Summary & Key Takeaways ​

• Git dependencies on known hosts (GitHub, GitLab, Bitbucket) are now treated as identities.
• All representations of the same repository resolve through the host's canonical HTTPS URL.
• Lockfiles will no longer record SSH URLs for these known hosts.
• Network probing for HTTPS vs. SSH at resolution time has been removed.
• Users can configure Git's URL rewriting for private hosted repositories over SSH.
• Interactive group selection added to pnpm update --global --interactive.
• pnpm root -g and pnpm bin -g now print warnings to stderr.

Our Commentary ​

This is a big one for anyone dealing with complex monorepos or private Git dependencies. The previous behavior of pnpm sometimes recording SSH URLs that only worked on specific machines was a real pain point for CI/CD. We're genuinely excited about this change. It feels like a solid step towards more robust and predictable dependency management.