pnpm

> It's just a shame to hear that the author is, for now at least, stopping their engagement with the community due to how they perceive it's changing! Want to clarify for others reading that the author of _Elixir_ isn't stopping, just the author of this post. José has been shockingly responsive on recent issue/pr threads I've posted on Elixir-related repos recently, often same day. They also don't seem to use any bot-based code review, which is incredibly refreshing in contrast to many other repos[1] in 2026 (Sorry for the callout, it's just such a good example). Elixir projects have been a joy as a fairly new contributor, compared to other ecosystems. [1] https://github.com/pnpm/pnpm/pull/13188

> pnpm is written in Rust Not just yet. The Rust rewrite of the installation engine is still experimental and available as an opt-in preview[0]. [0] https://github.com/pnpm/pnpm/releases/tag/v11.2.2

Unfortunately there is currently an issue in pnpm that makes `minimumReleaseAge` difficult: https://github.com/pnpm/pnpm/issues/11068

Note pnpm does not have this flag yet, please upvote this issue if you want it added: https://github.com/pnpm/pnpm/issues/11224 Currently pnpm only supports setting this option via persistent config file, not per-run.

> """ I'm strongly in favor of blocking post-install scripts by default. :+1: This is a change that will have a painful adjustment period for our users, but I believe in ~1 year everyone will look back and be thankful we made it. It's nuts that a [pnpm|yarn|npm] install can run arbitrary code in the first place. """ - a pnpm maintainer 1 year ago https://github.com/pnpm/pnpm/pull/8897

That’s weird, pnpm no longer automatically runs lifecycle scripts like preinstall [1], so unless they were running a very old version of pnpm, shouldn’t they have been protected from Shai-Hulud? 1: https://github.com/pnpm/pnpm/pull/8897

Pnpm already did that: https://github.com/pnpm/pnpm/releases/tag/v10.0.0

pnpm have already implemented a minimum age policy https://github.com/pnpm/pnpm/issues/9921

It would be fine if you could still manually specify those versions eg. npm i duckdb@1.3.3 installs 1.3.3 but duckdb@latest or duckdb@^1.3 stays on 1.3.2 until 1.3.3 is ~a week old. https://github.com/pnpm/pnpm/issues/9921

I think this is somewhat funny. His comment is pretty understandable if you've done frontend work in javascript. Node_modules is so ripe for duplicate content that some tools explicitly call out that they're disk efficient (It's literally in the tagline for PNPM "Fast, disk space efficient package manager": https://github.com/pnpm/pnpm) So he got ok results (~13% savings) on possibly the best target content available in a user's home directory. Then he got results so bad it's utterly not worth doing on the rest (0.10% - not 10%, literally 1/10 of a single percent). --- Deduplication isn't super simple, isn't always obviously better, and can require other system resources in unexpected ways (ex - lots of CPU and RAM). It's a cool tech to fiddle with on a NAS, and I'm generally a fan of modern CoW filesystems (incl APFS). But I want to be

I'm currently working in a pnpm monorepo and it really seems like a potential double edged sword. On the one hand I have longed for better support for local packages in the ecosystem (which pnpm does provide, and I'm happy for it). But some weird edge cases seem to arise. Like serverless functions not being supported[1]. I suppose that's just a matter of feature maturity. The more design-level hazard of this might be that it's easier to build monorepos where everything is tightly coupled. And you end up with something that is like a single package with extra abstraction layers. 1 - https://github.com/pnpm/pnpm/issues/6259