pnpm

pnpm 12.17.0 adds pnpm peers check --global, :prod, :optional and :peer override selectors, and Cargo and Python updates in pnpm outdated, per its release notes.

Reporting on TypeScript 7, Vite 8, pnpm 12 and a Rust React Compiler shows native rewrites with large reported speedups, mostly from project benchmarks, and costs in size and compatibility.

Sources describe package-install delays appearing in pnpm, pip, Bundler, Dependabot and GitHub's firewall with differing defaults, alongside an LWN-reported dispute over cooldowns versus upload queues.

pnpm 12.12.0 shares pnpm pipeline task results through a remote cache and adds addMissingPeerTypes; 12.12.1 adds the tool: protocol and OIDC for pnpm dist-tag, per the release notes.

Astro 7.3.8 and companion packages replace direct esbuild use with Vite's Oxc transform and Rolldown, while create-astro stops writing pnpm install-script approvals.

pnpm 12 replaces the package manager's TypeScript/Node.js implementation with Rust, with independent Vercel Turborepo testing showing median install-time cuts of 64.4% to 90.5%.

pnpm 11's release candidate ships minimumReleaseAge=1 day, blockExoticSubdeps, and strictDepBuilds as defaults, baking lessons from the March 2026 Trivy and axios attacks into the package manager itself.