#pnpm — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #pnpm, aggregated by home.social.
-
What’s Different in pnpm 12, by @kochan.io (@pnpm):
https://pnpm.io/blog/whats-different-in-pnpm-12?ref=frontenddogma.com
-
pnpm released another project: pnpr, an npm registry.
It is proprietary.
In my opinion mixing proprietary and open source code in one project is a recipe for disaster and I will try to avoid such projects when I can.
Am I being overzealous?
-
Looks like I may be embarking on setting up a new blog this week. I have missed blogging. I am going to set up an SSG site using Astro. This is the first development project I have done on this laptop so I have to set up my tooling, workflows etc. I enjoy thinking through all this and getting myself setup carefully.
Should I be using npm or yarn or pnpm as my package manager? I care about security, so the issues npm had over the last year has turned me off. However, all that may simply be because npm has so many users, so attracts so many bad actors, and if users are wise with package choice it is not a problem.
Feel free to share your advice with me.
-
pnpm 11.11–11.14, by @kochan.io (@pnpm):
https://pnpm.io/blog/releases/11.11-11.14?ref=frontenddogma.com
-
1. instalar #node #npm y #pnpm con #nvm
2, configurar llaves ssh y firmado ggp para #git
3. levantar contenedores mínimos con docker
4. instalar bruno
5. instalar dbeaver
6. importar base de datos
7. definir variables en archivo .env
8. configurar #zsh con oh-my-zshy todavía falta. Recuerdo que al principio no tenía que hacer tantas cosas para configurar mi pc para desarrollar.
-
🙌 Hoch die Hände, gleich gibt es Wochenende!
Pünktlich dazu berichten beide über ihre Grillerfahrungen.
Technik kommt auch nicht zu kurz: Beide sprechen über die Open-Source-Community und im Speziellen über #pnpm . Braucht man das noch nach den neuen Updates in #npm ?
Hört einfach selbst rein:
🎧 https://ready-for-review.dev/2026/07/10/rfr107-braucht-man-noch-pnpm/
-
Setting Node and pnpm Versions in Cloudflare Workers Programmatically, by (not on Mastodon or Bluesky):
https://senhongo.com/blog/cloudflare-workers-node-pnpm/?ref=frontenddogma.com
-
cURL summer of bliss? I'm getting the #pnpm summer of hell :TeslaFire:
My project just got a dependency update PR from pnpm v10 to v11 because of twelve new vulnerabilities, half of them "CVSS High". But, reading through the summaries and PoCs, I can't help but think that most of them are nothing burgers. Almost everything can be mitigated by a simple config change, and a good portion of those are like this by design.
Like, what the hell is GHSA-2phv-j68v-wwqx? "There is a possibility to execute programs. But if the program is malicious, you will execute a malicious program! RCE! CVSS 7.5! Patch asap!"
I'm either too dumb/sleepy/hot1 to understand the actual risks, or it's really some panic making by whoever (or whatever) submitted those vulns.
As in, hot from not having an A/C at home. Please gift me a PortaSplit ↩︎
-
Why pnpm No Longer Expands Environment Variables in a Repository’s .npmrc, by @kochan.io (@pnpm):
https://pnpm.io/blog/2026/06/11/env-variables-in-repository-npmrc?ref=frontenddogma.com
-
For my work with Angular frontend apps, I have mainly used npm for package management. For our current development project, we need a monorepo approach, as we target multiple apps with shared functionality in libraries. One option for that is pnpm, which provides workspaces. I will explore that to gain some experience.
#pnpm #dev #javascript -
📦 Package coverage is broad: npm (#pnpm, #yarn, #bun), #PyPI, #Go modules, #RubyGems, #Composer. Reads lockfiles & install metadata — no package-manager execution, no source-file reads. Zero network calls during scans.
🔌 Also scans #MCP server configs (claude_desktop_config.json, mcp.json, Gemini CLI settings) and editor extensions for VS Code, Cursor, Windsurf, VSCodium — plus Chromium & Firefox browser extensions.
-
whenever there’s another #npm #supplychain attack, it’s time to start victim-blaming. unironically. don’t use npm, use #pnpm (or #bun).
pnpm stores your packages in a single central repository instead of downloading them all every time, and it also doesn’t run build scripts by default unless you ask it to. plus, it’s faster, but that’s less important.
if you use plain npm, you’re not a victim, you’re a perpetrator.
[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: @parcel/[email protected], [email protected], [email protected], [email protected] Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts. -
-
Minimum Release Age Is an Underrated Supply Chain Defense, by @daniakash.com:
https://daniakash.com/posts/simplest-supply-chain-defense/
#security #dependencies #npm #bun #pnpm #yarn #deno #renovate #dependabot #axios
-
Supply-chain security woes! Here's a simple configuration that will improve your PNPM security posture along with a nudge towards something even deeper!
https://coderlegion.com/14098/configuring-pnpm-to-tackle-the-supply-chain-bonfire
-
Wow this is perfect for keeping NPM dependencies secure 🔥
👮 **deputui** — A TUI for reviewing release notes of your NPM dependencies
💯 Pipe in pnpm outdated, skim release notes and select exactly which updates to install
🦀 Written in Rust & built with @ratatui_rs
⭐ GitHub: https://github.com/twiddler/deputui
#rustlang #ratatui #tui #npm #pnpm #security #packaging #dependencies
-
pnpm in 2025, by @kochan.io (@pnpm):
-
Why not go whole hog? While not have wrapper / generic methods for actions, like "install <package>".
That way you can define what package manager you're using, without needing to know specifics. And swapping between them would be easy.
The more advanced stuff could then be handled if / when it was required 🤔This has drawbacks, and complexities, but at the moment I'm really not getting what's special or valuable about Corepack.
-
The GitHub docs state:
> In practical terms, **Corepack lets you use Yarn, npm, and pnpm without having to install them**.
But... it looks like Corepack just downloads and installs them *for you*. At least it's the right version / hash checked.
I feel like I'm missing something here...
