pnpm 12 Rewrites Package Manager in Rust, Accelerating Installs While Preserving pnpm 11 Workflows

pnpm 12 has been released, marking a significant rewrite of the package manager using Rust instead of TypeScript and Node.js. This shift maintains compatibility with pnpm 11 by preserving commands, flags, settings, lockfile format, and the node_modules layout. The primary goal was to enhance startup and filesystem performance without requiring teams to relearn the package manager or undergo a major migration process.

Initial bench tests show that a clean install of a file-heavy fixture dropped from 8.2 seconds to 5 seconds, while a repeated install with cache, lockfile, and node_modules warmed up dropped from 472 milliseconds to just 15 milliseconds. Independent production testing confirms these performance improvements, with Vercel's Turborepo workspace experiencing median install-time reductions ranging from 64.4% to 90.5% across six different scenarios.

However, larger native Corepack artifacts result in a slightly slower first uncached startup (11.1%), though cached startup improves by 74.7%. The npm tag remains unchanged, pointing to pnpm 11, and Homebrew, winget, Scoop, and Chocolatey still do not provide version 12 at launch. Alternative installation methods, including npm and standalone-script options, are available, even for environments without Node.js.

Migration from pnpm 11 is expected to be minimal, but teams should refer to pnpm's compatibility guide. A notable CI-breaking change is the removal of pnpm install --resolution-only, replaced by pnpm peers check. Git dependencies hosted on GitHub, GitLab, or Bitbucket now resolve through canonical HTTPS URLs, while private SSH access requires configuration through Git URL rewriting.

Linux versions of pnpm now prioritize hardlinks over reflinks, and unknown keys in pnpm-workspace.yaml are reported instead of silently being ignored. Additionally, project-aware global binaries have been introduced, which enable a globally installed Node.js, Deno, or Bun to follow the runtime pinned by the current project.

Furthermore, pnpm now handles cycles deterministically, resulting in byte-identical lockfiles and making peer resolution two to three times faster in cycle-heavy workspaces, while using about 25% less memory. Community reactions to the release have largely centered around the performance gains and their impact on workflow familiarity.

Some developers, like frontend engineer Dennis Morello, appreciate the performance improvements while acknowledging the familiar workflow. Former npm CLI maintainer Darcy Clarke argues that rewriting pnpm in Rust provides a more efficient way to improve shared internals compared to migrating to ECMAScript modules. In response, pnpm maintainer Zoltan Kochan contends that rewriting the package manager in Rust was faster than migrating to ECMAScript modules.

Some on HackerNews suggested that npm remains the best tool for Dennis, highlighting its stability and acceptable installation speed despite its slower performance. Others, however, expressed security concerns, stating that npm is the worst package manager among npm, pnpm, Yarn, and Bun. Pnpm continues to differentiate itself through its content-addressable store, strict dependency layout, and a native binary, while Bun still publishes faster results in its own benchmark suite.