fix(deps): update frontend non-major dependencies #122
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/frontend-non-major-dependencies"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
11.9.0→11.17.03.9.0→3.10.08.62.0→8.65.0Release Notes
pnpm/pnpm (pnpm)
v11.17.0: pnpm 11.17Compare Source
Minor Changes
Added a new setting,
update.githubActionsServer, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from theGITHUB_SERVER_URLenvironment variable, falling back tohttps://github.com. The URL must use thehttps://orhttp://protocol #13220.pnpm outdatedandpnpm updateno longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.Setting
update.githubActionstofalsenow makespnpm outdatedand the interactivepnpm updateskip GitHub Actions dependencies.Patch Changes
The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll pnpm/pnpm#12721.
Fixed
catalog:references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g.packages/foo) through a pnpr server #13232.Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug #13164.
Revert script ordering change for
pnpm run --sequential /regex/Support the
from-gitargument in thepnpm versioncommand.When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication pnpm/pnpm#12721.
Platinum Sponsors
Gold Sponsors
v11.16.0: pnpm 11.16Compare Source
Minor Changes
The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it.
pnpm version -randpnpm change statuscheck the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at1100.0.0with aminorchangeset is therefore published as1100.0.0rather than skipping straight to1100.1.0.Added a
--changesetflag topnpm update. Setupdate.changesettotrueinpnpm-workspace.yamlto enable this behavior by default, and use--no-changesetto override the setting for one update. After the update completes, pnpm writes a.changeset/pnpm-update-<suffix>.mdfile declaring a patch bump for every workspace package whosedependenciesoroptionalDependencieswere changed by the update and a major bump whenpeerDependencieschanged, including packages that consume an updated catalog entry via thecatalog:protocol. Private packages, packages without a name, and packages listed in theignorearray of.changeset/config.jsonare skipped. If.changeset/config.jsondoes not exist, a warning is printed and no changeset is generated.Added GitHub Actions dependencies to
pnpm outdatedand interactivepnpm update. Non-interactive updates can include them with--include-github-actionsor by settingupdate.githubActionstotrueinpnpm-workspace.yaml. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.Added
updateandauditsettings sections topnpm-workspace.yaml, superseding the awkwardly namedupdateConfig,auditConfig, and top-levelauditLevelsettings:update.ignoreDepslists dependency name patterns thatpnpm updateandpnpm outdatedshould skip.audit.levelandaudit.ignoretunepnpm audit.The deprecated
updateConfig,auditConfig, andauditLevelsettings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections.Patch Changes
pnpm add --save-exact/--save-prefixandpnpm updatewriting a package's version with thepeerDependenciesrange's prefix (e.g.^19.2.7instead of the requested19.2.7) whenever the same package also appeared inpeerDependencies. A realdependencies/devDependencies/optionalDependenciesentry now takes precedence over a same-namedpeerDependenciesentry when computing the current specifiers #13108.Platinum Sponsors
Gold Sponsors
v11.15.1: pnpm 11.15.1Compare Source
Patch Changes
pnpm installnow detects asupportedArchitectureschange and re-evaluates previously skipped platform-specific optional dependencies, instead of reporting the project as up to date and leaving the packages for the old architecture set in place.pnpm setupnow removes leftover v10-layout shims at the top ofPNPM_HOME, sopnpm self-updateno longer warns about a v10 installation layout after PATH has been migrated to the v11PNPM_HOME/binlayout. Applies to both the TypeScript CLI and pacquet.In the TypeScript CLI,
self-updatealso no longer treats a dangling legacy shim (one whose install target was garbage-collected) as a real v10 layout, so the warning can no longer fire on dead shim files.Closes #12496.
Completed pnpm runtime installation parity for Node.js, Deno, and Bun, including runtime failure policy, target architecture selection, and dependency runtime engines. Runtime failure overrides now preserve explicit runtime dependencies without matching engine entries.
