pnpm 12 Goes Native: Rust Rewrite Eliminates Node.js Runtime Dependency

pnpm 12 becomes a native binary

pnpm 12 is officially released; the CLI core has been rewritten from TypeScript to Rust and is now delivered as a native binary. By using an independent install script, the tool can run on machines that have no Node.js installed.

curl -fsSL https://get.pnpm.io/install.sh | env PNPM_VERSION=next-12 sh -

After installation the executable is a Rust binary for the host platform. The command‑line interface, configuration, error codes, lockfile format, and node_modules layout remain compatible, so users should barely notice the rewrite.

Performance of the Rust rewrite

The team’s public test records show mixed results. In a clean‑install benchmark the Rust version took 12.3 s versus 7.9 s for the TypeScript version; in a full‑dependency‑resolution scenario it took 27.4 s versus 11.5 s. The slowdown is attributed to the high number of filesystem calls, which erode the theoretical speed advantage of native code.

Subsequent releases focused on the I/O bottlenecks, and the final v12 binary shows concrete gains:

Peer‑dependency resolution in large cyclic‑dependency workspaces is 2–3× faster.

Memory consumption in the same scenario drops by roughly 25%.

On Linux with btrfs hot‑cache, building the node_modules tree takes about half the time.

Re‑ordered dependencies keep the lockfile byte‑identical to the TypeScript version.

Real‑world compatibility testing

Before the stable release the team selected ten large open‑source pnpm workspaces (n8n, Next.js, Material UI, Vite, Astro, Nuxt, Vue, Slidev, Prisma, Novu) and ran a comprehensive test matrix that included cold install, hot install, old lockfile compatibility, re‑resolution, build, test, lint, patch‑dependency handling, lifecycle scripts, and native‑module compilation.

Each Rust‑generated lockfile was compared byte‑by‑byte with the TypeScript‑generated one; any differences triggered further investigation. All ten projects passed every check, giving the v12 release solid confidence.

Upgrade considerations

Git dependency normalization : Different GitHub, GitLab, or Bitbucket URL forms are now resolved to a canonical HTTPS address, avoiding CI failures caused by SSH URLs.

Workspace configuration typos : Previously silent misconfigurations now emit warnings or errors.

Lockfile re‑ordering on circular dependencies : Old lockfiles still work, but a fresh resolution may alter some peer‑dependency entries.

engineStrict stricter : Incompatible optional dependencies can now cause installation failures.

filterLog hook deprecated : The Rust CLI ignores this hook and prints a warning.

Is TypeScript really defeated?

The rewrite can be framed as “Rust eats JavaScript”, a narrative echoed by other front‑end tooling such as Vite, Biome, Oxc, and Bun. However, Prisma’s recent move in the opposite direction—shifting some Rust components back to TypeScript—shows that the optimal language choice depends on the project’s primary bottleneck.

pnpm deals with massive network traffic, dependency graph resolution, and filesystem operations, whereas Prisma focuses on deployment simplicity and tight JavaScript ecosystem integration. The two projects therefore make different trade‑offs, and neither can claim a universal victory.

Ultimately, pnpm 12 demonstrates that a mature open‑source project can replace a decade‑old core implementation with a new language while keeping the user experience stable, provided extensive real‑world testing backs the transition.