-
Notifications
You must be signed in to change notification settings - Fork 516
chore(deps): update pnpm to v10 #867
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
e5471e2 to
cfed0a4
Compare
cfed0a4 to
e000104
Compare
e000104 to
dad1956
Compare
dad1956 to
a2a1023
Compare
a2a1023 to
9ebe2e2
Compare
9ebe2e2 to
8082903
Compare
8082903 to
82d5d5e
Compare
82d5d5e to
0868568
Compare
0868568 to
f089ed3
Compare
f089ed3 to
ead34a5
Compare
ead34a5 to
8892627
Compare
8892627 to
4332356
Compare
4332356 to
626e1a6
Compare
626e1a6 to
f3cb947
Compare
c3a69d5 to
7319ca7
Compare
7319ca7 to
06e186a
Compare
06e186a to
405bf9a
Compare
405bf9a to
0e0dd92
Compare
0e0dd92 to
b2d3627
Compare
b2d3627 to
7e496bc
Compare
7e496bc to
07f4fc8
Compare
07f4fc8 to
b29f551
Compare
b29f551 to
db196d1
Compare
db196d1 to
8696108
Compare
8696108 to
d099004
Compare
d099004 to
a952181
Compare
a952181 to
686224c
Compare
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
This PR contains the following updates:
9.15.4->10.7.0Release Notes
pnpm/pnpm (pnpm)
v10.7.0Compare Source
Minor Changes
pnpm config getandlistalso show settings set inpnpm-workspace.yamlfiles #9316.It should be possible to use env variables in
pnpm-workspace.yamlsetting names and value.Add an ability to patch dependencies by version ranges. Exact versions override version ranges, which in turn override name-only patches. Version range
*is the same as name-only, except that patch application failure will not be ignored.For example:
The above configuration would apply
patches/foo-3.patchto[email protected],patches/foo-2.patchto allfooversions which satisfy^2.0.0except2.1.0, andpatches/foo-1.patchto the remainingfooversions.pnpm config set --location=projectsaves the setting to apnpm-workspace.yamlfile if no.npmrcfile is present in the directory #9316.Rename
pnpm.allowNonAppliedPatchestopnpm.allowUnusedPatches. The old name is still supported but it would print a deprecation warning message.Add
pnpm.ignorePatchFailuresto manage whether pnpm would ignore patch application failures.If
ignorePatchFailuresis not set, pnpm would throw an error when patches with exact versions or version ranges fail to apply, and it would ignore failures from name-only patches.If
ignorePatchFailuresis explicitly set tofalse, pnpm would throw an error when any type of patch fails to apply.If
ignorePatchFailuresis explicitly set totrue, pnpm would print a warning when any type of patch fails to apply.Patch Changes
v10.6.5Compare Source
v10.6.4: pnpm 10.6.4Compare Source
Patch Changes
pnpm dlxwith--allow-buildflag #9263.use-node-versionshould not cause pnpm itself to break #9276.Platinum Sponsors
Gold Sponsors
v10.6.3Compare Source
Patch Changes
pnpm install --prod=falseshould not crash, when executed in a project with apnpm-workspace.yamlfile #9233. This fixes regression introduced via #9211.Add the missing
node-optionsconfig torecursive run#9180.Removed a branching code path that only executed when
dedupe-peer-dependents=false. We believe this internal refactor will not result in behavior changes, but we expect it to make future pnpm versions behave more consistently for projects that overridededupe-peer-dependentsto false. There should be less unique bugs from turning offdedupe-peer-dependents.See details in #9259.