Fixed
pnpm installrunning out of memory while resolving large dependency graphs #8441. The resolver kept full registry documents — per-version readmes, scripts, descriptions, and other install-irrelevant bulk — in memory for every package fetched with full metadata (optional dependencies, and packages re-fetched forminimumReleaseAge's publish timestamps). Every retained document is now condensed down to the field set installation actually reads, which reduces peak resolution memory by several times on workspaces with more than a thousand packages.When a dependency's build script fails under
enableGlobalVirtualStore, the global virtual store directory it was being built in is now removed for scoped packages too. Previously the cleanup resolved one directory level short of the hash directory for a scoped name, leaving a half-built directory behind that later installs would reuse.Fixed
pnpm login,pnpm adduser, andpnpm logoutagainst a registry hosted under a URL subpath (e.g.https://example.com/npm/registry) when the configured URL has no trailing slash. Such URLs were left unnormalized, so the last path segment was dropped when building the login and token endpoints and the auth token was stored under a truncated key. Registry URLs with a path now always get a trailing slash appended during normalization, matching how root-level registry URLs are handled.Platinum Sponsors
Gold Sponsors
v11.15.0: pnpm 11.15Compare Source
Minor Changes
peerDependenciesMeta(for exampledebug'ssupports-colorpeer) are now resolved from a satisfying version already present in the dependency graph, the same way explicitly declared optional peer dependencies are. Previously such peers were only resolved this way when the package's metadata was read back from the lockfile, so an unrelated dependency change could rewrite peer resolutions across the whole lockfile.Patch Changes
Updated
adm-zipto prevent crafted ZIP archives from causing excessive memory allocation.pnpm version -rno longer writes a versioning-ledger entry with no consumed intents as a bareintents:key, which the next run failed to read withERR_PNPM_INVALID_VERSIONING_LEDGER. Empty intent lists are now written asintents: [], and the ledger reader accepts the bare form left by earlier releases.Fixed pnpr workspace resolution to preserve project names and versions for
workspace:dependencies.Platinum Sponsors
Gold Sponsors
v11.14.0: pnpm 11.14Compare Source
Minor Changes
peerDependenciesnow accept dependency specifiers that carry a scheme — a named-registry spec (<registry>:<version>), annpm:alias, or afile:/git/URL spec — instead of rejecting them withERR_PNPM_INVALID_PEER_DEPENDENCY_SPECIFICATION#13095. Such a peer is matched against the semver range carried by the specifier (work:5.x.xis checked as5.x.x,npm:bar@^5as^5), or against*when it carries no version, while the original specifier still selects the package to auto-install. Barename@versionvalues, which are almost always a mistake, are still rejected.Added
pnpm doctor, which diagnoses the pnpm installation and the environment it runs in: the versions and install method, whether the global bin directory is onPATH, whether the store and cache are writable, which link strategies (reflink, hardlink, symlink) the store's filesystem supports, registry connectivity, and an offlinefile:install that exercises the resolve/store/link path end to end. Each check reports how to fix what it finds, and the command exits non-zero when any check fails.Use
--offlineto skip the checks that need network access,--jsonfor machine-readable output, and--benchmarkto time the filesystem and install checks.Added support for executing multiple scripts matching a RegExp passed to
pnpm run(e.g.,pnpm run "/^build:.*/"), running matched scripts in deterministic lexicographical order. Restored the--sequential(-s) CLI option forpnpm run, which forcesworkspaceConcurrencyto 1 so that matched scripts run sequentially one by one across and within packages.Patch Changes
Fixed
pnpm installfailing withERR_PNPM_LOCKFILE_IS_SYMLINKwhenpnpm-lock.yamlis a symlink, as build sandboxes such as Bazel and Nix stage it #13073. Reading a lockfile through a symlink is allowed again, and an install that leaves the lockfile unchanged no longer rewrites it, so--frozen-lockfileno longer needs to write at all. Writing a changed lockfile through a symlink is still refused, as that would redirect the write onto the symlink's target.Fixed frozen installs incorrectly treating equivalent Git dependency specifiers as a stale lockfile. See #13039.
pnpm owner lsnow reports authentication and authorization failures (401/403) as dedicated errors that include the registry's response body, matchingpnpm owner add/rm, instead of a genericFailed to fetch ownersmessage.Recover from a metadata cache entry that disappears (concurrent cache cleanup, antivirus) after the registry has already answered the conditional request with
304 Not Modified. The metadata is re-requested once without cache validators instead of failing the install withERR_PNPM_CACHE_MISSING_AFTER_304.A project pinned to a broken pnpm release via
packageManagerordevEngines.packageManagernow reports which release is broken and what to do about it, instead of failing inside the installer.pnpm self-updatealready refused these releases; the version switch does too.Prevent broken-lockfile errors from including snippets of the lockfile's contents.
pnpm self-updatenow checks that the version it installed can run before making it the active pnpm. A release that installs but cannot execute is discarded with an error instead of replacing a working installation.Fixed an out-of-memory regression when workspace projects concurrently resolve a package with large registry metadata pnpm/pnpm#13077.
