pnpm 12 is now stable, a full Rust rewrite that preserves pnpm 11's commands, flags, settings, and lockfile format without requiring migration. It's installed via the next-12 npm tag since latest still points to pnpm 11. Breaking changes include git dependency specifiers resolving through canonical HTTPS URLs instead of SSH, unrecognized pnpm-workspace.yaml settings now being reported (and failing when a pnpm version is pinned), canonicalized lockfiles for cyclic dependency graphs (2-3x faster peer resolution, ~25% less memory on cycle-heavy workspaces), hardlink-first behavior for packageImportMethod: auto on Linux, and stricter engineStrict edge traversal. New features include project-aware global bins for node/deno/bun, pnpm provisioning other package managers (npm, Yarn, Bun) via pnx and pnpm shim, registry revisions for serving patched artifacts without version bumps, pnpm init pinning the latest pnpm version, batch approval for staged publishing, audit.ignorePrune, sudo restrict

Node.js 24.20.0 'Krypton' LTS ships several SEMVER-MINOR additions: using scopes for AsyncLocalStorage, an end parameter for Buffer, permission.drop and a new --permission-audit flag, package maps support in the loader, a new node:stream/iter module, context.log() in the test runner, and WebAssembly JSPI enabled. It also updates root certificates to NSS 3.125 and bundles numerous dependency upgrades (npm 11.19.0, ngtcp2, nghttp3, c-ares, sqlite, timezone data) plus a long list of bug fixes across crypto, buffer, http, http2, quic, and net modules.