Node pnpm¶

A Node.js package manager with a content-addressable global store.

Like meta_package_manager.managers.npm.NPM, mpm drives pnpm in global mode (--global on every operation) and parses its --json output. Command equivalences with the sibling JS managers are listed at https://github.com/antfu-collective/ni?tab=readme-ov-file#ni.

Note

pnpm enforces a supply-chain cooldown through its minimumReleaseAge setting (counted in minutes), refusing to install any release published more recently than the configured age. The version floor is set by search, which first shipped in 11.0.0; that release also clears the earlier minimumReleaseAge floor, so one requirement guards every advertised operation.

Caution

pnpm outdated exits 1 when it finds outdated packages, printing the report to <stdout> with an empty <stderr>. The query passes must_succeed so this benign non-zero exit is tolerated instead of raising.

Home page: https://pnpm.io
Source: meta_package_manager/managers/pnpm.py
Version requirement: >=11.0.0

Platforms¶

🅱️ BSD
🐧 Linux
🍎 macOS
⨂ Unix
🪟 Windows

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`search`	✓	exact search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`	✓

Ecosystem¶

Accepted purl types: pkg:npm, pkg:pnpm

Usage¶

$ mpm --pnpm installed
$ mpm --pnpm search "query"
$ mpm --pnpm upgrade --all
$ mpm install pkg:pnpm/hello
$ mpm --dry-run --pnpm upgrade --all

Every example above accepts --dry-run, which simulates the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Deselect the manager for a single run with --no-pnpm, disable it from your configuration, or tune its invocation attributes with per-manager overrides.

Command line¶

CLI names, in lookup order: pnpm

The version is extracted from the output of pnpm --version with:

r"(?P<version>\S+)"

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

mpm natively enforces its release-age cooldown on Node pnpm, injecting the pnpm_config_minimum_release_age environment variable on every call.

Status: ✅ Enforced (pnpm ≥ 11.0)
Mechanism: minimumReleaseAge env pnpm_config_minimum_release_age (minutes)
Reference: pnpm docs

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Node pnpm well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ pnpm list --global --json --depth 0
[
  {
    "name": "global",
    "dependencies": {
      "eslint": {
        "from": "eslint",
        "version": "9.15.0"
      },
      "typescript": {
        "from": "typescript",
        "version": "5.6.3"
      }
    }
  }
]

$ pnpm outdated --global --json
{
  "eslint": {
    "current": "9.10.0",
    "latest": "9.15.0",
    "wanted": "9.15.0",
    "isDeprecated": false,
    "dependencyType": "dependencies"
  }
}