If you are using changesets for versioning, you can now use pnpm CLI directly for version management: pnpm.io/versioning
Release management | pnpm
Added in: v11.13.0
pnpm.io
All workflows in the pnpm monorepo itself are now using pnpm v12.0.0-alpha.12, which is the Rust rewrite of pnpm v11. No breaking changes in the API vs v11.
If you are on the latest pnpm v11.10.0 (or v10.34.5), you can try out the pnpm v12 alpha via: pnpm self-update 12.0.0-alpha.5 It is fully in Rust! 🦀
Very early sneak peek to pnpr - the pnpm registry: pnpm.io/pnpr/
Introduction | pnpm
pnpr is a pnpm-compatible npm registry server, written in Rust. It speaks the
pnpm.io
I have some early benchmark results with my custom @pnpm.io registry. In different scenarios, overall install times are 2 to 7 times faster than even the already very fast pnpm in Rust. Looks promising.
The pnpm e2e tests now use a "pnpm registry" instead of verdaccio. In the future we'll make pnpm faster with this registry.
In the next version of pnpm you'll be able to run the Rust engine for fetching, importing, and linking packages.
🫡 thank you regardless, we just switched the bluesky app to pnpm and it’s like a breath of fresh air after being stuck on yarn 1 so long
in times like these, I'm very happy that @sanity.io put some of our @opensourcepledge.com dollars on the good folks at @pnpm.io 🫡 (and we made it our mandated package manager internally)
Is there anything else we can/should do on the client side to mitigate supply chain attacks?
🧊 Big release for #JavaScript supply chain security: @pnpm.io 11 now defaults to a 1-day Minimum Release Age, blocks exotic subdependencies, and adds a new Allow Builds model. A strong step toward reducing exposure to fast-moving npm attacks → socket.dev/blog/pnpm-11... #nodejs
pnpm 11 Adds Supply Chain Protection Defaults for Minimum Re...
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.
socket.dev
Glad to see we have many new members of team "node is a dev dependency"
devEngines started as @geoffreybooth.bsky.social and I in DMs 2 years ago. It's now supported in @npmjs.bsky.social & @pnpm.io, and later this month will be our recommended way for developers at Netflix to define runtime and package manager versions in their projects. docs.npmjs.com/cli/v11/conf...
package.json | npm Docs
Specifics of npm's package.json handling
docs.npmjs.com
Thanks to early feedback we have shipped several fixes. pnpm v11.0.3 is released.
We donated to @pnpm.io as part of our open source donations program. It's the default package manager for many of our frontend engineers. The team behind the 11.0 release did an amazing job of securing pnpm against supply-chain attacks, making it one of the safest package managers out there.
Evil Martians@evilmartians.com · 4mo agoWe just donated to @wooorm.com as part of our OSS donation program! He's an engineer based in the Netherlands and the maintainer of 550+ projects. If your project uses Markdown, it probably already runs on one of his tools. His most well-known one is mdx for writing Markdown with JSX components.
pnpm v11.0.0 is released! The "latest" dist-tag still points to v10, so install it via "pnpm self-update latest-11" github.com/orgs/pnpm/di...
pnpm 11 · pnpm · Discussion #11377
Migration guide: Migrating from v10 to v11 Highlights Major Node.js 22+ required — support for Node 18, 19, 20, and 21 is dropped, pnpm itself is now pure ESM, and the standalone exe requires glibc...
github.com
We’ve cut the release branch for v11.0! From this point on, we are only merging bug fixes. Have you tried the latest v11.0 RC 5? If you've encountered any bugs, please file an issue in the repo or reply to this thread! To try v11, run "pnpm self-update next-11"
pnpm v11.0.0-rc.5 is out! You can install it with "pnpm self-update next-11" Now you can use "pnpm pack-app" to build a single executable app with Node.js! This command is used to publish pnpm CLI itself. Docs: pnpm.io/11.x/cli/pac...
pnpm pack-app | pnpm
Added in: v11.0.0
pnpm.io
@pnpm.io's experimental global virtual store is brilliant. The install performance gains are a game-changer for git flows. You get near-zero per-worktree overhead and instant installs for new worktrees as packages are already in the global store. @kochan.io can't stop making pnpm better 🤌
pnpm + Git Worktrees for Multi-Agent Development pnpm.io/11.x/git-wor...
pnpm + Git Worktrees for Multi-Agent Development | pnpm
When multiple AI agents need to work on the same monorepo simultaneously, they each need an isolated working copy with fully functional nodemodules. Git worktrees combined with pnpm's global virtual s...
pnpm.io
Additionally, pnpm 11 will block dependencies from exotic sources (like Git) in subdependencies.
Great write up by @filipsobol.bsky.social about our @pnpm.io migration: ckeditor.com/blog/migrati...
Migrating a Multi-Repo Setup from Yarn Classic to pnpm | CKEditor
How CKEditor migrated a multi-repository setup from Yarn Classic to pnpm - adding lockfiles for stable LTS builds, faster CI installs, and reliable linking.
ckeditor.com
🚀pnpm 2025 recap: 2x download growth, new homepage, my first JSNation talk, and v10 feature highlights pnpm.io/blog/2025/12...
🚀 pnpm in 2025 | pnpm
2025 has been a transformative year for pnpm. While our primary focus was redefining the security model of package management, we also delivered significant improvements in performance and developer e...
pnpm.io
pnpm 10.26 is here! This release focuses heavily on locking down supply chain security and giving you granular control over build scripts. From stricter git defaults to the new allowBuilds config, here’s a breakdown of the changes. 🧵👇 #pnpm #javascript
The Seattle Times is piloting pnpm’s client-side defenses—blocked lifecycle scripts, release cooldowns, and trust policy—to stop worms like Shai-Hulud 2.0 before they land. Read their story: pnpm.io/blog/2025/12...
How We're Protecting Our Newsroom from npm Supply Chain Attacks | pnpm
We got lucky with Shai-Hulud 2.0.
pnpm.io
🚀 pnpm v10.21 is out! This release introduces two powerful new security & compatibility features: 1️⃣ Automatic Node.js runtime installation for dependencies 2️⃣ Configurable trust policy for detecting supply-chain downgrades 🧵👇