--- title: pnpm 11.11-11.14 | daily.dev description: pnpm 11.11 through 11.14 add native workspace release management via pnpm change, pnpm lane, and a bare pnpm version -r, replacing the need for a separate... canonical: https://daily.dev/posts/pnpm-11-11-11-14-npcixnhgp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: pnpm 11.11-11.14 | daily.dev og:description: pnpm 11.11 through 11.14 add native workspace release management via pnpm change, pnpm lane, and a bare pnpm version -r, replacing the need for a separate... og:url: https://daily.dev/posts/pnpm-11-11-11-14-npcixnhgp og:image: https://api.daily.dev/og/posts/NpcIXNHgP.png og:image:alt: pnpm 11.11-11.14 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # pnpm 11.11-11.14 **[Fast, disk space efficient package manager \| pnpm](https://daily.dev/sources/pnpm-blog)** · 10 min read · 0 upvotes · 0 comments ## Summary pnpm 11.11 through 11.14 add native workspace release management via pnpm change, pnpm lane, and a bare pnpm version -r, replacing the need for a separate release tool. New commands pnpm doctor diagnoses installation health end to end, while pnpm access and pnpm team manage registry permissions and organizations. Other additions include convergence overrides for dependency resolution and peerDependencies specifiers that can carry a scheme (npm:, file:, git, or named-registry). The releases fix a path-traversal vulnerability where a scoped manifest name could write files outside node_modules, patch a crafted pnpm-lock.yaml exploit, and update adm-zip against a memory-exhaustion issue. Performance work cuts peak memory during cold-cache resolution by about 30%, and a long-standing peer dependency deadlock (triggered by packages like electron-builder) is resolved, alongside numerous other bug fixes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I manage versioning and changelogs across a pnpm workspace without a separate release tool? pnpm 11.11+ adds native workspace release management: pnpm change records changesets-compatible .changeset/*.md files naming affected packages and bump types, and a bare pnpm version -r consumes them at release time, bumping versions with dependent propagation through workspace: ranges, writing changelogs, and recording consumption in a committed .changeset/ledger.yaml. _daily.dev helps teams track workspace tooling changes like this before a release goes out._ ### Why does pnpm install hang forever when electron-builder is a dependency? A deadlock in peer dependency resolution caused pnpm install to hang when a peer dependency cycle spanned a project's own dependencies and auto-installed peer providers, which happened when installing electron-builder@26.15.3. This was fixed in pnpm 11.11-11.14, so upgrading resolves the frozen install. _Developers debugging stuck installs can find fixes like this one surfaced on daily.dev._ ### Is there a pnpm vulnerability involving path traversal in package names? Yes, a path traversal vulnerability allowed a dependency whose manifest name was a scoped path traversal, such as @x/../../../, to be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts enabled. It was fixed in pnpm 11.11-11.14, along with a related crafted pnpm-lock.yaml exploit and an adm-zip memory allocation issue. _Teams tracking supply-chain fixes like this often follow security patches on daily.dev._ ## Similar posts on daily.dev - [pnpm 11.28.5](https://daily.dev/posts/pnpm-11-28-5-cwufxwdeo) · Fast, disk space efficient package manager \| pnpm · 2 upvotes · 0 comments - [pnpm 12.2-12.3](https://daily.dev/posts/pnpm-12-2-12-3-gtkuwlrn9) · Fast, disk space efficient package manager \| pnpm · 4 upvotes · 0 comments - [pnpm 11 cuts the npm umbilical cord](https://daily.dev/posts/pnpm-11-cuts-the-npm-umbilical-cord-vhucinbuf) · Bytes by ui.dev · 50 upvotes · 5 comments - [pnpm 12.10.0](https://daily.dev/posts/pnpm-12-10-0-1jmwtjsma) · Fast, disk space efficient package manager \| pnpm · 4 upvotes · 0 comments - [pnpm 11 Adds Supply Chain Protection Defaults for Minimum Re...](https://daily.dev/posts/pnpm-11-adds-supply-chain-protection-defaults-for-minimum-re--wxgk3vhhu) · Socket · 102 upvotes · 6 comments --- Tags: [#general-programming](https://daily.dev/tags/general-programming), [#nodejs](https://daily.dev/tags/nodejs), [#pnpm](https://daily.dev/tags/pnpm) [View this post on daily.dev](https://daily.dev/posts/pnpm-11-11-11-14-npcixnhgp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"pnpm 11.11-11.14","url":"https://daily.dev/posts/pnpm-11-11-11-14-npcixnhgp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pnpm-11-11-11-14-npcixnhgp"},"datePublished":"2026-08-23T12:17:27.159Z","dateModified":"2026-08-23T12:24:33.336Z","description":"pnpm 11.11 through 11.14 add native workspace release management via pnpm change, pnpm lane, and a bare pnpm version -r, replacing the need for a separate...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Fast, disk space efficient package manager | pnpm","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Fast, disk space efficient package manager | pnpm","logo":"https://media.daily.dev/image/upload/s--JKuzGOiX--/f_auto,q_auto/v1787487440/logos/pnpm-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/pnpm-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pnpm-11-11-11-14-npcixnhgp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"general-programming,nodejs,pnpm","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Fast, disk space efficient package manager | pnpm","item":"https://daily.dev/sources/pnpm-blog"},{"@type":"ListItem","position":3,"name":"pnpm 11.11-11.14"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pnpm-11-11-11-14-npcixnhgp#faq","mainEntity":[{"@type":"Question","name":"How do I manage versioning and changelogs across a pnpm workspace without a separate release tool?","acceptedAnswer":{"@type":"Answer","text":"pnpm 11.11+ adds native workspace release management: pnpm change records changesets-compatible .changeset/*.md files naming affected packages and bump types, and a bare pnpm version -r consumes them at release time, bumping versions with dependent propagation through workspace: ranges, writing changelogs, and recording consumption in a committed .changeset/ledger.yaml. daily.dev helps teams track workspace tooling changes like this before a release goes out."}},{"@type":"Question","name":"Why does pnpm install hang forever when electron-builder is a dependency?","acceptedAnswer":{"@type":"Answer","text":"A deadlock in peer dependency resolution caused pnpm install to hang when a peer dependency cycle spanned a project's own dependencies and auto-installed peer providers, which happened when installing electron-builder@26.15.3. This was fixed in pnpm 11.11-11.14, so upgrading resolves the frozen install. Developers debugging stuck installs can find fixes like this one surfaced on daily.dev."}},{"@type":"Question","name":"Is there a pnpm vulnerability involving path traversal in package names?","acceptedAnswer":{"@type":"Answer","text":"Yes, a path traversal vulnerability allowed a dependency whose manifest name was a scoped path traversal, such as @x/../../../, to be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts enabled. It was fixed in pnpm 11.11-11.14, along with a related crafted pnpm-lock.yaml exploit and an adm-zip memory allocation issue. Teams tracking supply-chain fixes like this often follow security patches on daily.dev."}}]} ```