2026-09-04
每日一文 · 长文精读
pnpm 12 Rewrites Package Manager in Rust, Accelerating Installs While Preserving pnpm 11 Workflows
pnpm 12 用 Rust 重写包管理器，加速安装同时保留 pnpm 11 工作流
作者：Daniel Curtis · InfoQ 原文
摘要：pnpm 12 发布，将 TypeScript 和 Node.js 实现替换为原生 Rust 重写，并刻意保留 pnpm 11 的命令、标志、设置、锁文件格式和 node_modules 布局。性能提升在缓存或 node_modules 已存在时最为显著；独立生产测试也显示安装时间大幅缩短。迁移需要关注一些破坏性变更，如移除 `--resolution-only` 等。社区对原生工具性能及其权衡展开讨论。
pnpm has released pnpm 12, replacing its TypeScript and Node.js implementation with a native Rust rewrite while deliberately retaining pnpm 11’s commands, flags, settings, lockfile format, and node_modules layout.
pnpm 发布了 pnpm 12，用原生 Rust 重写替换了其 TypeScript 和 Node.js 实现，同时刻意保留了 pnpm 11 的命令、标志、设置、锁文件格式和 node_modules 布局。
The release targets startup and filesystem overhead without asking teams to relearn the package manager or undertake a broad migration.
该版本旨在减少启动和文件系统开销，而不要求团队重新学习包管理器或进行大规模迁移。
The performance improvements are most pronounced when caches or node_modules already exist.
性能提升在缓存或 node_modules 已存在时最为显著。
In pnpm’s regularly updated benchmarks, a clean install of its file-heavy fixture fell from 8.2 seconds under the previous implementation to 5 seconds with Rust.
在 pnpm 定期更新的基准测试中，其文件密集环境的全新安装从之前实现的 8.2 秒降至 Rust 版本的 5 秒。
A repeated install with the cache, lockfile, and node_modules warm dropped from 472 milliseconds to 15 milliseconds.
在缓存、锁文件和 node_modules 已预热的情况下重复安装，从 472 毫秒降至 15 毫秒。
Independent production testing offers further evidence.
独立的生产环境测试提供了进一步证据。
Socket reported that Vercel’s 21-project Turborepo workspace, containing 1,670 packages, recorded median install-time reductions of 64.4% to 90.5% across six scenarios.
Socket 报告称，Vercel 的包含 1,670 个包的 21 项目 Turborepo 工作区在六种场景下安装时间中位数减少了 64.4% 到 90.5%。
However, the native Corepack artifact was larger, making its first uncached startup 11.1% slower, although cached startup improved by 74.7%.
然而，原生 Corepack 产物更大，导致其首次无缓存启动慢了 11.1%，尽管缓存启动提升了 74.7%。
Developers can install the release using:
开发者可以使用以下命令安装该版本：
pnpm self-update next-12
pnpm self-update next-12
The latest npm tag still points to pnpm 11, and Homebrew, winget, Scoop, and Chocolatey did not offer version 12 at launch.
最新的 npm 标签仍指向 pnpm 11，且 Homebrew、winget、Scoop 和 Chocolatey 在发布时未提供版本 12。
The installation guide also provides npm and standalone-script options, including installation without Node.js.
安装指南还提供了 npm 和独立脚本选项，包括无需 Node.js 的安装方式。
Migration is intended to be limited, but teams should review pnpm’s compatibility guide.
迁移旨在有限，但团队应查看 pnpm 的兼容性指南。
The most likely CI-breaking change is removal of pnpm install --resolution-only, now replaced by pnpm peers check.
最可能破坏 CI 的变更时移除了 pnpm install --resolution-only，现由 pnpm peers check 替代。
Git dependencies hosted on GitHub, GitLab, or Bitbucket resolve through canonical HTTPS URLs, while private SSH access should be configured through Git URL rewriting.
托管在 GitHub、GitLab 或 Bitbucket 上的 Git 依赖通过规范的 HTTPS URL 解析，而私有 SSH 访问应通过 Git URL 重写进行配置。
Linux now tries hardlinks before reflinks, and unknown keys in pnpm-workspace.yaml are reported instead of silently ignored.
Linux 现在先尝试硬链接再尝试 reflink，并且 pnpm-workspace.yaml 中的未知键会被报告而非静默忽略。
The release also introduces project-aware global binaries.
该版本还引入了项目感知的全局二进制文件。
A globally installed Node.js, Deno, or Bun can follow the runtime pinned by the current project.
