pnpm 16 📦 Cheat Sheet
1. Toolchain & Installation
corepack enable # Enable Corepack (Node.js 16.10+)
corepack prepare pnpm@latest --activate # Install latest pnpm
npm install -g pnpm # Alternative via npm
curl -fsSL https://get.pnpm.io/install.sh | sh - # Standalone script
pnpm setup # Configure shell PATH
pnpm --version # Check version
pnpm store path # Show content-addressable store location
pnpm cache path # Show metadata cache location2. Project Initialization
pnpm init # Create package.json
pnpm init --bare # Minimal package.json (no license/author)
pnpm init --init-type commonjs # CommonJS instead of ESM
pnpm init --init-package-manager # Pin pnpm version in manifest3. Dependency Management
pnpm add <pkg> # Add to dependencies
pnpm add -D <pkg> # Add to devDependencies
pnpm add -O <pkg> # Add to optionalDependencies
pnpm add -E <pkg> # Add exact version (no caret)
pnpm add --save-peer <pkg> # Add to peerDependencies
pnpm remove <pkg> # Remove from all fields
pnpm remove -r <pkg> # Remove from all workspaces
pnpm update # Update within ranges
pnpm update --latest # Update to latest (may cross major)
pnpm update -i # Interactive update
pnpm why <pkg> # Show resolution chain
pnpm list --depth=0 # List direct dependencies4. Installation & Lockfile
pnpm install # Install all dependencies
pnpm install --frozen-lockfile # CI: fail if lockfile changes
pnpm install --fix-lockfile # Repair inconsistent lockfile
pnpm install --offline # Use only local store/cache
pnpm install --prefer-offline # Use cache, fetch missing only
pnpm install --lockfile-only # Generate lockfile without installing
pnpm import # Convert npm/Yarn lockfile to pnpm-lock.yaml5. Running Scripts & Binaries
pnpm <script> # Run script (no 'run' needed)
pnpm run <script> # Explicit run
pnpm exec <bin> # Run binary from dependencies
pnpm dlx <pkg> # Run package without installing (npx equivalent)
pnpm -r run <script> # Run in all workspaces
pnpm --filter <name> run <script> # Run in specific workspace
pnpm --filter <name>... run <script> # Run in workspace + dependencies6. Workspaces (Monorepos)
# pnpm-workspace.yaml
packages:
- 'apps/*'
- 'packages/*'{ "dependencies": { "@myorg/utils": "workspace:*" } }pnpm -r run build # Run in all workspaces
pnpm --filter "./apps/*" run test # Run by directory
pnpm --filter "![name]" run lint # Exclude workspace
pnpm -r --workspace-concurrency=2 run test # Limit concurrent execution
pnpm -r --parallel run lint # Ignore topological order
pnpm --filter "...[origin/main]" run test # Only changed workspaces7. Configuration (.npmrc vs pnpm-workspace.yaml)
# .npmrc — registry and auth only (pnpm 11+)
registry=https://registry.npmjs.org/
@myorg:registry=https://npm.internal.example.com/# pnpm-workspace.yaml — pnpm-specific settings
nodeLinker: isolated # isolated (default), hoisted, pnp
hoist: true # Hidden hoisting
strictPeerDependencies: false # Peer dependency enforcement
catalog:
react: ^19.0.0
registries:
default: https://registry.npmjs.org/
"@myorg": https://npm.internal.example.com/8. Strict Dependency Trees
pnpm why <pkg> # Trace why a package exists
ls -la node_modules/<pkg> # Verify symlink# pnpm-workspace.yaml
nodeLinker: hoisted # Flat layout (npm-like)
shamefully-hoist: true # Expose hidden hoisted packages at root
hoist: false # Disable hidden hoisting entirely9. Patches and Overrides
pnpm patch <pkg>@<version> # Extract for editing
pnpm patch-commit <path> # Generate patch and register
pnpm patch-remove <pkg>@<version> # Remove patch# pnpm-workspace.yaml
patchedDependencies:
lodash@4.17.21: patches/lodash@4.17.21.patch
overrides:
"minimist@<1.2.6": 1.2.6
allowUnusedPatches: true10. CI/CD Integration
pnpm install --frozen-lockfile # CI install (fails if lockfile changes)
CI=true pnpm install # Auto-enables frozen-lockfile
pnpm store path # Cache this directory in CI
pnpm cache path # Cache metadata for faster verification# GitHub Actions
- uses: pnpm/action-setup@v4
- run: pnpm install --frozen-lockfile11. Publishing Packages
pnpm publish # Publish current package
pnpm publish --dry-run # Preview tarball
pnpm publish --access public # Public scoped package
pnpm publish --tag beta # Attach dist-tag
pnpm -r publish # Publish all unpublished workspaces
pnpm publish --no-git-checks # Skip branch/cleanliness checks (CI)# Token (never commit)
pnpm config set //npm.internal.example.com/:_authToken "$TOKEN"
# OTP (CI)
export PNPM_CONFIG_OTP='123456'12. Offline Mode
pnpm install --offline # Use only store and metadata cache
pnpm install --prefer-offline # Skip stale checks, fetch missing
pnpm store add <pkg> # Pre-populate store + metadata
pnpm store prune # Remove unreferenced packages
pnpm config get cache-dir # Show metadata cache location13. Environment Variables
CI=true # Auto-enables frozen-lockfile
PNPM_HOME # Install directory
PNPM_CONFIG_OTP # OTP for CI publishing
NPM_CONFIG_//registry/:_authToken # Token via environment14. Migration from npm/Yarn
rm -rf node_modules # Remove existing install
pnpm import # Convert lockfile
pnpm install # Install (may fail on phantom deps)
pnpm add <missing-pkg> # Fix phantom dependencies
rm package-lock.json # Delete old lockfile{ "packageManager": "pnpm@10.0.0" }15. Key File Locations
| File/Directory | Purpose |
|---|---|
pnpm-lock.yaml | Lockfile |
pnpm-workspace.yaml | Workspace config + pnpm settings |
.npmrc | Registry and auth |
patches/ | Patch files |
~/.local/share/pnpm/store | Content-addressable store |
~/.cache/pnpm/metadata | Metadata cache |
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!