skills.rest
zomeru
zomeruCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pnpm

Manages Node.js dependencies with pnpm workspaces, catalogs, patches, and strict resolution.

Updated Jul 29, 2026
Search Tags:#ci/cd#dependency management#pnpm#node.js#package manager#monorepo#workspaces
One-click install
npx skills add https://github.com/zomeru/zomlab --skill pnpm-zomeru
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pnpm
Source: https://github.com/zomeru/zomlab/tree/main/.agents/skills/pnpm
Command: npx skills add https://github.com/zomeru/zomlab --skill pnpm-zomeru

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Node.js projects often suffer from phantom dependencies, duplicated packages, and inconsistent monorepo configuration. This Skill provides authoritative guidance for using pnpm's strict, disk-efficient package manager, including its v10/v11 configuration model where settings live in pnpm-workspace.yaml instead of package.json or .npmrc. ## Core Features & Use Cases - CLI & Workspace Management: Covers install/add/remove/update, filtering with --filter, the workspace: protocol, shared lockfiles, and per-package packageConfigs for monorepos. - Advanced Dependency Control: Explains catalogs for centralized versions, overrides for forcing transitive dependency versions, patches for modifying third-party packages, and config dependencies for sharing settings across repos. - Supply-Chain Security & CI/CD: Details build-script approval via allowBuilds, minimumReleaseAge, trustPolicy, lockfile integrity checks, and frozen-lockfile workflows for GitHub Actions, GitLab, and Docker. - Use Case: When migrating a monorepo from npm to pnpm, use this Skill to convert .npmrc settings into camelCase pnpm-workspace.yaml keys, set up catalogs for shared React versions, and configure pnpm ci for reproducible builds. ## Quick Start Ask the AI to configure a pnpm workspace with a shared catalog for React and set up a frozen-lockfile CI install.

Frequently Asked Questions about pnpm

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I migrate a project from npm or Yarn to pnpm?▼

Remove node_modules and the old lockfile, then run pnpm install, or use pnpm import to convert package-lock.json or yarn.lock into pnpm-lock.yaml. For monorepos, create a pnpm-workspace.yaml listing packages and switch internal dependencies to the workspace: protocol.

How do I manage shared dependency versions in a pnpm monorepo?▼

Use catalogs defined in pnpm-workspace.yaml to declare versions once, then reference them in package.json with the catalog: protocol. Named catalogs support version variants, and overrides can reference catalog: to keep forced versions in sync.

Where do pnpm settings go in pnpm v11?▼

All pnpm settings live in pnpm-workspace.yaml using camelCase keys, or in the global config.yaml. The package.json pnpm field is no longer read, and .npmrc is used only for authentication and registry credentials.

Why does pnpm block dependency install scripts?▼

pnpm blocks lifecycle scripts by default as a supply-chain security measure. Approve specific packages with the allowBuilds map in pnpm-workspace.yaml or run pnpm approve-builds interactively; unreviewed builds fail installs when strictDepBuilds is enabled.

Does pnpm work in CI pipelines like GitHub Actions?▼

Yes, use pnpm/action-setup with actions/setup-node caching, then run pnpm install --frozen-lockfile or pnpm ci. pnpm auto-enables frozen-lockfile mode in CI and fails on lockfiles written by a newer pnpm major version.

How do I patch a third-party package with pnpm?▼

Run pnpm patch <pkg>@<version> to open an editable copy, make changes, then run pnpm patch-commit with the printed path. The patch file is saved to patches/ and recorded under patchedDependencies in pnpm-workspace.yaml.

Related Skills

Explore More Software Engineering Skills→
parisgroup-aiparisgroup-ai
1

dep-check

Audit npm dependencies for vulnerabilities, outdated packages, and workspace mismatches.

Official
Intermediate
AstrumonAstrumon

docker-deployment

Containerize Kotlin applications and deploy them with Docker.

Community
Advanced
lgerard314lgerard314

supply-chain-and-dependencies

Enforce pnpm dependency audits, lockfile integrity, and license checks in CI.

Official
Advanced
aicodeproaicodepro

bun-package-manager

Manages JavaScript dependencies with Bun install, add, remove, update, workspaces, and lockfiles.

Official
Intermediate