Compare Versions - pm2

npm/pm2/Compare Versions

View on npm

→Compare

7.0.4

7.0.4

Features

• Start .ts apps with Node.js native type stripping when bun is not installed (Node.js >= 22.18 / 23.6, --experimental-strip-types auto-injected on 22.6+); ts-node fallback now resolved from the app's own dependencies

Bug Fixes

• Fix pm2 start --container / --container --dist crashing with Cannot find module — wrong require depth in Containerizer.js from the v7 promptly internalization
• Bump js-yaml 4.3.0 → 4.3.1
• Fix overlapping reloads colliding on the _old_<pm_id> slot and orphaning a cluster worker — a reload is now refused while one is in progress #6129
• Ignore stale exit events from a replaced process — fixes double start on Windows with shutdown_with_message #6142
• Fix retrying in NaNms kill log and ~1ms poll spam when kill_retry_time is unset — fallback to KILL_RETRY_TIME constant (100ms, PM2_KILL_RETRY_TIME overridable)
• Fix pm2 start/restart RPC hanging forever when a cluster worker dies before its online event (bad node_args, boot OOM) — executeApp now concludes on exit-before-online
• Surface the daemon's actual error in CLI output instead of masking everything as Process not found
• Pin OpenTelemetry package versions in pm2 install-otel and re-emit legacy HTTP span tags (http.method, http.status_code, http.target) dropped by @opentelemetry/instrumentation-http >= 0.220

Core Refactor

• Remove dead code: promise.min.js polyfill (native Promise), IsAbsolute.js (native path.isAbsolute), unused Java/Ruby Dockerfile templates, always-false win64 platform checks

7.0.3

7.0.3

Bug Fixes

• Fix daemon failing to boot on Node.js < 14.18 — embedded vizion used node:-scheme requires; switched to bare specifiers

7.0.2

7.0.2

Bug Fixes

• Fix pm2 serve returning 403 Forbidden on Windows — traversal guard used hardcoded / separator #6109
• Fix pm2 ls table misalignment when a username exceeds the user column width — cli-tableau's truncate() miscounts ANSI bytes, leaking bold into the watching column
• Fix long status lines (e.g. Applying action … on app […]) wrapping on narrow terminals — Common.printOut now ANSI-aware crops single-line TTY output to terminal width (piped output unaffected)

Features

• pm2 ls host-metrics line now shown by defaultpm2 update)
• pm2 ls adaptive layout: picks the widest layout that fits the terminal — full → condensed → new ultra-compact mini (id · name · status · cpu · mem) — and caps the name column so long names can't overflow the table
• pm2 ls host-metrics line only lists network interfaces carrying traffic (hides idle utun/awdl/bridge/anpi/unused en*)
• pm2 ls host-metrics line: replaced mem free with ram usage (%), added GPU memory/temperature when reported, per-interface network errors/drops shown when non-zero

Core Refactor

• Drop old vizion module, refactor to support only git and drop 3 submodules
• Replace the bundled pm2-sysmonit module and systeminformation with lib/tools/SysMetrics.js (Linux/macOS); pm2 slist/getSystemData and the Docker metrics path now read this collector. Covered by test/programmatic/sysmetrics.mocha.js

Security

• Bump js-yaml 4.1.1 → 4.3.0 — fixes quadratic-complexity DoS in merge-key handling (GHSA-h67p-54hq-rp68) #6122
• Bump ws 8.20.0 → 8.21.0 — fixes uninitialized-memory disclosure and tiny-fragment DoS (GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p) #6116
• Bump @pm2/js-api 0.8.0 → 0.8.1, pulling in patched ws@8.21.0 (its transitive ws was pinned to the vulnerable 7.x). Production deps are now advisory-free (npm audit --omit=dev clean)

