{"slug": "pnpm", "name": "pnpm", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "Fast, disk-efficient package manager for JavaScript and Node.js projects.", "recommenders": 11, "commenters": 17, "warners": 1, "score": 10.378, "rising": 4.36, "first": "2025-11-01", "latest": "2026-10-09", "why": "HN commenters like pnpm for monorepo workspaces and as a faster, more security-minded replacement for npm and Yarn, with controls over dependency install scripts.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 11, "neutral": 5, "compare": 0, "warn": 1}, "spark": [1, 1, 0, 0, 1, 1, 0, 1, 0, 3, 0, 3], "listed": true, "loved": ["Monorepo workspaces", "Supply-chain safeguards"], "caveat": "Not a security fix", "short_quote": "we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!", "icon": true, "domain": "pnpm.io", "github_repo": null, "official_url": "https://pnpm.io", "pricing": "open source", "aliases": ["pnpm"], "verdict": [{"text": "HN commenters like pnpm for monorepo workspaces", "cites": [{"id": 763614146, "item_id": 47725884, "url": "https://news.ycombinator.com/item?id=47725884", "by": "yathern", "date": "2026-04-10", "stance": "recommend", "quote": "Worked really really well with pnpm workspaces and a monorepo setup", "excerpt": "I used PGLite for a project (monkeys.zip) and it was absolutely fantastic! Loved how speedily I could have a \"real\" postgres instance without spinning up docker. Worked really really well with pnpm workspaces and a monorepo setup (EG pnpm run will run the DB package, as well as frontend and backend). The only downside (and this applies for SQLite as well) is that it runs too well that you can get some bad habits - or", "context": "", "use_case": "monorepo workspaces", "switched_from": "", "story": "PGLite Evangelism"}, {"id": 799317905, "item_id": 49957369, "url": "https://news.ycombinator.com/item?id=49957369", "by": "pelicanonical", "date": "2026-10-04", "stance": "recommend", "quote": "Features like pnpm's workspace catalog make life much easier", "excerpt": "hi there! I just released v0.0.1 of monoswan. I love TypeScript monorepos and one of the biggest pain points I've hit is keeping consistency and standards across packages. Features like pnpm's workspace catalog make life much easier when it comes to dependency management, and I want to take this even further. monoswan allows you to lint & fix your entire monorepo to enforce standards across your package.json, tsconfi", "context": "", "use_case": "monorepo dependency management", "switched_from": "", "story": "Show HN: Monoswan \u2013 a pleasant TS monorepo linter"}, {"id": 799640768, "item_id": 49977548, "url": "https://news.ycombinator.com/item?id=49977548", "by": "MrJohz", "date": "2026-10-06", "stance": "recommend", "quote": "I use `pnpm` and it Just Works\u2122.", "excerpt": "> - packages in workspaces can be used as dependencies without compilation (node's type stripping doesn't support this) Node does support this! Although it may depend on exactly you link the packages within a workspace \u2014 I use `pnpm` and it Just Works\u2122. Because NodeJS looks at the resolved symlink to decide whether a project is in `node_modules` or not, if the symlink resolves to a package in the workspace, then Node", "context": "", "use_case": "workspace package management", "switched_from": "", "story": "Friendship ended with Deno, now Node is my best friend"}, {"id": 732604240, "item_id": 45787765, "url": "https://news.ycombinator.com/item?id=45787765", "by": "smashah", "date": "2025-11-01", "stance": "recommend", "quote": "am a big fan of pnpm", "excerpt": "I love working within monorepos nowadays and am a big fan of pnpm but as far as I could find, there's no way for me to see which deps are out of date within the pnpm-workspace.yaml file so (a)I built this quick little tool to check which deps have newer versions (separated and colour coded by patch, minor and major) and update the workspace file automatically. tl;dr use `pnpx workspace-updater -h` to update your pnpm", "context": "", "use_case": "monorepo package management", "switched_from": "", "story": "Show HN: Workspace-updater \u2013 Fast update CLI for pnpm workspace catalogs"}]}, {"text": " and