Zoltan Kochan @kochan.io · 17/08/2026Has anyone moved from Github? what are the alternatives for open source? 120
Zoltan Kochan @kochan.io · 07/06/2026I have some early benchmark results with my custom @pnpm.io registry. In different scenarios, overall install times are 2 to 7 times faster than even the already very fast pnpm in Rust. Looks promising. 2636
Reposted by Zoltan KochanPodRocket Podcast @podrocket.bsky.social · 19/05/2026pnpm lead maintainer @kochan.io joined PodRocket to talk about pnpm 11: the 24-hour install rule, the new allow-builds config, the global virtual store, and what's coming in v12... including the highly anticipated Rust rewrite. YT: buff.ly/sUJL3H3 Apple: buff.ly/MIifAvK Spotify: buff.ly/heggcl9 041
Reposted by Zoltan Kochanpnpm @pnpm.io · 13/03/2026pnpm + Git Worktrees for Multi-Agent Development pnpm.io/11.x/git-wor...pnpm.iopnpm + Git Worktrees for Multi-Agent Development | pnpmWhen multiple AI agents need to work on the same monorepo simultaneously, they each need an isolated working copy with fully functional nodemodules. Git worktrees combined with pnpm's global virtual s... 1398
Reposted by Zoltan KochanParty Like It’s 1939 @symfonikz.blacksky.app · 16/12/2025Therein lies the rub: AI cannot have “ideas” of its own. Every “idea” you thought AI had came from a person, either through prompting or theft. The way to jumpstart the “idea machine” is to have people focused less on survival and more on living passionately. 42218
Reposted by Zoltan Kochanpnpm @pnpm.io · 08/12/2025The Seattle Times is piloting pnpm’s client-side defenses—blocked lifecycle scripts, release cooldowns, and trust policy—to stop worms like Shai-Hulud 2.0 before they land. Read their story: pnpm.io/blog/2025/12...pnpm.ioHow We're Protecting Our Newsroom from npm Supply Chain Attacks | pnpmWe got lucky with Shai-Hulud 2.0. 1163
Reposted by Zoltan KochanPiotrek Koszuliński @pkoszulinski.bsky.social · 24/11/2025Yet another reminder to use @pnpm.io's minimum dependency age. pnpm.io/settings#min... 1124
Reposted by Zoltan Kochanpnpm @pnpm.io · 10/11/2025🚀 pnpm v10.21 is out! This release introduces two powerful new security & compatibility features: 1️⃣ Automatic Node.js runtime installation for dependencies 2️⃣ Configurable trust policy for detecting supply-chain downgrades 🧵👇 1589
Reposted by Zoltan KochanECMAScript.News @ecmascript.news · 10/11/2025pnpm 10.21: installing Node.js runtimes for dependencies, not installing dependencies with decreased trust levels, and more @kochan.io @pnpm.io pnpm.io/blog/release... #ECMAScript #JavaScriptpnpm.iopnpm 10.21 | pnpmAdded support for Node.js runtime installation for dependencies and a setting for configuring trust policy. 073
Reposted by Zoltan KochanSoftware Engineering Daily @softwaredaily.bsky.social · 18/09/2025Zoltan Kochan is a full stack web developer and the creator of @pnpm.io. He joins the show with @joshuakgoldberg.com to talk about the state of package management for web dev. @kochan.io softwareengineeringdaily.com/2025/09/18/p...softwareengineeringdaily.compnpm with Zoltan Kochan - Software Engineering DailyTraditional package management systems for JavaScript have faced several inefficiencies related to dependency storage, resolution, and project performance. pnpm is a fast, disk-efficient package manag... 1205
Reposted by Zoltan KochanSocket @socket.dev · 15/09/2025After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJSsocket.devpnpm 10.16 Adds New Setting for Delayed Dependency Updates -...pnpm's new minimumReleaseAge setting delays package updates to prevent supply chain attacks, with other tools like Taze and NCU following suit. 0188
Zoltan Kochan @kochan.io · 31/07/2025I feel like pnpm will eventually grow from being a "npm alternative" to being a "nix alternative" but "pnix" doesn't sound appropriate 😂 3171
Zoltan Kochan @kochan.io · 31/07/2025With the changes to the lockfile format and the new types of fetchers that were added to pnpm, now it is really easy to make pnpm an installer for anything bsky.app/profile/pnpm... 0172
Reposted by Zoltan KochanAlex Strook 🐭⚡️SQUEAKROSS @alexstrook.bsky.social · 05/07/2025when you open a service you've been using for a decade only to find it out it caught the virus 61154795961
