Zoltan Kochan is a full stack web developer and the creator of @pnpm.io. He joins the show with @joshuakgoldberg.com to talk about the state of package management for web dev. @kochan.io softwareengineeringdaily.com/2025/09/18/p...

After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJS

Wow, Hollywood is so creative

I feel like pnpm will eventually grow from being a "npm alternative" to being a "nix alternative" but "pnix" doesn't sound appropriate 😂

With the changes to the lockfile format and the new types of fetchers that were added to pnpm, now it is really easy to make pnpm an installer for anything bsky.app/profile/pnpm...

when you open a service you've been using for a decade only to find it out it caught the virus

The pnpm repository has 32K stars!

I am thinking about a better name for the pnpm "virtual store". Which is where the dependency is written with its unique dependency graph. I couldn't find any prior art to this. Maybe "Package Context" could work. Or "fully resolved package store" but that's long.

Many packages request funding by printing message with postinstall scripts. What if instead of requesting funding we would promote sponsors? After all, we want companies to sponsor open source projects as they are the ones that make profit from it.

A lot of packages use postinstall scripts for printing out messages about funding. Could there be a better way to do this? pnpm doesn't even print the outputs from these scripts.

🚀 Check out what we’ve been building at Bit: Hope AI: Architect agent that builds professional software www.producthunt.com/products/hop...

@kochan.io's talk about configDependencies made me realize we forgot to document remote plugins on the Yarn website 🙈

Package manager summit with @kochan.io at #JSNation !

Ton of npm libs use github.com/cosmiconfig/... to load their config files. But, today I learned, if nodejs dies, the temporarily file created by cosmiconfig remains 🤷‍♂️ I fixed this locally in 5 mins thanks to the amazing patch ability of @pnpm.io (kudos @kochan.io!) and the LLMs era of code editors

So... I was working on making @pnpm.io a tad faster 😜 youtu.be/pNDFfJvaubY?...

I have copied over the list of trusted dependencies maintained by bun. So, you can use it with @pnpm.io if you want: github.com/pnpm/trusted...

I have searched Github for usages of "config dependencies". Found a single project for now: github.com/PSDTools/psd... This is a hook that removes polyfills from dependencies if they are not needed.

We’re excited to share that the @nodejs.org website (nodejs.org) now builds using @pnpm.io! This switch has led to faster CI builds and more efficient dependency management.

pnpm patch is a LIFE SAVER

I am wondering if we should always use some custom protocols like "kahuna:" when the registry is not the public npm registry. So package.json would get something like this:

I have improved the @pnpm.io "features comparison" page: pnpm.io/feature-comp...

New blog post! Let's categorize our deps better with @pnpm.io catalogs! antfu.me/posts/catego...

Now that we have a way to preload settings for @pnpm.io, maybe we could create standard config dependencies for specific stacks. Like "@pnpm/angular-defaults"

You can now add JSR packages with @yarnpkg.dev and @pnpm.io with `jsr:` specifier deno.com/blog/add-jsr...

Has anyone heard about DRPM? github.com/bnonni/drpm.... Thoughts? I would love to experiment with a decentralized registry. I think it could work great for open source projects. But I lack the knowledge.

pnpm v10.9 is out with native support for the JSR registry! You can now install packages from JSR using the "jsr:" protocol. For example: pnpm add jsr:@hono/hono

Every single Steven Seagal movie has a bigger IMDb score than "Snow White".

What is the difference between Verdaccio and Volt's registry? github.com/vltpkg/vsr

It would be nice if an LLM could help with writing "changesets" and detecting which of the changes are breaking and which are backward compatible. Currently I use exact versions to reference any packages from the same workspace as it is so hard to avoid mistakes.

It would be nice to be able to use underscore in semver versions. Like 10_24.0.0 would be same as 1024.0.0

Are you ready for require(esm) in Node v20 🥶🥶 github.com/nodejs/node/...

there will never be a dullest and pettiest supervillain

Node.js 22.14.0 is out, the first LTS release that includes the Corepack patch that fixes the "Cannot find matching keyid" error that has been impacting pnpm users recently. Full changelog and download info at nodejs.org/en/blog/rele...

Is anyone using the Fibonacci sequence for major version numbers?

I remember how every website and blog had a comment section in the past. Looks like those times are over. There were even popular discussion widgets like "disqus".

I understand that some protestware can be harmful, but I don’t see why a simple console message is reported by @socket.dev. Some dependencies print messages about funding—printing a message against war doesn’t seem any more harmful than that. I do not like this at all.

Does the npm registry rate limit by user agent? I am getting a lot of reports of 429 errors while installing with pnpm v9.15.3 and they say downgrading to v9.15.2 helps. But I don't see any changes between the two versions that could cause the issue.

I welcome any additional reviews on this PR. Especially regarding naming. I chose the name "pnpm.configDependencies" but maybe there are better names? bootDependencies, prepareDependencies, setupDependencies, initDependencies bsky.app/profile/pnpm...

If you’re like me and use your terminal for everything, check out Ghostty—it’s top-notch! ghostty.org

I have added localizations back when pnpm wasn't so popular. I thought it would bring more users and the Chinese Traditional localization indeed has many requests. However, in the past there was less content and less localizations. I was personally reviewing all text. bsky.app/profile/koch...

I am so afraid of crowd translations. @pnpm.io is translated on crowdin. We have many languages and many proofreaders. I can't possibly trust all the proofreaders. How to prevent the translators from changing code blocks in the localized versions or posting harmful content?

Are there any good bootstrap packages to be used with "pnpm create"/"yarn create"? I tried to search the npm registry with the "create" keyword and there are just a few results all of which are seemingly not maintained.

This is incredibly convenient to me bsky.app/profile/pnpm...

In pnpm v10.0.0-alpha.4 you may opt-in to have your dependencies automatically installed before running scripts with "pnpm run". Set the "verify-deps-before-run" setting to "install".

Elon Musk, a billionaire and close ally of U.S. President-elect Donald Trump, mocked on Nov. 16 President Volodymyr Zelensky for saying that Ukraine is an independent country that cannot be forced to "sit and listen."

Last one of the year! The State of JavaScript 2024 survey is now open: survey.devographics.com/en-US/survey...

One of the biggest active PRs now at @pnpm.io is adding a status check for node_modules. This should allow us to automatically run install on "pnpm run" if node_modules needs updates. I think it will also allow us to make repeat "pnpm install" faster.

You can experiment with the v10 version of @pnpm.bsky.social. The first alpha version is out already github.com/pnpm/pnpm/re...

Bluesky now has over 10 million users, and I was #35,537!

Next week is gonna be a fun week Soon the scourge of baseUrl, paths, and typesRoot will be purged, replaced with "how about we actually use node_modules like everyone else" (thank you Andrew and Nathan for your efforts, and of course @zkochan.bsky.social and contributors for pnpm)