chore: update auto merge on patch or minor#222
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
|
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/auto-merge-on-patch-or-minor
branch
from
d2c558b to
9c66f81
Compare
renovate
Bot
force-pushed
the
renovate/auto-merge-on-patch-or-minor
branch
from
9c66f81 to
39c57b5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
17.0.7→17.0.824.17.0→24.18.011.7.0→11.8.011.9.011.7.0→11.8.011.9.0Release Notes
lint-staged/lint-staged (lint-staged)
v17.0.8Compare Source
Patch Changes
#1809
179b437- Fix lint-staged discarding the ongoing merge conflict status (.git/MERGE_HEAD) when using the--hide-unstagedor--hide-alloptions.#1811
3d0b2c0- Fix issues with Git commands that are successful but also emit warnings tostderr, by ignoring thestderroutput completely when the process exits with code 0. This was the behavior when usingnano-spawnandexeca, but when switching totinyexecin 16.3.0 bothstdoutandstderrwere used as interleaved output.nodejs/node (node)
v24.18.0: 2026-06-23, Version 24.18.0 'Krypton' (LTS), @richardlau prepared by @sxaCompare Source
Notable Changes
e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #6352744c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #621834c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #631558c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #630793f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834Commits
d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #635979ff36e40f0] - build: add --enable-all-experimentals build flag (Paolo Insogna) #627557c22ee23aa] - build: defNODE_USE_NODE_CODE_CACHEonly used in node_mksnapshot (Chengzhong Wu) #635882551abdb4a] - build,win: enable x64 PGO (Stefan Stojanovic) #62761e8a55ce9b1] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763ae61cd68f3] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #633633d05a1d396] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363f9d10a3f6b] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363e431d93e9e] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #6336356e2505e48] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #632553bac77f2a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #632551bff901b09] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #632554433fca3df] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #63111b5cf01217a] - crypto: harden KeyObject internal slots (Filip Skokan) #63111ce84aef37d] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #6288326781689b0] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #62905aeea8f4970] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706407cf91656] - crypto: guard against size_t overflow on experimental 32-bit arch (Filip Skokan) #62626bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527b46d52b283] - crypto: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #6352761826df455] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #6353116d2fd3c07] - crypto: align verifyOneShot accepted types (Anshika Jain) #632803b8330deda] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576141de35399] - debugger: add --help tonode inspectand improve docs (Joyee Cheung) #63201b76bfcd4fa] - deps: upgrade npm to 11.16.0 (npm team) #636024ec142314c] - deps: SQLite: cherry-pickb869ed6(Junsu Han) #6352519e8ce1c36] - deps: upgrade npm to 11.15.0 (npm team) #634638a264260e2] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #6321750c8ff3f94] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #628116e56f01c4b] - deps: V8: cherry-pick435a2cd(Matthias Liedtke) #631363ba813b242] - deps: cherry-pick libuv/libuv@a43e543(Ali Hassan) #632222390e3a5ac] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #6365052a1c18374] - doc: updategit node landinstructions for security releases (Antoine du Hamel) #635863e6b4da037] - doc: drop --experimental from --permission (Rafael Gonzaga) #6358384d05163b9] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #634797da2a4450e] - doc: fix URL postMessage example in worker_threads (Kit Dallege) #622033d79bd8b29] - doc: clarifyfilteroption ofsqlite.database.applyChangeset(Antoine du Hamel) #635154f4174aace] - doc: fix double spaces in ERR_TLS_INVALID_PROTOCOL_METHOD (Daijiro Wachi) #63511388323ca4b] - doc: fix double space in modules.md (Daijiro Wachi) #635125258ccc058] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #6345343e83e6507] - doc: fix typo in deprecations (Daijiro Wachi) #63434f05a61d54c] - doc: remove unsupported template type from v8.md (René) #63410c39d5fc820] - doc: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) #62696398261f911] - doc: remove the bi-monthly contributor spotlight section (Claudio Wunder) #62734fd9e14c405] - doc: update http2'spushandtrailersevents withrawHeadersparam (YuSheng Chen) #63259b943ce6933] - doc: remove inactive members from Triagers list (Antoine du Hamel) #633294b9cdfc022] - doc: reference correct function in Module docs (Robin Malfait) #63247bed84b6df2] - doc: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) #6321132ea70569b] - doc: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) #631874627bcfd82] - doc: run license-builder (github-actions[bot]) #6323228eba71845] - doc: add large pull requests contributing guide (Matteo Collina) #628292648efd438] - doc: remove unnecessary<!