[rush] pnpm 11 no longer reads the pnpm field in package.json

[brunojppb]

Summary

Important

I did use AI to help me draft this issue, but I personally reviewed and confirmed the issue and the steps reproduced here in a large monorepo, including screenshots I took on my own.

pnpm 11 stopped reading configuration from the pnpm field of package.json; those settings must now live in pnpm-workspace.yaml (see the pnpm 11 release notes and settings docs).

Rush still serialises most of its pnpm-config.json settings into the pnpm field of the generated common/temp/package.json. After bumping pnpmVersion to 11.x, those settings are no longer applied. The most consequential of them, globalOverrides and globalPatchedDependencies, are commonly used to pin CVE remediations on transitive dependencies, so the regression is security-relevant.

Rush 5.176.0 already relocated one of these settings, allowBuilds, to pnpm-workspace.yaml via #5817. The same treatment is needed for the remaining fields.

Repro steps

1. In a Rush repository using pnpm, define a globalOverrides entry in common/config/rush/pnpm-config.json (for example, a transitive CVE pin).

2. Set pnpmVersion to 11.x in rush.json.

3. Run rush update.

4. Inspect the generated common/temp/pnpm-workspace.yaml.

   Expected result: The override is emitted into common/temp/pnpm-workspace.yaml (as allowBuilds already is) and applied by pnpm 11.

   Actual result: rush update prints the warning below and completes "successfully". The override is written only to common/temp/package.json under pnpm.overrides, where pnpm 11 ignores it; pnpm-workspace.yaml contains no overrides: block.

WARN  The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides", "pnpm.packageExtensions", "pnpm.peerDependencyRules", "pnpm.allowedDeprecatedVersions", "pnpm.patchedDependencies". See https://pnpm.io/settings for the new home of each setting.

Details

Settings affected

The warning names exactly the settings Rush copies into common/temp/package.json from pnpm-config.json:

pnpm-config.json key	Written to package.json as	Read by pnpm 11?
globalOverrides	pnpm.overrides	No
globalPackageExtensions	pnpm.packageExtensions	No
globalPeerDependencyRules	pnpm.peerDependencyRules	No
globalAllowedDeprecatedVersions	pnpm.allowedDeprecatedVersions	No
globalPatchedDependencies	pnpm.patchedDependencies	No
globalAllowBuilds	allowBuilds in pnpm-workspace.yaml	Yes (fixed in #5817)

Why this is easy to miss

The warning is the only signal; the settings are dropped without an error and the install still reports success. In a repository that pins CVE fixes through globalOverrides, the pins survive only while the committed lockfile already encodes them and installs run frozen. A rush update that re-resolves can rewrite the lockfile without the overrides, quietly reverting transitive dependencies to vulnerable versions. pnpm tracks this risk as pnpm/pnpm#11536.

Likely cause

The pnpm settings are serialised into the pnpm field of common/temp/package.json during install generation. pnpm 11 no longer reads that field; the canonical home for these settings is now common/temp/pnpm-workspace.yaml.

Suggested fix

Extend the relocation already done for allowBuilds (#5817) so that Rush also emits the following into the generated pnpm-workspace.yaml instead of the package.json pnpm field:

• globalOverrides → overrides
• globalPatchedDependencies → patchedDependencies
• globalPackageExtensions → packageExtensions
• globalPeerDependencyRules → peerDependencyRules
• globalAllowedDeprecatedVersions → allowedDeprecatedVersions

Relationship to existing issues

• [rush] Add pnpm 11 support: allowBuilds in pnpm-workspace.yaml #5817 relocated allowBuilds to pnpm-workspace.yaml for pnpm 11. This issue asks for the same mechanism to be applied to the remaining settings.
• [rush] minimumReleaseAge in pnpm-config.json is written to package.json but pnpm only reads it from .npmrc/pnpm-workspace.yaml #5752 reports the same root cause for minimumReleaseAge, but was filed under pnpm 10, where overrides/packageExtensions/patchedDependencies were still read from package.json. Its proposed fix (Fix/pnpm minimum release age #5798) targets minimumReleaseAge only and writes to .npmrc, which does not cover the settings above and is not the pnpm 11 home for them. The settings in this issue therefore remain untracked.

Standard questions

Question	Answer
@microsoft/rush globally installed version?	5.176.0
rushVersion from rush.json?	5.176.0
pnpmVersion, npmVersion, or yarnVersion from rush.json?	pnpm@11.7.0
(if pnpm) useWorkspaces from pnpm-config.json?	true
Operating system?	Mac
Would you consider contributing a PR?	Yes
Node.js version (node -v)?	v22.22.2

[brunojppb]

I mentioned in the issue, but I am happy to take a stab on fixing it if you folks don't have that under your radar yet.