[mugi-uno]

Summary

Update Node.js and pnpm to the latest versions that satisfy minimumReleaseAge: 4320 (3 days).

Tool	From	To	Type	Where
Node.js	26.12.1	26.13.0	minor (first LTS of 26.x, "Lithium")	.node-version (read by CI via node-version-file and by mise)
pnpm	11.1.2	12.17.0	major	package.json devEngines.packageManager.version (read by pnpm/action-setup and mise)

• No other place pins Node.js or pnpm: no engines, packageManager, .nvmrc, Dockerfile, or workflow node-version.
• Node.js 26 is now Active LTS. Per the v26.13.0 release notes it is supported until the end of April 2029.

Official pnpm 12 support was added in pnpm/action-setup v6.1.0 (#288), which #23 brings in. CI on this PR still uses v6.0.8, and it passes: the log shows Done in 3.8s using pnpm v12.17.0 and node: v26.13.0. So the two PRs can be merged in either order.

⚠️ Breaking changes / things to watch

• pnpm 12.0.0 is a major release. Per the 12.0 blog post, it keeps the commands, flags, settings, and lockfile format of pnpm 11. The breaking items in the v12.0.0 release, and how they affect us:
  • Unknown settings in pnpm-workspace.yaml are now an error (ERR_PNPM_UNRECOGNIZED_WORKSPACE_SETTINGS). We only have minimumReleaseAge, which is valid. → no impact
  • --frozen-lockfile false and pnpm install --resolution-only were removed. → not used (CI uses pnpm install --frozen-lockfile)
  • Git dependency URL normalization, circular peer normalization, packageImportMethod: auto on Linux, engineStrict, filterLog hook, and sudo restrictions. → we have no git deps, no hooks, and no engineStrict
• Lockfile: lockfileVersion stays '9.0'. Since 12.1.0, pnpm records the devEngines pin in the lockfile. That's why pnpm-lock.yaml gains a leading YAML document with packageManagerDependencies (pnpm 12.17.0 and its per-platform @pnpm/exe.* binaries with integrity hashes). The existing document below it is unchanged.
• minimumReleaseAge: since 12.3.0, setting it explicitly makes minimumReleaseAgeStrict default to true. A version younger than 3 days now fails or prompts instead of being skipped silently. That's the stricter behavior we want.
• Publish (pnpm publish --no-git-checks in release.yml):
  • No OIDC / provenance spec changes in 12.x.
  • 12.12.1 only uses NPM_ID_TOKEN when its aud matches the target registry.
  • Several releases changed which files go into the tarball (12.11.0, 12.11.1, 12.13.0, 12.14.0, 12.15.0, 12.16.1). I compared pnpm pack --dry-run --json between pnpm 11.1.2 and 12.17.0, and the file list is identical (83 files).
• Security fixes included in 11.x / 12.x:
  • 12.4.2: bin shim hijack.
  • 12.7.0: userAgent env expansion sent to registries.
  • 12.9.0: pnpm login sending credentials to redirects.
  • 12.10.0: path traversal, lockfile variations validation.
  • 12.15.0: ERR_PNPM_REGISTRY_NAME_MISMATCH.
  • 12.16.0: zstd vulnerability, RUSTSEC-2026-0387.
  • 11.4.0: tarball integrity mismatch is now a hard failure.
  • 11.5.3: no ${ENV} expansion in project .npmrc / pnpm-workspace.yaml (GHSA-3qhv-2rgh-x77r).
• Node.js 26.13.0: no changes from 26.12.1 other than the LTS metadata update, and no security fixes (release).
• Local setup: devEngines.packageManager.onFail is "error", so local pnpm must be 12.17.0. mise picks it up from package.json (mise ls --current shows pnpm 12.17.0 … package.json).

Pre-existing issue found while checking (not changed here)

.npmrc has save-exact=true, but pnpm config get save-exact returns undefined with pnpm 12.17.0 (and with 11.1.2, checked in a scratch directory). pnpm 11+ reads only auth/registry-related settings from .npmrc, so this setting seems to have no effect today. Moving it to pnpm-workspace.yaml as saveExact: true would restore it. That's a separate fix, so I didn't include it here.

Changes by version

Node.js 26.12.1 → 26.13.0

• 26.13.0 (2026-10-28): transition to LTS "Lithium"; no other changes (release)