as a faster, more security-minded replacement for npm and Yarn, with controls over dependency install scripts.", "cites": [{"id": 800443904, "item_id": 50027744, "url": "https://news.ycombinator.com/item?id=50027744", "by": "phatskat", "date": "2026-10-09", "stance": "recommend", "quote": "we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!", "excerpt": "I dunno, we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!", "context": "", "use_case": "JavaScript package management", "switched_from": "", "story": "Cloudflare acquires Deno"}, {"id": 791378417, "item_id": 49461151, "url": "https://news.ycombinator.com/item?id=49461151", "by": "CraigJPerry", "date": "2026-08-27", "stance": "recommend", "quote": "I have switched to pnpm already.", "excerpt": "Describing NPM as boring is a stretch. Given its security model, i think spicy is a far more apt label. I have switched to pnpm already.", "context": "", "use_case": "Node package manager", "switched_from": "npm", "story": "Pnpm 12.0"}, {"id": 775595872, "item_id": 48474742, "url": "https://news.ycombinator.com/item?id=48474742", "by": "mkesper", "date": "2026-06-10", "stance": "recommend", "quote": "Switched to pnpm in part due to that reason.", "excerpt": "It was a giant mistake to keep 'classic' (umnaintained, unpatched) yarn around. Switched to pnpm in part due to that reason.", "context": "", "use_case": "JS package management", "switched_from": "Yarn", "story": "Upcoming breaking changes for NPM v12"}, {"id": 760129344, "item_id": 47508084, "url": "https://news.ycombinator.com/item?id=47508084", "by": "darkteflon", "date": "2026-03-24", "stance": "recommend", "quote": "We recently switched to pnpm, in part to guard against supply chain attacks", "excerpt": "We recently switched to pnpm, in part to guard against supply chain attacks (https://pnpm.io/supply-chain-security). Reading this got me wondering whether uv has something similar, and indeed it does appear to (https://docs.astral.sh/uv/reference/settings/#exclude-newer)", "context": "", "use_case": "JS package management", "switched_from": "", "story": "LiteLLM PyPI has been compromised an hour ago, do not update"}, {"id": 789981025, "item_id": 49373814, "url": "https://news.ycombinator.com/item?id=49373814", "by": "praseodym", "date": "2026-08-20", "stance": "recommend", "quote": "pnpm has controls to allowlist install scripts for dependencies", "excerpt": "Unfortunately Cargo doesn\u2019t have security controls in place to prevent these kinds of attacks. For example pnpm has controls to allowlist install scripts for dependencies and will warn about new install scripts (without executing them). There is an open issue for this: https://github.com/rust-lang/cargo/issues/13681", "context": "", "use_case": "package management", "switched_from": "", "story": "Supply Chain Attack on Arrayref"}]}, {"text": " The main caveat is that one user says it is not the answer to the supply-chain and postinstall problem and moved off it,", "cites": [{"id": 799782400, "item_id": 49986400, "url": "https://news.ycombinator.com/item?id=49986400", "by": "miiiiiike", "date": "2026-10-07", "stance": "warn", "quote": "pnpm is not the answer to the supply chain/postinstall problem. I moved off pnpm recently", "excerpt": "pnpm is not the answer to the supply chain/postinstall problem. I moved off pnpm recently, for many reasons. Fortunately npm v12+ disables lifecycle scripts by default.", "context": "", "use_case": "", "switched_from": "", "story": "Friendship ended with Deno, now Node is my best friend"}]}, {"text": " and another found no way to see outdated dependencies in pnpm-workspace.yaml.", "cites": [{"id": 732604240, "item_id": 45787765, "url": "https://news.ycombinator.com/item?id=45787765", "by": "smashah", "date": "2025-11-01", "stance": "recommend", "quote": "am a big fan of pnpm", "excerpt": "I love working within monorepos nowadays and am a big fan of pnpm but as far as I could find, there's no way for me to see which deps are out of date within the pnpm-workspace.yaml file so (a)I built this quick little tool to check which deps have newer versions (separated and colour coded by patch, minor and major) and update the workspace file automatically. tl;dr