chore(deps): update npm packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
enhanced-resolve	5.21.1 → 5.21.3
pnpm (source)	10.33.2 → 10.33.4
semver	7.7.4 → 7.8.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

webpack/enhanced-resolve (enhanced-resolve)

v5.21.3

Compare Source

Patch Changes

• TsconfigPathsPlugin now falls through to normal module resolution when a paths pattern matches but the mapped path does not exist, matching TypeScript's native resolution behavior. Previously, patterns like "@​*" would block scoped npm packages (e.g. @sentry/react) from resolving via node_modules. (by @​xiaoxiaojx in #​579)

v5.21.2

Compare Source

Patch Changes

• Fix TsconfigPathsPlugin circular project references causing stack overflow, add support for extending from unscoped npm packages, and use stat instead of readFile for existence checks in extends resolution. (by @​xiaoxiaojx in #​575)

• perf: dedupe miss paths in DirectoryExistsPlugin/FileExistsPlugin and prune the per-resolve TsconfigPathsPlugin context scan. (by @​alexander-akait in #​574)

• perf: drop a dead Map lookup in findMatch and flatten AliasFieldPlugin's cache check. (by @​alexander-akait in #​574)

• perf: hot-path tweaks in ImportsFieldPlugin, AliasUtils, and util/entrypoints. (by @​alexander-akait in #​574)

• perf: cut per-resolve allocations in Resolver.parse, loadDescriptionFile, and TsconfigPathsPlugin._selectPathsDataForContext. (by @​alexander-akait in #​574)

pnpm/pnpm (pnpm)

v10.33.4: pnpm 10.33.4

Compare Source

Patch Changes

• Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

  A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.

• Fix a regression where pnpm --recursive --filter '!<pkg>' run/exec/test/add would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative --filter arguments are provided, matching the documented behavior. To include the root, pass --include-workspace-root #​11341.

Platinum Sponsors

Gold Sponsors

v10.33.3

Compare Source

npm/node-semver (semver)

v7.8.0

Compare Source

Features

• 0d0a0a2 #​855 Add truncate function (#​855) (@​pjohnmeyer, @​owlstronaut)

Bug Fixes

• 3905343 #​859 Warn when defaulting to --inc=patch in CLI (@​pjohnmeyer)

Documentation

• c368af6 #​853 fix typos in documentation (#​853) (@​ankitkumar572005)
• 37776c3 #​846 fix BNF grammar to distinguish prerelease from build identifiers (#​846) (@​abhu85, @​claude)

Chores

• 9542e09 #​860 template-oss-apply (@​owlstronaut)
• 937bc2c #​860 template-oss-apply@5.0.0 (@​owlstronaut)
• 6946fef #​852 bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#​852) (@​dependabot[bot], @​npm-cli-bot)

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.