v10.6.2Compare Source
Patch Changes
pnpm self-updateshould always update the version in thepackageManagerfield ofpackage.json.pnpm patch-commitwill now use the same filesystem as the store directory to compare and create patch files.--loglevel=erroris used.peerDependencyRulesshould be set inpnpm-workspace.yamlto take effect.v10.6.1Compare Source
Patch Changes
--silentreporting is used.--loglevelis set toerror, don't show installation summary, execution time, and big tarball download progress.package.json#9226.approve-buildscommand, if package.json containsonlyBuiltDependenciesorignoredBuiltDependencies, the selected dependency package will continue to be written intopackage.json.v10.6.0Compare Source
Minor Changes
pnpm-workspace.yamlcan now hold all the settings that.npmrcaccepts. The settings should use camelCase #9211.pnpm-workspace.yamlexample:Projects using a
file:dependency on a local tarball file (i.e..tgz,.tar.gz,.tar) will see a performance improvement during installation. Previously, using afile:dependency on a tarball caused the lockfile resolution step to always run. The lockfile will now be considered up-to-date if the tarball is unchanged.Patch Changes
pnpm self-updateshould not leave a directory with a broken pnpm installation if the installation fails.fast-globreplace withtinyglobbyto reduce the size of the pnpm CLI dependencies #9169.pnpm deployshould not remove fields from the deployed package'spackage.jsonfile #9215.pnpm self-updateshould not read the pnpm settings from thepackage.jsonfile in the current working directory.pnpm deploycreating apackage.jsonwithout theimportsandlicensefield #9193.pnpm update -ishould list only packages that have newer versions #9206.catalogssection of thepnpm-lock.yamlfile to be removed whendedupe-peer-dependents=falseon a filtered install. #9112v10.5.2Compare Source
Patch Changes
pnpm config setcommand should change the global.npmrcfile by default.This was a regression introduced by #9151 and shipped in pnpm v10.5.0.
v10.5.1Compare Source
Patch Changes
pnpm-workspaces.yamlorpnpm-workspaces.ymlfile is found instead of apnpm-workspace.yaml#9170.pnpm-workspace.yamlby thepnpm approve-buildscommand #9168.package.json#9163overridesinpnpm-workspace.yamlshould work.pnpm dlxshould ignore settings from thepackage.jsonfile in the current working directory #9178.v10.5.0Compare Source
Minor Changes
Allow to set the "pnpm" settings from
package.jsonvia thepnpm-workspace.yamlfile #9121.Added support for automatically syncing files of injected workspace packages after
pnpm run#9081. Use thesync-injected-deps-after-scriptssetting to specify which scripts build the workspace package. This tells pnpm when syncing is needed. The setting should be defined in a.npmrcfile at the root of the workspace. Example:The
packagesfield inpnpm-workspace.yamlbecame optional.Patch Changes
pnpm linkwith no parameters should work as if--globalis specified #9151.--config.prefix such as--@​scope:registry=https://scope.example.com/npm#9089.pnpm link <path>should calculate relative path from the root of the workspace directory #9132.pnpm-lock.yamlfile when using--fix-lockfileand--filter. #8639v10.4.1Compare Source
Patch Changes
--allow-buildoption overlaps with thepnpm.ignoredBuildDependencieslist #9105.init-package-managershould work.v10.4.0Compare Source
Minor Changes
pnpm approve-builds --globalworks now for allowing dependencies of globally installed packages to run postinstall scripts.The
pnpm addcommand now supports a new flag,--allow-build, which allows building the specified dependencies. For instance, if you want to install a package calledbundlethat hasesbuildas a dependency and want to allowesbuildto run postinstall scripts, you can run:This will run
esbuild's postinstall script and also add it to thepnpm.onlyBuiltDependenciesfield ofpackage.json. So,esbuildwill always be allowed to run its scripts in the future.Related PR: #9086.