use `pnpx workspace-updater -h` to update your pnpm", "context": "", "use_case": "monorepo package management", "switched_from": "", "story": "Show HN: Workspace-updater \u2013 Fast update CLI for pnpm workspace catalogs"}]}], "praise": [{"label": "Monorepo workspaces", "summary": "Commenters find pnpm workspaces and the workspace catalog work well for monorepos.", "quotes": [{"id": 763614146, "item_id": 47725884, "url": "https://news.ycombinator.com/item?id=47725884", "by": "yathern", "date": "2026-04-10", "stance": "recommend", "quote": "Worked really really well with pnpm workspaces and a monorepo setup", "excerpt": "I used PGLite for a project (monkeys.zip) and it was absolutely fantastic! Loved how speedily I could have a \"real\" postgres instance without spinning up docker. Worked really really well with pnpm workspaces and a monorepo setup (EG pnpm run will run the DB package, as well as frontend and backend). The only downside (and this applies for SQLite as well) is that it runs too well that you can get some bad habits - or", "context": "", "use_case": "monorepo workspaces", "switched_from": "", "story": "PGLite Evangelism"}, {"id": 799317905, "item_id": 49957369, "url": "https://news.ycombinator.com/item?id=49957369", "by": "pelicanonical", "date": "2026-10-04", "stance": "recommend", "quote": "Features like pnpm's workspace catalog make life much easier", "excerpt": "hi there! I just released v0.0.1 of monoswan. I love TypeScript monorepos and one of the biggest pain points I've hit is keeping consistency and standards across packages. Features like pnpm's workspace catalog make life much easier when it comes to dependency management, and I want to take this even further. monoswan allows you to lint & fix your entire monorepo to enforce standards across your package.json, tsconfi", "context": "", "use_case": "monorepo dependency management", "switched_from": "", "story": "Show HN: Monoswan \u2013 a pleasant TS monorepo linter"}, {"id": 799640768, "item_id": 49977548, "url": "https://news.ycombinator.com/item?id=49977548", "by": "MrJohz", "date": "2026-10-06", "stance": "recommend", "quote": "I use `pnpm` and it Just Works\u2122.", "excerpt": "> - packages in workspaces can be used as dependencies without compilation (node's type stripping doesn't support this) Node does support this! Although it may depend on exactly you link the packages within a workspace \u2014 I use `pnpm` and it Just Works\u2122. Because NodeJS looks at the resolved symlink to decide whether a project is in `node_modules` or not, if the symlink resolves to a package in the workspace, then Node", "context": "", "use_case": "workspace package management", "switched_from": "", "story": "Friendship ended with Deno, now Node is my best friend"}]}, {"label": "Supply-chain safeguards", "summary": "Teams cite install-script allowlisting and supply-chain protections as reasons to use it.", "quotes": [{"id": 789981025, "item_id": 49373814, "url": "https://news.ycombinator.com/item?id=49373814", "by": "praseodym", "date": "2026-08-20", "stance": "recommend", "quote": "pnpm has controls to allowlist install scripts for dependencies", "excerpt": "Unfortunately Cargo doesn\u2019t have security controls in place to prevent these kinds of attacks. For example pnpm has controls to allowlist install scripts for dependencies and will warn about new install scripts (without executing them). There is an open issue for this: https://github.com/rust-lang/cargo/issues/13681", "context": "", "use_case": "package management", "switched_from": "", "story": "Supply Chain Attack on Arrayref"}, {"id": 760129344, "item_id": 47508084, "url": "https://news.ycombinator.com/item?id=47508084", "by": "darkteflon", "date": "2026-03-24", "stance": "recommend", "quote": "We recently switched to pnpm, in part to guard against supply chain attacks", "excerpt": "We recently switched to pnpm, in part to guard against supply chain attacks (https://pnpm.io/supply-chain-security). Reading this got me wondering whether uv has something similar, and indeed it does appear to (https://docs.astral.sh/uv/reference/settings/#exclude-newer)", "context": "", "use_case": "JS package