pnpm 12.18.0 links agent skills by name, approves them one by one and packs pnpr variants
Serguey Asael Shinder1 min readpnpm 12.18.0 was released on 5 November. Its own summary names four themes: packing, publishing and installing packages with platform variants on pnpr registries, per-skill approval of agent skills, a pnpm store add command for offline installs from downloaded tarballs, and faster repeat installs that no longer read the package.json of unchanged workspace projects.
The agent-skill changes are the most visible. pnpm now names the link to a dependency's skill after the skill alone: a skill that the @acme/kit package ships in skills/auth is linked as .claude/skills/auth instead of a long prefixed name, and the next install replaces the old links. Linked skills are listed in a pnpm block of the skill directory's .gitignore. If two approved packages ship a skill with the same name, pnpm falls back to the prefixed form instead of failing the install. pnpm approve now asks which skills to link when a package ships several, records the choice as a list under permissions, and on first use asks which agent directories to link into. Skills nested up to three levels below skills are now found.
Platform variants require a registry declared with serverType pnpr. pnpm pack writes one archive per entry of publishConfig.variants, pnpm publish uploads every archive before the publish request that references them, and publishing variants to any other registry is refused unless --no-variants is given. A two-step flow with --upload-variant and --variant-integrity lets CI jobs on different platforms upload their own archives before one job publishes.
The release also fixes several peer-dependency resolution bugs.
What it means
Package managers are starting to treat agent skills as dependencies with their own approval step. That is the right place for the decision, next to the lockfile, rather than in an agent's settings.