pnpm

pnpm 12's version pin outgrew Corepack — packageManager, devEngines, and a lockfile GitHub could not read

October 10, 2026

A pnpm 12 pin writes two YAML documents, split by ---, into one pnpm-lock.yaml. How pmOnFail keeps GitHub's dependency graph intact, and dropping Corepack.

• pnpm
• GitHub
• Corepack

A GitHub Action that patches the pnpm advisories Dependabot cannot — via a GitHub App token

September 4, 2026

Dependabot cannot update transitive dependencies on pnpm. Building the GitHub Action that patches them, and why its credential decided the design.

• pnpm
• GitHub Actions
• Security
• Automation
• Node.js
• Claude Code

pnpm and Windows broke this blog's build twice — a shadowed Chocolatey install, then a blocked symlink

August 22, 2026

pnpm's version switcher corrupted its cache behind a shadowed Chocolatey install, and Windows separately blocked a build from symlinking its dependencies.

• pnpm
• Developer Tooling