Fixed
pnpm updaterewriting exact version pins that use the=operator (for example=3.5.1) to a caret range (^3.5.1). Exact pins are now preserved and written back as the bare version. See #12745.Platinum Sponsors
Gold Sponsors
v11.13.1: pnpm 11.13.1Compare Source
Patch Changes
pnpm packapplying workspace-root ignore rules when a workspace package has its own.npmignorefile.minimumReleaseAgeapproval prompt visible duringpnpm install. The progress reporter now pauses its redraws while a prompt is waiting for input instead of overwriting it, so the install no longer hangs on a question the user cannot see #13019.pnpm self-updatefailing to link native platform binaries stored in sibling global virtual store slots.v11.13.0: pnpm 11.13Compare Source
Minor Changes
Added
versioning.epicstopnpm-workspace.yaml. An epic ties a group of member packages to a lead package, constraining every member's major version to a band derived from the lead's major: while the lead is on majorM, members live inM*100 … M*100+99. Members move independently inside the band (patch, minor, and amajorintent that stays in-band); a bump that would carry a member past the band ceiling is rejected until the lead advances its own major. When a release plan takes the lead to a new stable major, every member re-bases to the band floor in the same plan. Membership is matched with pnpm's package selectors — name globs,./-prefixed directory globs, and!-prefixed negations.Added the
teamcommand for managing organization teams and team memberships on the registry, with create, destroy, add, rm, and ls subcommands and support for --otp, --parseable, and --json flags.Added native workspace release management #12952: the new
pnpm changecommand records change intents as changesets-compatible.changeset/*.mdfiles (pnpm change statusshows the pending release plan), and the barepnpm version -rconsumes them — bumping versions across the workspace with dependent propagation throughworkspace:ranges, fixed groups, amaxBumpcap,--filternarrowing, and--dry-run— writing changelogs, and recording consumed intents in a committed ledger that keeps cherry-picks and merge-backs between release branches safe. Packages can be moved onto per-package release lanes with the newpnpm lane <name> --filter <pkg>command and back withpnpm lane main --filter <pkg>(pnpm laneshows the membership), releasingX.Y.Z-lane.Nprereleases from the same runs that release stable versions of the packages on the main lane. Configuration lives under the newversioningkey ofpnpm-workspace.yaml(fixed,ignore,maxBump,lanes,changelog). When two workspace projects publish the same name, intent files,versioning.lanes, andversioning.fixed/ignoremay reference a project by its workspace-relative directory path (e.g."./pnpm/npm/pnpm") — the one additive extension to the changesets format, applied automatically bypnpm change.Release changelogs default to
registrystorage (versioning.changelog.storage): noCHANGELOG.mdis committed. Each release's section is composed at publish time and packed into the published tarball on top of the previously published version's changelog, and the consumed change intents are garbage-collected by a laterpnpm version -ronly once the registry confirms the version is published with its section. Setversioning.changelog.storage: repositoryto keep committedCHANGELOG.mdfiles instead.Added a new override selector form with an empty range —
"pkg@": "<version>"— called a convergence override. It rewrites a dependency edge only when its exact version satisfies the edge's declared range, so compatible consumers converge on one version while incompatible consumers keep their own resolution — now and for any dependent added in the future #12794.The value must be an exact version. When a full resolution detects that every declared range also admits a newer version, pnpm warns that the override is stale and names the version to converge on. Previously an empty range in an override selector was undocumented and behaved like a bare (unscoped) override.
