pnpm

pnpm at a glance

pnpm is a fast, disk-efficient package manager for JavaScript/Node.js, an increasingly popular alternative to npm and Yarn using a content-addressable store. pnpm ships frequent releases plus fixes; as tooling that resolves and installs dependency code, integrity and pinning matter.

For admins pnpm's strict, non-flat node_modules is a modest supply-chain advantage (it prevents accidental access to undeclared dependencies), but the core discipline is the same as any Node package manager: commit the lock file, install from it in CI (a frozen install), and audit dependencies for known vulnerabilities. Keep pnpm current for security and compatibility fixes, and pin its version per project (via the packageManager field or corepack) for reproducible installs across a team. After upgrading pnpm, verify that installs and builds work. The packages you pull carry the real risk — pin and audit them. Patchletter surfaces new pnpm releases.