[skip netlify] Update pnpm to v9.14.4 #11203
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
requested review from
Jarsen136 and
hassnian
and removed request for
a team
Deploying koda-art-prod with
|
| Latest commit: |
0bca13d
|
| Status: | 🚫 Build failed. |
renovate
bot
force-pushed
the
renovate/pnpm-9.x
branch
from
245a05e to
0bca13d
Compare
|
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎ To accept the risk, merge this PR and you will not be notified again.
Next stepsWhat is a typosquat?Package name is similar to other popular packages and may not be the package you want. Use care when consuming similarly named packages and ensure that you did not intend to consume a different package. Malicious packages often publish using similar names as existing popular packages. Take a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with
|
|
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update ( If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
This PR contains the following updates:
9->9.14.4Release Notes
pnpm/pnpm (pnpm)
v9.14.4Compare Source
v9.14.3Compare Source
v9.14.2Compare Source
Patch Changes
pnpm publish --jsonshould work #8788.Platinum Sponsors
Gold Sponsors
v9.14.1Compare Source
Minor Changes
pnpm pack --jsonto print packed tarball and contents in JSON format #8765.Patch Changes
pnpm execshould print a meaningful error message when no command is provided #8752.pnpm setupshould remove the CLI from the target location before moving the new binary #8173.ERR_PNPM_TARBALL_EXTRACTerror while installing a dependency from GitHub having a slash in branch name #7697.use-node-versionsetting is used and the system has no Node.js installed #8769..npmrcfiles to their correct types. For instance,child-concurrencyshould be a number, not a string #5075.manage-package-manager-versionsis set totrue.pnpm initshould respect the--diroption #8768.Platinum Sponsors
Gold Sponsors
v9.14.0Compare Source
v9.13.2: pnpm 9.13.2Compare Source
Patch Changes
dlxprocesses.Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.13.1: pnpm 9.13.1Compare Source
Patch Changes
Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.13.0: pnpm 9.13Compare Source
Minor Changes
The
self-updatenow accepts a version specifier to install a specific version of pnpm. E.g.:or
Patch Changes
Cannot read properties of undefined (reading 'name')that is printed while trying to render the missing peer dependencies warning message #8538.Platinum Sponsors
Gold Sponsors
Silver Sponsors
v9.12.3Compare Source
Patch Changes
node_modules, when typing "n" in the prompt that asks whether to removenode_modulesbefore installation #8655.manage-package-manager-versions=trueis set and the.toolsdirectory is corrupt.crypto.hash, when available, for improved performance #8629.package.jsonat the root of the workspace #8667.manage-package-manager-versionsis set totrue, errors spawning a self-managed version ofpnpmwill now be shown (instead of being silent).v9.12.2Compare Source
Patch Changes
v9.12.1Compare Source
Patch Changes
pnpm update --latestshould not update the automatically installed peer dependencies #6657.pnpm publishshould be able to publish from a local tarball #7950.EBUSYerrors caused by creating symlinks in paralleldlxprocesses #8604.v9.12.0Compare Source
Minor Changes
Fix peer dependency resolution dead lock #8570. This change might change some of the keys in the
snapshotsfield insidepnpm-lock.yamlbut it should happen very rarely.pnpm outdatedcommand supports now a--sort-by=nameoption for sorting outdated dependencies by package name #8523.Added the ability for
overridesto remove dependencies by specifying"-"as the field value #8572. For example, to removelodashfrom the dependencies, use this configuration inpackage.json:{ "pnpm": { "overrides": { "lodash": "-" } } }Patch Changes
pnpm list --json pkgshowed"private": falsefor a private package #8519.libcthat differ frompnpm.supportedArchitectures.libcare not downloaded #7362.ENOENTerrors caused by runningstore prunein parallel #8586.pnpm bugs#8596.v9.11.0Compare Source
Minor Changes
pnpm cachecommands for inspecting the metadata cache #8512.Patch Changes
pnpm deploywithnode-linker=hoistedproduces an emptynode_modulesdirectory #6682.pnpm deployshould work in workspace withshared-workspace-lockfile=false#8475.v9.10.0Compare Source
Minor Changes
Support for a new CLI flag,
--exclude-peers, added to thelistandwhycommands. When--exclude-peersis used, peer dependencies are not printed in the results, but dependencies of peer dependencies are still scanned #8506.Added a new setting to
package.jsonatpnpm.auditConfig.ignoreGhsasfor ignoring vulnerabilities by their GHSA code #6838.For instance:
{ "pnpm": { "auditConfig": { "ignoreGhsas": [ "GHSA-42xw-2xvc-qx8m", "GHSA-4w2v-q235-vp99", "GHSA-cph5-m8f7-6c5x", "GHSA-vh95-rmgr-6w4m" ] } } }Patch Changes
v9.9.0Compare Source
Minor Changes
Minor breaking change. This change might result in resolving your peer dependencies slightly differently but we don't expect it to introduce issues.
We had to optimize how we resolve peer dependencies in order to fix some infinite loops and out-of-memory errors during peer dependencies resolution.
When a peer dependency is a prod dependency somewhere in the dependency graph (with the same version), pnpm will resolve the peers of that peer dependency in the same way across the subgraph.
