pnpm 12 audit is CPU-bound, not network-bound
pnpm audit got ~60x slower in 12.x and the fix starts with checking user CPU time, not the registry.
Today I Learned#pnpm#ci#debugging
Check pnpm view and advisory ranges before forcing a security override
Two commands, `pnpm view <pkg> dist-tags` and a GitHub advisory's affected ranges, show whether a security fix is backported to the major your consumers use, so an override stays patch-level instead of forcing a major bump.
Today I Learned#pnpm#supply-chain#renovateWhy pnpm audit --fix=update kept a vulnerable nanoid behind an auto-installed peer
A pnpm peer-resolution path dropped the update depth, retained nanoid 3.3.16, and made a full lockfile and node_modules refresh the clean no-override fix.
Development#pnpm#supply-chain#dependency-managementHow pnpm deploy --legacy left dangling workspace symlinks in our Docker image
Starting with pnpm 11.19 in our build, `pnpm deploy --legacy` left workspace dependencies linked to source directories that the runtime image did not contain.
Development#pnpm#docker#monorepoRemoving the brace-expansion patch after moving minimatch to v10
A recurring SyntaxError traced to a brace-expansion patch and an ESM export-shape mismatch: how moving minimatch to v10 removed one patch while a minimatch@3 compatibility patch remained necessary.
Development#pnpm#renovate#dependency-managementWhat Changed in pnpm Since 11.7 Until 11.13.1
Seven pnpm releases shipped between 11.7 and 11.13.1, and the one that maps to my config is a peak-memory fix for the minimumReleaseAge and trustPolicy resolution path.
Development#pnpm#supply-chain#securityDependency caching belongs at the registry layer, not the package store
Caching the package manager store treats a symptom. A pull-through proxy registry is the layer where cross-runner dependency caching actually compounds.
Development#caching#nexus#platform-engineeringReducing Renovate's blast radius: split groups, custom managers, and the temporal-polyfill lesson
A single broken dependency blocked 20 updates in one Renovate PR. Three config changes prevent it from happening again.
Development#renovate#pnpm#supply-chainDesigning a GitLab CI cache strategy for a polyglot monorepo on a self-hosted runner
Five cache mechanisms layered on a single self-hosted GitLab runner to keep a Java + Node + Python + React Native monorepo fast without standing up an external cache service.
Development#gitlab#ci#cachingWhy pnpm-lock.yaml belongs in .prettierignore
Renovate PRs fail CI when Prettier reformats the lockfile. The fix is one line.
Today I Learned#pnpm#prettier#ciSix ways a full root pnpm workspace broke my polyglot monorepo
Pulling four mature JS apps into one root pnpm workspace with a shared lockfile failed for six concrete reasons; here's the narrower shape that survived.
Development#pnpm#monorepo#migrationpnpm audit signatures: a 'terminated' reason is a network error, not tampering
When pnpm audit signatures flags a package as invalid with reason 'terminated', the packument HTTP fetch failed, not a signature failure or tampering.
Today I Learned#pnpm#npm#supply-chainCodifying a pnpm audit remediation SOP into an agent skill
After re-deriving the same pnpm audit remediation decision tree across five JS trees one too many times, I packaged it as an agent skill that runs the process instead of rediscovering it.
Development#pnpm#supply-chain#agentscorepack packagemanager drifts from mise.toml under renovate
Renovate updates mise.toml via the mise manager and packageManager via the npm manager. They land in different PRs. I treated that as defense-in-depth until they disagreed.
Today I Learned#mise#pnpm#renovateClosing Renovate's transitive-CVE blind spot
Renovate's vulnerability alerts only cover direct dependencies in npm and pip. Here is the CI-gate and manual-remediation pattern that catches the rest, and why I run Renovate without Dependabot.
Development#security#supply-chain#renovateSelf-Contained mise in Dagger: Eliminating Tool Version Drift
Committing a self-contained mise bootstrap, mounting persistent cache volumes in Dagger, and enforcing the lockfile everywhere so mise.toml is the only source of truth for the toolchain.
Development#mise#dagger#ciDagger's TypeScript SDK doesn't understand pnpm catalog:
Dagger modules install in isolation with a generated pnpm-workspace.yml that has no catalog. The project root's workspace file is never read.
Today I Learned#dagger#pnpm#ciUnifying a pnpm Monorepo's Dependency Versions with Catalog
Using pnpm catalog to turn two workspace packages with divergent TypeScript and ESLint versions into a single source of truth. Covers a Remotion peer-dep fix and a minimumReleaseAge interaction.
Development#pnpm#monorepo#dependency-managementWhat Changed in pnpm Since 11.1.2 Until 11.7.0
Six pnpm releases shipped while my project was frozen at 11.1.2. Two of them added security controls I should have adopted sooner.
Development#pnpm#supply-chain#securityUpgrading Payload CMS 3.85.0: from 12 audit vulns to zero
A systematic approach to eliminate every known vulnerability and replace pnpm monkey-patches with proper supply-chain configuration.
Development#payload-cms#pnpm#supply-chainHardening a Renovate Config for Supply Chain Security
Closing supply chain gaps in an existing Renovate setup with OSV scanning, SHA pin protection, and cooldown alignment complementing pnpm's minimumReleaseAge.
Development#security#supply-chain#renovateAutomated Dependency Updates with Supply Chain Security
How to set up Renovate or Dependabot with cooldown policies that complement pnpm's minimumReleaseAge: automated patches without opening the door to compromised packages.
Development#security#supply-chain#renovateKeeping Supply Chain Exclusions Honest
Your pnpm security config decays over time. minimumReleaseAgeExclude entries pile up, trustPolicyExclude entries become stale, and allowBuilds lists drift from reality. Here's how to catch it.
Development#security#supply-chain#pnpmSupply Chain Security with mise and pnpm
Trying to survive in the JS minefield
Development#security#supply-chain#mise