Patch Changes
A
tokenHelperset in the global pnpmauth.iniis no longer rejected as project-level configuration. The guard that blockstokenHelperfrom a project.npmrconly treated~/.npmrcas a trusted source, so a helper written toauth.ini(for example bypnpm config set) failed on every command and could not even be removed withpnpm config delete. AtokenHelperin a workspace or project.npmrcis still rejected.pnpm cache deletenow removes a package's metadata from every metadata cache directory (metadata,metadata-full, andmetadata-full-filtered), instead of only the one the current resolution mode reads. Previously a package cached under a different mode (e.g.metadata-full-filtered) was left behind. Closes #12753.Fixed an injected workspace dependency (
injectWorkspacePackages: true) incorrectly staying asfile:instead of deduping back tolink:when an unrelated, ordinary shared dependency resolved to a peer-suffixed variant for the target project's own copy but not for the injected occurrence. See #10433.pnpm deploynow supports workspaces that use catalogs.Fixed
pnpm deploywith a shared lockfile so localfile:tarball dependencies keep their package name in the generated deploy lockfile. This prevents warm-store deploys from failing withERR_PNPM_UNEXPECTED_PKG_CONTENT_IN_STOREwhen the tarball filename includes the version.Options that follow
create,exec, ortestappearing as a subcommand of another command are now parsed instead of being silently treated as positional parameters. For example,pnpm team create @​org:team --registry <url>previously ignored the--registryoption and sent the request to the default registry.pnpm add -g,pnpm update -g,pnpm setup, and the self-updater no longer fail withERR_PNPM_MISSING_TIMEwhentrustPolicy: no-downgradeorresolutionMode: time-basedis set in the global config #12883. The decision to fetch full registry metadata now lives in one place, and theno-downgradetrust policy always requests full metadata (matching the self-updater), since the trust evidence it checks is missing from abbreviated metadata even on registries that include thetimefield.pnpm listandpnpm whyno longer crash withEMFILE: too many open fileswhen a project has a large number of unsaved dependencies (packages present innode_modulesbut not in the lockfile). The reads of those packages are now concurrency-limited.The published
pnpmpackage no longer declaresdependenciesordevDependencies. Because the CLI bundles its runtime dependencies intodist/node_modules, those fields are dropped when packing, sonpm installof the tarball no longer tries to resolve internal-only packages such as@pnpm/test-ipc-server. Closes #12955.Fixed
pnpm publish --otpandpnpm publish --batch --otpto send the configured OTP to the registry.pnpm publishagain sends the package's README to the registry as metadata, so registries can render it on the package page. The readme is always included in the published metadata (matching the npm CLI), while theembed-readmesetting continues to control only whether the readme is written into thepackage.jsoninside the tarball. This restores the behavior that was lost when publishing became fully native. Closes #12966.Fixed the dependency status check wrongly reporting "up to date" when a
package.json,.pnpmfile.cjs, or patch file was edited in the same second as the previous install, on filesystems that record mtimes at whole-second resolution (for example ext4 with 128-byte inodes). The optimistic repeat-install fast path andverify-deps-before-runcompared mtimes strictly, so a same-second edit whose mtime rounded down looked unchanged and re-resolution was skipped. Such a file's whole second is now treated as possibly-modified, falling through to the content check; behavior on sub-second filesystems is unchanged.Retry package metadata requests when a registry or proxy returns
304 Not Modifiedto an unconditional request, preventing falseERR_PNPM_CACHE_MISSING_AFTER_304failures pnpm/pnpm#12882.If the retry also returns
304, reportERR_PNPM_META_NOT_MODIFIED_WITHOUT_CACHEinstead.Fixed
pnpm updateremoving transitive lockfile entries whendedupePeerDependentsis disabled and the selected package is absent pnpm/pnpm#12456.Limit modern deploy lockfiles and localized virtual stores to dependencies reachable from the selected dependency groups.
A
tokenHelpercommand is now given a 60-second time limit. A helper that hangs (deadlock, stuck I/O) is killed and reported as an error instead of leaving the command waiting forever.Fixed orphaned child processes on Windows when pnpm exits on an error while commands spawned by
pnpm execorpnpm dlxare still running (for example, when one project's command fails duringpnpm --recursive exec). The PIDs of these commands are now recorded when they are spawned and their whole process trees are terminated withtaskkillon an error exit. Previously the cleanup relied on enumerating the system process list, which is so slow on Windows that the enumeration hit its timeout and the cleanup was silently skipped #12406.pnpm packnow respects workspace-root.npmignoreand.gitignorefiles when packing workspace packages.Platinum Sponsors
Gold Sponsors
v11.12.0: pnpm 11.12Compare Source
Minor Changes
a897ef7: Custom fetchers exported from a pnpmfile can now delegate by returning a{ delegate: <resolution> }envelope: pnpm rewrites the package's resolution to the delegated shape and runs the built-in fetcher on it. This is the portable delegation form that also works in pacquet, wherecafsandfetcherscannot be passed to the hook. Related to pnpm/pnpm#11685.Patch Changes
2b02764: The changed-packages filter (--filter "...[<since>]") no longer allows an option-like<since>value (such as--output=<path>) to be interpreted as a git option — git now rejects it as a bad revision. The repository root is also resolved to the nearest.gitentry, so the filter works in a git worktree checked out inside another repository's tree.43711ce:pnpm outdatedno longer checks the registry for dependencies that are resolved from locallink:,file:, orworkspace:references in the lockfile #12827.3c6718b: Fixed a deadlock in peer dependency resolution:pnpm installhung forever when a peer dependency cycle spanned a project's own dependencies and auto-installed peer providers, for example when installingelectron-builder@26.15.3#12921.252f15e: Fixed peer dependency auto-install picking a version the peer range rejects. In a workspace with several projects, a package declaring a peer dependency with a semver range (for example^1.0.0) could get the highest version found anywhere in the workspace (for example a2.0.0resolved for another project) instead of a version that satisfies the range. Peers are now deduplicated onto the highest preferred version that satisfies the declared range, and when none does, the range is resolved from the registry.Also fixed re-resolving with an existing lockfile hoisting a different peer version than a fresh install of the same manifest: root dependencies reused from the lockfile were invisible to peer hoisting, so a peer that a root dependency provides could be bound to another version.