management", "switched_from": "", "story": "LiteLLM PyPI has been compromised an hour ago, do not update"}, {"id": 800443904, "item_id": 50027744, "url": "https://news.ycombinator.com/item?id=50027744", "by": "phatskat", "date": "2026-10-09", "stance": "recommend", "quote": "we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!", "excerpt": "I dunno, we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!", "context": "", "use_case": "JavaScript package management", "switched_from": "", "story": "Cloudflare acquires Deno"}]}, {"label": "npm/Yarn alternative", "summary": "Users switched from npm's security model and unmaintained classic Yarn to pnpm.", "quotes": [{"id": 791378417, "item_id": 49461151, "url": "https://news.ycombinator.com/item?id=49461151", "by": "CraigJPerry", "date": "2026-08-27", "stance": "recommend", "quote": "I have switched to pnpm already.", "excerpt": "Describing NPM as boring is a stretch. Given its security model, i think spicy is a far more apt label. I have switched to pnpm already.", "context": "", "use_case": "Node package manager", "switched_from": "npm", "story": "Pnpm 12.0"}, {"id": 775595872, "item_id": 48474742, "url": "https://news.ycombinator.com/item?id=48474742", "by": "mkesper", "date": "2026-06-10", "stance": "recommend", "quote": "Switched to pnpm in part due to that reason.", "excerpt": "It was a giant mistake to keep 'classic' (umnaintained, unpatched) yarn around. Switched to pnpm in part due to that reason.", "context": "", "use_case": "JS package management", "switched_from": "Yarn", "story": "Upcoming breaking changes for NPM v12"}, {"id": 791599328, "item_id": 49474958, "url": "https://news.ycombinator.com/item?id=49474958", "by": "coder-pm", "date": "2026-08-28", "stance": "recommend", "quote": "pnpm was already great alternative to npm - just keep improving it instead of rewriting", "excerpt": "They should focus on the tool, do not try to rewrite it\u2026 everyone tries to rewrite things to rust now, pnpm was already great alternative to npm - just keep improving it instead of rewriting:/", "context": "", "use_case": "JavaScript package manager", "switched_from": "", "story": "Pnpm 12.0"}]}, {"label": "Reliability", "summary": "Users report years of use without issue and say it just works.", "quotes": [{"id": 800443904, "item_id": 50027744, "url": "https://news.ycombinator.com/item?id=50027744", "by": "phatskat", "date": "2026-10-09", "stance": "recommend", "quote": "we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!", "excerpt": "I dunno, we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!", "context": "", "use_case": "JavaScript package management", "switched_from": "", "story": "Cloudflare acquires Deno"}, {"id": 799640768, "item_id": 49977548, "url": "https://news.ycombinator.com/item?id=49977548", "by": "MrJohz", "date": "2026-10-06", "stance": "recommend", "quote": "I use `pnpm` and it Just Works\u2122.", "excerpt": "> - packages in workspaces can be used as dependencies without compilation (node's type stripping doesn't support this) Node does support this! Although it may depend on exactly you link the packages within a workspace \u2014 I use `pnpm` and it Just Works\u2122. Because NodeJS looks at the resolved symlink to decide whether a project is in `node_modules` or not, if the symlink resolves to a package in the workspace, then Node", "context": "", "use_case": "workspace package management", "switched_from": "", "story": "Friendship ended with Deno, now Node is my best friend"}, {"id": 738038946, "item_id": 46127434, "url": "https://news.ycombinator.com/item?id=46127434", "by": "kabirgoel", "date": "2025-12-02", "stance": "recommend", "quote": "We use PNPM and are very happy with it", "excerpt": "My team has been using it in prod for about a year now. There were some minor bugs in the runtime's implementation of buffers in 1.22 (?), but that was about the only issue we ran into. The nice things: 1. It's fast. 2. The standard library is great. (This may be less of an advantage over Deno.) 3. There's a ton of momentum behind it. 4. It's closer to Node.js than Deno is, at least last I tried. There were a bunch o", "context": "", "use_case": "package manager", "switched_from": "", "story": "Anthropic