@pnpm/types

property trustPackageIdentity

trustPackageIdentity?: boolean;

property ignoreGhsas

ignoreGhsas?: string[];

property ignore

ignore?: string[];

• GHSA IDs that pnpm audit should ignore. Supersedes auditConfig.ignoreGhsas.

property ignorePrune

ignorePrune?: boolean;

• When true, pnpm audit --fix removes entries from the ignore list that no longer appear in the audit report, so a re-introduced vulnerability under the same GHSA ID gets re-evaluated instead of staying silently suppressed.

property level

level?: AuditLevel;

• The minimum vulnerability severity pnpm audit reports on. Supersedes the top-level auditLevel setting.

property foundVersion

foundVersion: string;

property resolvedFrom

resolvedFrom: ParentPackages;

property author

author?: string;

property bin

bin?: PackageBin;

property bugs

bugs?:
    | string
    | {
          url?: string;
          email?: string;
      };

property bundledDependencies

bundledDependencies?: string[] | boolean;

property bundleDependencies

bundleDependencies?: string[] | boolean;

property config

config?: Record<string, unknown>;

property cpu

cpu?: string[];

property dependencies

dependencies?: Dependencies;

property dependenciesMeta

dependenciesMeta?: DependenciesMeta;

property description

description?: string;

property devDependencies

devDependencies?: Dependencies;

property devEngines

devEngines?: DevEngines;

property directories

directories?: {
    bin?: string;
};

property engines

engines?: {
    node?: string;
    npm?: string;
    pnpm?: string;
} & Pick<DevEngines, 'runtime'>;

property exports

exports?: Record<string, string>;

property files

files?: string[];

property funding

funding?: string;

property gypfile

gypfile?: boolean;

• false opts the package out of the node-gyp rebuild install script pnpm synthesizes for a package that ships a binding.gyp and declares no install or preinstall script of its own.

  npm documents gypfile as that opt-out, and sets gypfile: true at publish time on every package it synthesizes the script for, so only the false value carries anything pnpm can act on.

  See Also

  • https://docs.npmjs.com/cli/v12/configuring-npm/package-json#gypfile

property homepage

homepage?: string;

property imports

imports?: Record<string, unknown>;

property keywords

keywords?: string[];

property libc

libc?: string[];

property license

license?: string;

property main

main?: string;

property module

module?: string;

property name

name?: string;

property optionalDependencies

optionalDependencies?: Dependencies;

property os

os?: string[];

property peerDependencies

peerDependencies?: Dependencies;

property peerDependenciesMeta

peerDependenciesMeta?: PeerDependenciesMeta;

property publishConfig

publishConfig?: PublishConfig;

property readme

readme?: string;

property repository

repository?:
    | string
    | {
          url: string;
      };

property scripts

scripts?: PackageScripts;

property type

type?: string;

property types

types?: string;

property typesVersions

typesVersions?: TypesVersions;

property typings

typings?: string;

property version

version?: string;

property password

password: string;

property username

username: string;

property authToken

authToken?: string;

• The value of _authToken of each registry in the rc file.

property basicAuth

basicAuth?: BasicAuth;

• Parsed value of _auth of each registry in the rc file.

property tokenHelper

tokenHelper?: TokenHelper;

• Parsed value of tokenHelper of each registry in the rc file.

index signature

[dependencyName: string]: {
    injected?: boolean;
    patch?: string;
};

property name

name: string;

property version

version: string;

property name

name: string;

property onFail

onFail?: 'ignore' | 'warn' | 'error' | 'download';

property version

version?: string;

property alias

alias: string;

property name

name: string;

property readManifest

readManifest: () => DependencyManifest;

property version

version: string;

property optional

optional: boolean;

property parents

parents: ParentPackages;

property wantedRange

wantedRange: string;

property deprecated

deprecated?: string;

property severity

severity: VulnerabilitySeverity;

• The severity of the vulnerability

property versionRange

versionRange: string;

• A semver version range that indicates which versions are vulnerable

property getVulnerabilities

getVulnerabilities: () => Map<string, PackageVulnerability[]>;

• Get all vulnerabilities for all packages.

