pnpm vs bun install Comparison

// pnpm 12.3 — audited install with allowBuilds and workspace filtering
// package.json (root)
{
  "name": "monorepo-root",
  "private": true,
  "packageManager": "[email protected]"
}

// pnpm-workspace.yaml — allowBuilds arrived in v10.26.0; v11 removed the old names (onlyBuiltDependencies etc.)
packages:
  - "apps/*"
  - "packages/*"

allowBuilds:
  esbuild: true
  sharp: true
  core-js: false

catalog:
  react: ^19.2.3
  typescript: ^5.7.0

// CI install step (GitHub Actions)
- name: Install dependencies
  run: pnpm install --frozen-lockfile --trust-policy=no-downgrade

// Removing a package revalidates the entire lockfile against active policies
pnpm remove left-pad --filter ./apps/web --trust-lockfile

// Install only changed workspace packages
pnpm install --filter "...[origin/main]"

// Add the store location to the CI cache key
pnpm store path

// Bun 1.4 — isolated installs + global virtual store + offline install
// bunfig.toml (root)
[install]
linker = "isolated"
globalStore = true
exact = false

// package.json
{
  "name": "monorepo-root",
  "private": true,
  "workspaces": ["apps/*", "packages/*"],
  "trustedDependencies": [
    "esbuild",
    "sharp",
    "@prisma/client"
  ]
}

// CI install step (GitHub Actions) — locked and offline-compatible
- name: Install dependencies
  run: bun install --frozen-lockfile --prefer-offline

// List blocked postinstall scripts
bun pm untrusted

// Mark a package as trusted
bun pm trust sharp

// Install only specific workspace packages
bun install --filter "./apps/web"

// Fully offline install (never touches the network)
bun install --offline