What’s New

Source: https://pm2.keymetrics.io/docs/usage/whats-new/

What’s New in PM2

Release highlights of the latest PM2 major versions. The complete list lives in the CHANGELOG and on the GitHub releases page.

The current major version. Check your version with pm2 -v and upgrade with npm install pm2@latest -g && pm2 update.

Native Bun support: dedicated process containers for Bun in fork and cluster mode — see Bun, Deno & other Runtimes
Major supply-chain surface reduction: pm2-axon, pm2-axon-rpc, pm2-io-agent and other dependencies internalized as local modules; needle, enquirer, promptly, mkdirp, source-map-support, sprintf-js and fclone removed from npm dependencies in favor of native Node.js APIs
Rewritten TreeKill: a single process-snapshot with in-memory tree build eliminates race conditions when stopping process trees; SIGKILL escalation now targets surviving children directly
OpenTelemetry tracing available via pm2 install-otel and --trace

Fixed CVE-2025-5891 (ReDoS in configuration parsing) and CVE-2026-27699 (updated proxy-agent and basic-ftp)
Fixed command injection vectors in open() helpers (exec() replaced by execFile(), SUDO_USER validated)
Fixed prototype pollution in pm2 set/pm2 unset via __proto__ key traversal

pm2 serve --ftp for directory listing (python http.server style)
Fixed environment variables leaking as [object Object] to fork-mode subprocesses
Windows fixes: home path resolution via os.homedir(), TreeKill callback consistency

Bun support landed in 6.0.5 (pm2 start app.ts runs with Bun)
Git metadata parsing disabled by default (faster starts on large repositories)
Smaller dependency footprint (chalk replaced, npm-shrinkwrap dropped in favor of fixed dependency versions)
Module updates from tarballs and namespaced NPM modules (@org/module-name)

npm install pm2@latest -g
pm2 update          # replace the in-memory daemon, keeps your processes

See Update PM2 for details.