pnpm
Node.js package manager with strict dependency resolution. Use when running pnpm specific commands, configuring workspaces, or managing dependencies…
它会碰到什么
逐条看命中(30 条严重或高危)
- 严重
references/best-practices-migration.md:69cred-paths# .npmrc (default in pnpm v8+)
- 严重
references/best-practices-migration.md:94cred-paths# .npmrc
- 严重
references/best-practices-migration.md:202cred-paths### .npmrc Settings
- 严重
references/best-practices-migration.md:204cred-pathsMost npm/Yarn settings work in pnpm's `.npmrc`:
- 严重
references/best-practices-performance.md:32cred-paths# .npmrc
- 严重
references/best-practices-performance.md:59cred-paths# .npmrc
- 严重
references/best-practices-performance.md:82cred-paths# .npmrc
- 严重
references/best-practices-performance.md:93cred-paths# .npmrc
- 严重
references/best-practices-performance.md:126cred-paths# .npmrc
- 严重
references/best-practices-performance.md:168cred-paths# .npmrc
- 严重
references/best-practices-performance.md:177cred-paths# .npmrc
- 严重
references/best-practices-performance.md:187cred-paths# .npmrc
- 严重
references/best-practices-performance.md:199cred-paths# .npmrc
- 严重
references/best-practices-performance.md:247cred-pathsOptimized `.npmrc` for performance:
- 严重
references/core-config.md:3cred-pathsdescription: Configuration options via pnpm-workspace.yaml and .npmrc settings
- 严重
references/core-config.md:8cred-pathspnpm uses two main configuration files: `pnpm-workspace.yaml` for workspace and pnpm-specific settings, and `.npmrc` for npm-compatible and pnpm-specific settin
- 严重
references/core-config.md:40cred-paths# pnpm settings (alternative to .npmrc)
- 严重
references/core-config.md:49cred-paths## .npmrc Settings
- 严重
references/core-config.md:51cred-pathspnpm reads settings from `.npmrc` files. Create at project root or user home.
- 严重
references/core-config.md:133cred-paths2. `~/.npmrc` - User config
- 严重
references/core-config.md:134cred-paths3. `<project>/.npmrc` - Project config
- 严重
references/core-store.md:59cred-paths# .npmrc
- 严重
references/core-workspaces.md:127cred-pathsConfigure in `.npmrc` or `pnpm-workspace.yaml`:
- 严重
references/features-peer-deps.md:15cred-paths# .npmrc (default is true since pnpm v8)
- 严重
SKILL.md:13cred-paths**Important:** When working with pnpm projects, agents should check for `pnpm-workspace.yaml` and `.npmrc` files to understand workspace structure and configura
- 严重
SKILL.md:22cred-paths| Configuration | pnpm-workspace.yaml, .npmrc settings, and package.json fields | [core-config](references/core-config.md) |
- 高
references/features-hooks.md:27identity-config-writehooks: { - 高
references/features-hooks.md:154identity-config-writehooks: { - 高
references/features-overrides.md:153identity-config-writehooks: { - 高
references/features-peer-deps.md:125identity-config-writehooks: {
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
pnpm is a fast, disk space efficient package manager. It uses a content-addressable store to deduplicate packages across all projects on a machine, saving significant disk space. pnpm enforces strict dependency resolution by default, preventing phantom dependencies. Configuration should preferably be placed in pnpm-workspace.yaml for pnpm-specific settings.
Important: When working with pnpm projects, agents should check for pnpm-workspace.yaml and .npmrc files to understand workspace structure and configuration. Always use --frozen-lockfile in CI environments.
> The skill is based on pnpm 10.x, generated at 2026-01-28.
Core
| Topic | Description | Reference |
|-------|-------------|-----------|
| CLI Commands | Install, add, remove, update, run, exec, dlx, and workspace commands | [core-cli](references/core-cli.md) |
| Configuration | pnpm-workspace.yaml, .npmrc settings, and package.json fields | [core-config](references/core-config.md) |
| Workspaces | Monorepo support with filtering, workspace protocol, and shared lockfile | [core-workspaces](references/core-workspaces.md) |
| Store | Content-addressable storage, hard links, and disk efficiency | [core-store](references/core-store.md) |
Features
| Topic | Description | Reference |
|-------|-------------|-----------|
| Catalogs | Centralized dependency version management for workspaces | [features-catalogs](references/features-catalogs.md) |
| Overrides | Force specific versions of dependencies including transitive | [features-overrides](references/features-overrides.md) |
| Patches | Modify third-party packages with custom fixes | [features-patches](references/features-patches.md) |
| Aliases | Install packages under custom names using npm: protocol | [features-aliases](references/features-aliases.md) |
| Hooks | Customize resolution with .pnpmfile.cjs hooks | [features-hooks](references/features-hooks.md) |
| Peer Dependencies | Auto-install, strict mode, and dependency rules | [features-peer-deps](references/features-peer-deps.md) |
Best Practices
| Topic | Description | Reference |
|-------|-------------|-----------|
| CI/CD Setup | GitHub Actions, GitLab CI, Docker, and caching strategies | [best-practices-ci](references/best-practices-ci.md) |
| Migration | Migrating from npm/Yarn, handling phantom deps, monorepo migration | [best-practices-migration](references/best-practices-migration.md) |
| Performance | Install optimizations, store caching, workspace parallelization | [best-practices-performance](references/best-practices-performance.md) |
想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。