Check this out

The pnpm e2e tests now use a "pnpm registry" instead of verdaccio. In the future we'll make pnpm faster with this registry.

In the next version of pnpm you'll be able to run the Rust engine for fetching, importing, and linking packages.

🫡 thank you regardless, we just switched the bluesky app to pnpm and it’s like a breath of fresh air after being stuck on yarn 1 so long

in times like these, I'm very happy that @sanity.io put some of our @opensourcepledge.com dollars on the good folks at @pnpm.io 🫡 (and we made it our mandated package manager internally)

Is there anything else we can/should do on the client side to mitigate supply chain attacks?

🧊 Big release for #JavaScript supply chain security: @pnpm.io 11 now defaults to a 1-day Minimum Release Age, blocks exotic subdependencies, and adds a new Allow Builds model. A strong step toward reducing exposure to fast-moving npm attacks → socket.dev/blog/pnpm-11... #nodejs

Glad to see we have many new members of team "node is a dev dependency"

devEngines started as @geoffreybooth.bsky.social and I in DMs 2 years ago. It's now supported in @npmjs.bsky.social & @pnpm.io, and later this month will be our recommended way for developers at Netflix to define runtime and package manager versions in their projects. docs.npmjs.com/cli/v11/conf...

Thanks to early feedback we have shipped several fixes. pnpm v11.0.3 is released.

We donated to @pnpm.io as part of our open source donations program. It's the default package manager for many of our frontend engineers. The team behind the 11.0 release did an amazing job of securing pnpm against supply-chain attacks, making it one of the safest package managers out there.

pnpm v11.0.0 is released! The "latest" dist-tag still points to v10, so install it via "pnpm self-update latest-11" github.com/orgs/pnpm/di...

Added pnpm Pacquet to the benchmarks github.com/pnpm/pacquet

We’ve cut the release branch for v11.0! From this point on, we are only merging bug fixes. Have you tried the latest v11.0 RC 5? If you've encountered any bugs, please file an issue in the repo or reply to this thread! To try v11, run "pnpm self-update next-11"

pnpm v11.0.0-rc.5 is out! You can install it with "pnpm self-update next-11" Now you can use "pnpm pack-app" to build a single executable app with Node.js! This command is used to publish pnpm CLI itself. Docs: pnpm.io/11.x/cli/pac...

The "pnpm docs" and "pnpm home" commands will open @npmx.dev in pnpm v11.

@pnpm.io's experimental global virtual store is brilliant. The install performance gains are a game-changer for git flows. You get near-zero per-worktree overhead and instant installs for new worktrees as packages are already in the global store. @kochan.io can't stop making pnpm better 🤌

pnpm + Git Worktrees for Multi-Agent Development pnpm.io/11.x/git-wor...

Additionally, pnpm 11 will block dependencies from exotic sources (like Git) in subdependencies.

Great write up by @filipsobol.bsky.social about our @pnpm.io migration: ckeditor.com/blog/migrati...

🚀pnpm 2025 recap: 2x download growth, new homepage, my first JSNation talk, and v10 feature highlights pnpm.io/blog/2025/12...

pnpm 10.26 is here! This release focuses heavily on locking down supply chain security and giving you granular control over build scripts. From stricter git defaults to the new allowBuilds config, here’s a breakdown of the changes. 🧵👇 #pnpm #javascript

The Seattle Times is piloting pnpm’s client-side defenses—blocked lifecycle scripts, release cooldowns, and trust policy—to stop worms like Shai-Hulud 2.0 before they land. Read their story: pnpm.io/blog/2025/12...

pnpm v10.22 is out pnpm.io/blog/release...

🚀 pnpm v10.21 is out! This release introduces two powerful new security & compatibility features: 1️⃣ Automatic Node.js runtime installation for dependencies 2️⃣ Configurable trust policy for detecting supply-chain downgrades 🧵👇

pnpm v10.19 is out! pnpm.io/blog/release...

Zoltan Kochan is a full stack web developer and the creator of @pnpm.io. He joins the show with @joshuakgoldberg.com to talk about the state of package management for web dev. @kochan.io softwareengineeringdaily.com/2025/09/18/p...

Published an article about mitigating supply chain attacks with pnpm pnpm.io/supply-chain...

After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJS

pnpm v10.14 is shipped with support for runtime engine installation. Node, Deno, and Bun are supported. pnpm.io/blog/release...

The next version of pnpm will be able to lock your node.js version in the lockfile. Similarly to any other dependency of your project.

We have closed 3K issues on GitHub! Only 1.8K issues left😆

pnpm v10.13 also added a workaround for ESM, when using enableGlobalVirtualStore pnpm.io/settings#ena...

pnpm v10.13 shipped some DX improvements to config dependencies. Now it is simple to install pnpm plugins. For instance, you can run "pnpm add --config @pnpm/plugin-types-fixer" to install a plugin that will fix some frequently happening typescript issues.

💖 This May and June, we have forwarded our Open Collective fund to support Maintainers: @9romise.bsky.social @productdevbook.com @rzmu.bsky.social @edison1105.bsky.social Projects: @esm.sh @pnpm.io @cyberalien.dev Join us to show appreciation for our dependencies and help them be sustainable!

By far our biggest and oldest sponsor released a product on product hunt. bit install is pnpm install🙃 bsky.app/profile/koch...

📦 Big news in the package management space this week: pnpm 10.12.1 is out with a new experimental global virtual store for near-instant installs and smarter version catalog controls. socket.dev/blog/pnpm-in... @pnpm.io #NodeJS

Package manager summit with @kochan.io at #JSNation !

pnpm v10.12 is a huge release! We’ve added many new features to the version catalogs system. We also shipped a new experimental option that makes installation almost instant on most dev machines. github.com/pnpm/pnpm/re...

So... I was working on making @pnpm.io a tad faster 😜 youtu.be/pNDFfJvaubY?...

pnpm 10.11.1 is out! github.com/pnpm/pnpm/re...

If you run into issues with typescript and pnpm, try this config dependency that we created. Run: pnpm add @pnpm/types-fixer --config pnpm config set pnpmfile node_modules/.pnpm-config/@pnpm/types-fixer/pnpmfile.cjs --location=project

I have copied over the list of trusted dependencies maintained by bun. So, you can use it with @pnpm.io if you want: github.com/pnpm/trusted...

We’re excited to share that the @nodejs.org website (nodejs.org) now builds using @pnpm.io! This switch has led to faster CI builds and more efficient dependency management.

Now that we have a way to preload settings for @pnpm.io, maybe we could create standard config dependencies for specific stacks. Like "@pnpm/angular-defaults"

New blog post! Let's categorize our deps better with @pnpm.io catalogs! antfu.me/posts/catego...

You can now add JSR packages with @yarnpkg.dev and @pnpm.io with `jsr:` specifier deno.com/blog/add-jsr...

pnpm v10.9 is out with native support for the JSR registry! You can now install packages from JSR using the "jsr:" protocol. For example: pnpm add jsr:@hono/hono

We added support for a new hook in pnpm v10.8 for modifying its settings. Together with configDependencies, this lets you share your settings across repositories. To demonstrate it, we created a package with recommended pnpm settings: github.com/pnpm/better-...

Native JSR support coming to @pnpm.io 👀🔥 github.com/pnpm/pnpm/pu...