Sign in

Zoltan Kochan

@kochan.io
2.1K followers 181 following 158 posts

Developer, maker of @pnpm.io Works on dependency management at bit.dev

PostsRepliesMedia
Zoltan Kochan @kochan.io · 17/08/2026
Has anyone moved from Github? what are the alternatives for open source?
120
Zoltan Kochan @kochan.io · 07/06/2026
I have some early benchmark results with my custom @pnpm.io registry. In different scenarios, overall install times are 2 to 7 times faster than even the already very fast pnpm in Rust. Looks promising.
2636
Zoltan Kochan @kochan.io · 26/05/2026
Check this out
3503
Reposted by Zoltan Kochan
PodRocket Podcast @podrocket.bsky.social · 19/05/2026
pnpm lead maintainer @kochan.io joined PodRocket to talk about pnpm 11: the 24-hour install rule, the new allow-builds config, the global virtual store, and what's coming in v12... including the highly anticipated Rust rewrite. YT: buff.ly/sUJL3H3 Apple: buff.ly/MIifAvK Spotify: buff.ly/heggcl9
041
Reposted by Zoltan Kochan
pnpm @pnpm.io · 13/03/2026
pnpm + Git Worktrees for Multi-Agent Development pnpm.io/11.x/git-wor...
pnpm.io
pnpm + Git Worktrees for Multi-Agent Development | pnpm
When multiple AI agents need to work on the same monorepo simultaneously, they each need an isolated working copy with fully functional nodemodules. Git worktrees combined with pnpm's global virtual s...
1398
Reposted by Zoltan Kochan
Party Like It’s 1939 @symfonikz.blacksky.app · 16/12/2025
Therein lies the rub: AI cannot have “ideas” of its own. Every “idea” you thought AI had came from a person, either through prompting or theft. The way to jumpstart the “idea machine” is to have people focused less on survival and more on living passionately.
42218
Reposted by Zoltan Kochan
pnpm @pnpm.io · 08/12/2025
The Seattle Times is piloting pnpm’s client-side defenses—blocked lifecycle scripts, release cooldowns, and trust policy—to stop worms like Shai-Hulud 2.0 before they land. Read their story: pnpm.io/blog/2025/12...
pnpm.io
How We're Protecting Our Newsroom from npm Supply Chain Attacks | pnpm
We got lucky with Shai-Hulud 2.0.
1163
Reposted by Zoltan Kochan
Piotrek Koszuliński @pkoszulinski.bsky.social · 24/11/2025
Yet another reminder to use @pnpm.io's minimum dependency age. pnpm.io/settings#min...
1124
Reposted by Zoltan Kochan
pnpm @pnpm.io · 10/11/2025
🚀 pnpm v10.21 is out! This release introduces two powerful new security & compatibility features: 1️⃣ Automatic Node.js runtime installation for dependencies 2️⃣ Configurable trust policy for detecting supply-chain downgrades 🧵👇
1589
Reposted by Zoltan Kochan
ECMAScript.News @ecmascript.news · 10/11/2025
pnpm 10.21: installing Node.js runtimes for dependencies, not installing dependencies with decreased trust levels, and more @kochan.io @pnpm.io pnpm.io/blog/release... #ECMAScript #JavaScript
pnpm.io
pnpm 10.21 | pnpm
Added support for Node.js runtime installation for dependencies and a setting for configuring trust policy.
073
Reposted by Zoltan Kochan
Software Engineering Daily @softwaredaily.bsky.social · 18/09/2025
Zoltan Kochan is a full stack web developer and the creator of @pnpm.io. He joins the show with @joshuakgoldberg.com to talk about the state of package management for web dev. @kochan.io softwareengineeringdaily.com/2025/09/18/p...
softwareengineeringdaily.com
pnpm with Zoltan Kochan - Software Engineering Daily
Traditional package management systems for JavaScript have faced several inefficiencies related to dependency storage, resolution, and project performance. pnpm is a fast, disk-efficient package manag...
1205
Reposted by Zoltan Kochan
Socket @socket.dev · 15/09/2025
After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJS
socket.dev
pnpm 10.16 Adds New Setting for Delayed Dependency Updates -...
pnpm's new minimumReleaseAge setting delays package updates to prevent supply chain attacks, with other tools like Taze and NCU following suit.
0188
Zoltan Kochan @kochan.io · 15/09/2025
Wow, Hollywood is so creative
020
Zoltan Kochan @kochan.io · 31/07/2025
I feel like pnpm will eventually grow from being a "npm alternative" to being a "nix alternative" but "pnix" doesn't sound appropriate 😂
3171
Zoltan Kochan @kochan.io · 31/07/2025
With the changes to the lockfile format and the new types of fetchers that were added to pnpm, now it is really easy to make pnpm an installer for anything bsky.app/profile/pnpm...
0172
Reposted by Zoltan Kochan
Alex Strook 🐭⚡️SQUEAKROSS @alexstrook.bsky.social · 05/07/2025
when you open a service you've been using for a decade only to find it out it caught the virus
Fake website servic welcome page. text reads:

"Your favorite tool is now ruined by AI"
"you might not like it but shareholders love it"
61154795961
Reposted by Zoltan Kochan
pnpm @pnpm.io · 03/07/2025
The pnpm repository has 32K stars!
A star, the number 32000 and the pnpm logo
2251
Zoltan Kochan @kochan.io · 27/06/2025
I am thinking about a better name for the pnpm "virtual store". Which is where the dependency is written with its unique dependency graph. I couldn't find any prior art to this. Maybe "Package Context" could work. Or "fully resolved package store" but that's long.
430
Zoltan Kochan @kochan.io · 26/06/2025
Many packages request funding by printing message with postinstall scripts. What if instead of requesting funding we would promote sponsors? After all, we want companies to sponsor open source projects as they are the ones that make profit from it.
241
Zoltan Kochan @kochan.io · 25/06/2025
A lot of packages use postinstall scripts for printing out messages about funding. Could there be a better way to do this? pnpm doesn't even print the outputs from these scripts.
020
Zoltan Kochan @kochan.io · 25/06/2025
🚀 Check out what we’ve been building at Bit: Hope AI: Architect agent that builds professional software www.producthunt.com/products/hop...
producthunt.com
Hope AI: Architect agent that builds professional software | Product Hunt
Build maintainable, production-grade applications. Control generation at component-level with prompts and design sketches. Compose with design system and reusable components. Deploy instantly. Generat...
040
Reposted by Zoltan Kochan
Maël Nison @mael.dev · 12/06/2025
@kochan.io's talk about configDependencies made me realize we forgot to document remote plugins on the Yarn website 🙈
021
Reposted by Zoltan Kochan
Maël Nison @mael.dev · 12/06/2025
Package manager summit with @kochan.io at #JSNation !
Me and Zoltan
1213
Reposted by Zoltan Kochan
Anton Stoychev @stoychev.dev · 03/06/2025
Ton of npm libs use github.com/cosmiconfig/... to load their config files. But, today I learned, if nodejs dies, the temporarily file created by cosmiconfig remains 🤷‍♂️ I fixed this locally in 5 mins thanks to the amazing patch ability of @pnpm.io (kudos @kochan.io!) and the LLMs era of code editors
github.com
GitHub - cosmiconfig/cosmiconfig: Find and load configuration from a package.json property, rc file, TypeScript module, and more!
Find and load configuration from a package.json property, rc file, TypeScript module, and more! - cosmiconfig/cosmiconfig
031
Zoltan Kochan @kochan.io · 03/06/2025
So... I was working on making @pnpm.io a tad faster 😜 youtu.be/pNDFfJvaubY?...
youtu.be
A short demo of pnpm's speed with a new experimental option
YouTube video by pnpm
1646
Zoltan Kochan @kochan.io · 16/05/2025
I have copied over the list of trusted dependencies maintained by bun. So, you can use it with @pnpm.io if you want: github.com/pnpm/trusted...
github.com
GitHub - pnpm/trusted-deps
Contribute to pnpm/trusted-deps development by creating an account on GitHub.
072
Zoltan Kochan @kochan.io · 06/05/2025
I have searched Github for usages of "config dependencies". Found a single project for now: github.com/PSDTools/psd... This is a hook that removes polyfills from dependencies if they are not needed.
github.com
010
Reposted by Zoltan Kochan
Aviv Keller @aviv.sh · 03/05/2025
We’re excited to share that the @nodejs.org website (nodejs.org) now builds using @pnpm.io! This switch has led to faster CI builds and more efficient dependency management.
nodejs.org
Node.js — Run JavaScript Everywhere
Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine.
2344
Reposted by Zoltan Kochan
Wes Bos @wesbos.com · 01/05/2025
pnpm patch is a LIFE SAVER
6664
Zoltan Kochan @kochan.io · 01/05/2025
I am wondering if we should always use some custom protocols like "kahuna:" when the registry is not the public npm registry. So package.json would get something like this:
230
Zoltan Kochan @kochan.io · 30/04/2025
I have improved the @pnpm.io "features comparison" page: pnpm.io/feature-comp...
pnpm.io
Feature Comparison | pnpm
| Feature |pnpm |Yarn |npm | Notes |
1180
Reposted by Zoltan Kochan
Anthony Fu @antfu.me · 28/04/2025
New blog post! Let's categorize our deps better with @pnpm.io catalogs! antfu.me/posts/catego...
antfu.me
Categorize Your Dependencies
1511516
Zoltan Kochan @kochan.io · 29/04/2025
