pnpm Wisdom

~9 min · pnpm, wisdom, production

Level 0Newbie

0 XP0/55 lessons0/16 achievements

0/80 XP to next level80 XP to go0% complete

pnpm trades a bit of compatibility surface for huge wins in disk and strictness. These rules keep the trade favorable.

Pin pnpm version with packageManager in package.json. Different pnpm versions can produce different lockfiles. Pinning eliminates 'works on my machine' caused by version drift.

Use --frozen-lockfile in CI. Same role as npm ci — strict, fast, fails on lockfile drift.

Run pnpm store prune occasionally. The global store accumulates packages no project references anymore. Pruning monthly reclaims gigabytes.

Allow lifecycle scripts only for trusted packages. v10 blocks lifecycle scripts by default — that's the right default. Use pnpm.allowedDeprecatedVersions and pnpm.onlyBuiltDependencies in package.json to opt-in for packages that genuinely need them (e.g. esbuild, sharp).

Embrace the strictness. When pnpm complains about a missing dep, fix the dep — don't fight pnpm. Every error pnpm catches is a future production bug avoided.

Code

Pin the pnpm version per project·json

// package.json
{
  "name": "my-project",
  "version": "0.1.0",
  "packageManager": "pnpm@10.0.0",
  "scripts": { "build": "vite build" },
  "pnpm": {
    "onlyBuiltDependencies": ["esbuild", "sharp"]
  }
}

GitHub Actions for pnpm·yaml

# .github/workflows/ci.yml
name: ci
on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile
      - run: pnpm test

External links

Exercise

Add 'packageManager: pnpm@<version>' to a project's package.json. Then update your CI workflow to use pnpm/action-setup@v4 and 'pnpm install --frozen-lockfile'. Confirm the build passes — you've now locked in the pnpm version across all environments.

Progress

Progress is local-only — sign in to sync across devices.

← PreviousContent-Addressable Store, Strict node_modules, Workspaces Next →Quiz · 5 questions

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.