-
Couldn't load subscription status.
- Fork 3
chore(deps): update pnpm to v10.19.0 #257
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
renovate
wants to merge
1
commit into
main
Choose a base branch
from
renovate/pnpm-10.x
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
f4196d1 to
5bcd92c
Compare
5bcd92c to
c936b48
Compare
156322d to
88e8b90
Compare
88e8b90 to
953f1bd
Compare
953f1bd to
fc0d46f
Compare
fc0d46f to
9cb8d08
Compare
9cb8d08 to
056b6f6
Compare
056b6f6 to
74307c7
Compare
74307c7 to
4bd87e8
Compare
4bd87e8 to
18365d2
Compare
18365d2 to
6ef114d
Compare
6ef114d to
0b747fb
Compare
0b747fb to
bb15dfa
Compare
bb15dfa to
a23da12
Compare
a23da12 to
a304464
Compare
a304464 to
be7f8a0
Compare
be7f8a0 to
ff59ad1
Compare
ff59ad1 to
d8d7898
Compare
d8d7898 to
c27acf2
Compare
c27acf2 to
d21239f
Compare
d21239f to
92d25b5
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
None yet
0 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
10.6.5->10.19.0Release Notes
pnpm/pnpm (pnpm)
v10.19.0Compare Source
Minor Changes
You can now allow specific versions of dependencies to run postinstall scripts.
onlyBuiltDependenciesnow accepts package names with lists of trusted versions. For example:Related PR: #10104.
Added support for exact versions in
minimumReleaseAgeExclude#9985.You can now list one or more specific versions that pnpm should allow to install, even if those versions don’t satisfy the maturity requirement set by
minimumReleaseAge. For example:v10.18.3Compare Source
Patch Changes
verifyDepsBeforeInstall: installand pre/post install scripts that called other pnpm scripts #10060.@scope:registry) being parsed as property paths inpnpm config getwhen--location=projectis used #9362.pnpm config set --location=projectincorrectly handling keys with slashes (auth tokens, registry settings) #9884.pnpm-workspace.yamland.npmrcexist,pnpm config set --location=projectnow writes topnpm-workspace.yaml(matching read priority) #10072.pnpm outdated --long#10040.v10.18.2Compare Source
Patch Changes
pnpm outdated --longshould work #10040.pnpm dlxshould request the full metadata of packages, whenminimumReleaseAgeis set #9963.EPIPEerrors when piping output to other commands #10027.v10.18.1Compare Source
Patch Changes
--lockfile-onlyis used #8320.pnpm setupcreates a command shim to the pnpm executable. This is needed to be able to runpnpm self-updateon Windows #5700.pnpm install, pnpm produced false positive warnings for "skip adding to the default catalog because it already exists". This warning now only prints when usingpnpm add --save-catalogas originally intended.v10.18.0Compare Source
Minor Changes
Added network performance monitoring to pnpm by implementing warnings for slow network requests, including both metadata fetches and tarball downloads.
Added configuration options for warning thresholds:
fetchWarnTimeoutMsandfetchMinSpeedKiBps.Warning messages are displayed when requests exceed time thresholds or fall below speed minimums
Related PR: #10025.
Patch Changes
minimumReleaseAgeconfiguration #10030.cleanupUnusedCatalogsconfiguration when removing dependent packages.scriptShellis set tofalse#8748.pnpm dlxshould not fail whenminimumReleaseAgeis set #10037.v10.17.1Compare Source
Patch Changes
minimumReleaseAgesetting, print this information out in the error message #9974.state.jsoncreation path when executingpnpm patchin a workspace project #9733.minimumReleaseAgeis set and thelatesttag is not mature enough, prefer a non-deprecated version as the newlatest#9987.v10.17.0Compare Source
Minor Changes
The
minimumReleaseAgeExcludesetting now supports patterns. For instance:Related PR: #9984.
Patch Changes
minimumReleaseAgecheck, when the package is requested by exact version and the packument is loaded from cache #9978.minimumReleaseAgeis set and the active version under a dist-tag is not mature enough, do not downgrade to a prerelease version in case the original version wasn't a prerelease one #9979.v10.16.1Compare Source
Patch Changes
v10.16.0Compare Source
Minor Changes
There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies. In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour.
