As cited
Copy frozen at (site build).
industry
pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90%
pnpm 12 replaces the Node.js and TypeScript package manager with a Rust rewrite, maintaining backward compatibility with version 11 while reducing install times by up to 90% in production testing. The release adds supply chain security features including registry revisions, signed build artifacts, and deterministic lockfiles, alongside seven behavioral changes that may affect existing workflows. pnpm narrowed public performance claims after discovering benchmark bugs, now comparing only against npm and its prior JavaScript implementation rather than claiming superiority over Bun or Yarn.
Why it matters: Development teams using pnpm should evaluate the upgrade for substantial performance gains and new security controls such as signed artifacts and registry revisions, while testing for compatibility issues from the seven behavioral changes before rolling out to CI/CD pipelines.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
industry
pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90%
pnpm 12 replaces the Node.js and TypeScript package manager with a Rust rewrite, maintaining backward compatibility with version 11 while reducing install times by up to 90% in production testing. The release adds supply chain security features including registry revisions, signed build artifacts, and deterministic lockfiles, alongside seven behavioral changes that may affect existing workflows. pnpm narrowed public performance claims after discovering benchmark bugs, now comparing only against npm and its prior JavaScript implementation rather than claiming superiority over Bun or Yarn.
Why it matters: Development teams using pnpm should evaluate the upgrade for substantial performance gains and new security controls such as signed artifacts and registry revisions, while testing for compatibility issues from the seven behavioral changes before rolling out to CI/CD pipelines.
- Source published
- First seen by Cybersecurity Tracker