pnpm
pnpm is a package manager and drop-in replacement for npm, available for Linux, macOS, Windows, and Android.
What pnpm is
pnpm is a package manager and drop-in replacement for npm, available for Linux, macOS, Windows, and Android. It supports npm and JSR packages, Cargo crates, PyPI packages, tarballs, Git repositories, and local directories. Dependency resolution, fetching, and linking run in parallel, while package files are stored in a shared content-addressable store and linked into projects. Its workspace tools support monorepos, filtering, workspace protocols, and a shared lockfile. By default, only declared direct dependencies appear in the root node_modules directory. Since pnpm v10, install scripts are disabled unless explicitly allowed; other controls include blocking exotic transitive dependencies, delaying updates, and enforcing trust policies. pnpm can check for known vulnerabilities and verify ECDSA registry signatures. It can install and pin Node.js per project, and its standalone installer does not require Node.js. The project provides examples for several CI systems and a GitHub Actions setup action. pnpm is free; the provided pages state no pricing, trial, refund, or free-tier details.
Good
- Drop-in replacement for npm.
- Supports multiple package sources.
- Workspace features include filtering and a shared lockfile.
- Install scripts require approval by default since v10.
- Can audit vulnerabilities and verify registry signatures.
Watch out
- No pricing or billing details are stated.
- No trial or refund terms are stated.
- No free-tier limits are stated.
Who it suits
pnpm suits developers who manage project dependencies, especially those working with monorepos or wanting stricter dependency and install-script controls. Its listed package sources and platforms may also suit projects using multiple ecosystems.
Verdict
pnpm offers dependency management across several package sources, with workspace features and controls for install scripts and trust. Its pages state that it is free but do not specify pricing or trial terms.
The facts
Each one read from pnpm's own pages, with the date it was checked.
What it does
- Audit and signatures
- pnpm audit can check known vulnerabilities and verify ECDSA registry signatures for installed packages.checked 28 Sep 2026
- Build safety
- pnpm disables automatic execution of dependency postinstall scripts and recommends explicitly allowing trusted builds.checked 30 Sep 2026
- Build script security
- Install scripts require approval for packages allowed to execute them.checked 28 Sep 2026
- CI integrations
- The documentation provides configuration examples for AppVeyor, Azure Pipelines, Bitbucket Pipelines, CircleCI, GitHub Actions, GitLab CI, Jenkins, Semaphore, and Travis CI.checked 28 Sep 2026
- Community support
- Community channels include X, YouTube, Reddit, Bluesky, and Discord.checked 28 Sep 2026
- Content-addressable storage
- pnpm stores package files in a single content-addressable store and links them into projects.checked 28 Sep 2026
- Dependency catalogs
- Catalogs define dependency versions once in pnpm-workspace.yaml.checked 28 Sep 2026
- Dependency isolation
- By default, pnpm links only a project's direct dependencies into the root of node_modules.checked 30 Sep 2026
- Dependency patching
- pn patch creates persistent patches reapplied on every install.checked 28 Sep 2026
- Dependency resolution
- Yeschecked 21 Sep 2026
- Disk efficiency
- Files are hard-linked from one content-addressable store.checked 28 Sep 2026
- Disk use
- pnpm stores package files in a shared content-addressable store and hard-links them into project node_modules.checked 30 Sep 2026
- Feature set
- The feature comparison lists dependency patching, catalogs, JSR registry support, SBOM generation, license listing, and build script security.checked 30 Sep 2026
- GitHub Actions integration
- The pnpm/setup action installs pnpm, can install the requested runtime, runs pnpm install, and can cache the pnpm store.checked 28 Sep 2026
- Installation limit
- pnpm 12 requires Node.js 22.13 or newer when installed through npm, while the standalone executable does not require Node.js after installation.checked 28 Sep 2026
- Installation requirement
- pnpm 12 is a native executable that does not require Node.js after installation; installing it through npm requires Node.js 22.13 or newer.checked 30 Sep 2026
- Installation speed
- pnpm resolves, fetches, and links dependencies in parallel and describes its installation process as significantly faster than the traditional approach.checked 28 Sep 2026
- Install speed
- pnpm resolves, fetches, and links packages in parallel, and says installs on a warm store mostly create links.checked 30 Sep 2026
- Integrations
- The CI guide provides setup examples for systems including AppVeyor, Azure Pipelines, Bitbucket Pipelines, and CircleCI.checked 30 Sep 2026
- License
- The pnpm repository is MIT licensed except for the pnpr directory, which is source-available under the PolyForm Shield License 1.0.0.checked 28 Sep 2026
Money
- Billing details
- No pricing or billing details are stated on the provided pages.checked 28 Sep 2026
- Free plan
- Yeschecked 21 Sep 2026
- Free tier
- No free-tier plan or limits are stated on the provided pages.checked 28 Sep 2026
Where it runs
- Installation platforms
- Installation instructions are provided for macOS, Linux, and Windows.checked 28 Sep 2026
The full review of pnpm
pnpm is a package manager for JavaScript projects and a drop-in replacement for npm. It suits developers and teams managing dependencies across projects, especially monorepos. Its strongest case is the combination of shared package storage, workspace tools, and install-time security controls.