pnpm 11.1.2 → 12.17.0

All releases: https://github.com/pnpm/pnpm/releases/tag/v<version>

• 11.1.3: lockfile re-verified against minimumReleaseAge / trustPolicy; self-update respects minimumReleaseAge
• 11.2.0: optionalDependencies for configDependencies, cafile relative path fix
• 11.2.1: config dependency optional snapshot fix
• 11.2.2: pacquet delegation fixes
• 11.3.0: pnpm stage, trustLockfile, pkg / repo / set-script
• 11.4.0: security: tarball integrity mismatch is a hard failure; _authToken leak fix; git commit SHA validation
• 11.5.0: hoistingLimits, staged publish trust
• 11.5.1: faster audit, publish manifest repository normalization
• 11.5.2: peer resolution, lockfile verifier validates tarball URLs
• 11.5.3: security: stop ${ENV} expansion in project .npmrc / pnpm-workspace.yaml (GHSA-3qhv-2rgh-x77r). Our .npmrc has no env references.
• 11.6.0: better warnings for the above, env vars for URL-scoped registry settings
• 11.7.0: frozenStore, publish --batch, security: reject path-traversal aliases in lockfile
• 11.8.0: install --dry-run, package-map, sbom extensions
• 11.9.0: sbom --exclude-peers, peer determinism
• 11.10.0: _auth setting, self-update to v12
• 11.11.0: pnpm access, security: prevent writes outside the virtual store via crafted lockfiles, reject symlinked lockfiles
• 11.12.0: pnpmfile fetcher delegate, security: option injection via --filter
• 11.13.0: versioning.epics, pnpm change, team
• 11.13.1: pack ignore-rule fix
• 11.14.0: pnpm doctor, RegExp in run
• 11.15.0: optional peer resolution, adm-zip update (ZIP memory DoS)
• 11.15.1: supportedArchitectures change detection
• 11.16.0: update / audit sections, --save-exact peer prefix fix
• 11.17.0: republished to fix missing tarball files in 11.13.1–11.16.0
• 11.18.0: publishConfig.name
• 11.19.0: non-TTY login, = in save-prefix, minimumReleaseAge + latest fix
• 11.20.0: namedRegistries security fix (we don't use namedRegistries)
• 11.21.0: grouped selection in update -g -i, sudo warning
• 11.22.0: cache path, minimumReleaseAgeExcludePrune, security: project workspace yaml can't choose the credential store
• 11.23.0: pnpm config get/list names, warn on unknown settings
• 11.24.0: global build approvals, frozen-lockfile pinned-version mismatch fix
• 11.25.0: remote side-effects cache (PoC), audit.ignorePrune
• 11.26.0: workspace: in catalogs, hide credentials in URLs
• 11.27.0: trustPolicyExcludePrune, fetch-timeout
• 11.27.1: pn / pnx use the adjacent pnpm
• 11.28.0–11.28.10: maintenance line released in parallel with 12.x (security backports: userAgent env expansion, undici GHSA updates, login redirect, NPM_ID_TOKEN aud check, registry name mismatch, embedded Node 26.12.1)
• 12.0.0: major release; see "Breaking changes" above (blog, what's different)
• 12.1.0: login token saved to global config.yaml, parallel workspace tasks, project scope ignored, devEngines range pin recorded in the lockfile
• 12.2.0: workspace: in catalogs, deploy without injectWorkspacePackages
• 12.2.1: fix updating from ≤12.1
• 12.3.0: minimumReleaseAgeStrict defaults to true when minimumReleaseAge is set explicitly; native global shims
• 12.3.1: faster for large workspaces
• 12.3.2: audit --fix, import keeps lockfile versions
• 12.3.3: npm-distributed build runs via Node
• 12.3.4: accept pnpm 11 boolean flags again
• 12.4.0: Python / Cargo management, pnpm pipeline, .npmrc registry takes precedence over the saved login
• 12.4.1: install fixes, updateConfig hook gets the full config
• 12.4.2: security: bin shim hijack, credentials exposed in GitHub Actions links
• 12.5.0: pnpm add by PURL, ecosystem-specific registries
• 12.5.1: unknown task-config keys warn instead of failing
• 12.6.0: autoDedupe, add --tilde, security: shims, control characters in deprecation messages; publish allowed on detached HEAD
• 12.7.0: global node shim reads .node-version, install --allow-build, publish --publish-wait-timeout, security (4 fixes)
• 12.8.0: pack/publish warns about .env, --dev also installs optionalDependencies
• 12.8.1: frozen-lockfile / inject fixes
• 12.8.2: ppc64le crash fix
• 12.9.0: WebContainers WASM, security: login redirect credentials
• 12.9.1: GitLab CI provenance 422 fix
• 12.10.0: experimental nodeLinker: loaded, security (path traversal, config dependency validation, lockfile variations, audit signatures, 64 MiB archive limit)
• 12.10.1: loaded linker fixes
• 12.11.0: config dependencies honor minimumReleaseAge, --provenance=false under trusted publishing, pack/publish ignore matching
• 12.11.1: .npmignore / .gitignore no longer packed, registry.npmjs.com treated as an alias of .org
• 12.11.2: --workspace-concurrency=Infinity
• 12.12.0: addMissingPeerTypes, allowBuilds: false wins over dangerouslyAllowAllBuilds
• 12.12.1: NPM_ID_TOKEN aud check, OIDC for dist-tag
• 12.13.0: pnpm profile / pnpm token, files: [] behavior
• 12.14.0: sideEffectsCache.exclude, pack honors gitignore for main/browser/bin
• 12.15.0: include field, zstd, security: ERR_PNPM_REGISTRY_NAME_MISMATCH, OIDC with path-based registries
• 12.16.0: security: zstd vulnerability, signature timing leak (RUSTSEC-2026-0387); --env-file
• 12.16.1: npm-compatible files precedence in pack/publish
• 12.17.0: peers check --global, :prod overrides, outdated/update also cover devEngines

Code changes required by this update

None.

Unverified

• pnpm release summaries were built from the full GitHub Release bodies, using the leading items plus keyword searches (security / minimumReleaseAge / provenance / OIDC / devEngines / npmrc / publish). Minor items may be omitted.
• 12.0.0 alpha / beta / rc release bodies were not read separately. The 12.0.0 release body covers the diff from 11.x.
• The release.yml publish path with pnpm 12 can only be confirmed on the next release.

Verification

Run locally with Node.js 26.13.0 and pnpm 12.17.0 (via mise):

• pnpm install --frozen-lockfile
• pnpm build
• pnpm typecheck
• pnpm test (8 passed, 0 failed)
• pnpm pack --dry-run: same 83 files as with pnpm 11.1.2
• CI on this PR (pnpm v12.17.0 / Node.js v26.13.0, with pnpm/action-setup v6.0.8)