  Returns

  A map where the keys are package names and the values are arrays of vulnerabilities for those packages.

property isVulnerable

isVulnerable: (packageName: string, version: string) => boolean;

• Check if the given package version is vulnerable.

index signature

[dependencyName: string]: {
    optional?: boolean;
};

property bad

bad: BadPeerIssuesByPeerName;

property conflicts

conflicts: string[];

property intersections

intersections: Record<string, string>;

property missing

missing: MissingPeerIssuesByPeerName;

property allowAny

allowAny?: string[];

property allowedVersions

allowedVersions?: Record<string, string>;

property ignoreMissing

ignoreMissing?: string[];

property allowBuilds

allowBuilds?: Record<string, boolean | string>;

property allowedDeprecatedVersions

allowedDeprecatedVersions?: AllowedDeprecatedVersions;

property allowUnusedPatches

allowUnusedPatches?: boolean;

property audit

audit?: AuditSettings;

property auditConfig

auditConfig?: AuditConfig;

• Deprecated

  Use PnpmSettings.audit instead. Kept for backward compatibility until the next major version.

property autoInstallPeersFromHighestMatch

autoInstallPeersFromHighestMatch?: boolean;

property configDependencies

configDependencies?: ConfigDependencies;

property enableGlobalVirtualStore

enableGlobalVirtualStore?: boolean;

• The boolean spelling of PnpmSettings.virtualStoreType.

property externalDependencies

externalDependencies?: string[];

property httpProxy

httpProxy?: string;

property httpsProxy

httpsProxy?: string;

property ignoredOptionalDependencies

ignoredOptionalDependencies?: string[];

property namedRegistries

namedRegistries?: Record<string, string>;

• Deprecated

  Give the registry a prefix in PnpmSettings.registries instead. Kept working until the next major version.

property nodeDownloadMirrors

nodeDownloadMirrors?: Record<string, string>;

property noProxy

noProxy?: string | boolean;

property npmrcAuthFile

npmrcAuthFile?: string;

property overrides

overrides?: Record<string, string>;

property packageExtensions

packageExtensions?: Record<string, PackageExtension>;

property patchedDependencies

patchedDependencies?: Record<string, string>;

property peerDependencyRules

peerDependencyRules?: PeerDependencyRules;

property pnprServer

pnprServer?: string;

property registries

registries?: Record<string, RegistryDeclaration> | RegistriesByScope;

• The registries the project declares, keyed by registry URL, so that a registry's layout, the scopes routed to it, and the bare-specifier prefix it answers to are all stated once, in one place.

  A map whose values are plain strings is the older scope: url shape and is read as one.

property remoteSideEffectsCache

remoteSideEffectsCache?: RemoteSideEffectsCacheSettings;

• The alternative spelling of SideEffectsCacheSettings.remote. A field set under both takes its value from there; a field set under only one is kept either way.

property requiredScripts

requiredScripts?: string[];

property sideEffectsCache

sideEffectsCache?: boolean | SideEffectsCacheSettings;

• Whether a package's build output is reused, and where from. A boolean sets read and write together.

property supportedArchitectures

supportedArchitectures?: SupportedArchitectures;

property tasks

tasks?: WorkspaceTasks;

property update

update?: UpdateSettings;

property updateConfig

updateConfig?: {
    changeset?: boolean;
    ignoreDependencies?: string[];
    githubActions?: boolean;
    githubActionsServer?: string;
};

• Deprecated

  Use PnpmSettings.update instead. Kept for backward compatibility until the next major version.

property versioning

versioning?: VersioningSettings;

property virtualStoreType

virtualStoreType?: VirtualStoreType;

• Where the virtual store lives, and therefore who shares it: one store per machine (global) or one per project (project).

  The canonical spelling of PnpmSettings.enableGlobalVirtualStore. When both are set, this one wins.

property manifest

manifest: ProjectManifest;

property modulesDir

modulesDir?: string;

property rootDir

rootDir: ProjectRootDir;

property rootDirRealPath

rootDirRealPath: ProjectRootDirRealPath;

property writeProjectManifest

writeProjectManifest: (
    manifest: ProjectManifest,
    force?: boolean | undefined
) => Promise<void>;

property packageManager

packageManager?: string;

property private

private?: boolean;

property resolutions

resolutions?: Record<string, string>;

property workspaces

workspaces?: string[];

property access

access?: 'public' | 'restricted';

property directory

directory?: string;

property executableFiles

executableFiles?: string[];

property linkDirectory

linkDirectory?: boolean;

property name

name?: string;

• Publishes the package under a different name than the one its manifest carries in the workspace — for a project whose name is already taken by a sibling. Only the published artifact is renamed; dependents, the lockfile, and release tooling keep addressing the project by its manifest name.

property registry

registry?: string;

property gh

gh: string;

property npmjs

npmjs: string;

index signature

[name: string]: string;

property default

default: string;

index signature

[scope: string]: string;

property tls

tls?: TlsConfig;

index signature

[scope: `@${string}`]: Creds | undefined;

property registriesByPrefix

registriesByPrefix?: Record<string, string>;

• As the user wrote it; built-in aliases are merged in at lookup.

property registriesByScope

registriesByScope: RegistriesByScope;

property registryOptionsByUrl

registryOptionsByUrl?: Record<string, RegistryOptions>;

property prefix

prefix?: string;