Zoltan Kochan @kochan.io · 27/06/2025I am thinking about a better name for the pnpm "virtual store". Which is where the dependency is written with its unique dependency graph. I couldn't find any prior art to this. Maybe "Package Context" could work. Or "fully resolved package store" but that's long. 430
Zoltan Kochan @kochan.io · 26/06/2025Many packages request funding by printing message with postinstall scripts. What if instead of requesting funding we would promote sponsors? After all, we want companies to sponsor open source projects as they are the ones that make profit from it. 241
Zoltan Kochan @kochan.io · 25/06/2025A lot of packages use postinstall scripts for printing out messages about funding. Could there be a better way to do this? pnpm doesn't even print the outputs from these scripts. 020
Zoltan Kochan @kochan.io · 25/06/2025🚀 Check out what we’ve been building at Bit: Hope AI: Architect agent that builds professional software www.producthunt.com/products/hop...producthunt.comHope AI: Architect agent that builds professional software | Product HuntBuild maintainable, production-grade applications. Control generation at component-level with prompts and design sketches. Compose with design system and reusable components. Deploy instantly. Generat... 040
Reposted by Zoltan KochanMaël Nison @mael.dev · 12/06/2025@kochan.io's talk about configDependencies made me realize we forgot to document remote plugins on the Yarn website 🙈 021
Reposted by Zoltan KochanMaël Nison @mael.dev · 12/06/2025Package manager summit with @kochan.io at #JSNation ! 1213
Reposted by Zoltan KochanAnton Stoychev @stoychev.dev · 03/06/2025Ton of npm libs use github.com/cosmiconfig/... to load their config files. But, today I learned, if nodejs dies, the temporarily file created by cosmiconfig remains 🤷♂️ I fixed this locally in 5 mins thanks to the amazing patch ability of @pnpm.io (kudos @kochan.io!) and the LLMs era of code editorsgithub.comGitHub - cosmiconfig/cosmiconfig: Find and load configuration from a package.json property, rc file, TypeScript module, and more!Find and load configuration from a package.json property, rc file, TypeScript module, and more! - cosmiconfig/cosmiconfig 031
Zoltan Kochan @kochan.io · 03/06/2025So... I was working on making @pnpm.io a tad faster 😜 youtu.be/pNDFfJvaubY?...youtu.beA short demo of pnpm's speed with a new experimental optionYouTube video by pnpm 1646
Zoltan Kochan @kochan.io · 16/05/2025I have copied over the list of trusted dependencies maintained by bun. So, you can use it with @pnpm.io if you want: github.com/pnpm/trusted...github.comGitHub - pnpm/trusted-depsContribute to pnpm/trusted-deps development by creating an account on GitHub. 072
Zoltan Kochan @kochan.io · 06/05/2025I have searched Github for usages of "config dependencies". Found a single project for now: github.com/PSDTools/psd... This is a hook that removes polyfills from dependencies if they are not needed.github.com 010
Reposted by Zoltan KochanAviv Keller @aviv.sh · 03/05/2025We’re excited to share that the @nodejs.org website (nodejs.org) now builds using @pnpm.io! This switch has led to faster CI builds and more efficient dependency management.nodejs.orgNode.js — Run JavaScript EverywhereNode.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine. 2344
Zoltan Kochan @kochan.io · 01/05/2025I am wondering if we should always use some custom protocols like "kahuna:" when the registry is not the public npm registry. So package.json would get something like this: 230
Zoltan Kochan @kochan.io · 30/04/2025I have improved the @pnpm.io "features comparison" page: pnpm.io/feature-comp...pnpm.ioFeature Comparison | pnpm| Feature |pnpm |Yarn |npm | Notes | 1180
Reposted by Zoltan KochanAnthony Fu @antfu.me · 28/04/2025New blog post! Let's categorize our deps better with @pnpm.io catalogs! antfu.me/posts/catego...antfu.meCategorize Your Dependencies 1511516
Zoltan Kochan @kochan.io · 29/04/2025Now that we have a way to preload settings for @pnpm.io, maybe we could create standard config dependencies for specific stacks. Like "@pnpm/angular-defaults" 061