a38adda:pnpm self-update <version>now installs the requested pnpm version when it matches the currently running version but is missing from the global self-update directory.6a85968:pnpm stage listnow stops paginating after a fail-safe cap of 1000 pages, so a misbehaving registry cannot keep the command looping forever.eee7c9a:verify-deps-before-runno longer spawns apnpm installwhen pnpm is executed in a directory that has nopackage.json. A mistyped command run outside a project (for examplepnpm witch 10 login) used to crash with a confusing error from the spawned install; now it fails with the regular "no package.json found" error.Platinum Sponsors
Gold Sponsors
v11.11.0Compare Source
Minor Changes
508b8c2: Added thepnpm accesscommand for managing package access and visibility on the registry, supporting listing packages and collaborators, getting and setting package status and MFA requirements, and granting or revoking team access.Patch Changes
c70e33e: AllowallowBuildsentries for git-hosted packages to match by repository URL without pinning the resolved commit hash. This lets trusted git repositories keep running their build scripts after branch updates without approving each new commit, while package-name-only rules still do not approve git-hosted artifacts.3067e4f: Reduced peak memory usage during cold-cache dependency resolution. The metadata fetch is memoized for the whole resolution phase, and it was retaining each package's raw registry response body (used only to mirror the response to disk) for that entire time. The memoized cache now holds a body-less copy, so the raw body only lives as long as the call that writes the disk mirror. On large graphs that fetch full metadata (e.g. withminimumReleaseAgeortrustPolicyenabled) this cuts peak RSS by roughly 30%, back in line with pnpm 10. The resolved lockfile is unchanged.51300fd: Prevent a craftedpnpm-lock.yamlfrom writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g.../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshotversion: "../../x") is now rejected atformatGlobalVirtualStorePath, the single point every global-virtual-store slot path funnels through — closing the same escape in the isolated linker, the resolver's dependency-graph builder, and the config-dependency installer.f8058eb: Reject symlinkedpnpm-lock.yamlfiles when reading or writing the env lockfile document.9318a11: AllowregistriesandnamedRegistriesto be configured in the globalconfig.yamlfile.51300fd: Fixed a path traversal vulnerability where a dependency whose manifestnamewas a scoped path traversal (e.g.@x/../../../<path>) could be written outsidenode_modulesto an attacker-controlled location duringpnpm install, even with--ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.14332f0: Fail instead of silently removing an optional dependency's locked entries frompnpm-lock.yamlwhen the registry cannot resolve it. Previously, when registry metadata lacked a version that the lockfile already pinned (for example, a mirror that had not synced a recent release yet),pnpm installandpnpm dedupesilently dropped the optional dependency's entries — emptying maps such as the platform binaries of@napi-rs/canvas— so the lockfile differed between machines and frozen installs on other hosts had nothing to link #12853.fecfe83: Fixed peer dependency resolution withautoInstallPeerswhen a workspace package depends on a version of a package that a transitive dependency's self-contained closure also provides for itself. The peer providers that are attached to the root project for reuse are no longer peer-resolved a second time in the root context, so packages inside such a closure no longer get their peers bound to the root project's incompatible version #4993.5a4daec:${...}environment-variable placeholders in thehttpProxy,httpsProxy,noProxy,proxy, andnoproxysettings are no longer expanded when these settings come from a project'spnpm-workspace.yaml. They now receive the same protection already applied toregistry,namedRegistries, andpnprServer.d1da02e:pnpm publishno longer prints credentials when the target registry is configured with inlineuser:pass@credentials (e.g.registry=https://user:pass@example.com/). They are now redacted both from the "publishing to registry" line and from the OIDC (trusted publishing) failure messages.dcfc611:pnpm self-updatenow honorstrustPolicy=no-downgrade. It resolves the target pnpm version against full registry metadata, so it refuses to switch to a version whose supply-chain trust evidence is weaker than an earlier-published one, the same way a regular install does.a8ad82d: Register thepnalias in generated shell completion scripts.25bd5c3: Fixed standalone installer downgrades from pnpm v12 to v11.23996e9:pnpm runtime set <name> <version>now validates its arguments: the name must benode,deno, orbun, and the version must not contain a comma. Previously these were interpolated straight into apnpm addselector, where an unsupported name or a comma (e.g.node 22,is-positive) could be misread as a list of packages or a local directory and install unintended packages or bins.v11.10.0Compare Source
