Glossary / pnpm

pnpm

pnpm is a JavaScript package manager that stores package content in a shared content-addressable store and links files into project installations. Its layout can reduce duplicate disk usage and expose undeclared dependency assumptions that may be hidden by broad hoisting; workspace and install behavior depend on pnpm version and configuration.

Storage, links, and strictness

pnpm fetches package files into a global store, then constructs a project's node_modules using links (typically hard links where possible) and symlinks. This is not simply one flat shared node_modules; Node's resolver follows symlink/layout rules, and pnpm has compatibility options for hoisting. Projects should declare every direct import in their own manifest rather than depending on accidental availability.

A workspace is rooted by pnpm-workspace.yaml. The workspace: protocol can require a local package instead of silently resolving a registry version. pnpm-lock.yaml captures the dependency graph and should be committed for reproducible installs. pnpm install --frozen-lockfile is commonly used in CI to reject lockfile changes.

Engineering considerations

Check native package build scripts, peer dependency rules, symlink behavior, and tools that assume flat node_modules. Use workspace filtering and recursive commands with clear scope. Pin pnpm version and avoid having multiple managers rewrite the same project. Store configuration such as hoisting in reviewed project settings; changing it can reveal or conceal dependency bugs.

Interview questions

  1. How does pnpm reduce duplication? It uses a shared content-addressable store and links package files into projects.
  2. What bug can strict layouts reveal? Undeclared dependencies that happened to resolve due to hoisting.
  3. What is workspace: useful for? Explicitly requiring an in-repository package dependency.
  4. What role does the lockfile play? Recording exact graph resolution for repeatable installs.
  5. What should be checked when migrating? Tool compatibility with symlinks, peer resolution, lifecycle scripts, and native builds.

References