7.0.1

7.0.1

Bug Fixes

• Fix Python (and other non-Node) interpreter regression on Ubuntu: bun runtime detection used a naive includes('bun') substring check that matched any path containing the letters "bun" — most notably /home/ubuntu/.... Affected paths were routed through ProcessContainerForkBun.js and crashed with SyntaxError: unterminated string literal when Python tried to parse the JS container. Anchored the match to the end of the interpreter path (=== 'bun' or /bun$/) in both lib/God/ForkMode.js and lib/Common.js #5990
• Display max_memory_restart in pm2 describe output when set #5925
• Add missing port option to StartOptions TypeScript declaration #6045
• Fix incorrect file permissions on openrc.tpl template (0755 → 0644) #5957
• Fix Windows cmd.exe regression: revert bin/pm2* launchers to #!/usr/bin/env node shebang (was polyglot #!/bin/sh). Polyglot worked on Linux/macOS but broke npm's pm2.cmd shim on Windows — cmd.exe can't interpret /bin/sh shebang and failed with '"/bin/sh"' is not recognized as an internal or external command. PowerShell's auto-generated pm2.ps1 shim happened to call node directly so it kept working, masking the regression. Bun-only Linux/macOS users (no Node installed) need to symlink node to bun (sudo ln -s $(which bun) /usr/local/bin/node) — same workaround used in the project's bun test Dockerfile. Documented in README #6108

7.0.0

7.0.0

Breaking Changes

• Require Node.js >= 18.0.0 (dropped Node.js 16 support)

Core Refactor

• Internalize pm2-axon, pm2-axon-rpc, pm2-io-bpm, pm2-io-agent, fclone as local modules (reduced supply chain surface)
• Internalize pm2-multimeter and charm into lib/tools/multimeter (zero external deps)
• Add Bun runtime support (ProcessContainerBun.js, ProcessContainerForkBun.js)
• Replace needle with native fetch (CliAuth, TAR publish)
• Replace enquirer with lightweight built-in prompt (boilerplate selector)
• Replace promptly with built-in lib/tools/prompt
• Replace mkdirp with native fs.mkdirSync({ recursive: true })
• Replace source-map-support with native process.setSourceMapsEnabled()
• Replace sprintf-js with template literals (Dashboard)
• Replace url.parse() with native URL constructor (Serve, Utility, CliAuth)
• Remove fclone npm dep, use internalized module
• Drop auto source map file detection in Common.prepareAppConf

Security

• CVE-2025-5891 Fix ReDoS in Config.js string-to-array split regex #6075
• CVE-2026-27699 Update proxy-agent to 6.5.0, basic-ftp to 5.3.1 #6088
• Fix command injection in WebAuth.js open() — replace exec() with execFile() #6089
• Fix command injection in PM2IO.js open() — replace exec() with execFile(), validate SUDO_USER
• Fix command injection in lib/tools/open.js — replace exec() with execFile(), validate SUDO_USER
• Fix prototype pollution in Configuration.set/unset via proto key traversal #6089
• Fix HttpInterface env stripping never executing (WEB_STRIP_ENV_VARS) #6089

Bug Fixes

• Rewrite TreeKill: single ps snapshot + in-memory tree build, eliminates race conditions. SIGKILL escalation now targets surviving child processes directly instead of re-walking a dead tree #6084
• Fix [object Object] env vars leaked to fork mode subprocesses #6073
• Fix Windows home path: use os.homedir() instead of HOMEPATH/HOMEDRIVE env vars #6106
• Fix Windows TreeKill callback consistency
• Fix missing BPM monitoring injection in Bun cluster mode (ProcessContainerBun.js)
• Fix ReferenceError crash in Bun cluster console overrides when disable_logs is true
• Fix CliAuth wrong credentials error displaying "undefined" instead of error message

Features

• Add --ftp option to pm2 serve for directory listing (python http.server style)

Dependencies

• Add OpenTelemetry tracing as direct dependencies (@opentelemetry/api, sdk-node, auto-instrumentations-node)
• Upgrade OpenTelemetry packages to latest
• Update pidusage from 3.0.2 to 4.0.1
• Upgrade ws to ^8.18.0, eventemitter2 to ^6.4.9
• Remove needle, enquirer, promptly, mkdirp, source-map-support, sprintf-js, fclone from npm dependencies

Testing

• Add Docker parallel test runner with Node.js and Bun support
• Add Windows test suite (test/windows.sh)
• Add OpenTelemetry tracing tests
• Add TreeKill unit tests
• Add test scripts for internalized modules (bpm, axon, axon-rpc, io-agent)
• Fix test compatibility for Node.js 22+ and Bun
• CI matrix: Node.js 18, 20 + latest

6.0.14

6.0.14

• Fixed version of @pm2/pm2-version-check #6055
• CVE-2025-64718 Update js-yaml
• replace fs.R_OK with fs.constants.T_OK #6012 #6019