The new setting is called
minimumReleaseAge. It specifies the number of minutes that must pass after a version is published before pnpm will install it. For example, settingminimumReleaseAge: 1440ensures that only packages released at least one day ago can be installed.If you set
minimumReleaseAgebut need to disable this restriction for certain dependencies, you can list them under theminimumReleaseAgeExcludesetting. For instance, with the following configuration pnpm will always install the latest version of webpack, regardless of its release time:Related issue: #9921.
Added support for
finders#9946.In the past,
pnpm listandpnpm whycould only search for dependencies by name (and optionally version). For example:prints the chain of dependencies to any installed instance of
minimist:What if we want to search by other properties of a dependency, not just its name? For instance, find all packages that have
react@17in their peer dependencies?This is now possible with "finder functions". Finder functions can be declared in
.pnpmfile.cjsand invoked with the--find-by=<function name>flag when runningpnpm listorpnpm why.Let's say we want to find any dependencies that have React 17 in peer dependencies. We can add this finder to our
.pnpmfile.cjs:Now we can use this finder function by running:
pnpm will find all dependencies that have this React in peer dependencies and print their exact locations in the dependency graph.
It is also possible to print out some additional information in the output by returning a string from the finder. For example, with the following finder:
Every matched package will also print out the license from its
package.json:Patch Changes
nodeVersionis not set to an exact semver version #9934.pnpm publishshould be able to publish a.tar.gzfile #9927.pnpm runreturn a non-zero exit code #9626.v10.15.1Compare Source
Patch Changes
.pnp.cjscrash when importing subpath #9904.v10.15.0Compare Source
Minor Changes
cleanupUnusedCatalogsconfiguration. When set totrue, pnpm will remove unused catalog entries during installation #9793.@*/pnpm-plugin-*#9780.pnpm config getnow prints an INI string for an object value #9797.pnpm config getnow accepts property paths (e.g.pnpm config get catalog.react,pnpm config get .catalog.react,pnpm config get 'packageExtensions["@​babel/parser"].peerDependencies["@​babel/types"]'), andpnpm config setnow accepts dot-leading or subscripted keys (e.g.pnpm config set .ignoreScripts true).pnpm config get --jsonnow prints a JSON serialization of config value, andpnpm config set --jsonnow parses the input value as JSON.Patch Changes
pnpm createcommand, must verify whether the node version is supported even if a cache already exists #9775.*/*to theAcceptheader to avoid getting a 406 error on AWS CodeArtifact #9862.pnpm dlx pkg --helpdoesn't pass--helptopkg#9823.v10.14.0Compare Source
Minor Changes
Added support for JavaScript runtime resolution
Declare Node.js, Deno, or Bun in
devEngines.runtime(insidepackage.json) and let pnpm download and pin it automatically.Usage example:
{ "devEngines": { "runtime": { "name": "node", "version": "^24.4.0", "onFail": "download" (we only support the "download" value for now) } } }How it works:
pnpm installresolves your specified range to the latest matching runtime version.Why this is better:
useNodeVersionandexecutionEnv.nodeVersion)executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.devEngines.runtimesetting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.Related PR: #9755.
Add
--cpu,--libc, and--ostopnpm install,pnpm add, andpnpm dlxto customizesupportedArchitecturesvia the CLI #7510.Patch Changes
pnpm adddownloads packages whoselibcdiffer frompnpm.supportedArchitectures.libc.dlxto parse CLI flags and options between thedlxcommand and the command to run or between thedlxcommand and--#9719.pnpm install --prodshould removing hoisted dev dependencies #9782.pnpm installto incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.v10.13.1Compare Source
Patch Changes
v10.13.0Compare Source
Minor Changes
Added the possibility to load multiple pnpmfiles. The
pnpmfilesetting can now accept a list of pnpmfile locations #9702.pnpm will now automatically load the
pnpmfile.cjsfile from any config dependency named@pnpm/plugin-*orpnpm-plugin-*#9729.The order in which config dependencies are initialized should not matter — they are initialized in alphabetical order. If a specific order is needed, the paths to the
pnpmfile.cjsfiles in the config dependencies can be explicitly listed using thepnpmfilesetting inpnpm-workspace.yaml.Patch Changes
pkg.pr.new, treat them as Git tarball URLs #9694.dangerouslyAllowAllBuilds,onlyBuiltDependencies,onlyBuiltDependenciesFile, andneverBuiltDependencies#9628.pnpm-workspace.yamlwith deep #9701.pnpm rebuildcommand should not add pkgs included inignoredBuiltDependenciestoignoredBuildsinnode_modules/.modules.yaml#9338.shell-quotewithshlexfor quoting command arguments #9381.v10.12.4Compare Source
Patch Changes
Fix
pnpm licensescommand for local dependencies #9583.Fix a bug in which
pnpm ls --filter=not-exist --jsonprints nothing instead of an empty array #9672.Fix a deadlock that sometimes happens during peer dependency resolution #9673.
