Zoltan Kochan
- Reposted by Zoltan KochanTherein lies the rub: AI cannot have “ideas” of its own. Every “idea” you thought AI had came from a person, either through prompting or theft. The way to jumpstart the “idea machine” is to have people focused less on survival and more on living passionately.
- Reposted by Zoltan KochanThe Seattle Times is piloting pnpm’s client-side defenses—blocked lifecycle scripts, release cooldowns, and trust policy—to stop worms like Shai-Hulud 2.0 before they land. Read their story: pnpm.io/blog/2025/12...
- Reposted by Zoltan KochanYet another reminder to use @pnpm.io's minimum dependency age. pnpm.io/settings#min...
- Reposted by Zoltan Kochan🚀 pnpm v10.21 is out! This release introduces two powerful new security & compatibility features: 1️⃣ Automatic Node.js runtime installation for dependencies 2️⃣ Configurable trust policy for detecting supply-chain downgrades 🧵👇
- Reposted by Zoltan Kochanpnpm 10.21: installing Node.js runtimes for dependencies, not installing dependencies with decreased trust levels, and more @kochan.io @pnpm.io pnpm.io/blog/release... #ECMAScript #JavaScript
- Reposted by Zoltan Kochan@pnpm.io added a `trustPolicy` option in 10.21. It allows you to prevent installing potentially malicious dependency updates that are not signed like previous versions. pnpm.io/blog/release... Thank you for all the performance, productivity and security enhancements over the last years 💜
- Reposted by Zoltan KochanZoltan Kochan is a full stack web developer and the creator of @pnpm.io. He joins the show with @joshuakgoldberg.com to talk about the state of package management for web dev. @kochan.io softwareengineeringdaily.com/2025/09/18/p...
- Reposted by Zoltan KochanAfter recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJS
- Wow, Hollywood is so creative
- I feel like pnpm will eventually grow from being a "npm alternative" to being a "nix alternative" but "pnix" doesn't sound appropriate 😂
- With the changes to the lockfile format and the new types of fetchers that were added to pnpm, now it is really easy to make pnpm an installer for anything bsky.app/profile/pnpm...
- pnpm v10.14 is shipped with support for runtime engine installation. Node, Deno, and Bun are supported. pnpm.io/blog/release...
- Reposted by Zoltan Kochanwhen you open a service you've been using for a decade only to find it out it caught the virus
- Reposted by Zoltan KochanThe pnpm repository has 32K stars!
- I am thinking about a better name for the pnpm "virtual store". Which is where the dependency is written with its unique dependency graph. I couldn't find any prior art to this. Maybe "Package Context" could work. Or "fully resolved package store" but that's long.
- For context, this is what I am talking about: pnpm.io/settings#ena...
- I think dependency graph store is the best option github.com/pnpm/pnpm.io...
- Many packages request funding by printing message with postinstall scripts. What if instead of requesting funding we would promote sponsors? After all, we want companies to sponsor open source projects as they are the ones that make profit from it.
- A lot of packages use postinstall scripts for printing out messages about funding. Could there be a better way to do this? pnpm doesn't even print the outputs from these scripts.
- 🚀 Check out what we’ve been building at Bit: Hope AI: Architect agent that builds professional software www.producthunt.com/products/hop...
- Reposted by Zoltan Kochan@kochan.io's talk about configDependencies made me realize we forgot to document remote plugins on the Yarn website 🙈
- Reposted by Zoltan KochanPackage manager summit with @kochan.io at #JSNation !
- Reposted by Zoltan KochanTon of npm libs use github.com/cosmiconfig/... to load their config files. But, today I learned, if nodejs dies, the temporarily file created by cosmiconfig remains 🤷♂️ I fixed this locally in 5 mins thanks to the amazing patch ability of @pnpm.io (kudos @kochan.io!) and the LLMs era of code editors
- So... I was working on making @pnpm.io a tad faster 😜 youtu.be/pNDFfJvaubY?...
- I have copied over the list of trusted dependencies maintained by bun. So, you can use it with @pnpm.io if you want: github.com/pnpm/trusted...
- I have searched Github for usages of "config dependencies". Found a single project for now: github.com/PSDTools/psd... This is a hook that removes polyfills from dependencies if they are not needed.
- Reposted by Zoltan KochanWe’re excited to share that the @nodejs.org website (nodejs.org) now builds using @pnpm.io! This switch has led to faster CI builds and more efficient dependency management.
- Reposted by Zoltan Kochanpnpm patch is a LIFE SAVER