Overview
pnpm works with npm and JSR registries, workspace packages, local files, tarballs, and Git repositories; it also supports package formats including Cargo crates and PyPI packages. Dependency resolution and lockfiles provide the basic machinery for repeatable project installs.
Package files are kept in a content-addressable store and hard-linked into projects, reducing duplicate copies across projects. Resolution, fetching, and linking run in parallel. The project claims pnpm can be up to 2x faster than npm and Yarn Classic, but that is not a promise for every workload.
The repository is MIT licensed except for the pnpr directory, which uses the source-available PolyForm Shield License 1.0.0. That distinction matters to organizations evaluating the full repository.
Key features
Workspaces and dependency consistency
Workspace support is a substantial reason to choose pnpm for monorepos: teams can use workspace protocols, filter commands by package, and share one lockfile. Dependency catalogs define versions once in pnpm-workspace.yaml, helping keep choices aligned across packages rather than repeated independently.
Isolation and install security
By default, only declared direct dependencies are exposed at the root of node_modules. That stricter structure can surface undeclared dependency use instead of letting it work accidentally. Since pnpm v10, dependency postinstall scripts are disabled unless explicitly approved, giving teams a deliberate gate over which packages can run install-time code.
Additional supply-chain controls include blocking exotic transitive dependencies, delaying updates with a default minimum release age of 1440 minutes, and enforcing trust with trustPolicy. The pnpm audit command checks known vulnerabilities and can verify ECDSA registry signatures for installed packages. These controls are useful for teams that want policy at install time, though they require decisions about what to permit and trust.
Patching and runtime management
pn patch creates persistent patches that are reapplied on each install, offering a way to maintain dependency changes within a project. pnpm can also install and pin Node.js per project, which helps teams keep the runtime choice tied to project work.
Installation and automation
Installation instructions cover macOS, Linux, and Windows, and a standalone script works without Node.js already installed. Documentation includes CI examples for AppVeyor, Azure Pipelines, Bitbucket Pipelines, CircleCI, GitHub Actions, GitLab CI, Jenkins, Semaphore, and Travis CI. The GitHub Actions setup can install pnpm, install a requested runtime, run pnpm install, and cache the pnpm store.
Pricing
pnpm is free, with no trial. It is a straightforward fit for individuals and teams that want a package manager without a stated paid tier. There are no stated plan limits or billing terms to weigh against that choice.
Platforms
pnpm supports Linux, macOS, Windows, and Android. Its installation instructions cover macOS, Linux, and Windows; a standalone installer avoids requiring Node.js beforehand.
Who it's for
pnpm is a strong fit for JavaScript developers who want a npm-compatible replacement, particularly teams with monorepos that benefit from filtering, a shared lockfile, and centralized dependency versions. Its store-based linking is also relevant to users managing multiple projects where reducing duplicated package files matters. Teams prioritizing controlled install scripts and dependency trust have meaningful safeguards to configure.
It is a less natural choice for teams that do not want pnpm's stricter dependency visibility or that prefer a tool centered on another ecosystem. The performance claim is not a substitute for evaluating a project's own workload.
Pros and cons
- Pro: Shared content-addressable storage and hard links reduce duplicated package files across projects.
- Pro: Workspace filtering, a shared lockfile, and dependency catalogs give monorepos practical coordination tools.
- Pro: Install-script approval, release-age delays, trust policies, audits, and signature checks provide several layers of supply-chain control.
- Con: Only declared direct dependencies are exposed at the root of node_modules by default, which can require projects relying on accidental access to adjust.
- Con: Install scripts require explicit approval, so teams must manage allow decisions for packages that need to execute them.
- Con: The repository's pnpr directory is not covered by its MIT license.
Alternatives
npm is the direct alternative for readers who prefer the established package manager pnpm replaces, with a freemium model and a free plan for public package authors that includes unlimited public packages and public registry access.
uv is a free package-management alternative for Python projects. Conan is a free and open-source package manager for C and C++. Yarn is another free open-source package manager. Cargo is the free Rust package manager and build tool. NuGet is a free option for readers considering the NuGet ecosystem; its Gallery code is Apache 2.0 licensed and welcomes community contributions. Go Modules is another free option. Gradle is a free, open-source build system.
Browse Package Managers, Monorepo Management Tools, or JavaScript Package Managers for category options.
Verdict
Choose pnpm if you want an npm-compatible package manager with efficient shared storage, particularly for monorepos or teams that value install-time controls. Look elsewhere if the stricter dependency model does not suit your project, or if you need a package manager focused on another ecosystem.
