pnpm

pnpm

@pnpm.io

Fast, disk space efficient package manager pnpm.io

3.5K followers24 following108 posts

pnpm reposted

Nx
@nx.dev

You can add Nx to an existing pnpm workspace without restructuring anything. Install nx at the root, add a small nx.json with your targetDefaults, and run tasks across every project with nx run-many. Caching and task ordering come from there.

pnpm reposted

Ingvar Stepanyan
@rreverser.com

Replying to @atila.io

Hah yeah moved to pnpm years ago and never looked back. Native builds in pnpm 12 are even more promising.

pnpm
@pnpm.io

We plan to make pnpm v12.3.4 the latest version! Due to our minimum release age policy we need to wait at least for 24 hours😭

pnpm
@pnpm.io

All workflows in the pnpm monorepo itself are now using pnpm v12.0.0-alpha.12, which is the Rust rewrite of pnpm v11. No breaking changes in the API vs v11.

pnpm
@pnpm.io

If you are on the latest pnpm v11.10.0 (or v10.34.5), you can try out the pnpm v12 alpha via: pnpm self-update 12.0.0-alpha.5 It is fully in Rust! 🦀

pnpm reposted

Zoltan Kochan
@kochan.io

I have some early benchmark results with my custom @pnpm.io registry. In different scenarios, overall install times are 2 to 7 times faster than even the already very fast pnpm in Rust. Looks promising.

pnpm
@pnpm.io

The pnpm e2e tests now use a "pnpm registry" instead of verdaccio. In the future we'll make pnpm faster with this registry.

pnpm
@pnpm.io

In the next version of pnpm you'll be able to run the Rust engine for fetching, importing, and linking packages.

pnpm reposted

Samuel
@samuel.fm

Replying to @pnpm.io

🫡 thank you regardless, we just switched the bluesky app to pnpm and it’s like a breath of fresh air after being stuck on yarn 1 so long

pnpm
@pnpm.io

Is there anything else we can/should do on the client side to mitigate supply chain attacks?

pnpm reposted

Socket
@socket.dev

🧊 Big release for #JavaScript supply chain security: @pnpm.io 11 now defaults to a 1-day Minimum Release Age, blocks exotic subdependencies, and adds a new Allow Builds model. A strong step toward reducing exposure to fast-moving npm attacks → socket.dev/blog/pnpm-11... #nodejs

socket.devpnpm 11 Adds Supply Chain Protection Defaults for Minimum Re...pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.

pnpm reposted

Wes
@notwes.bsky.social

Replying to @notwes.bsky.social

Glad to see we have many new members of team "node is a dev dependency"

pnpm
@pnpm.io

Thanks to early feedback we have shipped several fixes. pnpm v11.0.3 is released.

pnpm reposted

Evil Martians
@evilmartians.com

We donated to @pnpm.io as part of our open source donations program. It's the default package manager for many of our frontend engineers. The team behind the 11.0 release did an amazing job of securing pnpm against supply-chain attacks, making it one of the safest package managers out there.

Evil Martians@evilmartians.com

We just donated to @wooorm.com as part of our OSS donation program! He's an engineer based in the Netherlands and the maintainer of 550+ projects. If your project uses Markdown, it probably already runs on one of his tools. His most well-known one is mdx for writing Markdown with JSX components.

github.comGitHub - mdx-js/mdx: Markdown for the component eraMarkdown for the component era. Contribute to mdx-js/mdx development by creating an account on GitHub.
pnpm
@pnpm.io

We’ve cut the release branch for v11.0! From this point on, we are only merging bug fixes. Have you tried the latest v11.0 RC 5? If you've encountered any bugs, please file an issue in the repo or reply to this thread! To try v11, run "pnpm self-update next-11"

pnpm reposted

patak
@patak.cat

@pnpm.io's experimental global virtual store is brilliant. The install performance gains are a game-changer for git flows. You get near-zero per-worktree overhead and instant installs for new worktrees as packages are already in the global store. @kochan.io can't stop making pnpm better 🤌

pnpm reposted

Zoltan Kochan
@kochan.io

Replying to @naugtur.pl

Additionally, pnpm 11 will block dependencies from exotic sources (like Git) in subdependencies.