Minor Changes
e2e3c81: Added theissuescommand as an alias ofbugs, sopnpm issuesopens the package's bug tracker URL in the browser.8491f8e: Added theprefixcommand which prints the current package prefix directory (or global prefix directory if-g/--globalis used).3425e80: Added an_authsetting for configuring registry authentication as a single structured (URL-keyed) value. It can be set in the global pnpm config (config.yaml) or, for CI, via thepnpm_config__authenvironment variable. The env form sidesteps the GitHub Actions / bash / zsh limitation that broke the existingpnpm_config_//host/:_authToken=…form (env var names containing/,:, or.are silently dropped). Closes #12314.The value is keyed by registry URL so each secret is explicitly bound to the host that may receive it. Registry URL keys must use
httporhttpsand must not include credentials, query strings, or fragments:The equivalent in the global
config.yaml:Within each registry URL,
@means registry-wide/default credentials and package scopes like@orgbind credentials to that scope on the same host. The only supported credential field isauthToken(maps to_authToken/ bearer auth); the deprecatedbasicAuth/username+passwordforms are intentionally not accepted here.Each entry also infers a trusted registry route:
@routes the default registry (andpnpm add <pkg>resolves there), and@orgroutes that scope. Because the credential and destination host arrive in one trusted value, repo-controlledpnpm-workspace.yamlor project.npmrccannot redirect the token to a different host._authis honored only from the env var and the global config — it is ignored in a projectpnpm-workspace.yaml/.npmrc, so repo-controlled config can never supply registry auth. Precedence: CLI flags (--registry,--@​scope:registry) >pnpm_config__auth> globalconfig.yaml_auth>pnpm-workspace.yaml.Both
pnpm_config__auth(lowercase, documented form) andPNPM_CONFIG__AUTH(all-caps, the shell convention some CI runners apply) are honored. If both are set, lowercase wins unless it is empty, in which case uppercase is used. The env var wins over the globalconfig.yaml_authon a conflicting key.tokenHelperis not supported in_auth. Parsing is strict: a malformed value (bad JSON, wrong shape, invalid registry URL or scope, an unsupported credential field) fails fast with an error rather than being silently dropped.Pacquet parity note: the pacquet (Rust) port supports the same single credential field as the TS CLI:
authToken.a33eeec:pnpm self-updateandpackageManagerversion-switching can now install and link pnpm v12 (the Rust port), published with equal content under both thepnpmand@pnpm/exenames on thenext-12dist-tag. Its native binaries ship as@pnpm/exe.<platform>-<arch>packages, which pnpm's built-in installer links directly — no Node.js launcher, so the command pays no Node startup cost. v12 is initialized exactly like@pnpm/exe, including per-platform global-virtual-store hashing. From v12 onward the install converges on the unscopedpnpmpackage (the Rust exe) — even when updating from the SEA@pnpm/exebuild.1dd12bd: When resolving through a pnpr install-accelerator server, pnpm no longer forwards its own upstream registry credentials in the resolve request. Only theAuthorizationheader identifying the caller to pnpr is sent. The pnpr server now selects upstream credentials from its own route policy (operator-configured upstream credential aliases), so private dependencies resolve through a pnpr-managed alias the caller is authorized to use, rather than by sending the client's registry tokens to the server.1e81761: Expose web authenticationauthUrlanddoneUrlin JSON error output when OTP is required in a non-interactive terminal #12724.Patch Changes
2f389d6: Added the Node.js release team's new signing key (Stewart X Addison,655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD) to the embedded Node.js release keys, so runtimes whoseSHASUMS256.txtis signed by the new releaser verify successfully.acbdb94: Fixed shell tab completion not suggesting workspaces after the-Falias for--filteroption.dcabb78: Fixedpnpm up -r <pkg>bumping unrelated packages that have open semver ranges. Previously, any update mutation nullified the lockfile-derivedpreferredVersionsglobally, so packages with^x.y.zranges could re-resolve to newer compatible versions even though the user only asked to update a specific package. The install layer now always seedspreferredVersionsfrom the lockfile, and caller-supplied preferred versions (such as the vulnerability penalties ofpnpm audit --fix) layer on top of the seed instead of replacing it. The targeted package still bumps: the per-resolveupdateRequestedflag makes the resolver ignore the target's own lockfile pins.Closes #10662.