• The bare-specifier prefix this registry answers to, as in "foo": "work:^1.0.0". Singular because the prefix is the registry's identity in a lockfile dep path (foo@work:1.0.0): a second spelling would key the same package from the same registry twice.

property scopes

scopes?: string[];

• The scopes routed here, @-prefixed. DEFAULT_REGISTRY_SCOPE (a bare @) is the registry packages resolve from when no scope matches, the same registry the registry setting names.

property serverType

serverType?: RegistryServerType;

property supportsTimeField

supportsTimeField?: boolean;

• Whether this registry's abbreviated metadata carries the time field.

  registry.npmjs.org does not, which is why the default is false and why a time-based resolution falls back to the far larger full metadata. A registry that does carry it — Verdaccio and several proxies — is worth declaring: the fallback is per registry, so one that needs full metadata no longer costs it at the others.

property architectureBaseline

architectureBaseline?: string;

property buildEnv

buildEnv?: Record<string, string>;

property builderId

builderId?: string;

property imageDigest

imageDigest?: string;

property keyId

keyId?: string;

• Identifies which of the consumer's trusted keys signed a published artifact.

property org

org?: string;

• Both halves are optional because one section is assembled from several sources: the repository names the eligible organization and packages while the machine supplies the trust root. The feature applies only once both halves are present.

property organization

organization?: string;

• The alternative spelling of RemoteSideEffectsCacheSettings.org, which wins when both are set.

property packages

packages?: string[];

property privateKey

privateKey?: string;

• Base64-encoded PKCS#8 P-256 private key used to sign published artifacts.

property publish

publish?: boolean;

• Publish the lifecycle-script diff of every eligible package that is built.

property trustedKeys

trustedKeys?: Record<string, string>;

• Base64-encoded P-256 SubjectPublicKeyInfo DER, keyed by key id.

property read

read?: boolean;

• Restore a package's build from the cache when one is present.

property remote

remote?: RemoteSideEffectsCacheSettings;

property write

write?: boolean;

• Save a package's build output to the cache.

property cpu

cpu?: string[];

property libc

libc?: string[];

property os

os?: string[];

property ca

ca?: string;

• Certificate authority (PEM).

property cert

cert?: string;

• Client certificate (PEM).

property key

key?: string;

• Client private key (PEM).

index signature

[version: Version]: {
    [pattern: Pattern]: string[];
};

property changeset

changeset?: boolean;

• Generate a changeset for the updated production dependencies by default, as if pnpm update were run with --changeset.

property githubActions

githubActions?: boolean;

• Whether pnpm outdated and pnpm update should also look at the GitHub Actions referenced by the workflow files. Opt-in: neither command reads them unless this is set to true or --include-github-actions is passed.

property githubActionsServer

githubActionsServer?: string;

• The base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When not set, the GITHUB_SERVER_URL environment variable is used, falling back to https://github.com.

property ignoreDeps

ignoreDeps?: string[];

• Dependency name patterns that pnpm update and pnpm outdated should skip.

property format

format?: string;

property storage

storage?: VersioningChangelogStorage;

• Where release changelogs live. Defaults to registry: no CHANGELOG.md is committed; each release's section is composed at publish time and packed into the published tarball, on top of the previously published version's changelog. repository keeps a committed CHANGELOG.md in every package.

property lead

lead: string;

• The package whose major version defines the band, referenced by name or by ./-prefixed workspace directory (e.g. pnpm).

property packages

packages: string[];

• Selectors matching the member packages: name globs, ./-prefixed directory globs, and !-prefixed negations, following pnpm's selector conventions (e.g. ["./pnpm11/**", "!./pnpm11/private/**"]).

property changelog

changelog?: VersioningChangelogSettings;

property epics

epics?: VersioningEpic[];

• Epics that band member packages' majors to a lead package's major.

property fixed

fixed?: string[][];

• Groups of packages that always release together at one shared version.

property ignore

ignore?: string[];

• Packages permanently excluded from versioning and dependent propagation.

property lanes

lanes?: Record<string, string>;

• Per-package release lanes: maps a package name to the lane it is on (e.g. "@example/cli": "alpha"). A lane is a parallel release track that emits X.Y.Z-tag.N prereleases; every unlisted package is on the reserved default lane, main, and releases stable versions.

property maxBump

maxBump?: VersioningBumpType;

• Caps the bump a release from the current checkout may apply. Enforced on the final assembled release plan, after dependent propagation and fixed-group resolution.

index signature

[taskName: string]: WorkspaceTaskSettings;

property concurrency

concurrency?: number;

property dependsOn

dependsOn?: string[];

• The tasks that must complete before this one may start. A ^name entry names the task in each of the project's workspace dependencies; a bare name entry names the task in the same project.

  A task with no declaration behaves as dependsOn: ['^<its own name>']. An entry with dependsOn omitted declares an empty dependency list — the task depends on nothing and may start immediately.