--- title: pnpm 11.3 | daily.dev description: pnpm 11.3 introduces a pnpm stage command bringing npm's staged publishing workflow to pnpm, allowing versions to be published hidden from npm install until... canonical: https://daily.dev/posts/pnpm-11-3-u0aqytlpd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: pnpm 11.3 | daily.dev og:description: pnpm 11.3 introduces a pnpm stage command bringing npm's staged publishing workflow to pnpm, allowing versions to be published hidden from npm install until... og:url: https://daily.dev/posts/pnpm-11-3-u0aqytlpd og:image: https://api.daily.dev/og/posts/u0aqytlpd.png og:image:alt: pnpm 11.3 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # pnpm 11.3 **[Fast, disk space efficient package manager \| pnpm](https://daily.dev/sources/pnpm-blog)** · 4 min read · 0 upvotes · 0 comments ## Summary pnpm 11.3 introduces a pnpm stage command bringing npm's staged publishing workflow to pnpm, allowing versions to be published hidden from npm install until explicitly approved. A new trustLockfile setting lets closed-source projects skip the minimumReleaseAge/trustPolicy supply-chain verification pass on already-trusted lockfiles, and the release also reduces the memory footprint of that verification cache to avoid OOM on large workspaces. pnpm pkg, pnpm repo, and pnpm set-script are now native implementations instead of delegating to npm, and a new --skip-manifest-obfuscation flag preserves packageManager and lifecycle scripts during pack/publish. Several patch fixes address dlx failures, lockfile non-determinism with transitive peer dependencies, dropped manifest updates for unparseable dependency specs, and orphaned entries in pnpm-lock.env.yaml. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the trustLockfile setting do in pnpm? trustLockfile is a pnpm setting that, when set to true, makes pnpm install treat the lockfile as already trusted and skip re-running the minimumReleaseAge and trustPolicy no-downgrade verification checks on every entry. It is useful for closed-source projects where every commit comes from a trusted author. The default is false, so verification stays on unless explicitly disabled in pnpm-workspace.yaml. _Track pnpm supply-chain settings like this on daily.dev before rolling out lockfile trust changes._ ### How does pnpm's new stage command work for staged publishing? pnpm stage brings npm's staged publishing workflow to pnpm, letting a version be published but hidden from npm install until explicitly approved via a subcommand such as pnpm stage publish. This is useful for verifying release artifacts, smoke-testing in CI, or coordinating multi-package releases without exposing unfinished versions to consumers. _Follow package manager releases like pnpm's on daily.dev when planning safer publishing workflows._ ### Why was pnpm dedupe producing non-deterministic lockfiles with transitive peer dependencies? pnpm dedupe and install produced flip-flopping lockfiles when a dependency graph had packages with transitive peer dependencies on each other, such as @aws-sdk/client-sts and @aws-sdk/client-sso-oidc, combined with auto-install-peers enabled. The cause was resolveDependencies pushing onto pkgAddresses and postponedResolutionsQueue arrays from inside Promise.all callbacks, letting completion-order timing leak into array order and affect cyclic-peer suffix assignment. This was fixed in pnpm 11.3. _Check daily.dev for fixes like this before debugging flaky lockfile diffs in CI._ ## Similar posts on daily.dev - [pnpm 12.8](https://daily.dev/posts/pnpm-12-8-6geqcckjt) · Fast, disk space efficient package manager \| pnpm · 5 upvotes · 0 comments - [pnpm 11 Adds Supply Chain Protection Defaults for Minimum Re...](https://daily.dev/posts/pnpm-11-adds-supply-chain-protection-defaults-for-minimum-re--wxgk3vhhu) · Socket · 102 upvotes · 6 comments - [pnpm 11 cuts the npm umbilical cord](https://daily.dev/posts/pnpm-11-cuts-the-npm-umbilical-cord-vhucinbuf) · Bytes by ui.dev · 50 upvotes · 5 comments - [pnpm 12.10.0](https://daily.dev/posts/pnpm-12-10-0-1jmwtjsma) · Fast, disk space efficient package manager \| pnpm · 6 upvotes · 0 comments - [pnpm 11 Release Candidate: ESM Distribution, Supply Chain Defaults and a New Store Format](https://daily.dev/posts/pnpm-11-release-candidate-esm-distribution-supply-chain-defaults-and-a-new-store-format-0aocvtgnx) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#npm](https://daily.dev/tags/npm), [#pnpm](https://daily.dev/tags/pnpm) [View this post on daily.dev](https://daily.dev/posts/pnpm-11-3-u0aqytlpd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"pnpm 11.3","url":"https://daily.dev/posts/pnpm-11-3-u0aqytlpd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pnpm-11-3-u0aqytlpd"},"datePublished":"2026-08-23T12:17:44.041Z","dateModified":"2026-08-23T12:24:21.133Z","description":"pnpm 11.3 introduces a pnpm stage command bringing npm's staged publishing workflow to pnpm, allowing versions to be published hidden from npm install until...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Fast, disk space efficient package manager | pnpm","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Fast, disk space efficient package manager | pnpm","logo":"https://media.daily.dev/image/upload/s--JKuzGOiX--/f_auto,q_auto/v1787487440/logos/pnpm-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/pnpm-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pnpm-11-3-u0aqytlpd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,npm,pnpm","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Fast, disk space efficient package manager | pnpm","item":"https://daily.dev/sources/pnpm-blog"},{"@type":"ListItem","position":3,"name":"pnpm 11.3"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pnpm-11-3-u0aqytlpd#faq","mainEntity":[{"@type":"Question","name":"What does the trustLockfile setting do in pnpm?","acceptedAnswer":{"@type":"Answer","text":"trustLockfile is a pnpm setting that, when set to true, makes pnpm install treat the lockfile as already trusted and skip re-running the minimumReleaseAge and trustPolicy no-downgrade verification checks on every entry. It is useful for closed-source projects where every commit comes from a trusted author. The default is false, so verification stays on unless explicitly disabled in pnpm-workspace.yaml. Track pnpm supply-chain settings like this on daily.dev before rolling out lockfile trust changes."}},{"@type":"Question","name":"How does pnpm's new stage command work for staged publishing?","acceptedAnswer":{"@type":"Answer","text":"pnpm stage brings npm's staged publishing workflow to pnpm, letting a version be published but hidden from npm install until explicitly approved via a subcommand such as pnpm stage publish. This is useful for verifying release artifacts, smoke-testing in CI, or coordinating multi-package releases without exposing unfinished versions to consumers. Follow package manager releases like pnpm's on daily.dev when planning safer publishing workflows."}},{"@type":"Question","name":"Why was pnpm dedupe producing non-deterministic lockfiles with transitive peer dependencies?","acceptedAnswer":{"@type":"Answer","text":"pnpm dedupe and install produced flip-flopping lockfiles when a dependency graph had packages with transitive peer dependencies on each other, such as @aws-sdk/client-sts and @aws-sdk/client-sso-oidc, combined with auto-install-peers enabled. The cause was resolveDependencies pushing onto pkgAddresses and postponedResolutionsQueue arrays from inside Promise.all callbacks, letting completion-order timing leak into array order and affect cyclic-peer suffix assignment. This was fixed in pnpm 11.3. Check daily.dev for fixes like this before debugging flaky lockfile diffs in CI."}}]} ```