d539172: Fixed pnpm pack and pnpm publish failing when prepack generates files that are included in the package and postpack cleans them up.be6505a: Hardened global package management:node.exeflavor of a bin, so a stalenode.exeno longer survives onPATHafter uninstall, and a new global install no longer silently overwrites an existingnode.exe.pnpm add -g pnpm@<version>(and@pnpm/exe@<version>) is now rejected like the barepnpmform, pointing topnpm self-update.node_modulespaths, preventing a tampered manifest from escaping the install directory.25c7388: pnpm now rejectsjsr:specifiers whose package name is not a valid npm package name — an empty scope or name (e.g.jsr:@​scope/), path separators inside the name, or any other shapevalidate-npm-package-namerejects — withERR_PNPM_INVALID_JSR_PACKAGE_NAMEinstead of silently converting them into a malformed@jsr/...npm package name.25c7388: pnpm now rejects named-registry specifiers (e.g.gh:) whose package name is not a valid npm package name — an empty scope (e.g.gh:@​/bar), path separators inside the name (e.g.gh:@​scope/../name), or any other shapevalidate-npm-package-namerejects — withERR_PNPM_INVALID_NAMED_REGISTRY_PACKAGE_NAMEinstead of passing the name through to registry URLs and metadata cache file paths.96da7c5: node-gyp'sgyp_main.pyandgypentrypoints are now packed with the executable bit in thepnpmand@pnpm/exetarballs. Without it, building native addons from source could fail with a permission error.99982b9: Sped up resolution and reduced memory use against registries that ignore npm's abbreviated metadata format and always return the full package document (for example, Azure DevOps Artifacts). pnpm now strips such documents down to the abbreviated field set before caching them. Resolution output is unchanged, and registries that honor the abbreviated format (such as the npm registry) pay no extra cost.11a7fdd: Sped up offline and--prefer-offlineresolution on large workspaces (e.g.pnpm dedupe --offline,pnpm install --offline). Package metadata loaded from the local cache is now kept in memory, so each package's metadata is parsed once per command instead of once per dependent that references it.2c7369d:pnpm pack-appnow rejects--entry/pnpm.app.entryand--output-dir/pnpm.app.outputDirvalues that are absolute paths or escape the project directory via..(or a symlink that resolves outside it), and refuses to write the produced executable when its target path already exists as a symlink (or other non-regular file). This prevents a repository-controlledpackage.jsonfrom embedding host files (such as an SSH key) into the produced executable, writing build artifacts outside the project, or overwriting an arbitrary file through a committed symlink. The new error codes areERR_PNPM_PACK_APP_ENTRY_OUTSIDE_PROJECT,ERR_PNPM_PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT, andERR_PNPM_PACK_APP_OUTPUT_FILE_NOT_REGULAR.When ad-hoc signing macOS targets,
pnpm pack-appnow runs the systemcodesignby absolute path and resolvesldidto a location outside the project, so a repository-controllednode_modules/.binonPATHcannot hijack the signer.ce5d5a5: Relative paths inpatchedDependenciesare now resolved against the lockfile directory when computing patch file hashes, so runningpnpm installfrom a subdirectory no longer fails withENOENTlooking for the patch file in the wrong location #12762.ebb4096:pnpm peersno longer reports a conflict for a missing peer dependency that is ignored viapnpm.peerDependencyRules.ignoreMissing.dcabb78: Fixed a prototype-pollution hazard when seeding preferred versions: a dependency named__proto__in a manifest or inpnpm-lock.yamlcould write throughObject.prototype(or crash the install) while the preferred-versions map was being built. The maps are now null-prototype objects, so crafted package names land as plain keys.f38e696: Hardenedpnpm deploy --forceso it refuses unsafe deploy targets such as workspace roots, parent directories, out-of-workspace paths, and symlinked target parents.806c3ec: pnpm no longer warns about ignored project-level auth settings whenPNPM_CONFIG_NPMRC_AUTH_FILEpoints at the project.npmrc— setting it to that file is an explicit opt-in to trusting it, so auth env variables in it are expanded pnpm/pnpm#12480.991405e: Restore differential rendering (ansi-diff) to fix duplicated