🎯 In short:
Safer installs 🛡️
Smarter runtime management ⚙️

Upgrade to pnpm v10.21:

pnpm self-update

Full changelog 👉 pnpm.io/blog/release...

This feature helps detect and block potentially compromised releases, such as when a package’s maintainer changes or its build pipeline loses attestation.

A new setting, trustPolicy, adds protection against supply-chain attacks.

When set to no-downgrade, pnpm will fail installation if a package’s trust level drops — e.g.
from a trusted publisher → provenance only → no trust evidence.

If a package is a CLI app, pnpm will bind that CLI to the specified Node.js version — so it always runs with the compatible runtime, regardless of what’s installed globally.

Even postinstall scripts will be executed with the right Node.js version.

🧩 Node.js runtime installation for dependencies

pnpm can now automatically install the Node.js version required by a dependency, declared in its engines.runtime field.

Example:

The pnpm repository has 33K stars!

The website's repository is at github.com/pnpm/pnpm.io

It is explained on the github release page of v10.0.0.

If a dependency has no dependencies of its own, it can be symlinked from a single location. Also, we have an option to symlink from a single location all dependencies: pnpm.io/settings#ena...

Who said anything about installing a copy?

Opt-out option can be considered

Yes, but it will be saved to devEngines in package.json. Internally for pnpm it is a new version spec and a new entry in dev deps. I am not sure yet if env use will work with it

If you want the "pnpmfile.cjs" from your config dependency to be automatically loaded by pnpm, name your package "pnpm-plugin-*"

The pnpm repository has 32K stars!