-- eslint-magic comments (Antoine du Hamel) #63200a95fc1f8fc] - doc: clarify SEA platform support excludes darwin-x64 (MJSHANG) #63181aaef29e2e1] - doc: update release steps when post-release fails (Rafael Gonzaga) #631317d81419cf2] - doc: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) #63121ececd80d81] - doc: document the latest-vX.x schema (Marco Ippolito) #6303327c1c1d842] - doc: remove list of versions inBUILDING.md(Antoine du Hamel) #63113e369886a65] - doc,sqlite: document entryPoint argument for loadExtension (Edy Silva) #63152e4e5137cbd] - errors: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) #634916d1f6048d2] - fs: makeDateproperties onStatsenumerable (LiviaMedeiros) #6332844c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #640044c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #6315539f61fb06c] - http2: emit session close before stream close (Matteo Collina) #634148a8f2127d1] - http2: validate non-link headers in writeEarlyHints (Matteo Collina) #620178c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079c05f38229b] - lib: cleanup stateless diffiehellman key handling (Filip Skokan) #626451c16b45d35] - lib: refactor internal webidl converters (Filip Skokan) #6297902f35d6dce] - lib: definekEnumerablePropertyatomically (Antoine du Hamel) #6360912c51547ba] - lib: fix typos in esm loader comments (RonGamzu) #634659b03b84262] - lib: fix typo idenity => identity (Daijiro Wachi) #63112a84e6b0567] - lib: fixes validator message (Daijiro Wachi) #6282311734166a8] - lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) #630177cead61d21] - meta: flip mcollina emails in .mailmap (Matteo Collina) #63621a08cfcfd35] - meta: label "source maps" PRs (Chengzhong Wu) #63591d56e8d2512] - meta: addvfssubsystem label (René) #623316201cfe488] - meta: skip scheduled workflows on forks (Jamie Magee) #63565f095e2bd31] - meta: add additional gitignore entries (James M Snell) #632671ea52c444c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63402b1b2327611] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #632357d88e130a9] - meta: ignore AI assistants files (Matteo Collina) #62612a53b51df38] - module: load ESM helpers eagerly in the snapshot (Joyee Cheung) #6355069df688fff] - module: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) #6292075d9a4ed47] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710c20aa4c47b] - quic: add reusePort option to QuicEndpoint (James M Snell) #6326726a30d8a7f] - quic: implement rate limiting for version nego and immediate close (James M Snell) #632670b534b5770] - quic: fixup linting issue after other changes (James M Snell) #632674b367cbe09] - quic: remove unused binding variable in session.cc (James M Snell) #631772574bef5a6] - repl: fix dedup comparing normalized line against raw history (Daijiro Wachi) #6288630e71c7e49] - sqlite: keep source database alive during backup (Matteo Collina) #62673677ca7e76c] - src: simplify OpenSSL feature gates (Filip Skokan) #63255c863c75c39] - src: add BoringSSL EVP enumeration fallback (Filip Skokan) #63206f6b2466921] - src: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) #6292492d4f07dd2] - src: remove license headers for new node_profiling files (Chengzhong Wu) #630668ac5d771c8] - src: split profiling helpers from util (Ilyas Shabi) #6300885d1639495] - src: remove TOCTOU race condition when encoding SAB-backedBuffers (Antoine du Hamel) #635179473c5f05c] - src: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) #63231f35c91ee68] - src: improve token return value check (James M Snell) #6348326f677c1c5] - src: exposenode::RegisterContextto make a node managed context (Chengzhong Wu) #62322275cf909b6] - src,sqlite: only passxFilterwhen user provided a callback (Antoine du Hamel) #63516287e02303f] - src,sqlite: remove dead code (Edy Silva) #6320458fa2ee189] - stream: switch to internalsleepbinding (Antoine du Hamel) #63611f954ab3f1a] - stream: use data listener for compose forwarding (Trivikram Kamat) #63593dc57173003] - stream: fix Writable.toWeb() hang on synchronous drain (sangwook) #611973f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834cee279c5d6] - stream: remove unnecessary check (Antoine du Hamel) #6303061b20f60a3] - test: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) #63161a835363808] - test: update WPT for WebCryptoAPI to97bbc72(Node.js GitHub Bot) #63417a00297480b] - test: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) #623895a95a2b055] - test: shorten path in net pipe connect errors (Matteo Collina) #634055e8ff22d8f] - test: remove test-node-output-v8-warning (Joyee Cheung) #63469ee15380950] - test: update test426-fixtures to9b9e225(Node.js GitHub Bot) #633739e063d9bea] - test: update WPT for url toe4a4672(Node.js GitHub Bot) #63372503bee4b43] - test: deflake async-hooks statwatcher test (Trivikram Kamat) #63396cccc7c32d8] - test: avoid test_runner watch restart in spec snapshot (Trivikram Kamat) #63392c89489258c] - test: reduce watch mode restart