@pnpm/hoist 8.1.4

Hoists dependencies in a node_modules created by pnpm

@pnpm/hoist@8.1.4 was published on 2023-12-14. Its manifest declares 14 runtime dependencies and 1 peer requirement. Type declarations are bundled according to the package metadata. The declared Node.js requirement is >=16.14.

All @pnpm/hoist versions · Permanent reference to 8.1.4 · Latest release

Package specifications

Version	8.1.4
License declaration	MIT
Published	2023-12-14T15:31:25.077Z
Node.js requirement	>=16.14
Type declarations	Bundled declarations
Runtime dependency count	14
Peer requirement count	1
Optional dependency count	0
Minified size	Measurement not available yet
Minified + gzip	Measurement not available yet
Unpacked distribution size	20.31 KiB
Published file count	6
Package type	Not declared
ES module entry	Not declared
Default entry	lib/index.js
Side effects declaration	Not declared
Direct advisories	0
Resolved graph dependencies	121
Repository stars	36888
Repository forks	1957

Install @pnpm/hoist 8.1.4

npm install @pnpm/hoist@8.1.4
pnpm add @pnpm/hoist@8.1.4
yarn add @pnpm/hoist@8.1.4

Runtime dependencies

Peer requirements

@pnpm/logger ^5.0.0

Optional dependencies

None declared

Resolved dependency graph

This deps.dev graph describes a generic 64-bit Linux environment, not your application lockfile.

@babel/code-frame@7.29.7 — indirect
@babel/helper-validator-identifier@7.29.7 — indirect
@gwhitney/detect-indent@7.0.1 — indirect
@nodelib/fs.scandir@2.1.5 — indirect
@nodelib/fs.stat@2.0.5 — indirect
@nodelib/fs.walk@1.2.8 — indirect
@pnpm/constants@7.1.1 — direct
@pnpm/core-loggers@9.0.5 — direct
@pnpm/crypto.base32-hash@2.0.0 — indirect
@pnpm/dependency-path@2.1.6 — direct
@pnpm/error@5.0.2 — indirect
@pnpm/graceful-fs@3.2.0 — indirect
@pnpm/link-bins@9.0.11 — direct
@pnpm/lockfile-types@5.1.4 — direct
@pnpm/lockfile-utils@9.0.3 — direct
@pnpm/lockfile-walker@7.0.7 — direct
@pnpm/manifest-utils@5.0.6 — indirect
@pnpm/matcher@5.0.0 — direct
@pnpm/package-bins@8.0.5 — indirect
@pnpm/pick-fetcher@2.0.1 — indirect
@pnpm/ramda@0.28.1 — direct
@pnpm/read-modules-dir@6.0.1 — indirect
@pnpm/read-package-json@8.0.6 — indirect
@pnpm/read-project-manifest@5.0.9 — indirect
@pnpm/resolver-base@11.0.1 — indirect
@pnpm/text.comments-parser@2.0.0 — indirect
@pnpm/types@9.4.1 — direct
@pnpm/util.lex-comparator@1.0.0 — direct
@pnpm/write-project-manifest@5.0.5 — indirect
@zkochan/cmd-shim@6.0.0 — indirect
@zkochan/rimraf@2.1.3 — indirect
argparse@2.0.1 — indirect
balanced-match@1.0.2 — indirect
better-path-resolve@1.0.0 — indirect
bin-links@4.0.4 — indirect
brace-expansion@1.1.21 — indirect
braces@3.0.3 — indirect
cmd-extension@1.0.2 — indirect
cmd-shim@6.0.3 — indirect
concat-map@0.0.1 — indirect
encode-registry@3.0.1 — indirect
error-ex@1.3.4 — indirect
escape-string-regexp@4.0.0 — indirect
fast-deep-equal@3.1.3 — indirect
fast-glob@3.3.3 — indirect
fastq@1.20.3 — indirect
fill-range@7.1.1 — indirect
fs-extra@10.1.0 — indirect
fs.realpath@1.0.0 — indirect
function-bind@1.1.2 — indirect
get-npm-tarball-url@2.1.0 — indirect
glob@7.2.3 — indirect
glob-parent@5.1.2 — indirect
graceful-fs@4.2.11 — indirect
hasown@2.0.4 — indirect
hosted-git-info@6.1.3 — indirect
imurmurhash@0.1.4 — indirect
inflight@1.0.6 — indirect
inherits@2.0.4 — indirect
is-arrayish@0.2.1 — indirect
is-core-module@2.17.0 — indirect
is-extglob@2.1.1 — indirect
is-glob@4.0.3 — indirect
is-number@7.0.0 — indirect
is-plain-obj@2.1.0 — indirect
is-subdir@1.2.0 — direct
is-windows@1.0.2 — indirect
js-tokens@4.0.0 — indirect
js-yaml@4.3.2 — indirect
json-parse-even-better-errors@2.3.1 — indirect
json5@2.2.3 — indirect
jsonfile@6.2.1 — indirect
lines-and-columns@1.2.4 — indirect
load-json-file@6.2.0 — indirect
lodash.clonedeep@4.5.0 — indirect
lru-cache@7.18.3 — indirect
map-age-cleaner@0.1.3 — indirect
mem@8.1.1 — indirect
merge2@1.4.1 — indirect
micromatch@4.0.8 — indirect
mimic-fn@3.1.0 — indirect
minimatch@3.1.5 — indirect
normalize-package-data@5.0.0 — indirect
normalize-path@3.0.0 — indirect
npm-normalize-package-bin@3.0.1 — indirect
once@1.4.0 — indirect
p-defer@1.0.0 — indirect
p-limit@2.3.0 — indirect
p-reflect@2.1.0 — indirect
p-settle@4.1.1 — indirect
p-try@2.2.0 — indirect
parse-json@5.2.0 — indirect
path-is-absolute@1.0.1 — indirect
picocolors@1.1.1 — indirect
picomatch@2.3.2 — indirect
queue-microtask@1.2.3 — indirect
read-cmd-shim@4.0.0 — indirect
read-yaml-file@2.1.0 — indirect
rename-overwrite@5.0.4 — indirect
resolve-link-target@2.0.0 — direct
reusify@1.1.0 — indirect
rfc4648@1.5.4 — indirect
rimraf@3.0.2 — indirect
run-parallel@1.2.0 — indirect
semver@7.8.5 — indirect
signal-exit@4.1.0 — indirect
sort-keys@4.2.0 — indirect
spdx-correct@3.2.0 — indirect
spdx-exceptions@2.5.0 — indirect
spdx-expression-parse@3.0.1 — indirect
spdx-license-ids@3.0.24 — indirect
strip-bom@4.0.0 — indirect
strip-comments-strings@1.2.0 — indirect
symlink-dir@5.2.1 — direct
to-regex-range@5.0.1 — indirect
type-fest@0.6.0 — indirect
universalify@2.0.1 — indirect
validate-npm-package-license@3.0.4 — indirect
wrappy@1.0.2 — indirect
write-file-atomic@5.0.1 — indirect
write-yaml-file@5.0.0 — indirect

