pnpm 12.7 stops --force from installing other platforms' optional binaries
Victoria Shinder2 min readpnpm 12.7.0 was released on 25 September, alongside a parallel 11.28.0 for the previous major line. The change most likely to affect existing projects concerns pnpm install --force: it now keeps skipping optional dependencies whose os, cpu or libc fields do not match the host. It still refetches every package and still lifts engineStrict. Teams that relied on the old behaviour - installing optional binaries for every platform under --force - can restore it with the new forceIgnoresPlatform setting.
Several smaller features arrive with it. The global node shim now honours the nearest .nvmrc or .node-version file when a project does not declare a runtime in devEngines.runtime or engines.runtime; within one directory package.json wins over .node-version, which wins over .nvmrc, and nvm-only values such as system are ignored. pnpm install --allow-build lets you allow or deny a package's lifecycle scripts from the command line and records the decision in pnpm-workspace.yaml. pnpm publish --publish-wait-timeout waits until published versions and their tarballs are available from the registry, and recursive publishing now confirms each package before publishing the ones that depend on it. When a repository has a workspaces field in its root package.json but no pnpm-workspace.yaml, pnpm install creates the file.
The release notes also list three security fixes: for bin shims on Nix, for lifecycle scripts of packages in a storeDir inside the workspace, and for userAgent placeholders in pnpm-workspace.yaml.
What it means
The --force change fixes a surprise that bit teams in CI. --force is often reached for to clear a corrupted install, and previously it also pulled in native binaries for every operating system and architecture a package supports, making installs larger and slower for no benefit. The new default matches what people usually mean; the setting exists for the rare case of building a multi-platform bundle on one machine.
Two of the features point in the same direction: making decisions explicit and recorded. Lifecycle scripts are the main way a compromised package runs code at install time, and --allow-build turns allowing them into a reviewed line in version control. The publish wait closes a quieter gap in monorepos, where a dependent package could be published before the registry had made its dependency available, leaving a short window in which installs of the new version failed.