What changes when the project uses pnpm?

Use pnpm if the repository documents it or pins it in package.json. pnpm records resolved dependencies in pnpm-lock.yaml and can reuse package files from a store on the same machine.

A workspace groups packages or apps in one repository. Its pnpm-workspace.yaml can say which folders belong to the group. A workspace may share one lockfile. Start from the documented workspace folder so the manager sees the same settings as the automated build.

Do you need Node.js to run pnpm?

The standalone pnpm 12 executable can run without Node.js. Installing it through npm still needs Node.js, and your application or build scripts may need Node.js even when the manager itself does not.

Match the project’s pinned pnpm and Node.js versions separately. Some pnpm setups can fetch a pinned manager automatically, so check the project pin and how your copy of pnpm starts before using it. If an install reports a blocked dependency build script, check the package and the project’s approval policy before allowing anything to run.

How can you tell which app a workspace change affects?

Sketch a workspace with a public site and a staff app. Read the list of included folders and each app’s own manifest to see who directly asks for a package.

Make two fictional folders on paper
Name them apps/site and apps/staff. Write that pnpm-workspace.yaml includes apps/*. In the site’s package.json, list a fictional demo-widget dependency and leave it out of the staff app’s file.
Find the owner of the dependency
Mark the site app as the one asking for the package. A shared lockfile covers the workspace’s resolved dependencies, so a name in that file alone does not tell you which app declared it.
Check the actual repo by reading files
In a real project, compare the owning package.json, pnpm-workspace.yaml and pnpm-lock.yaml before approving a change. Leave the package manager and app scripts unopened for this exercise. No package download is needed.

What do you keep for CI or a move to another computer?

Keep package.json, pnpm-lock.yaml and any workspace configuration in version control. Use the project’s pinned manager, runtime and registry settings. pnpm install --frozen-lockfile fails if the lockfile is missing or needs to change.

Recreate installed packages instead of carrying the old node_modules folder to a different machine. If you are moving from npm, pnpm import can use an existing package-lock.json to produce a pnpm lockfile. It resolves dependencies again and may select different versions. Compare the result and run the project’s checks before switching the build.