How can we use pnpm for dependency management in m...
# webassemblyh
Himanshu Kumar
12/08/2025, 8:56 AMHow can we use pnpm for dependency management in my kmp wasm setup? For now i can see yarn and npm supported.
plus1 5
a
Artem Kobzar
12/08/2025, 9:10 AM@Ilya Goncharov [JB], I saw some code related to pnpm inside KGP, is it alive?
h
Himanshu Kumar
12/09/2025, 6:41 AMSince many companies are moving to pnpm from npm/yarn after the recent sha1-hulud 2.0 vulnerability, I wanted to check if pnpm support is available for a kmp wasm setup or if there are any known workarounds.
a
Adam Semenenko
12/10/2025, 2:39 PMI don't see any pnpm code inside KGP, only 'setu *pNpm*' tasks...
https://github.com/search?q=repo%3AJetBrains%2Fkotlin%20%2Fpnpm%2F&type=code
⬆️ 2
Adam Semenenko
12/10/2025, 2:41 PMI believe pnpm was investigated, but because it uses symlinks this causes issues on some operating systems, and Gradle can't track the files properly.
Adam Semenenko
12/10/2025, 3:32 PMhmmm I do see a pnpm option to disable symlinking
https://pnpm.io/settings#symlink
Are there still strong benefits for pnpm without symlinking?
t
turansky
12/10/2025, 3:33 PMYes, it has more options for safe development 😉
turansky
12/10/2025, 3:34 PMLike granular
post_install⬆️ 1
a
Adam Semenenko
12/10/2025, 4:12 PMdo you have something stronger? :) I can see it's convenient. but life goes on without it, right?
Adam Semenenko
12/10/2025, 4:15 PMI'm investigating the npm dependencies in KGP at the moment, so now is a good time to make suggestions and investigate alternatives.
Potentially we can make the JS/WasmJS dependency resolution pluggable, so while KGP would provide a sensible competent default (probably npm), it would be possible to add a custom mechanism. But I have no idea if this is feasible, practical, workable. Well defined specifications for how this could work are welcome!
t
turansky
12/10/2025, 4:18 PMdo you have something stronger? 🙂Latest NPM viruses like Sha1-Hulud use exactly it 😞
⬆️ 1
e
Edoardo Luppi
12/10/2025, 6:06 PMPersonal opinion, but I would stick to npm as the single solution provided out of the box, after rounding out a couple of issues currently in YouTrack. pnpm has the habit of shipping fast and breaking stuff.
The npm version tho should be kept separate from Node.js, and be up to date since the latest versions have improved package-lock reliability and resolution performance.
21 Views