Support PNPM v11

Is there an existing issue for this?

I have searched the existing issues

Feature description

PNPM vesrion 11 is in release candidate stage, and I would like to use it in my project. However, I see that dependabot only supports up to v10 (https://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories#supported-ecosystems-and-repositories).

https://github.com/pnpm/pnpm/releases/tag/v11.0.0 is out so this become more important now

any updates?

@IanVS

@IanVS thanks for opening this! Does anyone have example repos using PNPM 11 I can test against? Trying to get a feel for real-world usage before diving into the implementation. @PikachuEXE @shimscho

@robaiken

Hi @robaiken, follow-up on this with a more careful data point.

Attempted v10.33.3 to v11.0.9 on a private NestJS + SvelteKit monorepo (around 1100 deps). After resolving four explicit allowBuilds decisions blocked by the new strictDepBuilds: true default (@nestjs/core, @scarf/scarf, @sentry/cli, protobufjs), local pnpm install, type-check, full build and the lint suite all came up green.

The honest answer is: I rolled back without ever running CI against the new toolchain, so I cannot tell you whether your existing pnpm 9 or 10 code path would have produced correct PRs on a v11 project. That CI verification is the actual gap, not the migration itself.

Two observations that might be useful for your test plan:

pnpm 11 auto-writes literal placeholder strings (set this to true or false) into pnpm-workspace.yaml for any postinstall not yet listed in allowBuilds. strictDepBuilds: true then blocks the install. Worth checking how Dependabot's install path handles that on first contact with a v11 project that hasn't been hand-configured.
The lockfile stayed on lockfileVersion: '9.0' after the first install with v11 in our case, because no re-resolution was triggered. So v9 lockfiles under pnpm 11 may be a common shape for a while, which could simplify the support story for you.

Happy to push to a test branch and share CI results if you have a reference setup in mind.

@shimscho

Happy to push to a test branch and share CI results if you have a reference setup in mind.

@shimscho that would be amazing, thank you

@robaiken

@robaiken https://github.com/alveusgg/alveusgg (monorepo) + https://github.com/alveusgg/extension (single package) are both on v11 if you need things to test against. We don't set devEngines, so we don't have the multi-document lockfiles though. We received a security update from Dependabot since updating, and it seemed correct.

[ERR_PNPM_NO_MATURE_MATCHING_VERSION] from pnpm 11's minimumReleaseAge: 1440 default will block Dependabot real time security PRs once v11 is supported. Worth flagging in docs.

Ideally, Dependabot would add a minimumReleaseAgeExclude entry to security-related PRs. That's how RenovateBot works too.

The reasoning is that the GHSA reports used by Dependabot are reviewed and go through much more scrutiny than regular releases, so it's better to update sooner rather than later given that it's a public vulnerability.

chore(deps): upgrade vite to 8, mlt-core to 0.9, cql2 to 0.5.6 (#916)

Hey! Any update here to support v11? Is in stable version now!

@vaskouk

@vaskouk We're updating pnpm 11 support at the moment as we use corepack to pull in package manager versions. If you're hitting a specific issue, could you share some logs or a repo so I can investigate further? I can't say our pnpm 11 support is fully stable yet, but I'm keen to see the errors people are getting so I can reproduce and fix them

@vaskouk

@vaskouk We're updating pnpm 11 support at the moment as we use corepack to pull in package manager versions. If you're hitting a specific issue, could you share some logs or a repo so I can investigate further? I can't say our pnpm 11 support is fully stable yet, but I'm keen to see the errors people are getting so I can reproduce and fix them

I observed that pipeline failed today while trying to use pnpm audit --fix command in latest version of pnpm. Is this known ? Shall I share more logs from this ?

Two more things needed before we are really fine and also have v12 support:

Upstream:

get-pnpm ignores HTTP_PROXY/HTTPS_PROXY, so the pnpm 12 Corepack launcher cannot download the native binary behind a proxy pnpm/get.pnpm.io#57

build: pin pnpm 10, move config to pnpm-workspace.yaml, normalize pac…

chore(workspace): bootstrap Nevo SpecDev monorepo foundation (#1)

chore(frontend): upgrade pnpm to 12.3.4

@Stanzilla

I just tested this out on my repository after @Stanzilla's PR was merged in. It looks like GitHub's dependency graph is still pulling in the first document in the yaml, which means that only the pnpm executables etc. are listed in the dependency graph.

This means that the dependabot security alerts are gone again, even though they haven't actually gone away.

As a workaround, I have removed the multi-document setup in the pnpm lockfile and added this configuration option to the pnpm-workspace.yaml

pmOnFail: ignore

Warning

This configuration option comes with some trade-offs, so make sure to consult the documentation to see if this is the right thing for you.

It would be great to plug this hole.

Closing this issue as I believe this is now complete. Please let a comment below, or open a new issue, if you're still seeing issues.

@JamieMagee

Hi @JamieMagee, unsure if I'd say that dependabot supports v11 in its current state. There is support with a less-than-ideal workaround, which has security implications.

IMO once GitHub's dependency graph supports multi-yaml documents, which seems like a common occurrence in newer versions on pnpm, then we can well and truly say that v11 is supported.

If someone takes this closure as full support, updates their version of pnpm and silently loses all of their dependabot alerts and dependency graph, I'd say that's not a great outcome.

@dancallaghan

@dancallaghan can you update your post above to summarize the exact problems and workarounds (with links) that have been discussed?

@karlhorky

@karlhorky here is an example of the dependency graph:
https://github.com/dancallaghan/dependabot-pnpm-v11-reproduction/network/dependencies

The security section only shows 2 alerts:
https://github.com/dancallaghan/dependabot-pnpm-v11-reproduction/security

Running pnpm audit locally shows that there are more vulnerabilities:

$ pnpm audit

36 vulnerabilities found
Severity: 1 low | 14 moderate | 21 high

Here is an example of the workaround described above:
dancallaghan/dependabot-pnpm-v11-reproduction#11

Let me know if you would like more details.

Not sure I'm following - what is the problem there?

Also, if you agree we could keep this description of the problem in your original comment (and then delete these other comments) to keep the thread compact.

@karlhorky here is an example of the dependency graph: dancallaghan/dependabot-pnpm-v11-reproduction (dependencies)

Please make a new issue that describes the issue in more detail, my guess would be that you are trying to say that it only lists the first slice of the lockfile there?

@dancallaghan

@dancallaghan I think #15904 covers what you're seeing?

ci: Dependabotにfrontend(npm)のversion updatesレーンを追加する (#352)

Navigation Menu

Repository navigation

Support PNPM v11 #14794

Is there an existing issue for this?

Feature description

49 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Support PNPM v11 #14794

Description

Is there an existing issue for this?

Feature description

Activity

PikachuEXE commented on Apr 29, 2026

shimscho commented on May 9, 2026

robaiken commented on May 12, 2026

shimscho commented on May 12, 2026

robaiken commented on May 12, 2026

MattIPv4 commented on May 12, 2026

CleytonGoncalves commented on May 13, 2026

vaskouk commented on May 20, 2026

robaiken commented on May 20, 2026

vaskouk commented on May 20, 2026

49 remaining items

Stanzilla commented on Sep 3, 2026

dancallaghan commented on Sep 9, 2026

JamieMagee commented on Sep 15, 2026

dancallaghan commented on Sep 15, 2026

karlhorky commented on Sep 16, 2026

dancallaghan commented on Sep 17, 2026

karlhorky commented on Sep 17, 2026

Stanzilla commented on Sep 17, 2026

MattIPv4 commented on Sep 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions