--- title: pnpm 11.23 | daily.dev description: pnpm 11.23 reworks the registries setting so each registry is declared once with its tarball layout, routed scopes, and prefix, keeping custom registry tarball... canonical: https://daily.dev/posts/pnpm-11-23-migxmswxe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: pnpm 11.23 | daily.dev og:description: pnpm 11.23 reworks the registries setting so each registry is declared once with its tarball layout, routed scopes, and prefix, keeping custom registry tarball... og:url: https://daily.dev/posts/pnpm-11-23-migxmswxe og:image: https://api.daily.dev/og/posts/MIGXmSwxe.png og:image:alt: pnpm 11.23 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # pnpm 11.23 **[Fast, disk space efficient package manager \| pnpm](https://daily.dev/sources/pnpm-blog)** · 15 min read · 3 upvotes · 0 comments ## Summary pnpm 11.23 reworks the registries setting so each registry is declared once with its tarball layout, routed scopes, and prefix, keeping custom registry tarball URLs out of pnpm-lock.yaml. It adds virtualStoreType as the canonical name for global vs project virtual stores, resolves phantom dependencies under ESM via a NODE_PATH resolve hook without needing a plugin, and makes pnpm config get/list report the effective settings pnpm actually uses. Frozen installs now fail rather than silently rewrite outdated packageManager pins, pnpm audit stops suggesting unpublished patched versions, and numerous fixes address registry URL handling, build approvals, git dependency specifiers, and Windows shim staleness. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I keep custom registry tarball URLs like Artifactory or GitLab out of pnpm-lock.yaml? As of pnpm 11.23, declare the registry's serverType in the registries setting in pnpm-workspace.yaml. Setting serverType to artifactory tells pnpm the registry repeats the scope in a scoped package's tarball filename, letting pnpm reconstruct the URL instead of writing it into pnpm-lock.yaml; npm mirrors registry.npmjs.org's layout the same way. _Track pnpm release notes like this on daily.dev when tuning registry and lockfile setups._ ### What does the new virtualStoreType setting do in pnpm 11.23? virtualStoreType is the canonical spelling of enableGlobalVirtualStore, choosing whether the virtual store lives once per machine (global) or once per project (project, the unchanged default). It can be set via PNPM_CONFIG_VIRTUAL_STORE_TYPE and read with pnpm config get virtualStoreType; when both settings are present, virtualStoreType wins, and it works independently of nodeLinker. _Developers weighing pnpm store layout options can follow config changes like this on daily.dev._ ### Why does pnpm audit sometimes report a patched version that doesn't actually exist? Before pnpm 11.23, pnpm audit inferred a patched range like >=4.17.24 directly from an advisory without checking the registry packument, so it could point at an unpublished or deprecated version. Version 11.23 checks the inferred range against the registry and corrects it to the lowest non-deprecated published version satisfying it, showing 'Patched versions: None' when nothing qualifies. _Teams relying on pnpm audit for CI can watch fixes like this on daily.dev before they get burned in production._ ## Similar posts on daily.dev - [pnpm 11.28.5](https://daily.dev/posts/pnpm-11-28-5-cwufxwdeo) · Fast, disk space efficient package manager \| pnpm · 4 upvotes · 0 comments - [pnpm 11.21-11.22](https://daily.dev/posts/pnpm-11-21-11-22-samutlmgg) · Fast, disk space efficient package manager \| pnpm · 27 upvotes · 2 comments - [pnpm 11 cuts the npm umbilical cord](https://daily.dev/posts/pnpm-11-cuts-the-npm-umbilical-cord-vhucinbuf) · Bytes by ui.dev · 50 upvotes · 5 comments - [pnpm 11 Release Candidate: ESM Distribution, Supply Chain Defaults and a New Store Format](https://daily.dev/posts/pnpm-11-release-candidate-esm-distribution-supply-chain-defaults-and-a-new-store-format-0aocvtgnx) · InfoQ · 0 upvotes · 0 comments --- Tags: [#nodejs](https://daily.dev/tags/nodejs), [#pnpm](https://daily.dev/tags/pnpm) [View this post on daily.dev](https://daily.dev/posts/pnpm-11-23-migxmswxe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"pnpm 11.23","url":"https://daily.dev/posts/pnpm-11-23-migxmswxe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pnpm-11-23-migxmswxe"},"datePublished":"2026-08-23T15:10:33.314Z","dateModified":"2026-09-14T08:34:14.126Z","description":"pnpm 11.23 reworks the registries setting so each registry is declared once with its tarball layout, routed scopes, and prefix, keeping custom registry tarball...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Fast, disk space efficient package manager | pnpm","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Fast, disk space efficient package manager | pnpm","logo":"https://media.daily.dev/image/upload/s--JKuzGOiX--/f_auto,q_auto/v1787487440/logos/pnpm-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/pnpm-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pnpm-11-23-migxmswxe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"nodejs,pnpm","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Fast, disk space efficient package manager | pnpm","item":"https://daily.dev/sources/pnpm-blog"},{"@type":"ListItem","position":3,"name":"pnpm 11.23"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pnpm-11-23-migxmswxe#faq","mainEntity":[{"@type":"Question","name":"How do I keep custom registry tarball URLs like Artifactory or GitLab out of pnpm-lock.yaml?","acceptedAnswer":{"@type":"Answer","text":"As of pnpm 11.23, declare the registry's serverType in the registries setting in pnpm-workspace.yaml. Setting serverType to artifactory tells pnpm the registry repeats the scope in a scoped package's tarball filename, letting pnpm reconstruct the URL instead of writing it into pnpm-lock.yaml; npm mirrors registry.npmjs.org's layout the same way. Track pnpm release notes like this on daily.dev when tuning registry and lockfile setups."}},{"@type":"Question","name":"What does the new virtualStoreType setting do in pnpm 11.23?","acceptedAnswer":{"@type":"Answer","text":"virtualStoreType is the canonical spelling of enableGlobalVirtualStore, choosing whether the virtual store lives once per machine (global) or once per project (project, the unchanged default). It can be set via PNPM_CONFIG_VIRTUAL_STORE_TYPE and read with pnpm config get virtualStoreType; when both settings are present, virtualStoreType wins, and it works independently of nodeLinker. Developers weighing pnpm store layout options can follow config changes like this on daily.dev."}},{"@type":"Question","name":"Why does pnpm audit sometimes report a patched version that doesn't actually exist?","acceptedAnswer":{"@type":"Answer","text":"Before pnpm 11.23, pnpm audit inferred a patched range like >=4.17.24 directly from an advisory without checking the registry packument, so it could point at an unpublished or deprecated version. Version 11.23 checks the inferred range against the registry and corrects it to the lowest non-deprecated published version satisfying it, showing 'Patched versions: None' when nothing qualifies. Teams relying on pnpm audit for CI can watch fixes like this on daily.dev before they get burned in production."}}]} ```