntax. The _auth variable has an ordinary name and stores a structured, URL-keyed JSON value mapping registries and scopes to auth tokens, and it is only honored from the environment variable or global config, never from project files. _daily.dev surfaces release notes like this so CI auth setups don't break silently._ ### Can pnpm self-update install pnpm v12, the Rust port? Yes, pnpm self-update and packageManager version-switching can install pnpm v12, published under both the pnpm and @pnpm/exe names on the next-12 dist-tag, using the command pnpm self-update next-12. Its native binaries ship as @pnpm/exe.- packages with no Node.js launcher, so the command has no Node.js startup cost, and future installs converge on the unscoped pnpm package. _track pnpm's Rust port rollout on daily.dev before switching your team's package manager._ ### Why does pnpm up bump unrelated packages with open semver ranges when I only asked to update one package? This was a bug in pnpm where pnpm up -r re-resolved unrelated packages with open ^x.y.z ranges to newer compatible versions instead of leaving them untouched. It is fixed by having the install layer always seed preferredVersions from the lockfile, so only the targeted package re-resolves while others stay pinned to their lockfile versions. _developers debugging unexpected dependency bumps can follow fixes like this on daily.dev._ ## Similar posts on daily.dev - [pnpm 11.10 Hardens Registry Authentication to Block Token Re...](https://daily.dev/posts/pnpm-11-10-hardens-registry-authentication-to-block-token-re--fwa9evwsm) · Socket · 2 upvotes · 0 comments - [pnpm 11.23](https://daily.dev/posts/pnpm-11-23-migxmswxe) · Fast, disk space efficient package manager \| pnpm · 3 upvotes · 0 comments - [pnpm 11 cuts the npm umbilical cord](https://daily.dev/posts/pnpm-11-cuts-the-npm-umbilical-cord-vhucinbuf) · Bytes by ui.dev · 50 upvotes · 5 comments - [pnpm 11.28.5](https://daily.dev/posts/pnpm-11-28-5-cwufxwdeo) · Fast, disk space efficient package manager \| pnpm · 4 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#nodejs](https://daily.dev/tags/nodejs), [#cicd](https://daily.dev/tags/cicd), [#pnpm](https://daily.dev/tags/pnpm) [View this post on daily.dev](https://daily.dev/posts/pnpm-11-10-5t4urxmll) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"pnpm 11.10","url":"https://daily.dev/posts/pnpm-11-10-5t4urxmll","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pnpm-11-10-5t4urxmll"},"datePublished":"2026-08-23T12:17:33.428Z","dateModified":"2026-08-23T12:24:32.675Z","description":"pnpm 11.10 introduces a new _auth setting that stores registry authentication as a single structured, URL-keyed value, solving problems with special characters...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Fast, disk space efficient package manager | pnpm","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Fast, disk space efficient package manager | pnpm","logo":"https://media.daily.dev/image/upload/s--JKuzGOiX--/f_auto,q_auto/v1787487440/logos/pnpm-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/pnpm-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pnpm-11-10-5t4urxmll","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,nodejs,cicd,pnpm","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Fast, disk space efficient package manager | pnpm","item":"https://daily.dev/sources/pnpm-blog"},{"@type":"ListItem","position":3,"name":"pnpm 11.10"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pnpm-11-10-5t4urxmll#faq","mainEntity":[{"@type":"Question","name":"How do I set up pnpm registry authentication in GitHub Actions without the token being silently dropped?","acceptedAnswer":{"@type":"Answer","text":"Use the new _auth setting via the pnpm_config__auth environment variable instead of the older pnpm_config_//host/:_authToken form. GitHub Actions, bash, and zsh silently drop environment variable names containing slashes, colons, or periods, which broke the old syntax. The _auth variable has an ordinary name and stores a structured, URL-keyed JSON value mapping registries and scopes to auth tokens, and it is only honored from the environment variable or global config, never from project files. daily.dev surfaces release notes like this so CI auth setups don't break silently."}},{"@type":"Question","name":"Can pnpm self-update install pnpm v12, the Rust port?","acceptedAnswer":{"@type":"Answer","text":"Yes, pnpm self-update and packageManager version-switching can install pnpm v12, published under both the pnpm and @pnpm/exe names on the next-12 dist-tag, using the command pnpm self-update next-12. Its native binaries ship as @pnpm/exe.- packages with no Node.js launcher, so the command has no Node.js startup cost, and future installs converge on the unscoped pnpm package. track pnpm's Rust port rollout on daily.dev before switching your team's package manager."}},{"@type":"Question","name":"Why does pnpm up bump unrelated packages with open semver ranges when I only asked to update one package?","acceptedAnswer":{"@type":"Answer","text":"This was a bug in pnpm where pnpm up -r re-resolved unrelated packages with open ^x.y.z ranges to newer compatible versions instead of leaving them untouched. It is fixed by having the install layer always seed preferredVersions from the lockfile, so only the targeted package re-resolves while others stay pinned to their lockfile versions. developers debugging unexpected dependency bumps can follow fixes like this on daily.dev."}}]} ```