pnpm 10.25

pnpm 10.25 improves certificate handling, adds a bare pnpm init, and ships several quality-of-life fixes.

<!-- truncate -->

Minor Changes

Per-registry certificates

You can now load inline certificates from the cert, ca, and key settings for specific registry URLs (for example, //registry.example.com/:ca=-----BEGIN CERTIFICATE-----...). Previously, pnpm only respected the certfile, cafile, and keyfile entries. This aligns pnpm with npm's .npmrc behavior #10230.

pnpm init --bare

Added a --bare flag to pnpm init for creating a package.json with only the required fields #10226.

Patch Changes

• Improved reporting of ignored dependency scripts #10276.
• pnpm install now builds any dependencies that were added to onlyBuiltDependencies but have not run their builds yet #10256.
• pnpm publish -r --force will publish even if the version already exists in the registry, matching the intent of the flag #10272.
• Avoid ERR_PNPM_MISSING_TIME errors when a package excluded from trust policy checks lacks the time field in its metadata.