For example, we have
react-domin the peer deps of theformandbuttonpackages.cardhasreact-domandreactas regular dependencies andcardis a dependency ofform.These are the direct dependencies of our example project:
These are the dependencies of card:
When resolving peers, pnpm will not re-resolve
react-domforcard, even thoughcardshadowsreact@16from the root withreact@17. So, all 3 packages (form,card, andbutton) will usereact-dom@16, which in turn usesreact@16.formwill usereact@16, whilecardandbuttonwill usereact@17.Before this optimization
react-dom@16was duplicated for thecard, so thatcardandbuttonwould use areact-dom@16instance that usesreact@17.Before the change:
After the change
Patch Changes
pnpm deployshould write thenode_modules/.modules.yamlto thenode_modulesdirectory within the deploy directory #7731.node_modulesif it already points to the right location pnpm/symlink-dir#54.v9.8.0Compare Source
Minor Changes
Added a new command for upgrading pnpm itself when it isn't managed by Corepack:
pnpm self-update. This command will work, when pnpm was installed via the standalone script from the pnpm installation page #8424.When executed in a project that has a
packageManagerfield in itspackage.jsonfile, pnpm will update its version in thepackageManagerfield.Patch Changes
CLI tools installed in the root of the workspace should be added to the PATH, when running scripts and
use-node-versionis set.pnpm setupshould never switch to another version of pnpm.This fixes installation with the standalone script from a directory that has a
package.jsonwith thepackageManagerfield. pnpm was installing the version of pnpm specified in thepackageManagerfield due to this issue.Ignore non-string value in the os, cpu, libc fields, which checking optional dependencies #8431.
Remember the state of edit dir, allow running
pnpm patch-committhe second time without having to re-runpnpm patch.v9.7.1Compare Source
Patch Changes
public-hoist-patternandhoist-patternvia env variables #8339.pnpm setupno longer creates Batch/Powershell scripts on Linux and macOS #8418.pnpm execnow supports executionEnv #8356.pnpmfield, add warnings for non-rootpnpmsubfields that aren'texecutionEnv#8143.patch-commitin which relative path is rejected #8405.@pnpm/exeto v20.v9.7.0Compare Source
Minor Changes
Added pnpm version management to pnpm. If the
manage-package-manager-versionssetting is set totrue, pnpm will switch to the version specified in thepackageManagerfield ofpackage.json#8363. This is the same field used by Corepack. Example:{ "packageManager": "[email protected]" }Added the ability to apply patch to all versions:
If the key of
pnpm.patchedDependenciesis a package name without a version (e.g.pkg), pnpm will attempt to apply the patch to all versions ofthe package. Failures will be skipped.
If it is a package name and an exact version (e.g.
[email protected]), pnpm will attempt to apply the patch to that exact version only. Failures willcause pnpm to fail.
If there's only one version of
pkginstalled,pnpm patch pkgand subsequentpnpm patch-commit $edit_dirwill create an entry namedpkginpnpm.patchedDependencies. And pnpm will attempt to apply this patch to other versions ofpkgin the future.If there are multiple versions of
pkginstalled,pnpm patch pkgwill ask which version to edit and whether to attempt to apply the patch to all.If the user chooses to apply the patch to all,
pnpm patch-commit $edit_dirwould create apkgentry inpnpm.patchedDependencies.If the user chooses not to apply the patch to all,
pnpm patch-commit $edit_dirwould create a[email protected]entry inpnpm.patchedDependencieswithx.y.zbeing the version the user chose to edit.If the user runs
pnpm patch [email protected]withx.y.zbeing the exact version ofpkgthat has been installed,pnpm patch-commit $edit_dirwill alwayscreate a
[email protected]entry inpnpm.patchedDependencies.Change the default edit dir location when running
pnpm patchfrom a temporary directory tonode_modules/.pnpm_patches/pkg[@​version]to allow the code editor to open the edit dir in the same file tree as the main project.Substitute environment variables in config keys #6679.
Patch Changes
pnpm installshould runnode-gyp rebuildif the project has abinding.gypfile even if the project doesn't have an install script #8293.v9.6.0Compare Source
Minor Changes
pnpm.executionEnv.nodeVersioninpackage.json) for running lifecycle scripts per each package in a workspace #6720.catalogs:protocol #8303.Patch Changes
pnpm deploycommand now supports thecatalog:protocol #8298.pnpm outdatedcommand now supports thecatalog:protocol #8304.pnpm patchwithoutnode_modules/.modules.yaml#8257.pnpm execcommand #7608.v9.5.0Compare Source
Minor Changes
Added support for catalogs 8122.
Catalogs may be declared in the
pnpm-workspace.yamlfile. For example:v9.4.0Compare Source
Minor Changes
strict-store-pkg-content-checksetting tofalse#4724.Patch Changes
package-manager-strict-versionmissing in config #8195.v9.3.0Compare Source
Minor Changes
peers-suffix-max-lengthsetting #8177.Patch Changes
reporter-hide-prefixtotrueby default forpnpm exec. In order to show prefix, the user now has to explicitly setreporter-hide-prefix=false#8174.v9.2.0Compare Source
Minor Changes
package-manager-strict-versionis set totrue, pnpm will fail if its version doesn't exactly match the version in the "packageManager" field ofpackage.json.Patch Changes
@yarnpkg/pnpto the latest version, fixing issue withnode:imports #8161.package.json#8087.execnow also streams prefixed output when--recursiveor--parallelis specified just asrundoes #8065.v9.1.4Compare Source
Patch Changes
v9.1.3Compare Source
Patch Changes
optional=false#8066.v9.1.2Compare Source
Patch Changes
pnpm licensesoutput are not misplaced anymore #8071.v9.1.1Compare Source
Patch Changes
link:now preserve absolute path #8053.file:overrides for workspace package #8053.resolution-modeis set totime-basedand the registry fails to return the"time"field in the package's metadata.v9.1.0Compare Source
Minor Changes
virtual-store-dir-max-lengthadded to modify the maximum allowed length of the directories insidenode_modules/.pnpm. The default length is set to 120 characters. This setting is particularly useful on WConfiguration
📅 Schedule: Branch creation - "before 3am on Monday" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.