pnpm

The pnpm repository has 35K stars!

should we block such flags if we detect that pnpm is executed by an agent? x.com/encrypted/stat…

After some more correctness fixes, pnpm in rust is even faster

The @pnpmjs e2e tests now use a "pnpm registry" instead of verdaccio. In the future we'll make pnpm faster with this registry.

@marklynchdev @theo We work on it since April 23rd. We did not start from scratch as we had a small PoC ready from a couple of years ago. And it is not ready yet. It is under active development.

@pnpmjs @theo How long did this take? Curious because the bun rewrite was around 7’ish days.

We were able to make the rust rewrite faster than pnpm in all scenarios

pnpm v11.3 is out with the "pnpm stage" commands pnpm.io/blog/releases/…

@kidkarolis The Rust rewrite is a direct rewrite of the Node.js implementation. The same techniques/optimizations are in place.

@pnpmjs Also impressive how fast JS is already 😳. Do you know why Rust is significantly faster in some of those scenarios? Curious if that technique/optimisation could be brought into the JS implementation.

@theBarracuda_ You can try it x.com/pnpmjs/status/…

@pnpmjs Will be waiting on that feature, thanks ! Also do you have a roadmap or ETA for partial rust port to be done and recommend to be used in production?

This is due to additional checks that pnpm performs on a lockfile that was generated not locally. We will add an option to disable it, which should be safe for projects don't accepting contributions from outside collaborators. Also we'll document some ways to cache verification

@schickling Only the version released today (0.2.6) won all the benchmarks that we publish to our website. If you have scenarios, where it is still slower, please file an issue.

@pnpmjs Very excited about this work! Unfortunately this doesn't seem to be true for my scenarios/experiments. While memory usage seems lower, the overall install time was slower. Happy to try a new release to see if it fixes the regression. github.com/orgs/pnpm/disc…

@ghoullier It is slower because people wanted additional validation checks of the lockfile that was generated not locally. You can try caching the pnpm cache directory to make it faster. We can make an option to disable it in a future version.

@pnpmjs Install time is ~x2 slower with pnpm@11... We keep v10 for now

Also new in pnpm v11.2, pnpm outdated displays runtimes

@bygregorr The pnpm monorepo has 204 projects. It works there.

@pnpmjs imo the real test is how it handles monorepos with 40+ packages

You can try out the new pnpm Rust engine if you update to pnpm v11.2.2 and run: pnpm add @pnpm/pacquet --config Whenever a new version of the engine comes out, just run the above command again. Issues can be reported in the pnpm repository with "pacquet:" in the title.

We are dogfooding it on the pnpm repository itself.

@YouPulseX Remove the config dependency from "pnpm-workspace.yaml" and run "pnpm install", then commit the updated lockfile. Not sure "pnpm remove --config" is implemented. We'll add that too.

@pnpmjs What is the rollback path if the Rust engine breaks a workspace after pnpm add @pnpm/pacquet --config - remove the config entry, downgrade pnpm, or both?

1/ To prevent supply chain attacks following the pattern of Mini Shai Hulud, we invalidated npm granular access tokens with write access that bypass 2FA. Update the stored token and rerun the workflow for your automations.

@minijus Faster - yes. Memory we did not test.

@pnpmjs Will it be faster? Or will it consume less memory? With v11 our Renovate runs started getting OOM issues when creating/updating lock files.

In the next version of pnpm you'll be able to run the Rust engine for fetching, importing, and linking packages.

pnpm lead maintainer @zkochan joined PodRocket to talk about pnpm 11: the 24-hour install rule, the new allow-builds config, the global virtual store, and what's coming in v12... including the highly anticipated Rust rewrite.