Running
pnpm installafterpnpm fetchshould hoist all dependencies that need to be hoisted.Fixes a regression introduced in [v10.12.2] by [#9648]; resolves [#9689].
[v10.12.2]: https://github.com/pnpm/pnpm/releases/tag/v10.12.2Add commentMore actions
[#9648]: #9648
[#9689]: #9689
v10.12.3Compare Source
Patch Changes
Regression introduced in v10.12.2 by #9648; resolves #9685.
v10.12.2Compare Source
Patch Changes
enableGlobalVirtualStoreset totrue#9648.--helpand-hflags not working as expected for thepnpm createcommand.pnpm licenses list --jsoncommand is incorrect.pnpm deployfails due to overridden dependencies having peer dependencies causingERR_PNPM_OUTDATED_LOCKFILE#9595.v10.12.1Minor Changes
Experimental. Added support for global virtual stores. When enabled,
node_modulescontains only symlinks to a central virtual store, rather tonode_modules/.pnpm. By default, this central store is located at<store-path>/links(you can find the store path by runningpnpm store path).In the central virtual store, each package is hard linked into a directory whose name is the hash of its dependency graph. This allows multiple projects on the system to symlink shared dependencies from this central location, significantly improving installation speed when a warm cache is available.
To enable the global virtual store, set
enableGlobalVirtualStore: truein your rootpnpm-workspace.yaml, or globally via:NOTE: In CI environments, where caches are typically cold, this setting may slow down installation. pnpm automatically disables the global virtual store when running in CI.
Related PR: #8190
pnpm updatecommand now supports updatingcatalog:protocol dependencies and writes new specifiers topnpm-workspace.yaml.--save-catalogand--save-catalog-name=<name>) topnpm addto save new dependencies as catalog entries.catalog:orcatalog:<name>will be added topackage.jsonand the package specifier will be added to thecatalogsorcatalog[<name>]object inpnpm-workspace.yaml#9425.cifor explicitly telling pnpm if the current environment is a CI or not.Patch Changes
pnpm patchusing semantic versioning rules.v10.11.1Compare Source
Patch Changes
pnpm deploy --legacycreates unexpected directories when the rootpackage.jsonhas a workspace package as a peer dependency #9550.strictPeerDependenciesistruebut all issues are ignored bypeerDependencyRules#9505.pnpm_config_env variables instead ofnpm_config_#9571.--lockfile-onlyflag onpnpm updateto produce a differentpnpm-lock.yamlthan an update without the flag.pnpm deploywork in repos withoverrideswheninject-workspace-packages=true#9283.pnpm -r --silent runshould not print out section #9563.v10.11.0Compare Source
Minor Changes
A new setting added for
pnpm initto create apackage.jsonwithtype=module, wheninit-typeismodule. Works as a flag for the init command too #9463.Added support for Nushell to
pnpm setup#6476.Added two new flags to the
pnpm auditcommand,--ignoreand--ignore-unfixable#8474.Ignore all vulnerabilities that have no solution:
> pnpm audit --ignore-unfixableProvide a list of CVE's to ignore those specifically, even if they have a resolution.
> pnpm audit --ignore=CVE-2021-1234 --ignore=CVE-2021-5678Added support for recursively running pack in every project of a workspace #4351.
