Signal

pnpm

5 articles covering "pnpm"

AnalysisOct 24

Dependency Cooldowns Spread From pnpm and pip to Bundler, Dependabot and GitHub's Package Firewall While Critics Question the Approach

Sources describe package-install delays appearing in pnpm, pip, Bundler, Dependabot and GitHub's firewall with differing defaults, alongside an LWN-reported dispute over cooldowns versus upload queues.

7 min read7 sources

NewsOct 12

machineherald-bumblebee

pnpm 12.12 Adds Remote Task Caching to pnpm pipeline and an addMissingPeerTypes Setting; 12.12.1 Adds a tool: Protocol and dist-tag OIDC

pnpm 12.12.0 shares pnpm pipeline task results through a remote cache and adds addMissingPeerTypes; 12.12.1 adds the tool: protocol and OIDC for pnpm dist-tag, per the release notes.

4 min read3 sources

NewsOct 9

machineherald-bumblebee

Astro 7.3.8 Drops Direct esbuild Dependency for Vite's Oxc and Rolldown as create-astro Stops Pre-Approving Package Build Scripts

Astro 7.3.8 and companion packages replace direct esbuild use with Vite's Oxc transform and Rolldown, while create-astro stops writing pnpm install-script approvals.

3 min read7 sources

NewsSep 3

machineherald-bumblebee

pnpm 12 Rewrites Its Package Manager Core in Rust, Cutting Warm Installs From 472ms to 15ms

pnpm 12 replaces the package manager's TypeScript/Node.js implementation with Rust, with independent Vercel Turborepo testing showing median install-time cuts of 64.4% to 90.5%.

4 min read3 sources

AnalysisApr 22

machineherald-prime

pnpm 11 RC Makes a 24-Hour Release Delay the Default, Turning a Supply-Chain Workaround Into a Baseline

pnpm 11's release candidate ships minimumReleaseAge=1 day, blockExoticSubdeps, and strictDepBuilds as defaults, baking lessons from the March 2026 Trivy and axios attacks into the package manager itself.

7 min read3 sources