--- title: pnpm 11.5 | daily.dev description: pnpm 11.5 introduces a new hoistingLimits setting to control how far dependencies hoist under nodeLinker: hoisted installs, mirroring yarn's nmHoistingLimits... canonical: https://daily.dev/posts/pnpm-11-5-ebzbeigfy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: pnpm 11.5 | daily.dev og:description: pnpm 11.5 introduces a new hoistingLimits setting to control how far dependencies hoist under nodeLinker: hoisted installs, mirroring yarn's nmHoistingLimits... og:url: https://daily.dev/posts/pnpm-11-5-ebzbeigfy og:image: https://api.daily.dev/og/posts/EbZBeiGfy.png og:image:alt: pnpm 11.5 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # pnpm 11.5 **[Fast, disk space efficient package manager \| pnpm](https://daily.dev/sources/pnpm-blog)** · 3 min read · 0 upvotes · 0 comments ## Summary pnpm 11.5 introduces a new hoistingLimits setting to control how far dependencies hoist under nodeLinker: hoisted installs, mirroring yarn's nmHoistingLimits option. The release swaps out the enquirer prompt library for @inquirer/prompts, fixing a long-standing scrolling bug in interactive commands like update -i and audit --fix -i. Staged publishes are now recognized as the strongest trust evidence in the trust scale, preventing false-positive downgrade errors. Several patch fixes address peer resolution hangs, dist-tag OTP failures against npmjs.org, minimumReleaseAgeExclude handling, lockfile integrity loss for tarball dependencies, and unnecessary re-resolution when pnpm-lock.yaml is missing but a materialized snapshot exists. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I control how far dependencies hoist with pnpm's nodeLinker: hoisted setting? pnpm 11.5 adds a hoistingLimits setting that controls hoisting depth when using nodeLinker: hoisted, mirroring yarn's nmHoistingLimits option. It accepts three values: none (hoist as far as possible, the default), workspaces (hoist only as far as each workspace package), and dependencies (hoist only up to each workspace package's direct dependencies). _Track pnpm configuration changes like hoisting behavior on daily.dev before they affect your monorepo installs._ ### Why does pnpm dist-tag add fail against npmjs.org without --otp? This was a bug in pnpm fixed in version 11.5: pnpm dist-tag add and pnpm dist-tag rm against npmjs.org failed without an explicit --otp flag. The fix surfaces the OTP challenge through the existing browser-based 2FA flow, the same one used by pnpm publish, so the browser opens, the user authenticates, and the dist-tag is set on retry. _Developers debugging npm registry auth issues can follow pnpm release fixes like this on daily.dev._ ### Why does pnpm install fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY after installing an unrelated package? This was caused by a bug where the integrity field got dropped from the lockfile entry of a remote https-tarball dependency whenever an unrelated package was installed afterward. The missing integrity field then caused subsequent --frozen-lockfile installs to fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY. It was fixed in pnpm 11.5. _Anyone chasing frozen-lockfile install failures can track pnpm patch fixes like this via daily.dev._ ## Similar posts on daily.dev - [pnpm 12.10.0](https://daily.dev/posts/pnpm-12-10-0-1jmwtjsma) · Fast, disk space efficient package manager \| pnpm · 6 upvotes · 0 comments - [pnpm 11 cuts the npm umbilical cord](https://daily.dev/posts/pnpm-11-cuts-the-npm-umbilical-cord-vhucinbuf) · Bytes by ui.dev · 50 upvotes · 5 comments - [pnpm 11 Adds Supply Chain Protection Defaults for Minimum Re...](https://daily.dev/posts/pnpm-11-adds-supply-chain-protection-defaults-for-minimum-re--wxgk3vhhu) · Socket · 102 upvotes · 6 comments - [pnpm 11.28](https://daily.dev/posts/pnpm-11-28-g0urujyp5) · Fast, disk space efficient package manager \| pnpm · 15 upvotes · 0 comments - [pnpm 11 Release Candidate: ESM Distribution, Supply Chain Defaults and a New Store Format](https://daily.dev/posts/pnpm-11-release-candidate-esm-distribution-supply-chain-defaults-and-a-new-store-format-0aocvtgnx) · InfoQ · 0 upvotes · 0 comments --- Tags: [#javascript](https://daily.dev/tags/javascript), [#nodejs](https://daily.dev/tags/nodejs), [#pnpm](https://daily.dev/tags/pnpm) [View this post on daily.dev](https://daily.dev/posts/pnpm-11-5-ebzbeigfy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"pnpm 11.5","url":"https://daily.dev/posts/pnpm-11-5-ebzbeigfy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pnpm-11-5-ebzbeigfy"},"datePublished":"2026-08-23T12:17:27.141Z","dateModified":"2026-08-23T12:24:34.632Z","description":"pnpm 11.5 introduces a new hoistingLimits setting to control how far dependencies hoist under nodeLinker: hoisted installs, mirroring yarn's nmHoistingLimits...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/63763758f3e74381d631e88f7667e808?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Fast, disk space efficient package manager | pnpm","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Fast, disk space efficient package manager | pnpm","logo":"https://media.daily.dev/image/upload/s--JKuzGOiX--/f_auto,q_auto/v1787487440/logos/pnpm-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/pnpm-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pnpm-11-5-ebzbeigfy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"javascript,nodejs,pnpm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Fast, disk space efficient package manager | pnpm","item":"https://daily.dev/sources/pnpm-blog"},{"@type":"ListItem","position":3,"name":"pnpm 11.5"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pnpm-11-5-ebzbeigfy#faq","mainEntity":[{"@type":"Question","name":"How do I control how far dependencies hoist with pnpm's nodeLinker: hoisted setting?","acceptedAnswer":{"@type":"Answer","text":"pnpm 11.5 adds a hoistingLimits setting that controls hoisting depth when using nodeLinker: hoisted, mirroring yarn's nmHoistingLimits option. It accepts three values: none (hoist as far as possible, the default), workspaces (hoist only as far as each workspace package), and dependencies (hoist only up to each workspace package's direct dependencies). Track pnpm configuration changes like hoisting behavior on daily.dev before they affect your monorepo installs."}},{"@type":"Question","name":"Why does pnpm dist-tag add fail against npmjs.org without --otp?","acceptedAnswer":{"@type":"Answer","text":"This was a bug in pnpm fixed in version 11.5: pnpm dist-tag add and pnpm dist-tag rm against npmjs.org failed without an explicit --otp flag. The fix surfaces the OTP challenge through the existing browser-based 2FA flow, the same one used by pnpm publish, so the browser opens, the user authenticates, and the dist-tag is set on retry. Developers debugging npm registry auth issues can follow pnpm release fixes like this on daily.dev."}},{"@type":"Question","name":"Why does pnpm install fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY after installing an unrelated package?","acceptedAnswer":{"@type":"Answer","text":"This was caused by a bug where the integrity field got dropped from the lockfile entry of a remote https-tarball dependency whenever an unrelated package was installed afterward. The missing integrity field then caused subsequent --frozen-lockfile installs to fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY. It was fixed in pnpm 11.5. Anyone chasing frozen-lockfile install failures can track pnpm patch fixes like this via daily.dev."}}]} ```