output lines introduced by #12351.c121235: Fixed the topological order of--filtered commands (pnpm run,pnpm exec,pnpm publish,pnpm pack,pnpm rebuild) when the selected projects depend on each other only transitively through projects that were not selected. Previously such selected projects could run concurrently or in the wrong order; now a project always runs after the selected projects it transitively depends on, while projects without a real dependency relationship still run concurrently. This now also holds for prod-only filters (--filter-prod), which resolve order through the production dependency graph so transitive production dependencies are respected without pulling back the dev dependencies the filter drops, and for selections that mix--filterwith--filter-prod#8335.d539172:pnpm packandpnpm publishno longer follow a symlinked workspaceLICENSEfile when injecting it into a package that has no license of its own. Following the symlink could pack bytes from outside the workspace into the published tarball.dcabb78: Fixedpnpm up <pkg>producing a different result than a fresh install of the same manifests would. The resolver now distinguishesupdateRequested(true only for packages that match the user's update target) from the broaderupdateflag, and for the targeted package ignores only its own lockfile-derived preferred-version pins — so the target re-resolves exactly as if its lockfile entries were deleted andpnpm installran. Preferred versions a fresh install applies (manifest pins, versions propagated down the dependency chain, and the vulnerability-avoidance penalties ofpnpm audit --fix) stay in effect, so an update never installs duplicate versions that a reinstall from scratch would not reproduce. When a preferred version holds the update target below the newest version its range admits, pnpm now prints a warning explaining that reaching the newer version everywhere requires an override.dcabb78:pnpm update <dep>@​<version>now prints a warning when<dep>is only present as a transitive dependency: the requested version cannot be applied there (updates resolve the target the way a fresh install would), and the warning recommends adding the version topnpm.overridesinstead, which is the mechanism that does pin transitive dependencies. Closes #12744.a6c4d5f: When a dependency cannot be found in the registry (404) or the registry has no matching version, and a workspace project with the same name exists only at non-matching versions, the error now reports the available workspace versions (ERR_PNPM_NO_MATCHING_VERSION_INSIDE_WORKSPACE) instead of the raw registry failure pnpm/pnpm#1379. Other registry failures (authorization, network, server errors) still propagate unchanged. The pacquet (Rust) resolver applies the same behavior.recharts/recharts (recharts)
v3.10.0Compare Source
What's Changed
Legend position
Legend now supports
positionandoffsetprops, same as Label and LabeList. This replaces the previousalignandverticalAlignfor a more convenient positioning, and fixes couple visual bugs too. See https://recharts.github.io/en-US/examples/LegendPosition/XAxis auto height
XAxis now supports height="auto" prop, similar to YAxis width="auto".
Other features
Bugfixes
New Contributors
Full Changelog: https://github.com/recharts/recharts/compare/v3.9.2...v3.10.0
v3.9.2Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/recharts/recharts/compare/v3.9.1...v3.9.2
v3.9.1Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/recharts/recharts/compare/v3.9.0...v3.9.1
typescript-eslint/typescript-eslint (typescript-eslint)
v8.65.0Compare Source
🚀 Features
❤️ Thank You
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.64.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.63.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.62.1Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.
75d24487027196ecfd98chore(deps): update dependency typescript-eslint to v8.62.1to fix(deps): update frontend non-major dependencies7196ecfd986847adde3a6847adde3a37cd9307d437cd9307d4e1d3a97931e1d3a97931a6c2172672a6c2172672fe6b0a4082fe6b0a408251b765971451b765971468dde7636068dde763609e5209021d9e5209021d57f29eb19b57f29eb19b978d6d946f978d6d946f466394bb5b466394bb5b319acfcacc319acfcacce3d089576fe3d089576fd80710fe01d80710fe01e4dd5bf7d9View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.