The
pnpm initcommand adds apackageManagerfield with the current version of pnpm CLI #9069. To disable this behaviour, set theinit-package-managersetting tofalse.Patch Changes
pnpm approve-buildsshould work after two consecutivepnpm installruns #9083.packageManagercannot start withv.v10.3.0Compare Source
Minor Changes
strict-dep-builds. When enabled, the installation will exit with a non-zero exit code if any dependencies have unreviewed build scripts (aka postinstall scripts) #9071.Patch Changes
verify-deps-before-runafterpnpm install --production|--no-optional#9019.v10.2.1Compare Source
Patch Changes
pnpm approve-buildsshould work, when executed from a subdirectory of a workspace #9042.pnpm deploy --legacyshould work without injected dependencies.v10.2.0Compare Source
Minor Changes
Packages executed via
pnpm dlxandpnpm createare allowed to be built (run postinstall scripts) by default.If the packages executed by
dlxorcreatehave dependencies that have to be built, they should be listed via the--allow-buildflag. For instance, if you want to run a package calledbundlethat hasesbuildin dependencies and want to allowesbuildto run postinstall scripts, run:Related PR: #9026.
Patch Changes
pnpm deployfails to read the correctprojectIdwhen the deploy source is the same as the workspace directory #9001.overridesfrom adding invalid version ranges topeerDependenciesby keeping thepeerDependenciesand overriding them with proddependencies#8978.pnpm approve-builds.v10.1.0Compare Source
Minor Changes
pnpm ignored-builds#8963.pnpm approve-builds#8963.optimistic-repeat-install. When enabled, a fast check will be performed before proceeding to installation. This way a repeat install or an install on a project with everything up-to-date becomes a lot faster. But some edge cases might arise, so we keep it disabled by default for now #8977.Patch Changes
pnpm install, thepreprepareandpostpreparescripts of the project should be executed #8989.workspace:andcatalog:to be part of wider version range inpeerDependencies.pnpm deployshould inherit thepnpmobject from the rootpackage.json#8991.node_modulesin a sub-project of a monorepo is detected as out-of-date #8959.pnpmto execute other scripts duringpnpm installwithverify-deps-before-run=install#8954.strip-ansiwith the built-inutil.stripVTControlCharacters#9009.v10.0.0Compare Source
Major Changes
Lifecycle scripts of dependencies are not executed during installation by default! This is a breaking change aimed at increasing security. In order to allow lifecycle scripts of specific dependencies, they should be listed in the
pnpm.onlyBuiltDependenciesfield ofpackage.json#8897. For example:{ "pnpm": { "onlyBuiltDependencies": ["fsevents"] } }pnpm linkbehavior updated:The
pnpm linkcommand now adds overrides to the rootpackage.json.pnpm linkfrom the package’s directory. Previously, you needed to usepnpm link -g.Related PR: #8653
Secure hashing with SHA256:
Various hashing algorithms have been updated to SHA256 for enhanced security and consistency:
node_modules/.pnpmare now hashed with SHA256.packageExtensionsChecksumfield ofpnpm-lock.yamlis now SHA256.Configuration updates:
manage-package-manager-versions: enabled by default. pnpm now manages its own version based on thepackageManagerfield inpackage.jsonby default.public-hoist-pattern: nothing is hoisted by default. Packages containingeslintorprettierin their name are no longer hoisted to the root ofnode_modules. Related Issue: #8378Upgraded
@yarnpkg/extensionsto v2.0.3. This may alter your lockfile.virtual-store-dir-max-length: the default value on Windows has been reduced to 60 characters.Reduced environment variables for scripts:
During script execution, fewer
npm_package_*environment variables are set. Onlyname,version,bin,engines, andconfigremain.Related Issue: #8552
All dependencies are now installed even if
NODE_ENV=production. Related Issue: #8827Changes to the global store:
Store version bumped to v10.
Some registries allow identical content to be published under different package names or versions. To accommodate this, index files in the store are now stored using both the content hash and package identifier.
This approach ensures that we can:
Related PR: #8510
Related Issue: #8204
More efficient side effects indexing. The structure of index files in the store has changed. Side effects are now tracked more efficiently by listing only file differences rather than all files.