acquires Bun"}]}, {"label": "Speed", "summary": "Commenters call it faster, and one notes that its installs use hardlinks to speed things up.", "quotes": [{"id": 800443904, "item_id": 50027744, "url": "https://news.ycombinator.com/item?id=50027744", "by": "phatskat", "date": "2026-10-09", "stance": "recommend", "quote": "we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!", "excerpt": "I dunno, we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!", "context": "", "use_case": "JavaScript package management", "switched_from": "", "story": "Cloudflare acquires Deno"}, {"id": 745466897, "item_id": 46591681, "url": "https://news.ycombinator.com/item?id=46591681", "by": "qudent", "date": "2026-01-12", "stance": "neutral", "quote": "runs pnpm install (which uses hardlinks to speed things up)", "excerpt": "The \"correct\" way to have agents working on repositories in parallel - which you want to do to speed up AI development rather than just waiting around - is to use git worktrees, which are separate directories checking out different branches of a repo - so agents can work in parallel on different directories without interference. This also allows comparing different prompts, frameworks, agents etc. But manually, I alw", "context": "", "use_case": "installing dependencies", "switched_from": "", "story": "Show HN: Agents working in parallel nested worktrees made simple"}]}], "caveats": [{"label": "Not a security fix", "summary": "One user says pnpm does not solve the supply-chain and postinstall problem and notes that npm v12+ now disables lifecycle scripts by default.", "quotes": [{"id": 799782400, "item_id": 49986400, "url": "https://news.ycombinator.com/item?id=49986400", "by": "miiiiiike", "date": "2026-10-07", "stance": "warn", "quote": "pnpm is not the answer to the supply chain/postinstall problem. I moved off pnpm recently", "excerpt": "pnpm is not the answer to the supply chain/postinstall problem. I moved off pnpm recently, for many reasons. Fortunately npm v12+ disables lifecycle scripts by default.", "context": "", "use_case": "", "switched_from": "", "story": "Friendship ended with Deno, now Node is my best friend"}]}, {"label": "Catalog update visibility", "summary": "One user found no way to see which dependencies in pnpm-workspace.yaml are out of date and built a tool for it.", "quotes": [{"id": 732604240, "item_id": 45787765, "url": "https://news.ycombinator.com/item?id=45787765", "by": "smashah", "date": "2025-11-01", "stance": "recommend", "quote": "am a big fan of pnpm", "excerpt": "I love working within monorepos nowadays and am a big fan of pnpm but as far as I could find, there's no way for me to see which deps are out of date within the pnpm-workspace.yaml file so (a)I built this quick little tool to check which deps have newer versions (separated and colour coded by patch, minor and major) and update the workspace file automatically. tl;dr use `pnpx workspace-updater -h` to update your pnpm", "context": "", "use_case": "monorepo package management", "switched_from": "", "story": "Show HN: Workspace-updater \u2013 Fast update CLI for pnpm workspace catalogs"}]}, {"label": "Rewrite concerns", "summary": "One commenter would rather see the tool improved than rewritten in Rust.", "quotes": [{"id": 791599328, "item_id": 49474958, "url": "https://news.ycombinator.com/item?id=49474958", "by": "coder-pm", "date": "2026-08-28", "stance": "recommend", "quote": "pnpm was already great alternative to npm - just keep improving it instead of rewriting", "excerpt": "They should focus on the tool, do not try to rewrite it\u2026 everyone tries to rewrite things to rust now, pnpm was already great alternative to npm - just keep improving it instead of rewriting:/", "context": "", "use_case": "JavaScript package manager", "switched_from": "", "story": "Pnpm 12.0"}]}], "who": [], "tags": ["for monorepos", "npm alternative", "for supply-chain caution", "for teams"], "use_cases": ["js package management", "package management", "monorepo package management", "javascript package management", "workspace package management", "monorepo dependency management"], "compared": [{"slug": "npm", "name": "npm", "co": 3, "switched_from": 1, "switched_to": 