pnpm 12 rewrites core in Rust while preserving pnpm 11 lockfile and commands

pnpm 12 is a Rust rewrite that deliberately avoids a migration: the lockfile format, CLI flags, and configuration files from pnpm 11 remain valid. This means teams can upgrade without rewriting scripts or regenerating lockfiles, but must still test for behavioral differences in Git dependency resolution and cyclic peer graphs. The Rust implementation is not a drop-in performance patch, it changes how pnpm shells out to Git and how it orders peers during resolution, so the same dependency graph may produce a different lockfile on first install after upgrade.

Git dependencies now resolve through the host’s canonical HTTPS URL for GitHub, GitLab, and Bitbucket, regardless of the specifier used. This means `github:owner/repo`, `owner/repo`, and `git+https://` all resolve to the same HTTPS URL, while SSH URLs are only preserved for unknown hosts or URLs with embedded credentials. To use SSH for private repos, engineers must configure Git’s URL rewriting globally. This change reduces lockfile churn but may break workflows that rely on SSH URLs being recorded verbatim.

Cyclic dependency graphs are now broken canonically during peer resolution, producing byte-identical lockfiles across installs. This improves reproducibility and reduces lockfile size, but the first install after upgrade will re-key peer variants of cyclic packages. The change also delivers a 2 to 3× speedup and 25% memory reduction on large workspaces, though existing lockfiles remain compatible with `--frozen-lockfile`. Engineers should expect smaller, more stable lockfiles but must validate that the new resolution order does not introduce unexpected peer conflicts.

pnpm 12 introduces stricter validation for unrecognized settings in `pnpm-workspace.yaml`, reporting them as errors or warnings instead of silently ignoring them. This prevents misconfigurations like misspelled keys from going unnoticed, but may surface existing issues in projects that rely on ignored settings. The error only occurs when the project pins a pnpm version that matches the running version, ensuring the setting was not meant for a different release. This change makes configuration more explicit but may require cleanup in legacy workspaces.

The Rust rewrite also ships new features like project-aware global bins, where globally installed tools like Node, Deno, or Bun follow the version pinned by the current project. This eliminates the need for shell hooks or `use`-style commands, but requires explicit configuration via the `globalShims` setting. While not all new features are exclusive to pnpm 12, the Rust implementation enables them without breaking compatibility, offering engineers incremental improvements without forced migration.