Project
pnpm is a fast, disk-space-efficient JavaScript package manager that uses a strict, symlinked node_modules layout to block access to undeclared dependencies.
A Claude Code sub-agent allegedly deleted about 48,218 files in 103 seconds after a Python remover followed Windows junctions out of its copy. The account is unverified, but the failure path is documented: a copy with links back to the original carries the original inside it.
Reality
pnpm, npm, Bun and Yarn can each refuse versions younger than a set age, using minutes, days, seconds and minutes respectively. Pasting pnpm's 1440 into npm makes the cooldown 1440 days, roughly 3.9 years.
Reality
Next.js will ship an out-of-band security update on October 14 for three upstream dependency vulnerabilities, two rated Critical and one High. Until then, the useful preparation is confirming which Next.js build each production app actually serves.
Reality
Redux Toolkit 2.13 adds official TypeScript 7 support and moves to a TSDown build, keeping its APIs unchanged from 2.12. The cost of upgrading is a TypeScript 5.6 floor plus bug fixes that change runtime results in edge cases.
Reality
postgres-js leaves a connection's row cursor set after a query fails mid-stream, so one team's LIMIT 500 query came back with 813 entries. With the one-line fix an open pull request since October 2025, pooled users have to patch the driver themselves.
Reality
Mrsaynothing.dev's author runs a newsletter on 1,258 self-written lines of TypeScript, Svelte and SQL built around RFC 8058's one-click unsubscribe headers. Signed links cover the compliance, while aligned DKIM, the cost of skipping a paid relay, is still missing.
Reality
September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.
Reality
Rulestack found a skill file that named a deleted pnpm script for 24 days while 28 commit-time shape tests passed. A 26-line check against package.json exits 1 on any missing name, so a hook can block the commit that deletes a referenced script.
Reality
TanStack's postmortem says 84 malicious versions went out across 42 packages on 2026-05-11 with no npm token stolen, because a release job restored a cache that an untrusted pull_request_target build had written.
Reality
The rule telling a Claude Code session to gloss its own jargon sat unchecked in the repository for 68 days. Making it executable cost the team a narrower rule and one tightened parser.
Reality
The check compared each source's date against the slot's planning label, so three swapped Bluesky posts cleared a 72-hour window and then sat in a queue that would not reach them for four to six days.
Reality
After counting 42 scheduled Bluesky posts in a week with five images, one team cut its poster's reach to a single committed directory and made the commit gate and the poster read media through the same hashing loader.
Reality
bol has run its Backstage platform for more than five years and switched to pnpm so coding agents could work in parallel worktrees. Then came a store path two systems disagreed on and 1.42 GB of cached node_modules that saved nothing.
Reality
The consultancy's own site sat on a framework it would not choose today, because a successful migration ends with nothing looking different. An agent shrank the mechanical work to a fortnight, and a review still found four bugs.
Reality
The IDE stays a Windows process while a small Linux-side agent does the file and process work. That is the fourth architecture JetBrains has tried for WSL, and the first one it names as the recommended entry point.
Reality
Three postures exist for an agent instruction file. Only the third holds at commit speed. The team running it watched its own CLAUDE.md reach 548KB before a context-measurement pass cut it to 34KB.
Reality
The override forced a patched vite into the tree with no ceiling, so pnpm took 8.1.4, vitest evaluated all 71 files and registered no suites, and 845 tests stopped running behind an honest error message.
Reality
The Rust rewrite keeps pnpm 11's commands and lockfile, so adopting it costs little more than pulling from the next-12 tag, but the headline percentage describes a 1.5-second install and the cold case improved by about two thirds.
Reality
One developer merged five shared repositories into a provider monorepo in June 2026. The load-bearing rule is that no shared package reads process.env, so values like table names arrive as arguments from whichever product is consuming them.
Reality
A dev.to post makes the pnpm decision arithmetic on workspace count, since npm can copy one shared devDependency once per package while pnpm keeps a single copy in a global store outside the project.
Reality