pnpm
Fast, disk-efficient package manager for JavaScript and Node.js projects.
HN commenters like pnpm for monorepo workspaces1234 and as a faster, more security-minded replacement for npm and Yarn, with controls over dependency install scripts.56789 The main caveat is that one user says it is not the answer to the supply-chain and postinstall problem and moved off it,10 and another found no way to see outdated dependencies in pnpm-workspace.yaml.11
Why people recommend it
Monorepo workspaces · 3
Commenters find pnpm workspaces and the workspace catalog work well for monorepos.
“Worked really really well with pnpm workspaces and a monorepo setup”
“Features like pnpm's workspace catalog make life much easier”
Show 1 more
“I use `pnpm` and it Just Works™.”
Supply-chain safeguards · 3
Teams cite install-script allowlisting and supply-chain protections as reasons to use it.
“pnpm has controls to allowlist install scripts for dependencies”
“We recently switched to pnpm, in part to guard against supply chain attacks”
Show 1 more
“we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!”
npm/Yarn alternative · 3
Users switched from npm's security model and unmaintained classic Yarn to pnpm.
“Switched to pnpm in part due to that reason.”
Show 1 more
“pnpm was already great alternative to npm - just keep improving it instead of rewriting”
Reliability · 3
Users report years of use without issue and say it just works.
“we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!”
“I use `pnpm` and it Just Works™.”
Show 1 more
Speed · 2
Commenters call it faster, and one notes that its installs use hardlinks to speed things up.
“we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!”
“runs pnpm install (which uses hardlinks to speed things up)”
Caveats and dissent
Not a security fix · 1
One user says pnpm does not solve the supply-chain and postinstall problem and notes that npm v12+ now disables lifecycle scripts by default.
“pnpm is not the answer to the supply chain/postinstall problem. I moved off pnpm recently”
Catalog update visibility · 1
One user found no way to see which dependencies in pnpm-workspace.yaml are out of date and built a tool for it.
“am a big fan of pnpm”
Rewrite concerns · 1
One commenter would rather see the tool improved than rewritten in Rust.
“pnpm was already great alternative to npm - just keep improving it instead of rewriting”
Often compared with
Threads where it came up
- Friendship ended with Deno, now Node is my best friend 2 mentions
- Pnpm 12.0 2 mentions
- Cloudflare acquires Deno 1 mention
- Show HN: Monoswan – a pleasant TS monorepo linter 1 mention
- Supply Chain Attack on Arrayref 1 mention
- Upcoming breaking changes for NPM v12 1 mention
Data: pnpm.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 17
“we've been using pnpm for years now without issue, and it's been faster and a little more secure to boot!”
“pnpm is not the answer to the supply chain/postinstall problem. I moved off pnpm recently”
“I use `pnpm` and it Just Works™.”
“Features like pnpm's workspace catalog make life much easier”
“pnpm was already great alternative to npm - just keep improving it instead of rewriting”
“I have switched to pnpm already.”
“pnpm has controls to allowlist install scripts for dependencies”
“Switched to pnpm in part due to that reason.”
“Worked really really well with pnpm workspaces and a monorepo setup”
“I use yarn or pnpm for monorepos.”
“Run `pnpm audit` and research any security issues”
“We recently switched to pnpm, in part to guard against supply chain attacks”
“downloads Ghostty, VSCode, fnm and pnpm”
“runs pnpm install (which uses hardlinks to speed things up)”
“We use PNPM and are very happy with it”
“I use pnpm, but even so”
“am a big fan of pnpm”