Zoltan Kochan

Has anyone moved from Github? what are the alternatives for open source?

I have some early benchmark results with my custom @pnpm.io registry. In different scenarios, overall install times are 2 to 7 times faster than even the already very fast pnpm in Rust. Looks promising.

Check this out

pnpm lead maintainer @kochan.io joined PodRocket to talk about pnpm 11: the 24-hour install rule, the new allow-builds config, the global virtual store, and what's coming in v12... including the highly anticipated Rust rewrite. YT: buff.ly/sUJL3H3 Apple: buff.ly/MIifAvK Spotify: buff.ly/heggcl9

pnpm + Git Worktrees for Multi-Agent Development pnpm.io/11.x/git-wor...

Therein lies the rub: AI cannot have “ideas” of its own. Every “idea” you thought AI had came from a person, either through prompting or theft. The way to jumpstart the “idea machine” is to have people focused less on survival and more on living passionately.

The Seattle Times is piloting pnpm’s client-side defenses—blocked lifecycle scripts, release cooldowns, and trust policy—to stop worms like Shai-Hulud 2.0 before they land. Read their story: pnpm.io/blog/2025/12...

Yet another reminder to use @pnpm.io's minimum dependency age. pnpm.io/settings#min...

🚀 pnpm v10.21 is out! This release introduces two powerful new security & compatibility features: 1️⃣ Automatic Node.js runtime installation for dependencies 2️⃣ Configurable trust policy for detecting supply-chain downgrades 🧵👇

pnpm 10.21: installing Node.js runtimes for dependencies, not installing dependencies with decreased trust levels, and more @kochan.io @pnpm.io pnpm.io/blog/release... #ECMAScript #JavaScript

Zoltan Kochan is a full stack web developer and the creator of @pnpm.io. He joins the show with @joshuakgoldberg.com to talk about the state of package management for web dev. @kochan.io softwareengineeringdaily.com/2025/09/18/p...

After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJS

Wow, Hollywood is so creative

I feel like pnpm will eventually grow from being a "npm alternative" to being a "nix alternative" but "pnix" doesn't sound appropriate 😂

With the changes to the lockfile format and the new types of fetchers that were added to pnpm, now it is really easy to make pnpm an installer for anything bsky.app/profile/pnpm...

when you open a service you've been using for a decade only to find it out it caught the virus

The pnpm repository has 32K stars!

Many packages request funding by printing message with postinstall scripts. What if instead of requesting funding we would promote sponsors? After all, we want companies to sponsor open source projects as they are the ones that make profit from it.

A lot of packages use postinstall scripts for printing out messages about funding. Could there be a better way to do this? pnpm doesn't even print the outputs from these scripts.

🚀 Check out what we’ve been building at Bit: Hope AI: Architect agent that builds professional software www.producthunt.com/products/hop...

@kochan.io's talk about configDependencies made me realize we forgot to document remote plugins on the Yarn website 🙈

Package manager summit with @kochan.io at #JSNation !

Ton of npm libs use github.com/cosmiconfig/... to load their config files. But, today I learned, if nodejs dies, the temporarily file created by cosmiconfig remains 🤷‍♂️ I fixed this locally in 5 mins thanks to the amazing patch ability of @pnpm.io (kudos @kochan.io!) and the LLMs era of code editors

So... I was working on making @pnpm.io a tad faster 😜 youtu.be/pNDFfJvaubY?...

I have copied over the list of trusted dependencies maintained by bun. So, you can use it with @pnpm.io if you want: github.com/pnpm/trusted...

I have searched Github for usages of "config dependencies". Found a single project for now: github.com/PSDTools/psd... This is a hook that removes polyfills from dependencies if they are not needed.

We’re excited to share that the @nodejs.org website (nodejs.org) now builds using @pnpm.io! This switch has led to faster CI builds and more efficient dependency management.

pnpm patch is a LIFE SAVER

I have improved the @pnpm.io "features comparison" page: pnpm.io/feature-comp...

New blog post! Let's categorize our deps better with @pnpm.io catalogs! antfu.me/posts/catego...

Now that we have a way to preload settings for @pnpm.io, maybe we could create standard config dependencies for specific stacks. Like "@pnpm/angular-defaults"

You can now add JSR packages with @yarnpkg.dev and @pnpm.io with `jsr:` specifier deno.com/blog/add-jsr...

Has anyone heard about DRPM? github.com/bnonni/drpm.... Thoughts? I would love to experiment with a decentralized registry. I think it could work great for open source projects. But I lack the knowledge.

pnpm v10.9 is out with native support for the JSR registry! You can now install packages from JSR using the "jsr:" protocol. For example: pnpm add jsr:@hono/hono

What is the difference between Verdaccio and Volt's registry? github.com/vltpkg/vsr

It would be nice if an LLM could help with writing "changesets" and detecting which of the changes are breaking and which are backward compatible. Currently I use exact versions to reference any packages from the same workspace as it is so hard to avoid mistakes.

It would be nice to be able to use underscore in semver versions. Like 10_24.0.0 would be same as 1024.0.0

Are you ready for require(esm) in Node v20 🥶🥶 github.com/nodejs/node/...

there will never be a dullest and pettiest supervillain