pnpm 12.0: Package Manager Rewritten in Rust
Faster, more secure, and more consistent dependency management
1Rewritten in Rust
pnpm 12.0 is a complete rewrite of the original JavaScript codebase in Rust. This transition brings performance improvements and lower memory usage. All pnpm 11 commands, flags, and settings remain compatible. Rust's thread safety and deep optimizations make a noticeable difference, especially in large projects.
2Git Dependency Changes
pnpm 12 changes how GitHub, GitLab, and Bitbucket dependencies are handled. It now uses HTTPS URLs by default instead of SSH, and lockfiles no longer store SSH URLs. For private repositories, Git's URL rewriting feature can be configured. This change improves security while making dependency resolution more consistent.
3Unrecognized Settings Now Reported
Previous versions silently ignored misspelled settings. pnpm 12 detects unrecognized settings and suggests similar valid options. If a project pins a specific pnpm version, unrecognized settings cause the command to fail. This makes configuration errors easier to catch early in the development process.
4Improved Dependency Cycle Handling
pnpm 12 breaks dependency cycles more consistently. Cycle members are ordered by package ID, and cuts always occur at the same points. This makes the lockfile a pure function of the dependency graph. As a result, peer resolution is 2-3x faster in large projects, uses 25% less memory, and produces smaller lockfiles.
5Filesystem Optimizations
On Linux, pnpm 12 now tries hardlinks first when creating node_modules, falling back to clones if needed. This cuts installation time in half on btrfs. macOS continues using APFS clonefile. ext4 behavior remains unchanged as cloning was never supported there. These optimizations significantly improve installation speed.
6Stricter Engine Compatibility
In engineStrict mode, pnpm 12 now fails when encountering incompatible packages in the regular dependency tree. pnpm 11 only emitted warnings in this case. Packages reachable only through optional dependencies are still skipped. This change makes project compatibility more reliable and predictable.
7Global Shim Feature
pnpm 12 introduces project-aware version management for globally installed node, deno, and bun. The globalShims setting controls which global packages get this treatment. By default, node, deno, and bun are enabled. For untrusted projects, execution requires confirmation, and responses are remembered machine-wide.
8Expanded Package Manager Support
pnpm 12 adds automatic installation support for npm, Yarn Classic, Yarn Berry, Yarn 6, and Bun. These package managers are fetched from trusted sources and verified before execution. Git dependencies can be prepared with their requested package manager. The pnx command runs one-off commands, and pnpm shim add creates project-specific manager links.
9What pnpm 12 Brings
pnpm 12 delivers significant performance gains through its Rust rewrite. Dependency resolution becomes more consistent while security measures are strengthened. Large projects see noticeable speed improvements and memory efficiency. The expanded package manager ecosystem support offers developers a more flexible working environment.
Original article: Hacker News: Front Page — pnpm 12.0: Rust ile Yeniden Yazılan Paket Yöneticisi