Fast, disk space efficient package manager Sponsor us: GH: github.com/sponsors/pnpm OC: opencollective.com/pnpm We don't endorse any memecoins!
- Tweets 1,462
- Following 7
- Followers 27,207
- Likes 477
pnpm retweeted
pnpm lead maintainer @zkochan joined PodRocket to talk about pnpm 11: the 24-hour install rule, the new allow-builds config, the global virtual store, and what's coming in v12... including the highly anticipated Rust rewrite.
2
3
10
2,141
pnpm v11.1.3 is out
github.com/pnpm/pnpm/release…
17
265
15,020
pnpm retweeted
The Rust rewrite of pnpm was moved to the pnpm repository today. Now we will make changes to the TS and Rust versions in parallel.
25
47
866
141,208
pnpm retweeted
Exact methodology, more stats, history and source on working branch here:
github.com/wojtekmaj/package…
2
5
2,265
By some metrics pnpm is currently the most used package manager. However, we know that there is no time for rest. We work on big changes in a few areas to stay relevant.
1. Sincerest apologies, underestimated pnpm in my stats because of /npm/.match(…) 🤦
2. Weighted by monorepo it gets interesting! 👇 Please note: this includes ~9k packages from DefinitelyTyped, but even adjusting for this, pnpm would be... #1!
7
13
292
26,620
pnpm retweeted
be great if the community could rally around practices like github.com/lirantal/npm-secu…
7
38
6,807
in times like these, I'm very happy that @sanity_io put some of our @ThePledge dollars on the good folks at @pnpmjs 🫡
(and we made it our mandated package manager internally)
2
4
2,349
pnpm retweeted
Read this great in-depth postmortem from the @tan_stack team, then tell your agent to read the post, and check your repo for the attack vectors.
tanstack.com/blog/npm-supply…
1
5
31
3,484
pnpm retweeted
The TanStack supply-chain compromise is a masterclass in why "trusted publishing" isn't enough. 🧵
16
42
324
40,133
pnpm retweeted
This is why @pnpmjs's latest v11 release was the top story in Socket Weekly this past week - it includes smart defaults that put roadblocks in front of attacks like this.
Hard to imagine a more relevant release for this week’s supply chain chaos. 🔮
socket.dev/blog/pnpm-11-adds…
Everyone is tweeting out "use pnpm & set a minimumReleaseAge of 7 days"
but don't forget blockExoticSubdeps - which would also prevent the usage of a remote github reference here!
4
67
504
79,505
pnpm v11.1 is out. Can't update the docs due to issues with crowdin. Highlighted feature: named registries. Release page on github:
github.com/pnpm/pnpm/release…
1
11
168
8,746
pnpm retweeted
🧊 Big release for #JavaScript supply chain security: @pnpmjs 11 now defaults to a 1-day Minimum Release Age, blocks exotic subdependencies, and adds a new Allow Builds model.
A strong step toward reducing exposure to fast-moving npm attacks →
socket.dev/blog/pnpm-11-adds… #nodejs
5
37
137
15,456