pnpm 12 is stable: a Rust rewrite that is deliberately not a migration. Commands, flags, settings, and the lockfile format from v11 carry over. latest on npm still points at 11 — install 12 with pnpm self-update next-12.

What actually changes is a short list. The ones I am watching:

Git deps are identities. On GitHub, GitLab, and Bitbucket, github:owner/repo, owner/repo, HTTPS, and SSH all resolve to the same canonical repo; the lockfile never records SSH for those hosts. Private repos over SSH need a machine-level git config url.*.insteadOf rewrite.

Cyclic lockfiles go deterministic. Peer resolution now breaks dependency cycles canonically (by package id), so reordered imports and repeated installs produce byte-identical lockfiles. Large cycle-heavy workspaces reportedly see 2–3× faster peer resolution, ~25% less memory, and smaller lockfiles. Existing lockfiles still work frozen; the first install that re-resolves re-keys cycle-dependent peer variants once.

Project-aware global bins. A globally installed node, deno, or bun follows the version the current project pins — no shell hooks. Stable Node switches silently (signature-checked); everything else asks once per project and remembers locally.

pnpm provisions other package managers. Git-hosted deps install with whatever PM the repo asks for; pnx yarn@4 install and pnpm shim add yarn run the pinned tool. pnpm add yarn@4 records Corepack-style "packageManager": "[email protected]" while other PMs land in devEngines.packageManager.

Smaller but real: unrecognized keys in pnpm-workspace.yaml are now warned (or fail when the project pins a pnpm version you satisfy); engineStrict fails on incompatible packages reached through optional subtrees; Linux packageImportMethod: auto tries hardlinks before reflinks; registry revisions let a patched artifact replace a version without bumping the number ([email protected]+r1 in the lockfile).

Worth a read if you run monorepos or care about reproducible installs: What’s different in pnpm 12.