Now you can run
pnpm -r packto pack all packages in the workspace.Patch Changes
dangerouslyAllowAllBuildsis set totrue#9472.pnpm linkshould work from inside a workspace #9506.workspaceConcurrencytoMath.min(os.availableParallelism(), 4)#9493.strictPeerDependenciesistruebut all issues are ignored bypeerDependencyRules#9505.updateConfigfrompnpm-workspace.yaml#9500.recursive packurl.parseusage to fix warning on Node.js 24 #9492.pnpm runshould be able to run commands from the workspace root, ifignoreScriptsis set tottrue#4858.v10.10.0Compare Source
Minor Changes
preResolution,importPackage, andfetchershooks from local pnpmfile.Patch Changes
cdcommand, whenshellEmulatoristrue#7838.pnpm-workspace.yaml#9453.npm_package_jsonenvironment variable to the executed scripts #9452.--reporter=silentoption.v10.9.0Compare Source
Minor Changes
Added support for installing JSR packages. You can now install JSR packages using the following syntax:
or with a version range:
For example, running:
will add the following entry to your
package.json:{ "dependencies": { "@​foo/bar": "jsr:^0.1.2" } }When publishing, this entry will be transformed into a format compatible with npm, older versions of Yarn, and previous pnpm versions:
{ "dependencies": { "@​foo/bar": "npm:@​jsr/foo__bar@^0.1.2" } }Related issue: #8941.
Note: The
@jsrscope defaults to https://npm.jsr.io/ if the@jsr:registrysetting is not defined.Added a new setting,
dangerouslyAllowAllBuilds, for automatically running any scripts of dependencies without the need to approve any builds. It was already possible to allow all builds by adding this topnpm-workspace.yaml:dangerouslyAllowAllBuildshas the same effect but also allows to be set globally via:It can also be set when running a command:
Patch Changes
verifyDepsBeforeRunwhennodeLinkerishoistedand there is a workspace package without dependencies andnode_modulesdirectory #9424.verifyDepsBeforeRunsupport fornodeLinker: pnp. CombiningverifyDepsBeforeRunandnodeLinker: pnpwill now print a warning.v10.8.1Compare Source
Patch Changes
package.json,onlyBuiltDependencieswill be written topnpm-workspace.yamlfile #9404.v10.8.0Compare Source
Minor Changes
Experimental. A new hook is supported for updating configuration settings. The hook can be provided via
.pnpmfile.cjs. For example:Now you can use the
pnpm addcommand with the--configflag to install new configurational dependencies #9377.Patch Changes
!/inpnpm-workspace.yaml. This fixes a regression introduced by #9169.pnpm audit --fixshould update the overrides inpnpm-workspace.yaml.pnpm linkshould update overrides inpnpm-workspace.yaml, not inpackage.json#9365.v10.7.1Compare Source
Patch Changes
pnpm config setshould convert the settings to their correct type before adding them topnpm-workspace.yaml#9355.pnpm config getshould read auth related settings via npm CLI #9345.~/in a path in.npmrcwith the home directory #9217.v10.7.0Compare Source
Minor Changes
pnpm config getandlistalso show settings set inpnpm-workspace.yamlfiles #9316.It should be possible to use env variables in
pnpm-workspace.yamlsetting names and value.Add an ability to patch dependencies by version ranges. Exact versions override version ranges, which in turn override name-only patches. Version range
*is the same as name-only, except that patch application failure will not be ignored.For example:
The above configuration would apply
patches/foo-3.patchto[email protected],patches/foo-2.patchto allfooversions which satisfy^2.0.0except2.1.0, andpatches/foo-1.patchto the remainingfooversions.pnpm config set --location=projectsaves the setting to apnpm-workspace.yamlfile if no.npmrcfile is present in the directory #9316.Rename
pnpm.allowNonAppliedPatchestopnpm.allowUnusedPatches. The old name is still supported but it would print a deprecation warning message.Add
pnpm.ignorePatchFailuresto manage whether pnpm would ignore patch application failures.If
ignorePatchFailuresis not set, pnpm would throw an error when patches with exact versions or version ranges fail to apply, and it would ignore failures from name-only patches.If
ignorePatchFailuresis explicitly set tofalse, pnpm would throw an error when any type of patch fails to apply.If
ignorePatchFailuresis explicitly set totrue, pnpm would print a warning when any type of patch fails to apply.Patch Changes
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.