flakiness (Trivikram Kamat) #63390e4d5e2578e] - test: isolate rerun-failures state file under tmpdir (Chemi Atlow) #63449362644a9ba] - test: wait for ok before initial break after restart (Yuya Inoue) #62807c4058d0e05] - test: disable Maglev in near-heap-limit worker test (Trivikram Kamat) #63398214da630a7] - test: deflake connection refused proxy tests (Trivikram Kamat) #633951d61a29876] - test: avoid repeated writes in watch helper (Trivikram Kamat) #633862004e25387] - test: deflake watch mode worker test (Trivikram Kamat) #63384d691cccfc1] - test: relax test-memory-usage arrayBuffers check (inoway46) #632440ff6bf853c] - test: reduce flakiness ofdifferent-registry-per-thread(Antoine du Hamel) #63244d9f4e8e503] - test: fix flaky test-watch-mode-inspect timeout (Matteo Collina) #633616d7cd50328] - test: relax min assertion in test-performance-eventloopdelay (Marco) #631009dafe1d2d8] - test: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) #62055989b2de973] - test: avoid initial-break wait in restart-message (inoway46) #62060a072a25ee7] - test: move FFI tests toNATIVE_SUITES(Antoine du Hamel) #6316564efbfd878] - test: use ERM to destroy sqlite database handles after tests (René) #630767dee66cd94] - test_runner: dont buffer unordered events in process isolation mode (Moshe Atlow) #63432d257eec1e3] - test_runner: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) #63431288c320e2f] - test_runner: show replayed-from-attempt hint in spec reporter (Moshe Atlow) #63429904bdf5bb4] - test_runner: preserve run duration when using test-rerun (Moshe Atlow) #63429df183d7bfa] - test_runner: avoid hanging on incomplete v8 frames (Ali Hassan) #62704ec86c69726] - test_runner: fix diagnostics channel context tracking (Moshe Atlow) #6328394e5f63b83] - tls: add unsupported renegotiation error (Filip Skokan) #6316106d308fb61] - tools: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) #631112e4a0d0c91] - tools: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot[bot]) #634154c9666b366] - tools: skip commit-lint on backport pull requests (Marco) #6337867d0c490a8] - tools: fix skip oftest-interneton forks (Antoine du Hamel) #6349202f73c7cac] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #630755d016d3241] - tools: update gyp-next to 0.22.2 (Node.js GitHub Bot) #6337455af0f0edb] - tools: fix test426 updater (Antoine du Hamel) #63271d8475e167a] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110c605df9e50] - util: remove unused functions (Antoine du Hamel) #63612fe4540ebdb] - util: create hex style cache and fast path (Guilherme Araújo) #62999pnpm/pnpm (pnpm)
v11.8.0Compare Source
Minor Changes
c112b61: Added a--dry-runoption topnpm install. It runs a full dependency resolution and reports what an install would change, but writes nothing to disk (no lockfile, nonode_modules) and always exits with code 0. This mirrors the preview semantics ofnpm install --dry-run#7340.179ebc4:pnpm run --no-bailnow exits with a non-zero exit code when any of the executed scripts fail, while still running every matched script to completion. This makes the exit-code behavior of--no-bailconsistent between recursive and non-recursive runs (recursive runs already failed at the end). Previously, a non-recursivepnpm run --no-bailalways exited with code 0, even when a script failed #8013.0474a9c: Added support for generating Node.js package maps atnode_modules/.package-map.jsonduring isolated and hoisted installs. Added thenode-experimental-package-mapsetting to inject the generated map into pnpm-managed Node.js script environments, and thenode-package-map-typesetting to choose betweenstandardandloosepackage maps.dcededc:pnpm sbomnow marks components reachable only throughdevDependencieswith CycloneDXscope: "excluded"and thecdx:npm:package:developmentproperty. Theexcludedscope documents "component usage for test and other non-runtime purposes", which matches the semantics of a devDependency; the property is the CycloneDX npm-taxonomy marker emitted by@cyclonedx/cyclonedx-npm, so both modern (scope) and existing (property) consumers are covered. Components reachable at runtime (including installedoptionalDependencies) omitscopeand default torequired.1495cb0: Added per-package SBOM generation with--outand--splitflags. Use--out out/%s.cdx.jsonto write one SBOM per workspace package to individual files, or--splitfor NDJSON output to stdout. When--filterselects a single package, the SBOM root component now uses that package's metadata. Workspace inter-dependencies (workspace:protocol) and their transitive dependencies are included. Author, repository, and license fall back to the root manifest when the package doesn't define them.293921a: feat(view): support searching project manifest upward when package name is omittedWhen running
pnpm viewwithout a package name, the command now searchesupward for the nearest project manifest (
package.json,package.yaml, orpackage.json5) and uses itsnamefield.If the manifest exists but lacks a
namefield, an error is thrown.This change also replaces the
find-updependency withempathicforimproved performance and consistency across workspace tools.
