Was the workspace state file permission change in pnpm 12 intentional?

[wancup]

I noticed that the permissions of node_modules/.pnpm-workspace-state-v1.json changed between pnpm 11 and 12:

• pnpm 11.28.8: 644 (rw-r--r--)
• pnpm 12.0.0 and 12.16.0: 600 (rw-------)

In my use case, I install dependencies as root in one stage of a multi-stage Docker build, then run pnpm start as a non-root user in the runtime stage. With pnpm 12, the runtime user cannot read the state file, and pnpm attempts to install dependencies again.

I couldn't find this permission change in the pnpm 12.0 release notes. Is it intentional?

---

Reproduction

# syntax=docker/dockerfile:1
FROM node:24-bookworm-slim AS build

ARG PNPM_VERSION=12.0.0
RUN npm install -g pnpm@${PNPM_VERSION}

WORKDIR /app

COPY <<'EOF' package.json
{
  "name": "repro",
  "private": true,
  "scripts": {
    "start": "node -e \"console.log(require('local-dep'))\""
  },
  "dependencies": {
    "local-dep": "workspace:*"
  }
}
EOF

COPY <<EOF pnpm-workspace.yaml
packages:
  - packages/*
EOF

COPY <<EOF packages/local/package.json
{
  "name": "local-dep",
  "version": "1.0.0",
  "main": "index.js"
}
EOF

COPY <<EOF packages/local/index.js
module.exports = 'start succeeded'
EOF

RUN pnpm install --lockfile-only
RUN pnpm install --frozen-lockfile

FROM node:24-bookworm-slim AS runtime

ARG PNPM_VERSION=12.0.0
RUN npm install -g pnpm@${PNPM_VERSION}

WORKDIR /app
COPY --from=build /app/ /app/

USER node
CMD ["pnpm", "start"]

# v11.28.8: pnpm start runs without another install.
docker build --build-arg PNPM_VERSION=11.28.8 -t pnpm-repro:11 .
docker run --rm pnpm-repro:11

# v12.0.0: pnpm attempts another install. In this Dockerfile, the install fails with a permission error.
docker build --build-arg PNPM_VERSION=12.0.0 -t pnpm-repro:12 .
docker run --rm pnpm-repro:12

# v12.16.0: pnpm attempts another install, which fails, but the script still runs.
docker build --no-cache --build-arg PNPM_VERSION=12.16.0 -t pnpm-repro:12.16 .
docker run --rm pnpm-repro:12.16

[g4lb]

I think that this is a side effect of the Rust rewrite. pnpm 12 writes the file through tempfile::NamedTempFile, which uses mode 0600. pnpm 11 used fs.writeFile, which gives 644. A maintainer can tell you if they want to change it.

Workaround 1: Give the runtime user ownership:

COPY --from=build --chown=node:node /app/ /app/

Workaround 2: Make the file readable in the build stage:

RUN chmod a+r node_modules/.pnpm-workspace-state-v1.json

I tested both with your Dockerfile and pnpm 12.16.0. With each workaround, pnpm start runs without an install.

[zkochan]

Thanks for the report and the repro. The change wasn't intentional. pnpm 12 wrote the state file through a temp file created with mode 0600. pnpm 11 used fs.writeFile, which creates it as 0644 under the usual umask. #17438 creates the file with the same umask-based mode as other new files, so another user can read it again. Until it ships, the --chown or chmod a+r workarounds above both work.

---

Written by an agent (Claude Code, claude-opus-5-5).