Technology
Pnpm 12.0 released as stable Rust rewrite
The updated JavaScript package manager maintains backwards compatibility for commands and lockfiles while introducing new resolution rules and developer features.
The short version
- Pnpm 12.0 has been released as a stable version rewritten in Rust, maintaining command and lockfile compatibility with version 11.
- Key breaking changes alter how Git dependencies resolve, enforce validation of workspace settings, and change peer resolution for cyclic dependencies.
- New capabilities include project-aware global bin shimming, direct provisioning and verification of other package managers, and restrictions on running global commands with sudo.
Key facts
- Pnpm 12.0 is a stable release rewritten in Rust, maintaining commands, flags, settings, and lockfile formats from version 11 while being installed via the next-12 tag.[Hacker News]
- Git dependencies targeting GitHub, GitLab, and Bitbucket now resolve through host canonical HTTPS URLs instead of explicit transport protocols.[Hacker News]
- Unrecognized settings in pnpm-workspace.yaml now trigger errors when the pinned pnpm version satisfies the running version, rather than being silently ignored.[Hacker News]
- Dependency cycles during peer resolution are now broken canonically by package ID order to produce deterministic lockfiles and accelerate resolution on large workspaces.[Hacker News]
- Pnpm can now provision npm, Yarn variants, and Bun, verifying npm signatures before executing binaries.[Hacker News]
- Global commands modifying global installations now explicitly fail when executed under sudo.[Hacker News]
What remains uncertain
- Package distributors including Homebrew, winget, Scoop, and Chocolatey do not yet offer pnpm 12.0, with availability timelines unannounced.[Hacker News]
- The remote side-effects cache is currently an opt-in proof of concept restricted to Linux/glibc x64 and arm64 systems.[Hacker News]
Sources
- Pnpm 12.0Hacker News