Patch Changes
29ab905: Fixedpnpm updateoverriding the version range policy of a named catalog whose name parses as a version (e.g.catalog:express4-21). Thecatalog:reference carries no pinning of its own, so the prefix from the catalog entry (such as~) is now preserved instead of being widened to^#10321.bee4bf4: Security: validate config dependency names and versions from the env lockfile (pnpm-lock.yaml) before using them to build filesystem paths. A committed lockfile with a traversal-shapedconfigDependenciesname (such as../../PWNED) or version (such as../../../PWNED) could previously causepnpm installto create symlinks or write package files outsidenode_modules/.pnpm-configand the store. Names must now be valid npm package names and versions must be exact semver versions; the same validation is applied to optional subdependencies of config dependencies, and to the legacy workspace-manifest format before any lockfile is written. See GHSA-qrv3-253h-g69c.96bdd57: Fixlink:workspace protocol switching tofile:afterpnpm rmis run from inside a workspace package whose target workspace dependency has its own dependencies, wheninjectWorkspacePackages: trueis set. Follow-up to #10575, which fixed the same symptom for workspace packages without dependencies.302a2f7: No longer warn about using bothpackageManageranddevEngines.packageManagerwhen the two fields pin the same package manager at the same version with the same integrity hash (e.g. bothpnpm@11.5.1+sha512.…). Previously the hash was stripped from the legacypackageManagerfield but not fromdevEngines.packageManager, so even identical specifications looked like a mismatch #12028.The warning still fires on any genuine divergence, and several cases now state the specific reason instead of a single generic message: a different package manager, a different version, or contradictory integrity hashes for the same version.
3f0fb21: Fixed the progress line showing leftover characters from external processes that write to the terminal between progress updates (e.g. an SSH passphrase prompt would leave a fragment likeadded 0sa':). The interactive reporter now redraws each frame in place, erasing to the end of the display before reprinting, so any such remnants are cleared #12350.564619f: Fixedpnpm approve-buildsreporting "no packages awaiting approval" when a build-script dependency whose approval was revoked (e.g. aftergit stashdrops theallowBuildsfrompnpm-workspace.yaml) is re-added. The revoked packages are now correctly recorded in.modules.yamlsoapprove-buildscan find them. #122213d1fd20: Skip the redundant "target bin directory already contains an exe called node" warning on Windows when the existingnode.exealready matches the target (same hard link or identical content) pnpm/pnpm#12203.1b02b47: Fix macOS Gatekeeper blocking native binaries (.node,.dylib,.so) by removing thecom.apple.quarantineextended attribute after importing them from the store.When pnpm imports files from its content-addressable store into
node_modules, macOS preserves extended attributes, includingcom.apple.quarantine. If this xattr is present on a store blob (e.g. it was first written under a Gatekeeper-enabled app such as a Git client), it propagates tonode_modules, and Gatekeeper blocks the native binary from loading even though pnpm already verified the file's integrity against the lockfile.After importing a package, pnpm now strips
com.apple.quarantinefrom its native binaries, matching Homebrew's behaviour of dropping quarantine from verified downloads. The cleanup is macOS-only, runs in a single batchedxattrcall per package, is restricted to native binaries (other files are untouched), and is non-fatal (it logs a warning on unexpected errors).Fixes #11056
61969fb: Fixpnpm installwithoptimisticRepeatInstallincorrectly reportingAlready up to datewhenpnpm-lock.yamlchanged but project manifests did not. This affected workflows such as checking out or restoring only the lockfile #12100.Also fixes
checkDepsStatusto use the correct lockfile path whenuseGitBranchLockfileis enabled, so the optimistic fast-path and lockfile modification detection work withpnpm-lock.<branch>.yamlfiles instead of always stat'ingpnpm-lock.yaml. Merge-conflict detection now reads the resolved lockfile name as well, and withmergeGitBranchLockfilesenabled everypnpm-lock.