全局安装的 Node.js、Deno 或 Bun 可跟随当前项目锁定的运行时。
pnpm can provision npm, Yarn, and Bun itself, including the package manager requested by a Git-hosted dependency.
pnpm 可以自行提供 npm、Yarn 和 Bun，包括 Git 托管依赖所请求的包管理器。
Deterministic cycle handling also produces byte-identical lockfiles and, according to the release notes, makes peer resolution two to three times faster in cycle-heavy workspaces while using about 25% less memory.
确定性循环处理还生成字节完全相同的锁文件，并且根据发布说明，在循环繁重的工作区中使同级依赖解析速度提升两到三倍，同时内存使用减少约 25%。
Community reaction has focused on native-tooling performance and its tradeoffs.
社区反应集中在原生工具性能及其权衡上。
Frontend engineer Dennis Morello described the release as a performance release wearing a major version number, highlighting that the visible workflow remains familiar.
前端工程师 Dennis Morello 将该版本描述为穿着主版本号外衣的性能发布，强调可见的工作流仍然熟悉。
In a discussion covered by Socket, former npm CLI maintainer Darcy Clarke argued that keeping package managers in JavaScript makes shared internals easier to improve, while pnpm maintainer Zoltan Kochan responded: It was faster to rewrite pnpm in Rust than to migrate to ESM.
在 Socket 报道的一场讨论中，前 npm CLI 维护者 Darcy Clarke 认为将包管理器保留在 JavaScript 中更易于改进共享内部组件，而 pnpm 维护者 Zoltan Kochan 回应：用 Rust 重写 pnpm 比迁移到 ESM 更快。
On HackerNews, one commenter suggested that for them, npm is the best tool:
在 HackerNews 上，一位评论者表示对他们来说 npm 是最好的工具：
I got to the conclusion that boring is good enough, for me NPM is the best tool, is not that fast, but the installation speed is not that bad, considering how many times I need to run from scratch, the difference does not matter, it is stable and it's the default Node package manager, so I don't need to bother to install in CI any other tool, etc…
我得出的结论是，无聊就够好了，对我来说 NPM 是最好的工具，它没那么快，但安装速度也不算太差，考虑到我需要从头运行的次数，差异并不重要，它很稳定，而且是默认的 Node 包管理器，所以我无需在 CI 中费心安装其他工具等等……
To which others pointed out security as a concern for using npm, and pnpm is a better alternative:
对此，其他人指出安全性是使用 npm 的一个问题，而 pnpm 是更好的替代方案：
Describing NPM as boring is a stretch.
将 NPM 描述为无聊有点牵强。
Given its security model, i think spicy is a far more apt label.
考虑到其安全模型，我认为 spicy 是更合适的标签。
I have switched to pnpm already.
我已经切换到 pnpm 了。
Npm likes to run package lifecycle scripts of your dependencies by default.
Npm 默认喜欢运行依赖的包生命周期脚本。
You have to explicitly opt out of this.
你必须明确选择退出。
It’s probably the worst package manager out of npm, pnpm, yarn, and bun.
它可能是 npm、pnpm、yarn 和 bun 中最差的包管理器。
Against npm, Yarn, and Bun, pnpm continues to differentiate through its content-addressable store, strict dependency layout, and now a native binary.
与 npm、Yarn 和 Bun 相比，pnpm 继续通过其内容可寻址存储、严格的依赖布局以及现在的原生二进制文件来区分。
Bun still publishes faster results in its own benchmark suite, but pnpm removed Bun and Yarn from its public comparison after benchmark-harness problems made broad rankings unreliable.
Bun 在自己的基准测试套件中仍发布更快的结果，但 pnpm 在基准测试框架问题导致广泛排名不可靠后将 Bun 和 Yarn 从其公开比较中移除。
pnpm is an open-source JavaScript package manager created by Zoltan Kochan.
pnpm 是由 Zoltan Kochan 创建的开源 JavaScript 包管理器。
It shares packages across projects through a content-addressable store and hardlinks, reducing duplicated files while enforcing dependency declarations more strictly than conventional flat node_modules layouts.
它通过内容可寻址存储和硬链接在项目间共享包，减少重复文件，同时比传统的扁平 node_modules 布局更严格地强制依赖声明。
阅读理解
1. What is the primary reason pnpm 12 achieves performance improvements according to the article?
2. Which of the following is identified as a likely CI-breaking change when migrating to pnpm 12?
3. According to the community discussion, what security concern was raised about npm?