Skip to content

v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Oct 23:19
· 22 commits to main since this release
v1.0.0
e6dd384

jpm 1.0.0: a fast, small, secure-by-default package manager for JavaScript, written in Rust. The
first release.

curl -fsSL https://getjpm.sh | sh                  # macOS and Linux
irm https://getjpm.sh/install.ps1 | iex              # Windows

Then jpm install in any npm, pnpm, yarn or bun project.

What it is

  • A drop-in. jpm install reads package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml,
    yarn.lock (yarn 1 and berry) or bun.lock, and writes jpm.lock with the same versions.
    Workspaces, overrides, patches, catalogs, git and directory dependencies included.
  • Fast. The fastest cold install of nuxt on GitHub's Linux runners: 1.22 s, against bun's
    1.28 s and pnpm's 1.72 s, and a no-op repeat in 2 ms.
    Every table, with CPU, memory
    and disk.
  • Small. One binary of about 2 MB: no runtime to install.
  • Secure by default. A dependency's install scripts don't run until you jpm approve that
    package and version. Versions published in the last day aren't picked. A published package
    can't pull in git or tarball dependencies. A project's own .npmrc can't turn off TLS checks
    or loosen those rules.
  • Two layouts. pnpm's isolated node_modules by default, with a global store that builds
    each package once for every project; npm's flat layout with node-linker=hoisted, which an
    Electron app gets on its own.
  • Tested against everyone else's tests: npm's, pnpm's, yarn's and bun's own test suites and
    lockfiles, Project Wycheproof for the crypto, and 166 large open-source projects, all of which
    install on Linux, macOS and Windows.

Every line of jpm was written by Claude Code, directed by one engineer. The story is in the
README.

Downloads

Platform File
Linux x64, arm64, armv7 (glibc 2.17 and later) jpm-linux-x64, jpm-linux-arm64, jpm-linux-armv7
Linux x64, arm64, armv7 (musl, static) jpm-linux-x64-musl, jpm-linux-arm64-musl, jpm-linux-armv7-musl
macOS Apple silicon, Intel jpm-darwin-arm64, jpm-darwin-x64
Windows x64, arm64 jpm-windows-x64.exe, jpm-windows-arm64.exe

SHA256SUMS lists every file's hash, and every file has signed build provenance:
gh attestation verify <file> --repo jtwebman/jpm
(verifying a release).

Docs

Install ·
Usage ·
Migrating ·
Configuration ·
Install scripts ·
How it works

Assets 17
Loading