1}, {"slug": "bun", "name": "Bun", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "node-js", "name": "Node.js", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "deno", "name": "Deno", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49971719", "title": "Friendship ended with Deno, now Node is my best friend", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49460032", "title": "Pnpm 12.0", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50019911", "title": "Cloudflare acquires Deno", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49957368", "title": "Show HN: Monoswan \u2013 a pleasant TS monorepo linter", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49372853", "title": "Supply Chain Attack on Arrayref", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48467705", "title": "Upcoming breaking changes for NPM v12", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1, "neutral": 1}, "2025-12": {"recommend": 1}, "2026-01": {"neutral": 2}, "2026-02": {}, "2026-03": {"recommend": 1, "neutral": 1}, "2026-04": {"neutral": 1, "recommend": 1}, "2026-05": {}, "2026-06": {"recommend": 1}, "2026-07": {}, "2026-08": {"recommend": 3}, "2026-09": {}, "2026-10": {"recommend": 3, "warn": 1}}, "quotes": [{"id": 800443904, "item_id": 50027744, "url": "https://news.ycombinator.com/item?id=50027744", "by": "phatskat", "date": "2026-10-09", "stance": "recommend", "quote": "we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!", "excerpt": "I dunno, we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!", "context": "", "use_case": "JavaScript package management", "switched_from": "", "story": "Cloudflare acquires Deno"}, {"id": 799782400, "item_id": 49986400, "url": "https://news.ycombinator.com/item?id=49986400", "by": "miiiiiike", "date": "2026-10-07", "stance": "warn", "quote": "pnpm is not the answer to the supply chain/postinstall problem. I moved off pnpm recently", "excerpt": "pnpm is not the answer to the supply chain/postinstall problem. I moved off pnpm recently, for many reasons. Fortunately npm v12+ disables lifecycle scripts by default.", "context": "", "use_case": "", "switched_from": "", "story": "Friendship ended with Deno, now Node is my best friend"}, {"id": 799640768, "item_id": 49977548, "url": "https://news.ycombinator.com/item?id=49977548", "by": "MrJohz", "date": "2026-10-06", "stance": "recommend", "quote": "I use `pnpm` and it Just Works\u2122.", "excerpt": "> - packages in workspaces can be used as dependencies without compilation (node's type stripping doesn't support this) Node does support this! Although it may depend on exactly you link the packages within a workspace \u2014 I use `pnpm` and it Just Works\u2122. Because NodeJS looks at the resolved symlink to decide whether a project is in `node_modules` or not, if the symlink resolves to a package in the workspace, then Node", "context": "", "use_case": "workspace package management", "switched_from": "", "story": "Friendship ended with Deno, now Node is my best friend"}, {"id": 799317905, "item_id": 49957369, "url": "https://news.ycombinator.com/item?id=49957369", "by": "pelicanonical", "date": "2026-10-04", "stance": "recommend", "quote": "Features like pnpm's workspace catalog make life much easier", "excerpt": "hi there! I just released v0.0.1 of monoswan. I love TypeScript monorepos and one of the biggest pain points I've hit is keeping consistency and standards across packages. Features like pnpm's workspace catalog make life much easier when it comes to dependency management, and I want to take this even further. monoswan allows you to lint & fix your entire monorepo to enforce standards across your package.json, tsconfi", "context": "", "use_case": "monorepo dependency management", "switched_from": "", "story": "Show HN: Monoswan \u2013 a pleasant TS monorepo linter"}, {"id": 791599328, "item_id": 49474958, "url": "https://news.ycombinator.com/item?id=49474958", "by": "coder-pm", "date": "2026-08-28", "stance": "recommend", "quote": "pnpm was already great alternative to npm - just keep improving it instead of rewriting", "excerpt": "They should focus on the tool, do not try to rewrite it\u2026 everyone tries to rewrite things to