How to interpret the specifications

Bundlephobia measurements use its standard package build and may exclude peer dependencies. Unpacked npm distribution size includes shipped files and is a different measurement. Module declarations do not prove tree-shaking or runtime compatibility.

Advisories apply to this package version directly; transitive dependencies need separate inspection. Repository signals describe the whole repository and are current observations, including on historical-version pages.

OpenSSF repository checks

Provider assessment: 2026-08-24T00:00:00Z. These are repository checks, not a jsL maintenance score.

Code-Review	9/10 — Found 27/30 approved changesets -- score normalized to 9
Maintained	10/10 — 30 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	10/10 — security policy file detected
CII-Best-Practices	0/10 — no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	10/10 — no dangerous workflow patterns detected
Token-Permissions	0/10 — detected GitHub workflow tokens with excessive permissions
License	10/10 — license file detected
Binary-Artifacts	10/10 — no binaries found in the repo
Branch-Protection	5/10 — branch protection is not maximal on development and all release branches
Pinned-Dependencies	9/10 — dependency not pinned by hash detected -- score normalized to 9
Signed-Releases	0/10 — Project has not signed or included provenance with any releases.
Packaging	10/10 — packaging workflow detected
Fuzzing	0/10 — project is not fuzzed
SAST	10/10 — SAST tool is run on all commits

Evidence and freshness

https://registry.npmjs.org/%40pnpm%2Fhoist/8.1.4 — retrieved 2026-10-29T17:00:12.793Z
https://api.deps.dev/v3/projects/github.com%2Fpnpm%2Fpnpm — retrieved 2026-10-29T12:01:18.702Z
https://api.deps.dev/v3/systems/npm/packages/%40pnpm%2Fhoist/versions/8.1.4 — retrieved 2026-10-29T17:00:13.599Z
https://api.deps.dev/v3/systems/npm/packages/%40pnpm%2Fhoist/versions/8.1.4:dependencies — retrieved 2026-10-29T17:00:13.718Z