{"full_name":"pnpm/pnpm","owner":"pnpm","name":"pnpm","url":"https://github.com/pnpm/pnpm","description":"Fast, disk space efficient package manager","homepage":"https://pnpm.io","topics":[],"language":"Rust","license":"MIT","avatar":"https://avatars.githubusercontent.com/u/21320719?v=4","created_at":"2016-01-28T07:40:43Z","pushed_at":"2026-11-10T09:30:42Z","metrics":{"stars":37048,"forks":1985,"watchers":161,"issues":6924,"prs":8764,"releases":1000,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":1803},"growth":{"day":{"stars":9,"forks":2,"base_day":"2026-11-09"}},"history":{"dates":["2026-11-09","2026-11-10"],"stars":[37039,37048],"forks":[1983,1985],"watchers":[161,161],"issues_open":[null,null],"prs_open":[null,null]},"boards":{},"same_owner":[],"issues":[{"number":17889,"title":"Regression: frozen install ignores modulesDir for direct dependency and executable links","comments":1,"created_at":"2026-11-08T15:37:25Z"},{"number":17888,"title":"deploy --offline --frozen-lockfile requires metadata despite pinned lockfile and populated store","comments":0,"created_at":"2026-11-08T15:36:22Z"}],"discussions":[{"number":17890,"title":"Packaging pnpm v12 for openSUSE: `The \"@pnpm/exe.linux-x64\" package is not installed, so pnpm has no native binary to run.`","comments":1,"category":"Q&A","created_at":"2026-11-08T16:49:28Z"},{"number":17827,"title":"Support declaring skill locations beyond the top-level `skills/` directory","comments":0,"category":"Ideas","created_at":"2026-11-06T23:05:29Z"},{"number":17808,"title":"pnpm 11.25.0 on Windows: EPERM during store project registration","comments":1,"category":"Q&A","created_at":"2026-11-06T18:08:10Z"},{"number":17819,"title":"Can't install on NetBSD on amd64 host","comments":3,"category":"Ideas","created_at":"2026-11-06T16:49:52Z"},{"number":17745,"title":"Link agent skills into a directory outside the workspace root","comments":0,"category":"Ideas","created_at":"2026-11-05T15:39:44Z"},{"number":17742,"title":"pnpm deploy reruns the deployed project's preinstall/install/postinstall scripts","comments":3,"category":"Ideas","created_at":"2026-11-05T13:31:39Z"},{"number":17733,"title":"Make automatic network concurrency downscaling configurable","comments":0,"category":"Ideas","created_at":"2026-11-05T11:35:31Z"},{"number":17718,"title":"Skip filling an optional peer when the peers it brings in can't be satisfied","comments":1,"category":"Ideas","created_at":"2026-11-05T05:43:48Z"}],"latest_release":{"name":"pnpm 12.18","tag":"v12.18.0","published_at":"2026-11-05T00:56:45Z","body":"pnpm 12.18.0 packs, publishes, and installs packages with platform variants on pnpr registries. It also adds per-skill approval of agent skills and `pnpm store add` for offline installs from downloaded tarballs. Repeat installs and `verifyDepsBeforeRun` no longer read the `package.json` of unchanged workspace projects. The release fixes several peer dependency resolution bugs too.\r\n\r\n### Minor Changes\r\n\r\n#### Agent skills\r\n\r\n- pnpm now names the link to a dependency's agent skill after the skill alone. A skill that the `@acme/kit` package ships in `skills/auth/` is linked as `.claude/skills/auth`, not `.claude/skills/pnpm-@acme+kit-auth`. The next install replaces links with the old names. pnpm lists the linked skills in a `# pnpm` block of each agent skill directory's `.gitignore` [#17455](https://github.com/pnpm/pnpm/discussions/17455).\r\n\r\n  When two approved packages ship a skill of the same name, or the name is already taken in an agent skill directory, pnpm links the skill as `pnpm-<package>-<skill>`. Before, the install failed.\r\n\r\n- `pnpm approve` now asks which agent skills to link when a package ships more than one. pnpm records the chosen skills as a list, such as `permissions.<pkg>.skills: [guide, migrate]`, and does not offer the other skills for approval again. The first time a project approves a skill, `pnpm approve` also asks which agent directories to link skills into, and records the answer under `skills.dirs`.\r\n\r\n- pnpm links agent skills nested in category directories, such as `skills/engineering/implement/SKILL.md`, up to three levels below `skills/`. Before, it linked only the skills directly under `skills/`.\r\n\r\n#### Platform variants\r\n\r\nThese features need a registry declared with `serverType: pnpr`.\r\n\r\n- `pnpm pack` packs one archive per entry of `publishConfig.variants`, each platform variant as `<name>-<version>~<tag>.tgz`. `pnpm pack --variant <target>` packs only the archive whose entry lists that target. `pnpm pack --json` prints the `integrity` and `size` of every archive it writes.\r\n\r\n- `pnpm publish` publishes a package's `publishConfig.variants`. pnpm uploads every archive before the publish request that references them. Publishing variants to any other registry is refused unless `--no-variants` is given, which publishes only the archive that targets `any`.\r\n\r\n- `pnpm publish --upload-variant <target>` uploads the archive of one `publishConfig.variants` entry to the registry's staging area and prints `<target>=<integrity>`. `pnpm publish --variant-integrity <target>=<integrity>` then publishes the version from archives that other jobs uploaded. With `--recursive`, each value names its package as `<name>~<target>=<integrity>`.\r\n\r\n- `pnpm publish -r --batch` now uploads each package archive on its own request and skips archives the registry already holds, so the batch request no longer grows with the archives it publishes. A batch of more than 256 packages still carries every archive inline. Packages with `publishConfig.variants` can be published in a batch. A batch with variants that would reference more than 256 archives on one registry fails with `ERR_PNPM_BATCH_PUBLISH_TOO_MANY_ARCHIVES` [pnpm/tasks#244](https://github.com/pnpm/tasks/issues/244).\r\n\r\n- `pnpm publish --provenance` signs one statement that names every archive of a version with `publishConfig.variants`. A platform variant's archive is named by the version's package URL with a `variant` qualifier.\r\n\r\n- Rerunning `pnpm publish` after the version was already published now succeeds when the published version is the same release. pnpm compares the archives, the provenance statement when the rerun signs one, and the dist-tag. When the published version differs, the publish fails with `ERR_PNPM_PUBLISHED_RELEASE_DIFFERS`, which names what differs.\r\n\r\n- pnpm installs the platform variant of a package that fits the host, or the package's own archive when none does. The lockfile records every variant. A version published with variants only, "},"readme":true,"readme_zh":false,"news":[],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}