pnpm deprecate and unpublish: Registry Access Reimagined

Written by Alessio on 4/6/2026

Problem

pnpm was delegating pnpm deprecate and pnpm unpublish to npm's CLI. This added process overhead and didn't integrate with pnpm's architecture or support per-scope registries.

Solution

Created @pnpm/registry-access.commands package with three native commands:

pnpm deprecate <package>[@<version>] <message>: Sets deprecation on matching versions
pnpm undeprecate <package>[@<version>]: Removes deprecation
pnpm unpublish <package>[@<version>]: Supports versions, semver ranges, --force for entire packages

All commands share common logic for auth, registry selection via pickRegistryForPackage, and version matching. Payload sent to registry is minimal: only name + modified versions.deprecated fields.

Result

Direct registry interaction without CLI pass-through. Proper OTP and custom registry support.

Commits: pnpm/pnpm@d401ff250, pnpm/pnpm@2c90d406
PRs: #11120, #11128