pnpm 12 Rewrites Its Package Manager Core in Rust, Cutting Warm Installs From 472ms to 15ms

Overview

pnpm 12, released August 26, according to the GitHub release notes, rewrites the JavaScript package manager’s implementation in Rust, replacing the TypeScript and Node.js codebase pnpm has run on to date. According to InfoQ, a repeated install with the cache, lockfile, and node_modules already warm dropped from 472 milliseconds to 15 milliseconds under the rewrite, while a clean install of pnpm’s file-heavy benchmark fixture fell from 8.2 seconds under the previous implementation to 5 seconds with Rust. As previously reported, pnpm 11 had already made supply-chain-hardening defaults like a 24-hour minimum release age standard; pnpm 12 keeps that behavior while targeting raw install speed instead.

What We Know

• pnpm maintainer Zoltan Kochan said of the decision to switch languages, “It was faster to rewrite pnpm in Rust than to migrate to ESM,” according to both InfoQ and Socket, which reported the same quote.
• Independent testing by Socket found that when Vercel upgraded its 21-project Turborepo workspace, which installs 1,670 packages, pnpm 12 reduced median install times by 64.4% to 90.5% compared with pnpm 10.28 across six combinations of warm and cold stores, existing and absent node_modules, and enabled or disabled lifecycle scripts. Those results came from 20 measured runs per version on the same Linux system, per Socket.
• The largest reduction in that testing came when node_modules was already present: 1.476 seconds fell to 142 milliseconds with a warm store, and 1.385 seconds fell to 141 milliseconds with a cold one, according to Socket. With both the store and node_modules absent and lifecycle scripts enabled, the median install time dropped from 9.850 seconds to 3.472 seconds.
• The tradeoff shows up at startup: pnpm 12’s native Corepack artifact is 47.3 MB, compared with 17.5 MB for pnpm 10.28, making an uncached Corepack startup 11.1% slower, Socket reported. Once cached, startup is 74.7% faster — a figure InfoQ independently reported as well.
• The combined pnpm store and node_modules footprint on Socket’s test system fell 52.5%, from 3.891 GB to 1.850 GB, according to Socket.
• Per the GitHub release notes, dependency cycles are now broken canonically during peer resolution, with members ordered by package ID, producing byte-identical lockfiles across repeated installs and reordered dependencies. On cycle-heavy workspaces, that change improves peer-resolution performance by 2 to 3 times, a figure Socket also cited alongside a roughly 25% reduction in memory use.
• The release notes also describe packageImportMethod: auto now trying hardlinks before cloning on Linux, roughly halving installation time for materializing node_modules on btrfs filesystems, and a change to git dependency handling: dependencies on GitHub, GitLab, or Bitbucket are now treated as identities rather than transport choices, so different URL formats for the same repository resolve through canonical HTTPS instead of being tracked separately, per the GitHub release notes.
• pnpm 12 removes the pnpm install --resolution-only flag, which the GitHub release notes say is replaced by pnpm peers check. The pnpm-workspace.yaml file can also no longer contain unrecognized settings; misspelled keys now trigger warnings or errors with correction suggestions.
• Despite the performance gains, InfoQ reported that the latest npm tag still points to pnpm 11, and Homebrew, winget, Scoop, and Chocolatey did not offer version 12 at launch.
• Reaction was mixed on the broader trend of JavaScript tooling moving to Rust. Darcy Clarke, described by Socket as a former npm CLI maintainer and the founder of vlt, said the shift “reflects Node.js developer-experience shortcomings and its slow progress on single-executable applications and foreign-function interfaces.” Frontend engineer Dennis Morello, InfoQ reported, characterized the release as a performance-focused major version bump where the everyday workflow stays familiar.

What We Don’t Know

Neither source specifies what fraction of pnpm 12’s codebase remains TypeScript or Node.js versus Rust, or a firm date for when Homebrew, winget, Scoop, and Chocolatey packages will catch up to version 12. Kochan’s comments, as relayed by Socket, indicate he no longer plans to publish head-to-head speed comparisons against other package managers beyond npm, so how pnpm 12 stacks up against alternatives like Bun’s package manager — also rewritten in Rust — was not addressed in the coverage reviewed here.