pnpm-plus

pnpm without the five pain points.

pnpm-plus is a community-maintained build of pnpm that flips five defaults that the wider community has loudly objected to. Every behaviour is still configurable, but the new defaults line up with how real-world teams actually install packages.

The five pain points that are gone by default:

1. Lifecycle scripts are not blocked. dangerously-allow-all-builds: true so packages like bcrypt and esbuild keep compiling native binaries on pnpm install. You can still set it back to false per project.
2. minimumReleaseAge is off. No more "frozen" 1-day cutoff that breaks pnpm update, and the strict-by-default toggle that exploded on immature transitive deps has been removed.
3. engineStrict and verify-deps-before-run are off. You can keep using Node 18/20/22 in a corporate fleet without pnpm install failing on the engine field of an unrelated dependency.
4. Peer dependencies are loose. strict-peer-dependencies: false and auto-install-peers: true so React 18 and React 19 micro-frontends can coexist in a pnpm monorepo without manually tuning pnpm.peerDependencyRules.
5. Pacquet (Rust rewrite) is opt-in. pnpm-plus stays on the JS resolver/install path by default. Add configDependencies: { pacquet: ... } to pnpm-workspace.yaml if you want to try the Rust engine.

The product surface, CLI commands, and file formats are identical to upstream pnpm. Drop-in replacement.

Install

# From GitHub Releases (recommended)
curl -fsSL https://raw.githubusercontent.com/TheAstrayDev/pnpm-plus/main/install.sh | sh

The installer puts pnpm-plus (and a pnpm shim) into ~/.local/bin.

Quick start

pnpm-plus install
pnpm-plus add react
pnpm-plus test
pnpm-plus dlx create-vite my-app

pnpm-plus accepts every CLI flag that pnpm does. The only difference is the default values listed above.

What changed versus upstream

The defaults that were modified live in pnpm11/config/reader/src/index.ts:

- 'dangerously-allow-all-builds': false,
+ 'dangerously-allow-all-builds': true,
- 'minimum-release-age': 24 * 60,
- 'minimum-release-age-ignore-missing-time': true,
+ 'minimum-release-age': 0,
+ 'minimum-release-age-strict': false,
+ 'minimum-release-age-ignore-missing-time': true,
- 'verify-deps-before-run': 'install',
+ 'verify-deps-before-run': false,
- 'block-exotic-subdeps': true,
+ 'block-exotic-subdeps': false,

The auto-strict block that silently flipped minimumReleaseAge into strict mode is also removed. See CHANGELOG.md for the full list.

Compatibility

• Same lockfile format as pnpm.
• Same package.json and pnpm-workspace.yaml fields as pnpm.
• Same engine support as upstream pnpm (Node 18+ for installing projects; building pnpm-plus itself requires Node 22.13+ because that is the upstream monorepo's policy).

Maintenance

This is a focused fork: it tracks pnpm/pnpm for bug fixes, but the defaults are patched to match the five pain points above. Bug reports about behaviour that is unchanged from upstream pnpm should ideally be filed at https://github.com/pnpm/pnpm/issues; everything else is welcome here.

License

MIT. See LICENSE.