Reposted by Zoltan KochanJSR @jsr.io · 25/04/2025You can now add JSR packages with @yarnpkg.dev and @pnpm.io with `jsr:` specifier deno.com/blog/add-jsr...deno.comAdd JSR packages with pnpm and YarnYou can now access JSR packages via pnpm and Yarn. Here's how. 410317
Zoltan Kochan @kochan.io · 25/04/2025Has anyone heard about DRPM? github.com/bnonni/drpm.... Thoughts? I would love to experiment with a decentralized registry. I think it could work great for open source projects. But I lack the knowledge.github.comGitHub - bnonni/drpm.tools: Decentralized Registry Package Manager (DRPM)Decentralized Registry Package Manager (DRPM). Contribute to bnonni/drpm.tools development by creating an account on GitHub. 110
Reposted by Zoltan Kochanpnpm @pnpm.io · 21/04/2025pnpm v10.9 is out with native support for the JSR registry! You can now install packages from JSR using the "jsr:" protocol. For example: pnpm add jsr:@hono/hono 413729
Zoltan Kochan @kochan.io · 27/03/2025Every single Steven Seagal movie has a bigger IMDb score than "Snow White". 120
Zoltan Kochan @kochan.io · 19/03/2025What is the difference between Verdaccio and Volt's registry? github.com/vltpkg/vsrgithub.comGitHub - vltpkg/vsr: a minimal npm-compatible package registrya minimal npm-compatible package registry. Contribute to vltpkg/vsr development by creating an account on GitHub. 120
Zoltan Kochan @kochan.io · 17/03/2025It would be nice if an LLM could help with writing "changesets" and detecting which of the changes are breaking and which are backward compatible. Currently I use exact versions to reference any packages from the same workspace as it is so hard to avoid mistakes. 130
Zoltan Kochan @kochan.io · 09/03/2025It would be nice to be able to use underscore in semver versions. Like 10_24.0.0 would be same as 1024.0.0 020
Reposted by Zoltan KochanMarco Ippolito @marcoippolito.dev · 06/03/2025Are you ready for require(esm) in Node v20 🥶🥶 github.com/nodejs/node/...github.comv20.19.0 proposal by marco-ippolito · Pull Request #57349 · nodejs/node2025-03-13, Version 20.19.0 'Iron' (LTS), @marco-ippolito Notable Changes require(esm) is now enabled by default Support for loading native ES modules using require() had been available on ... 2276
Reposted by Zoltan Kochanpatak @patak.cat · 22/02/2025there will never be a dullest and pettiest supervillain 2212
Reposted by Zoltan KochanAntoine du Hamel @aduh95.bsky.social · 11/02/2025Node.js 22.14.0 is out, the first LTS release that includes the Corepack patch that fixes the "Cannot find matching keyid" error that has been impacting pnpm users recently. Full changelog and download info at nodejs.org/en/blog/rele...nodejs.orgNode.js — Node v22.14.0 (LTS)Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine. 15212
Zoltan Kochan @kochan.io · 07/02/2025Is anyone using the Fibonacci sequence for major version numbers? 160
Zoltan Kochan @kochan.io · 07/02/2025I remember how every website and blog had a comment section in the past. Looks like those times are over. There were even popular discussion widgets like "disqus". 170
Zoltan Kochan @kochan.io · 29/01/2025I understand that some protestware can be harmful, but I don’t see why a simple console message is reported by @socket.dev. Some dependencies print messages about funding—printing a message against war doesn’t seem any more harmful than that. I do not like this at all. 0120
Zoltan Kochan @kochan.io · 13/01/2025Does the npm registry rate limit by user agent? I am getting a lot of reports of 429 errors while installing with pnpm v9.15.3 and they say downgrading to v9.15.2 helps. But I don't see any changes between the two versions that could cause the issue. 040
Zoltan Kochan @kochan.io · 29/12/2024I welcome any additional reviews on this PR. Especially regarding naming. I chose the name "pnpm.configDependencies" but maybe there are better names? bootDependencies, prepareDependencies, setupDependencies, initDependencies bsky.app/profile/pnpm... 1101
Zoltan Kochan @kochan.io · 28/12/2024If you’re like me and use your terminal for everything, check out Ghostty—it’s top-notch! ghostty.orgghostty.orgGhosttyGhostty is a fast, feature-rich, and cross-platform terminal emulator that uses platform-native UI and GPU acceleration. 0120
