pnpm 12 rewrites core in Rust while keeping pnpm 11 commands and formats

pnpm 12 replaces its TypeScript and Node.js internals with a native Rust binary. The change targets startup latency and filesystem overhead, particularly when caches or node_modules already exist. Teams can update without relearning commands, flags, or configuration formats, as the release deliberately preserves pnpm 11’s workflows. The rewrite does not alter the content-addressable store or the strict dependency layout that distinguish pnpm from npm and Yarn.

Performance gains are most visible in warm-cache scenarios. Benchmarks show a clean install of a file-heavy fixture dropping from 8.2 seconds to 5 seconds, while a repeated install with warm cache and lockfile falls from 472 milliseconds to 15 milliseconds. Independent testing on a 1,670-package workspace recorded install-time reductions of 64.4% to 90.5%. The tradeoff is a larger Corepack artifact, which makes the first uncached startup 11.1% slower, although cached startup improves by 74.7%.

Migration is intended to be minimal, but teams should review the compatibility guide. The most likely CI-breaking change is the removal of `pnpm install --resolution-only`, replaced by `pnpm peers check`. Git dependencies now resolve through canonical HTTPS URLs, and private SSH access requires Git URL rewriting. Linux now tries hardlinks before reflinks, and unknown keys in pnpm-workspace.yaml are reported instead of silently ignored. Project-aware global binaries allow a globally installed runtime to follow the version pinned by the current project.

Community reaction highlights the performance gains while noting the tradeoffs. Some engineers argue that the rewrite was faster than migrating to ESM, while others prefer npm’s stability and ubiquity. Security concerns around npm’s lifecycle scripts and default behavior continue to drive adoption of pnpm. The release positions pnpm as a faster alternative to npm and Yarn, while Bun remains the fastest in its own benchmarks.