6.0.13

• fix blessed dep

6.0.12

• #6037 Drop npm-shrinkwrap in favor of fixed dependencies versions
• #5577 fix pm2 monit crash

6.0.11

• #6034 replace package-lock.json by npm-shrinkwrap.json
• #5915 fix allowing to update namespaced pm2 NPM module (@org/module-name)

6.0.10

• revert #5971 #6031

6.0.9

6.0.9

• updates all typescript definitions
• upgrade github ci workflows
• upgrade mocha dep and adapt tests
• bump packages
• fix:Potential ReDoS Vulnerability or Inefficient Regular Expression in Project: Need for Assessment and Mitigation #5971

6.0.8

• fix: package-lock update

6.0.7

• fix: ansis-node10 https://github.com/Unitech/pm2/commit/99d9224e940d119a1ad5b241b4fc4e0db7c830ed @
  webdiscus

6.0.6

• refactor: replace chalk with ansis by @webdiscus fix #5976 #5247

6.0.5

6.0.5

• Bun support - Fixes #5893 #5774 #5682 #5675 #5777
• Disable git parsing by default #5909 #2182 #5801 #5051 #5696
• Add WEBP content type for pm2 serve #5900 @tbo47
• Enable PM2 module update from tarball #5906 @AYOKINYA
• Fix treekil on FreeBSD #5896 @skeyby
• fix allowing to update namespaced pm2 NPM module (@org/module-name) #5915 @endelendel

5.4.2

• https://github.com/Unitech/pm2/pull/5833
• https://github.com/keymetrics/pm2-io-apm/issues/301

5.4.1

Update websocket dependency in pm2/agent submodule

5.4.0

• drop old uuid sub dependency
• #5782 add autostart true||false feature by @ultimate-tester
• update modules

5.3.1

• Fix terminal width when condensed https://github.com/Unitech/pm2/commit/cac839329afaa768ea9901e3e2551987d509ae05
• Auto run tsx/ts files with bun binary instead of ts-node https://github.com/Unitech/pm2/commit/f122aabe3270aade8fa770fd5b67b877a26efd52
• #5686 Switch from Travis CI to Github Actions
• #5680 Fixed reserved keyword for ES6 Strict Mode when Bundling @juaneth
• #5683 update badges
• #5684 auto switch light and dark mode logos
• #5678 Bugfix/deploy ecosystem filename extension / esm module default ecosystem config name @TeleMediaCC
• #5660 Fix matching logic for logs from namespace when lines = 0 @bawjensen
• fix "vulnerabilities" in axios module

2.1.4

2.1.4

• #2333 #2478 #1732 #1346 #1311 #1101 Fix GracefulShutdown SIGINT output + Better Stop process flow
• Faster CLI load time, reduce load time by 1/4 (downgrade cli-table2 -> cli-table)
• #2353 --wait-ready will wait that the application sends 'ready' event process.send('ready')
• #2486 add --web option to pm2-docker command to expose web process api
• #2425 allow to specify node.js version to be used or installed via interpreter 'node@VERSION'
• #2471 Make app environment immutable on application restart/reload by default for CLI actions
• #2451 Config file can be javascript files
• #2484 fix pm2 kill on windows
• #2101 pm2 ecosystem now generates a javascript configuration file
• #2422 allow to pass none to exec_interpreter
• Do not use disconnect() anymore on cluster processes
• Better Stop process flow: Upgrade TreeKill system + Wait for check
• Fix deploy issue with Windows
• Expose -i to pm2-docker
• Drop npm-shrinkwrap
• Upgrade chokidar (fix symlink), cron, fclone, shelljs

2.0.18

• #2400 Create log/pid default folder even if the root folder is already created
• #2395 CRON feature now call PM2 for app to be killed (allow to use SIGINT)
• #2413 #2405 #2406 do not exit on unhandledRejection auto catch
• pidusage upgrade to 1.0.8 to avoid util exception on windows when wmic fail
• Do no display error when pidusage try to monitor an unknow PID (modules)

0.15.8

• New module system backward compatible and compatible with NPM 3.x
• Possibility to install module from tgz (#1713)
• ecosystem generated file via pm2 generate uptaded (not json5 prefix anymore, and updated comments)
• always prefix logs #1695
• blessed dependency removed
• drop locking system
• add callback to deploy (#1673)
• typo fixes