rust now, pnpm was already great alternative to npm - just keep improving it instead of rewriting:/", "context": "", "use_case": "JavaScript package manager", "switched_from": "", "story": "Pnpm 12.0"}, {"id": 791378417, "item_id": 49461151, "url": "https://news.ycombinator.com/item?id=49461151", "by": "CraigJPerry", "date": "2026-08-27", "stance": "recommend", "quote": "I have switched to pnpm already.", "excerpt": "Describing NPM as boring is a stretch. Given its security model, i think spicy is a far more apt label. I have switched to pnpm already.", "context": "", "use_case": "Node package manager", "switched_from": "npm", "story": "Pnpm 12.0"}, {"id": 789981025, "item_id": 49373814, "url": "https://news.ycombinator.com/item?id=49373814", "by": "praseodym", "date": "2026-08-20", "stance": "recommend", "quote": "pnpm has controls to allowlist install scripts for dependencies", "excerpt": "Unfortunately Cargo doesn\u2019t have security controls in place to prevent these kinds of attacks. For example pnpm has controls to allowlist install scripts for dependencies and will warn about new install scripts (without executing them). There is an open issue for this: https://github.com/rust-lang/cargo/issues/13681", "context": "", "use_case": "package management", "switched_from": "", "story": "Supply Chain Attack on Arrayref"}, {"id": 775595872, "item_id": 48474742, "url": "https://news.ycombinator.com/item?id=48474742", "by": "mkesper", "date": "2026-06-10", "stance": "recommend", "quote": "Switched to pnpm in part due to that reason.", "excerpt": "It was a giant mistake to keep 'classic' (umnaintained, unpatched) yarn around. Switched to pnpm in part due to that reason.", "context": "", "use_case": "JS package management", "switched_from": "Yarn", "story": "Upcoming breaking changes for NPM v12"}, {"id": 763614146, "item_id": 47725884, "url": "https://news.ycombinator.com/item?id=47725884", "by": "yathern", "date": "2026-04-10", "stance": "recommend", "quote": "Worked really really well with pnpm workspaces and a monorepo setup", "excerpt": "I used PGLite for a project (monkeys.zip) and it was absolutely fantastic! Loved how speedily I could have a \"real\" postgres instance without spinning up docker. Worked really really well with pnpm workspaces and a monorepo setup (EG pnpm run will run the DB package, as well as frontend and backend). The only downside (and this applies for SQLite as well) is that it runs too well that you can get some bad habits - or", "context": "", "use_case": "monorepo workspaces", "switched_from": "", "story": "PGLite Evangelism"}, {"id": 762513521, "item_id": 47657095, "url": "https://news.ycombinator.com/item?id=47657095", "by": "abustamam", "date": "2026-04-05", "stance": "neutral", "quote": "I use yarn or pnpm for monorepos.", "excerpt": "I use bun for everything except for monorepos with isolated deployment targets and shared packages. I use yarn or pnpm for monorepos. Maybe it's changed in the last six months but I could never get docker to properly resolve my dependencies when I only want to build the web app, for example, since the bun lock is deterministic based off of all the packages in the repo so isolating a single leaf makes it error. Maybe ", "context": "", "use_case": "monorepo package management", "switched_from": "", "story": "We replaced Node.js with Bun for 5x throughput"}, {"id": 760629123, "item_id": 47539320, "url": "https://news.ycombinator.com/item?id=47539320", "by": "iBelieve", "date": "2026-03-26", "stance": "neutral", "quote": "Run `pnpm audit` and research any security issues", "excerpt": "Looks like I'm limited to only 3 cloud scheduled tasks. And I'm on the Max 20x plan, too :( \"Your plan gets 3 daily cloud scheduled sessions. Disable or delete an existing schedule to continue.