*.yamlis scanned for modifications and conflicts. The git branch is now resolved by reading.git/HEADdirectly (no process spawn) and uses the workspace directory rather thanprocess.cwd().5c12968: Fix recursive updates of transitive dependencies when the update command mixes transitive dependency patterns with direct dependency selectors. For example,pnpm up -r "@​babel/core" uuidnow updates matching transitive@babel/coredependencies even whenuuidis a direct dependency selector #12103.9d79ba1: Register thepnpm update --no-saveflag in the CLI help and option parser.0474a9c: Fixedpnpm importfor Yarn v2 lockfiles whenjs-yamlv4 is installed.9e0c375: Fixedpnpm installrepeatedly prompting to remove and reinstallnode_modulesin a workspace package whenenableGlobalVirtualStoreis enabled. The post-install build step recorded a per-projectnode_modules/.pnpmvirtual store directory innode_modules/.modules.yaml, overwriting the global<storeDir>/linksvalue the install step had written. The next install then detected a virtual-store mismatch (ERR_PNPM_UNEXPECTED_VIRTUAL_STORE). The build step now derives the same global virtual store directory as the install step #12307.223d060: Document the--cpu,--osand--libcflags in the output ofpnpm install --help. These flags were already supported but were only documented on the website #12359.e85aea2: Avoid readingREADME.mdfrom disk when publishing if the publish manifest already provides areadmefield. The README is now only read lazily, insidecreateExportableManifest, when it is actually needed.3188ae7: Fixedpnpm peers checkto accept loose peer dependency ranges such as>=3.16.0 || >=4.0.0-when the installed peer version satisfies the range #12149.531f2a3: Fixedpnpm updaterewriting aworkspace:dependency that points at a local path (e.g.workspace:../packages/foo/dist) into a normalizedlink:or version-range specifier. Such specifiers are now preserved verbatim when the workspace protocol is preserved #3902.fe66535: Fixed a lockfile non-convergence bug where an incremental install kept a duplicate transitive dependency that a fresh install would not produce. When a package is reused from the lockfile, its child edges are taken verbatim and bypass the preferred-versions walk, so a transitive dependency could stay pinned to an older version even after a direct dependency resolved to a higher version that satisfies the same range. The resolver now refreshes such a stale pin to the higher direct-dependency version during resolution — so the older version is never resolved or fetched, and the incremental result converges to the fresh one.6d35338:pnpm installdetects changes inside local file dependencies again. The optimistic repeat-install fast path only tracks manifest and lockfile modification times, so edits inside a local dependency's directory (or a repacked local tarball) were reported as "Already up to date". Projects with local file dependencies (file:and bare local path or tarball specifiers, declared directly or throughpnpm.overrides) now always run a full install, which refetches those dependencies, matching pnpm v10 behavior #11795.4ca9247: Preserve the existing Node.js runtime version prefix when resolvingnode@runtime:<range>to a concrete version.30c7590: Create shorter CAFS temporary package directories to leave room for lifecycle scripts that create IPC socket paths under TMPDIR.13815ad: Reporter output (warnings, progress) forpnpm storeandpnpm configsubcommands now goes to stderr instead of stdout. This fixes scripts that capture their stdout (e.g.PNPM_STORE=$(pnpm store path),pnpm config list --json | jq) from getting warnings mixed into the result.1c05876: Avoid relinking unchanged child dependencies and remove stale child links during warm installs.817f99d: Fixed lockfile churn where a package'stransitivePeerDependenciescould be dropped (and shift between packages) when the package participates in a dependency cycle. A cycle re-entry resolves against truncated children, so it must not be cached as "pure"; otherwise sibling occurrences of the same package short-circuit and lose transitive peers depending on traversal order #5108.eba03e0: Fixpnpm installreporting "Already up to date" after a catalog entry inpnpm-workspace.yamlwas reverted to a previous version. After an update modified a catalog, the workspace state cache stored the pre-update catalog versions, so reverting the entry back to its original version was not detected as an outdated state #12418.3b54d79:pnpm updatenow keeps lockfileoverridesthat resolve through a catalog in sync with the catalog. Previously, when an override referenced a catalog (e.g.overrides: { foo: 'catalog:' }) andpnpm updatebumped that catalog entry, the lockfile'scatalogsadvanced while the resolvedoverrideskept the old version. The resulting lockfile was internally inconsistent, so a laterpnpm install --frozen-lockfilefailed withERR_PNPM_LOCKFILE_CONFIG_MISMATCH.9d0a300: Fixedpnpm version --recursiveso it honors the workspace selection. In recursive mode the version bump now applies to the packages resolved from the workspace filter (selectedProjectsGraph), matching the behavior ofpnpm publish --recursive, instead of always bumping every workspace package #11348.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.