I just review less. PRs are waiting for weeks sometimes.
21.02.2026 17:43
👍 0
🔁 0
💬 0
📌 0
I just review less. PRs are waiting for weeks sometimes.
pnpm fails on unknown flags. And known flags won't be installed as packages. Maybe there is some edge case where you can escape the dashes. I have never tested it.
It is also available as an opt-in feature in v10: pnpm.io/settings#blo...
Additionally, pnpm 11 will block dependencies from exotic sources (like Git) in subdependencies.
Vox is running out of ideas.
Therein lies the rub: AI cannot have “ideas” of its own. Every “idea” you thought AI had came from a person, either through prompting or theft.
The way to jumpstart the “idea machine” is to have people focused less on survival and more on living passionately.
The Seattle Times is piloting pnpm’s client-side defenses—blocked lifecycle scripts, release cooldowns, and trust policy—to stop worms like Shai-Hulud 2.0 before they land.
Read their story:
pnpm.io/blog/2025/12...
That whole output is from codemod
I guess codemod is a package manager of itself and they have switched to some new types of codemods. That is why it prints legacy
Pnpx is not deprecated. I don’t know why there’s a warning from the codemod
Yet another reminder to use @pnpm.io's minimum dependency age.
pnpm.io/settings#min...
I somewhat agree with your points. However, this feature was the most upvoted in our repository. The npm registry has advertised provenance as the solution to the supply chain problems.
Yeah, but i think almost no packages use provenance at the moment at all
Yes, it will be possible to do both by name and version(s)
There will be a setting to exclude packages from the rule. Although some believe it is a bad idea. Someone suggested to even ship a list of exceptions.
Yes, that’s the only safe way of doing it. We’re not fixing it only for the lockfile update case
I am not sure there’s a better way to do it.
🚀 pnpm v10.21 is out!
This release introduces two powerful new security & compatibility features:
1️⃣ Automatic Node.js runtime installation for dependencies
2️⃣ Configurable trust policy for detecting supply-chain downgrades
🧵👇
Sometimes I can’t tell if someone was using an agent or not but reviewing pull requests takes a lot of my time. I probably spend double the time on the review if they use agents.
pnpm 10.21: installing Node.js runtimes for dependencies, not installing dependencies with decreased trust levels, and more
@kochan.io @pnpm.io
pnpm.io/blog/release...
#ECMAScript #JavaScript
@pnpm.io added a `trustPolicy` option in 10.21.
It allows you to prevent installing potentially malicious dependency updates that are not signed like previous versions.
pnpm.io/blog/release...
Thank you for all the performance, productivity and security enhancements over the last years 💜
I am not making any promises about the libraries. The major version is the major version of pnpm cli x100. So a library can have up to 99 breaking changes till the next pnpm cli comes out
Zoltan Kochan is a full stack web developer and the creator of @pnpm.io. He joins the show with @joshuakgoldberg.com to talk about the state of package management for web dev.
@kochan.io
softwareengineeringdaily.com/2025/09/18/p...
After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates.
Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management.
socket.dev/blog/pnpm-10... #NodeJS
Wow, Hollywood is so creative
We need a versioning system that consists of 4 numbers, where the first one is used for marketing purposes
There were no peer dependencies in 1985
That would be the logo
I feel like pnpm will eventually grow from being a "npm alternative" to being a "nix alternative"
but "pnix" doesn't sound appropriate 😂
With the changes to the lockfile format and the new types of fetchers that were added to pnpm, now it is really easy to make pnpm an installer for anything
bsky.app/profile/pnpm...