Now that we have a way to preload settings for @pnpm.io, maybe we could create standard config dependencies for specific stacks. Like "@pnpm/angular-defaults"
061
Reposted by Zoltan Kochan
JSR @jsr.io · 25/04/2025
You can now add JSR packages with @yarnpkg.dev and @pnpm.io with `jsr:` specifier deno.com/blog/add-jsr...
deno.com
Add JSR packages with pnpm and Yarn
You can now access JSR packages via pnpm and Yarn. Here's how.
410317
Zoltan Kochan @kochan.io · 25/04/2025
Has anyone heard about DRPM? github.com/bnonni/drpm.... Thoughts? I would love to experiment with a decentralized registry. I think it could work great for open source projects. But I lack the knowledge.
github.com
GitHub - bnonni/drpm.tools: Decentralized Registry Package Manager (DRPM)
Decentralized Registry Package Manager (DRPM). Contribute to bnonni/drpm.tools development by creating an account on GitHub.
110
Reposted by Zoltan Kochan
pnpm @pnpm.io · 21/04/2025
pnpm v10.9 is out with native support for the JSR registry! You can now install packages from JSR using the "jsr:" protocol. For example: pnpm add jsr:@hono/hono
413729
Zoltan Kochan @kochan.io · 27/03/2025
Every single Steven Seagal movie has a bigger IMDb score than "Snow White".
120
Zoltan Kochan @kochan.io · 19/03/2025
What is the difference between Verdaccio and Volt's registry? github.com/vltpkg/vsr
github.com
GitHub - vltpkg/vsr: a minimal npm-compatible package registry
a minimal npm-compatible package registry. Contribute to vltpkg/vsr development by creating an account on GitHub.
120
Zoltan Kochan @kochan.io · 17/03/2025
It would be nice if an LLM could help with writing "changesets" and detecting which of the changes are breaking and which are backward compatible. Currently I use exact versions to reference any packages from the same workspace as it is so hard to avoid mistakes.
130
Zoltan Kochan @kochan.io · 09/03/2025
It would be nice to be able to use underscore in semver versions. Like 10_24.0.0 would be same as 1024.0.0
020
Reposted by Zoltan Kochan
Marco Ippolito @marcoippolito.dev · 06/03/2025
Are you ready for require(esm) in Node v20 🥶🥶 github.com/nodejs/node/...
github.com
v20.19.0 proposal by marco-ippolito · Pull Request #57349 · nodejs/node
2025-03-13, Version 20.19.0 'Iron' (LTS), @marco-ippolito Notable Changes require(esm) is now enabled by default Support for loading native ES modules using require() had been available on ...
2276
Reposted by Zoltan Kochan
patak @patak.cat · 22/02/2025
there will never be a dullest and pettiest supervillain
2212
Reposted by Zoltan Kochan
Antoine du Hamel @aduh95.bsky.social · 11/02/2025
Node.js 22.14.0 is out, the first LTS release that includes the Corepack patch that fixes the "Cannot find matching keyid" error that has been impacting pnpm users recently. Full changelog and download info at nodejs.org/en/blog/rele...
nodejs.org
Node.js — Node v22.14.0 (LTS)
Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine.
15212
Zoltan Kochan @kochan.io · 07/02/2025
Is anyone using the Fibonacci sequence for major version numbers?
160
Zoltan Kochan @kochan.io · 07/02/2025
I remember how every website and blog had a comment section in the past. Looks like those times are over. There were even popular discussion widgets like "disqus".
170
Zoltan Kochan @kochan.io · 29/01/2025
I understand that some protestware can be harmful, but I don’t see why a simple console message is reported by @socket.dev. Some dependencies print messages about funding—printing a message against war doesn’t seem any more harmful than that. I do not like this at all.
0120
Zoltan Kochan @kochan.io · 13/01/2025
Does the npm registry rate limit by user agent? I am getting a lot of reports of 429 errors while installing with pnpm v9.15.3 and they say downgrading to v9.15.2 helps. But I don't see any changes between the two versions that could cause the issue.
040
Zoltan Kochan @kochan.io · 29/12/2024
I welcome any additional reviews on this PR. Especially regarding naming. I chose the name "pnpm.configDependencies" but maybe there are better names? bootDependencies, prepareDependencies, setupDependencies, initDependencies bsky.app/profile/pnpm...
1101
Zoltan Kochan @kochan.io · 28/12/2024
If you’re like me and use your terminal for everything, check out Ghostty—it’s top-notch! ghostty.org
ghostty.org
Ghostty
Ghostty is a fast, feature-rich, and cross-platform terminal emulator that uses platform-native UI and GPU acceleration.
0120