pnpm 11 RC is a release that deserves your attention, not because it invents a new category of tool, but because it sharpens the ones you already use. The move to an SQLite-backed store index is the kind of under-the-hood change that doesn't make a flashy headline, yet it speaks directly to the daily friction of slow installs and bloated disk usage. For teams wrestling with monorepos or large dependency trees, this is the difference between waiting on your package manager and getting back to writing code. It's a practical upgrade that prioritizes the experience of the developer who has better things to do than watch a progress bar crawl.
Security is where pnpm 11 RC makes its strongest statement. By isolating global installs by default and tightening the default build script behavior, the team is saying that convenience should never come at the cost of your supply chain's integrity. This is not a theoretical concern; it's a direct response to the reality that every dependency you pull in is a potential attack vector. The consolidated build script setting simplifies a previously fragmented configuration, which means fewer places for misconfiguration to hide. For users who have felt that package managers too often assume you'll tighten the screws later, this release says otherwise: the secure path is the default path, and that is a shift worth welcoming.
The Node.js v22 requirement might sting for those still on older LTS releases, but it's a reasonable line in the sand. It signals that pnpm is willing to push the ecosystem forward, even if it means leaving some stragglers behind. The new commands aimed at usability suggest the maintainers are listening to the actual pain points of their user base, not just bolting on features for the sake of a changelog. This is a tool that feels designed by people who have felt the pain of a tangled `node_modules` folder and decided to do something about it.
Our take is straightforward: pnpm 11 RC is not a radical departure, but a mature consolidation of lessons learned. It rewards those who value performance and security enough to read the migration guide and make the switch. If you've been holding off because the current setup works, consider what "works" really means when the alternative is faster installs and a harder-to-exploit environment. The documentation is there, the defaults are sensible, and the direction is clear. The only question left is whether you're ready to move with it.