Node pnpm¶

ID: pnpm
Links: Home page · Documentation · Repository · Wikipedia
Upstream stars: ⭐ 36,699
Last commit: 2026-09-29
Version requirement: >= 11
Cooldown: ✓
Platforms: 🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows
Operations: installed · outdated · search · install · upgrade · upgrade_all · remove · cleanup
purl types: pkg:npm/ · pkg:pnpm/
CLI name: pnpm
Issues and PRs: 📦 manager: npm-based
Source: pnpm.py

A Node.js package manager with a content-addressable global store.

Like meta_package_manager.managers.npm.NPM, mpm drives pnpm in global mode (--global on every operation) and parses its --json output. Command equivalences with the sibling JS managers are listed in antfu-collective/ni.

Note

pnpm enforces a supply-chain cooldown through its minimumReleaseAge setting (counted in minutes), refusing to install any release published more recently than the configured age. The version floor is set by search, which first shipped in 11.0.0; that release also clears the earlier minimumReleaseAge floor, so one requirement guards every advertised operation.

What `mpm` adds to `pnpm`¶

Through mpm, pnpm gains --exact search, to narrow results to exact names.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover pnpm alongside bun, npm, volta, yarn, yarn-berry and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `pnpm` commands, in `mpm`¶

You already know pnpm: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `pnpm`	With `mpm`
List what’s installed	`pnpm list --global --json --depth 0`	`mpm --pnpm installed`
List outdated packages	`pnpm outdated --global --json`	`mpm --pnpm outdated`
Search for a package	`pnpm search --json is-positive`	`mpm --pnpm search is-positive`
Install a package	`pnpm add --global markdown`	`mpm install pkg:pnpm/markdown`
Upgrade one package	`pnpm update --global --latest markdown`	`mpm --pnpm upgrade markdown`
Upgrade everything	`pnpm update --global --latest`	`mpm --pnpm upgrade --all`
Remove a package	`pnpm remove --global markdown`	`mpm remove pkg:pnpm/markdown`
Clear caches	`pnpm store prune`	`mpm --pnpm cleanup --cache`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✅
`outdated`	✅
`orphans`
`search`	✅	Exact search backfilled by `mpm`.
`install`	✅
`upgrade`	✅
`upgrade_all`	✅
`remove`	✅
`sync`
`cleanup`	✅
`doctor`

Configuration¶

Ignore pnpm on the mpm CLI by passing the --no-pnpm option.
Ignore it for every run in your configuration:
```
[mpm]
pnpm = false
```
Raise the timeout of all pnpm calls:
```
[mpm.overrides.pnpm]
timeout = 900
```

Run mpm config-template pnpm to print all overridable settings for your configuration file:

[mpm.overrides.pnpm]
cli_names = [
    "pnpm",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = []
pre_cmds = []
requirement = ">=11.0.0"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "--version",
]
version_regexes = [
    "(?P<version>\\S+)",
]

Recipes¶

A few jobs you would otherwise script around pnpm, one mpm command each:

Snapshot and clone a machine: mpm --pnpm dump pnpm.toml, then mpm restore pnpm.toml on the next one.
Export a compliance SBOM: mpm --pnpm sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown¶

mpm natively enforces its release-age cooldown on Node pnpm, injecting the pnpm_config_minimum_release_age environment variable on every call. Point it at a window (mpm --cooldown 7 --pnpm upgrade --all) to skip anything published in the last 7 days: a guard against a compromised or yanked fresh release landing before anyone notices.

Status: ✅ Enforced (pnpm ≥ 11.0)
Mechanism: minimumReleaseAge env pnpm_config_minimum_release_age (minutes)
Reference: pnpm docs

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: npm registry (pkg:npm)
Retraction: Unpublish within 72 h of publishing, then only with no dependents, under 300 weekly downloads and a single owner (policy). Past that, flag only: npm deprecate warns on install but does not stop resolution
Publish date: ✅ time, mapping each version to its publication timestamp (packument)

Reference traces¶

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know Node pnpm well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ pnpm list --global --json --depth 0
[
  {
    "name": "global",
    "dependencies": {
      "eslint": {
        "from": "eslint",
        "version": "9.15.0"
      },
      "typescript": {
        "from": "typescript",
        "version": "5.6.3"
      }
    }
  }
]

$ pnpm outdated --global --json
{
  "eslint": {
    "current": "9.10.0",
    "latest": "9.15.0",
    "wanted": "9.15.0",
    "isDeprecated": false,
    "dependencyType": "dependencies"
  }
}

Version check¶

The version is extracted from the output of pnpm --version with:

r"(?P<version>\S+)"

Upstream project¶

Metrics	`pnpm/pnpm`
Activity
Popularity
Metadata

Changelog¶

7.0.0 (2026-06-26)
- Add the pnpm package manager (installed, outdated, search, install, upgrade, remove, cleanup), enforcing --cooldown via pnpm’s native minimumReleaseAge gate.