pnpm has released pnpm 12, replacing its TypeScript and Node.js implementation with a native Rust rewrite while deliberately retaining pnpm 11’s commands, flags, settings, lockfile format, and node_modules layout. The release targets startup and filesystem overhead without asking teams to relearn the package manager or undertake a broad migration.

The performance improvements are most pronounced when caches or node_modules already exist. In pnpm’s regularly updated benchmarks, a clean install of its file-heavy fixture fell from 8.2 seconds under the previous implementation to 5 seconds with Rust. A repeated install with the cache, lockfile, and node_modules warm dropped from 472 milliseconds to 15 milliseconds.

Independent production testing offers further evidence. Socket reported that Vercel’s 21-project Turborepo workspace, containing 1,670 packages, recorded median install-time reductions of 64.4% to 90.5% across six scenarios. However, the native Corepack artifact was larger, making its first uncached startup 11.1% slower, although cached startup improved by 74.7%.

Developers can install the release using:

pnpm self-update next-12

The latest npm tag still points to pnpm 11, and Homebrew, winget, Scoop, and Chocolatey did not offer version 12 at launch. The installation guide also provides npm and standalone-script options, including installation without Node.js.

Migration is intended to be limited, but teams should review pnpm’s compatibility guide. The most likely CI-breaking change is removal of pnpm install --resolution-only, now replaced by pnpm peers check. Git dependencies hosted on GitHub, GitLab, or Bitbucket resolve through canonical HTTPS URLs, while private SSH access should be configured through Git URL rewriting. Linux now tries hardlinks before reflinks, and unknown keys in pnpm-workspace.yaml are reported instead of silently ignored.

The release also introduces project-aware global binaries. A globally installed Node.js, Deno, or Bun can follow the runtime pinned by the current project. pnpm can provision npm, Yarn, and Bun itself, including the package manager requested by a Git-hosted dependency. Deterministic cycle handling also produces byte-identical lockfiles and, according to the release notes, makes peer resolution two to three times faster in cycle-heavy workspaces while using about 25% less memory.

Community reaction has focused on native-tooling performance and its tradeoffs. Frontend engineer Dennis Morello described the release as a performance release wearing a major version number, highlighting that the visible workflow remains familiar. In a discussion covered by Socket, former npm CLI maintainer Darcy Clarke argued that keeping package managers in JavaScript makes shared internals easier to improve, while pnpm maintainer Zoltan Kochan responded: It was faster to rewrite pnpm in Rust than to migrate to ESM.

On HackerNews, one commenter suggested that for them, npm is the best tool:

I got to the conclusion that boring is good enough, for me NPM is the best tool, is not that fast, but the installation speed is not that bad, considering how many times I need to run from scratch, the difference does not matter, it is stable and it's the default Node package manager, so I don't need to bother to install in CI any other tool, etc…

To which others pointed out security as a concern for using npm, and pnpm is a better alternative:

Describing NPM as boring is a stretch. Given its security model, i think spicy is a far more apt label.
I have switched to pnpm already.

Npm likes to run package lifecycle scripts of your dependencies by default. You have to explicitly opt out of this.
It’s probably the worst package manager out of npm, pnpm, yarn, and bun.

Against npm, Yarn, and Bun, pnpm continues to differentiate through its content-addressable store, strict dependency layout, and now a native binary. Bun still publishes faster results in its own benchmark suite, but pnpm removed Bun and Yarn from its public comparison after benchmark-harness problems made broad rankings unreliable. 

pnpm is an open-source JavaScript package manager created by Zoltan Kochan. It shares packages across projects through a content-addressable store and hardlinks, reducing duplicated files while enforcing dependency declarations more strictly than conventional flat node_modules layouts.