Summary & Key Takeaways ​

• nodeDownloadMirrors can now be configured globally via config.yaml or environment variables.
• A new trustPolicyExcludePrune setting helps clean up stale entries in pnpm-workspace.yaml.
• pnpm now correctly reads packageManager pins from the workspace root's package.json when lockfileDir is set.
• Global add, update, and remove commands are more robust against malformed package manifests.
• The fetch-timeout now limits progress-free request time, not total download time, improving large file downloads.
• pnpm peers check no longer incorrectly flags workspace: peer dependencies as unmet.

Our Commentary ​

We appreciate the continued focus on developer experience and security in pnpm. The global nodeDownloadMirrors is a small but mighty win for teams managing diverse environments. I'm particularly interested in the trustPolicyExcludePrune feature; it feels like a proactive step towards tidier, more secure dependency graphs. It's these kinds of thoughtful improvements that make a real difference in daily workflows.