Node pnpm¶

ID: pnpm
Home page: https://pnpm.io
Version requirement: >= 11
Cooldown: ✓
Platforms: 🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove · cleanup
purl types: pkg:npm · pkg:pnpm
CLI name: pnpm
Issues and PRs: 📦 manager: npm-based
Source: meta_package_manager/managers/pnpm.py

A Node.js package manager with a content-addressable global store.

Like meta_package_manager.managers.npm.NPM, mpm drives pnpm in global mode (--global on every operation) and parses its --json output. Command equivalences with the sibling JS managers are listed in antfu-collective/ni.

Note

pnpm enforces a supply-chain cooldown through its minimumReleaseAge setting (counted in minutes), refusing to install any release published more recently than the configured age. The version floor is set by search, which first shipped in 11.0.0; that release also clears the earlier minimumReleaseAge floor, so one requirement guards every advertised operation.

Caution

pnpm outdated exits 1 when it finds outdated packages, printing the report to <stdout> with an empty <stderr>. The query passes must_succeed so this benign non-zero exit is tolerated instead of raising.

What `mpm` adds to `pnpm`¶

Through mpm, pnpm gains --exact search, to narrow results to exact names.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover pnpm alongside npm, volta, yarn, yarn-berry and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `pnpm` commands, in `mpm`¶

You already know pnpm: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `pnpm`	With `mpm`
List what’s installed	`pnpm list --global --json --depth 0`	`mpm --pnpm installed`
List outdated packages	`pnpm outdated --global --json`	`mpm --pnpm outdated`
Search for a package	`pnpm search --json is-positive`	`mpm --pnpm search is-positive`
Install a package	`pnpm add --global markdown`	`mpm install pkg:pnpm/markdown`
Upgrade one package	`pnpm update --global --latest markdown`	`mpm --pnpm upgrade markdown`
Upgrade everything	`pnpm update --global --latest`	`mpm --pnpm upgrade --all`
Remove a package	`pnpm remove --global markdown`	`mpm remove pkg:pnpm/markdown`
Clear caches	`pnpm store prune`	`mpm --pnpm cleanup --cache`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`orphans`
`search`	✓	exact search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`	✓
`doctor`

Selecting and configuring `pnpm`¶

Deselect pnpm for a single run with --no-pnpm, or persist the choice in your configuration:

[mpm]
pnpm = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.pnpm]
timeout = 900

mpm config-template pnpm prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around pnpm, one mpm command each:

Snapshot and clone a machine: mpm --pnpm dump pnpm.toml, then mpm restore pnpm.toml on the next one.
Export a compliance SBOM: mpm --pnpm sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

mpm natively enforces its release-age cooldown on Node pnpm, injecting the pnpm_config_minimum_release_age environment variable on every call. Point it at a window (mpm --cooldown 7 --pnpm upgrade --all) to skip anything published in the last 7 days: a guard against a compromised or yanked fresh release landing before anyone notices.

Status: ✅ Enforced (pnpm ≥ 11.0)
Mechanism: minimumReleaseAge env pnpm_config_minimum_release_age (minutes)
Reference: pnpm docs

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: npm registry (pkg:npm)
Retraction: Unpublish within 72 h of publishing, then only with no dependents, under 300 weekly downloads and a single owner (policy). Past that, flag only: npm deprecate warns on install but does not stop resolution
Publish date: ✅ time, mapping each version to its publication timestamp (packument)

Version probe¶

The version is extracted from the output of pnpm --version with:

r"(?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Node pnpm well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ pnpm list --global --json --depth 0
[
  {
    "name": "global",
    "dependencies": {
      "eslint": {
        "from": "eslint",
        "version": "9.15.0"
      },
      "typescript": {
        "from": "typescript",
        "version": "5.6.3"
      }
    }
  }
]

$ pnpm outdated --global --json
{
  "eslint": {
    "current": "9.10.0",
    "latest": "9.15.0",
    "wanted": "9.15.0",
    "isDeprecated": false,
    "dependencyType": "dependencies"
  }
}

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --pnpm installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

7.0.0 (2026-06-26)
- Add the pnpm package manager (installed, outdated, search, install, upgrade, remove, cleanup), enforcing --cooldown via pnpm’s native minimumReleaseAge gate.