pnpm
@pnpm.io

pnpm 10.26 is here! This release focuses heavily on locking down supply chain security and giving you granular control over build scripts. From stricter git defaults to the new allowBuilds config, here’s a breakdown of the changes. 🧵👇 #pnpm #javascript

View full thread
pnpm
@pnpm.io

📦 Block Exotic Sub-dependencies Want to secure your dependency tree? Enable blockExoticSubdeps: true. This prevents transitive dependencies (deps of deps) from resolving "exotic" protocols like git+ssh: or direct https: tarballs. Keep the weird stuff out of your deep dependency graph. 🕵️‍♂️

pnpm
@pnpm.io

pnpm 10.26 is here! This release focuses heavily on locking down supply chain security and giving you granular control over build scripts. From stricter git defaults to the new allowBuilds config, here’s a breakdown of the changes. 🧵👇 #pnpm #javascript

pnpm
@pnpm.io

The Main Feature (allowBuilds) 🛡️ Granular Script Control Meet allowBuilds. This new setting replaces onlyBuiltDependencies as the preferred way to manage scripts. It accepts a map to explicitly allow (true) or block (false) execution—even for specific versions!

pnpm
@pnpm.io

🔒 Stricter Git Dependencies Security just tightened up. Git-hosted dependencies are now blocked from running prepare scripts during install by default. To run them, you must now explicitly whitelist them in allowBuilds. This prevents malicious code from sneaking in via untrusted git repos.

pnpm
@pnpm.io

🚀 pnpm v10.21 is out! This release introduces two powerful new security & compatibility features: 1️⃣ Automatic Node.js runtime installation for dependencies 2️⃣ Configurable trust policy for detecting supply-chain downgrades 🧵👇

View full thread
pnpm
@pnpm.io

This feature helps detect and block potentially compromised releases, such as when a package’s maintainer changes or its build pipeline loses attestation.

pnpm
@pnpm.io

🚀 pnpm v10.21 is out! This release introduces two powerful new security & compatibility features: 1️⃣ Automatic Node.js runtime installation for dependencies 2️⃣ Configurable trust policy for detecting supply-chain downgrades 🧵👇

View full thread
pnpm
@pnpm.io

If a package is a CLI app, pnpm will bind that CLI to the specified Node.js version — so it always runs with the compatible runtime, regardless of what’s installed globally. Even postinstall scripts will be executed with the right Node.js version.

pnpm
@pnpm.io

A new setting, trustPolicy, adds protection against supply-chain attacks. When set to no-downgrade, pnpm will fail installation if a package’s trust level drops — e.g. from a trusted publisher → provenance only → no trust evidence.

pnpm
@pnpm.io

🚀 pnpm v10.21 is out! This release introduces two powerful new security & compatibility features: 1️⃣ Automatic Node.js runtime installation for dependencies 2️⃣ Configurable trust policy for detecting supply-chain downgrades 🧵👇

pnpm
@pnpm.io

🧩 Node.js runtime installation for dependencies pnpm can now automatically install the Node.js version required by a dependency, declared in its engines.runtime field. Example:

pnpm reposted

Software Engineering Daily
@softwaredaily.bsky.social

Zoltan Kochan is a full stack web developer and the creator of @pnpm.io. He joins the show with @joshuakgoldberg.com to talk about the state of package management for web dev. @kochan.io softwareengineeringdaily.com/2025/09/18/p...

softwareengineeringdaily.compnpm with Zoltan Kochan - Software Engineering DailyTraditional package management systems for JavaScript have faced several inefficiencies related to dependency storage, resolution, and project performance. pnpm is a fast, disk-efficient package manag...
pnpm
@pnpm.io

Published an article about mitigating supply chain attacks with pnpm pnpm.io/supply-chain...

pnpm.ioMitigating supply chain attacks | pnpmSometimes npm packages are compromised and published with malware. Luckily, there are companies like [Socket], [Snyk], and [Aikido] that detect these compromised packages early. The npm registry usually removes the affected versions within hours. However, there is always a window of time between when the malware is published and when it is detected, during which you could be exposed. Fortunately, there are some things you can do with pnpm to minimize the risks.

pnpm reposted

Socket
@socket.dev

After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJS

socket.devpnpm 10.16 Adds New Setting for Delayed Dependency Updates -...pnpm's new minimumReleaseAge setting delays package updates to prevent supply chain attacks, with other tools like Taze and NCU following suit.