pnpm 12.16 adds a global --env-file flag, patches a timing leak

pnpm 12.16.0 shipped on 27 October with a repeatable global --env-file <path> flag that loads environment variables from dotenv-style files before a command runs. Multiple files are read in order, later ones override earlier ones, and existing environment variables are left alone. The loaded values are also available to lifecycle scripts and to interpolation in your user-level .npmrc.

The same release lets pnpm treat pnpm-lock.yaml as a symlink: list the real target directories under a new symlinkedLockfileTargetDirs setting and pnpm writes updates to the file the symlink points at. There’s also a pnpm setup --no-modify-path option that skips touching your shell config and prints the lines you’d need instead. Tucked into the patch notes are two security fixes: a memory exposure bug in zstd decompression, and a timing side-channel in pnpm’s signing code, tracked as RUSTSEC-2026-0387, that could in theory leak a private key through arithmetic timing during artifact signing, OCI token handling or OIDC login.

pnpm --env-file .env.local --env-file .env.ci run build

Why it matters: --env-file removes a common reason projects reach for dotenv-cli or a wrapper script just to get variables into a pnpm command. The lockfile-symlink support is a narrower fix, but useful if you’ve ever had to work around a shared pnpm-lock.yaml across linked repos.