\" But otherwise, this looks really cool. I've tried using local scheduled tasks in both Claude Code Desktop and the Codex desktop app, and very quickly got annoyed with permissions prompts, so it'll be nice to be able to run sc", "context": "", "use_case": "package management and audits", "switched_from": "", "story": "Schedule Claude Code tasks on the web"}, {"id": 760129344, "item_id": 47508084, "url": "https://news.ycombinator.com/item?id=47508084", "by": "darkteflon", "date": "2026-03-24", "stance": "recommend", "quote": "We recently switched to pnpm, in part to guard against supply chain attacks", "excerpt": "We recently switched to pnpm, in part to guard against supply chain attacks (https://pnpm.io/supply-chain-security). Reading this got me wondering whether uv has something similar, and indeed it does appear to (https://docs.astral.sh/uv/reference/settings/#exclude-newer)", "context": "", "use_case": "JS package management", "switched_from": "", "story": "LiteLLM PyPI has been compromised an hour ago, do not update"}, {"id": 749494948, "item_id": 46843434, "url": "https://news.ycombinator.com/item?id=46843434", "by": "ChadNauseam", "date": "2026-01-31", "stance": "neutral", "quote": "downloads Ghostty, VSCode, fnm and pnpm", "excerpt": "I've been getting my family members to start vibe coding. In my experience, claude works very well but the biggest issue is actually installing all the necessary tools. So I created a little setup script that MacOS users can use to get up-and-running quickly. It basically sets them up with a development environment similar to the one I use personally. It uses the git settings from https://blog.gitbutler.com/how-git-c", "context": "", "use_case": "JS package management", "switched_from": "", "story": "Start (Vibe) Coding Fast"}, {"id": 745466897, "item_id": 46591681, "url": "https://news.ycombinator.com/item?id=46591681", "by": "qudent", "date": "2026-01-12", "stance": "neutral", "quote": "runs pnpm install (which uses hardlinks to speed things up)", "excerpt": "The \"correct\" way to have agents working on repositories in parallel - which you want to do to speed up AI development rather than just waiting around - is to use git worktrees, which are separate directories checking out different branches of a repo - so agents can work in parallel on different directories without interference. This also allows comparing different prompts, frameworks, agents etc. But manually, I alw", "context": "", "use_case": "installing dependencies", "switched_from": "", "story": "Show HN: Agents working in parallel nested worktrees made simple"}, {"id": 738038946, "item_id": 46127434, "url": "https://news.ycombinator.com/item?id=46127434", "by": "kabirgoel", "date": "2025-12-02", "stance": "recommend", "quote": "We use PNPM and are very happy with it", "excerpt": "My team has been using it in prod for about a year now. There were some minor bugs in the runtime's implementation of buffers in 1.22 (?), but that was about the only issue we ran into. The nice things: 1. It's fast. 2. The standard library is great. (This may be less of an advantage over Deno.) 3. There's a ton of momentum behind it. 4. It's closer to Node.js than Deno is, at least last I tried. There were a bunch o", "context": "", "use_case": "package manager", "switched_from": "", "story": "Anthropic acquires Bun"}, {"id": 736621296, "item_id": 46038831, "url": "https://news.ycombinator.com/item?id=46038831", "by": "mkhalil", "date": "2025-11-24", "stance": "neutral", "quote": "I use pnpm, but even so", "excerpt": "I use pnpm, but even so: thankfully naming things is hard, and all my env variable names are very_convuluted_non_standard_names for things lol.", "context": "", "use_case": "package management", "switched_from": "", "story": "Shai-Hulud Returns: Over 300 NPM Packages Infected"}, {"id": 732604240, "item_id": 45787765, "url": "https://news.ycombinator.com/item?id=45787765", "by": "smashah", "date": "2025-11-01", "stance": "recommend", "quote": "am a big fan of pnpm", "excerpt": "I love working within monorepos nowadays and am a big fan of pnpm but as far as I could find, there's no way for me to see which deps are out of date within the pnpm-workspace.yaml file so (a)I built this quick little tool to check which deps have newer versions (separated and colour coded by patch, minor and major) and update the workspace file automatically. tl;dr use `pnpx workspace-updater -h` to update your pnpm", "context": "", "use_case": "monorepo package management", "switched_from": "", "story": "Show HN: Workspace-updater \u2013 Fast update CLI for pnpm workspace catalogs"}]}