pnpm 10.26 is here! This release focuses heavily on locking down supply chain security and giving you granular control over build scripts. From stricter git defaults to the new allowBuilds config, here’s a breakdown of the changes. 🧵👇 #pnpm #javascript

The Seattle Times is piloting pnpm’s client-side defenses—blocked lifecycle scripts, release cooldowns, and trust policy—to stop worms like Shai-Hulud 2.0 before they land. Read their story: pnpm.io/blog/2025/12...

pnpm v10.22 is out pnpm.io/blog/release...

🚀 pnpm v10.21 is out! This release introduces two powerful new security & compatibility features: 1️⃣ Automatic Node.js runtime installation for dependencies 2️⃣ Configurable trust policy for detecting supply-chain downgrades 🧵👇

pnpm v10.19 is out! pnpm.io/blog/release...

Zoltan Kochan is a full stack web developer and the creator of @pnpm.io. He joins the show with @joshuakgoldberg.com to talk about the state of package management for web dev. @kochan.io softwareengineeringdaily.com/2025/09/18/p...

Published an article about mitigating supply chain attacks with pnpm pnpm.io/supply-chain...

After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJS

pnpm v10.14 is shipped with support for runtime engine installation. Node, Deno, and Bun are supported. pnpm.io/blog/release...

The next version of pnpm will be able to lock your node.js version in the lockfile. Similarly to any other dependency of your project.

We have closed 3K issues on GitHub! Only 1.8K issues left😆

pnpm v10.13 also added a workaround for ESM, when using enableGlobalVirtualStore pnpm.io/settings#ena...

pnpm v10.13 shipped some DX improvements to config dependencies. Now it is simple to install pnpm plugins. For instance, you can run "pnpm add --config @pnpm/plugin-types-fixer" to install a plugin that will fix some frequently happening typescript issues.

💖 This May and June, we have forwarded our Open Collective fund to support Maintainers: @9romise.bsky.social @productdevbook.com @rzmu.bsky.social @edison1105.bsky.social Projects: @esm.sh @pnpm.io @cyberalien.dev Join us to show appreciation for our dependencies and help them be sustainable!

By far our biggest and oldest sponsor released a product on product hunt. bit install is pnpm install🙃 bsky.app/profile/koch...

📦 Big news in the package management space this week: pnpm 10.12.1 is out with a new experimental global virtual store for near-instant installs and smarter version catalog controls. socket.dev/blog/pnpm-in... @pnpm.io #NodeJS

Package manager summit with @kochan.io at #JSNation !

pnpm v10.12 is a huge release! We’ve added many new features to the version catalogs system. We also shipped a new experimental option that makes installation almost instant on most dev machines. github.com/pnpm/pnpm/re...

So... I was working on making @pnpm.io a tad faster 😜 youtu.be/pNDFfJvaubY?...

pnpm 10.11.1 is out! github.com/pnpm/pnpm/re...

If you run into issues with typescript and pnpm, try this config dependency that we created. Run: pnpm add @pnpm/types-fixer --config pnpm config set pnpmfile node_modules/.pnpm-config/@pnpm/types-fixer/pnpmfile.cjs --location=project

I have copied over the list of trusted dependencies maintained by bun. So, you can use it with @pnpm.io if you want: github.com/pnpm/trusted...

We’re excited to share that the @nodejs.org website (nodejs.org) now builds using @pnpm.io! This switch has led to faster CI builds and more efficient dependency management.

Now that we have a way to preload settings for @pnpm.io, maybe we could create standard config dependencies for specific stacks. Like "@pnpm/angular-defaults"

New blog post! Let's categorize our deps better with @pnpm.io catalogs! antfu.me/posts/catego...

You can now add JSR packages with @yarnpkg.dev and @pnpm.io with `jsr:` specifier deno.com/blog/add-jsr...

pnpm v10.9 is out with native support for the JSR registry! You can now install packages from JSR using the "jsr:" protocol. For example: pnpm add jsr:@hono/hono

We added support for a new hook in pnpm v10.8 for modifying its settings. Together with configDependencies, this lets you share your settings across repositories. To demonstrate it, we created a package with recommended pnpm settings: github.com/pnpm/better-...

Native JSR support coming to @pnpm.io 👀🔥 github.com/pnpm/pnpm/pu...

🕳️ node-modules.dev v0.4.0 is just out! ⚠️ Deprecated packages 🌈 Clusters by @pnpm.io catalogs 🔼 Latest version indicator 📖 publint.dev integration Thanks @jyc.dev @43081j.com @bluwy.me @sxzz.dev et al. for the PRs, brainstorming, and tools! 💚 We should really take some actions to cleanup now! 🧹

With pnpm v10.6 you can now move your settings from .npmrc to pnpm-workspace.yaml

pnpm v10.5 is out github.com/pnpm/pnpm/re...

Should pnpm v10 throw an error if there are unreviewed packages with postinstall scripts? Github poll: github.com/orgs/pnpm/di...

pnpm 10.2 is now the latest version of pnpm.

Looks like @renovatebot.com now supports pnpm catalogs!

. @sarahgooding.bsky.social thanks for the detailed article about our change in pnpm v10 regarding blocking scripts of dependencies. socket.dev/blog/pnpm-10...

We're considering it as well.

Big changes in @pnpm.io 10.0.0: Lifecycle scripts are now blocked by default to combat supply chain attacks. This change is widely supported but comes with some friction. socket.dev/blog/pnpm-10... #NodeJS #pnpm #JavaScript

pnpm 10.0.0 is out! It isn't latest yet but it is stable. github.com/pnpm/pnpm/re...

Should we have a big "note" section in the output of the run command (like the one printed by npm) or a short one (like the one printed by Yarn v1)?

pnpm is now featured on the @nodejs.org download page. How cool is that!

pnpm can block lifecycle scripts of dependencies during installation. This is an opt-in feature though. Should we block them by default? github.com/orgs/pnpm/di...

We’re planning to introduce “configurational dependencies” in pnpm. These will be installed before all other dependencies, allowing repositories to share configurations. Think patches, build allowlists, version catalogs, or even installation hooks. RFC: github.com/pnpm/rfcs/pu...

Published the v10 docs. Most changes are on the "link" page: pnpm.io/10.x/cli/link

In pnpm v10.0.0-alpha.4 you may opt-in to have your dependencies automatically installed before running scripts with "pnpm run". Set the "verify-deps-before-run" setting to "install".

pnpm v9.13.1 is out! github.com/pnpm/pnpm/re...

You can experiment with the v10 version of @pnpm.bsky.social. The first alpha version is out already github.com/pnpm/pnpm/re...

The pnpm repository has 24K stars!

I've spent a lot of time with Node.js package managers and I've consistently found pnpm to deliver a great overall experience. { author: Adam Coster } https://dev.to/adamcoster/configure-pnpm-for-the-best-possible-developer-experience-a17?signin=true

🙌 Got a contribution to @pnpm.bsky.social! Before: ERR_PNPM_NO_SCRIPT  Missing script: buil After: ^ and also Command "buil" not found. Did you mean "pnpm run build"? Thankjs @zkochan.bsky.social for the helpful PR review & assist! 💙 https://github.com/pnpm/pnpm/pull/6496