Related PR: #8636
A new
indexdirectory stores package content mappings. Previously, these files were infiles.Other breaking changes:
#character is now escaped in directory names withinnode_modules/.pnpm.Related PR: #8557
pnpm add --global pnpmorpnpm add --global @​pnpm/exenow fails with an error message, directing you to usepnpm self-updateinstead.Related PR: #8728
Related Issue: #8833
pnpm deploycommand now only works in workspaces that haveinject-workspace-packages=true. This limitation is introduced to allow us to create a proper lockfile for the deployed project using the workspace lockfile.pnpm testnow passes all parameters after thetestkeyword directly to the underlying script. This matches the behavior ofpnpm run test. Previously you needed to use the--prefix.Related PR: #8619
node-gypupdated to version 11.pnpm deploynow tries creating a dedicated lockfile from a shared lockfile for deployment. It will fallback to deployment without a lockfile if there is no shared lockfile orforce-legacy-deployis set totrue.Minor Changes
Added support for a new type of dependencies called "configurational dependencies". These dependencies are installed before all the other types of dependencies (before "dependencies", "devDependencies", "optionalDependencies").
Configurational dependencies cannot have dependencies of their own or lifecycle scripts. They should be added using exact version and the integrity checksum. Example:
{ "pnpm": { "configDependencies": { "my-configs": "1.0.0+sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==" } } }Related RFC: #8.
Related PR: #8915.
New settings:
New
verify-deps-before-runsetting. This setting controls howpnpmchecksnode_modulesbefore running scripts:install: Automatically runpnpm installifnode_modulesis outdated.warn: Print a warning ifnode_modulesis outdated.prompt: Prompt the user to confirm runningpnpm installifnode_modulesis outdated.error: Throw an error ifnode_modulesis outdated.false: Disable dependency checks.Related Issue: #8585
New
inject-workspace-packagessetting enables hard-linking all local workspace dependencies instead of symlinking them. Previously, this could be achieved usingdependenciesMeta[].injected, which remains supported.Related PR: #8836
Faster repeat installs:
On repeated installs,
pnpmperforms a quick check to ensurenode_modulesis up to date.Related PR: #8838
pnpm addintegrates with default workspace catalog:When adding a dependency,
pnpm addchecks the default workspace catalog. If the dependency and version requirement match the catalog,pnpm adduses thecatalog:protocol. Without a specified version, it matches the catalog’s version. If it doesn’t match, it falls back to standard behavior.Related Issue: #8640
pnpm dlxnow resolves packages to their exact versions and uses these exact versions for cache keys. This ensurespnpm dlxalways installs the latest requested packages.Related PR: #8811
No
node_modulesvalidation on certain commands. Commands that should not modifynode_modules(e.g.,pnpm install --lockfile-only) no longer validate or purgenode_modules.Related PR: #8657
v9.15.9: pnpm 9.15.9Compare Source
Patch Changes
Platinum Sponsors
Gold Sponsors
v9.15.8: pnpm 9.15.8Compare Source
Patch Changes
pnpm self-updateshould always update the version in thepackageManagerfield ofpackage.json.--silentreporting is used.--loglevelis set toerror, don't show installation summary, execution time, and big tarball download progress.--loglevel=erroris used.Platinum Sponsors
Gold Sponsors
v9.15.7: pnpm 9.15.7Compare Source
Patch Changes
pnpm self-updateshould not leave a directory with a broken pnpm installation if the installation fails.--config.prefix such as--@​scope:registry=https://scope.example.com/npm#9089.pnpm self-updateshould not read the pnpm settings from thepackage.jsonfile in the current working directory.pnpm update -ishould list only packages that have newer versions #9206.catalogssection of thepnpm-lock.yamlfile to be removed whendedupe-peer-dependents=falseon a filtered install. #9112Platinum Sponsors
Gold Sponsors
v9.15.6: pnpm 9.15.6Compare Source
Patch Changes
packageManagercannot start withv.pnpm-lock.yamlfile when using--fix-lockfileand--filter. #8639v9.15.5: pnpm 9.15.5Compare Source
Patch Changes
pnpm install, thepreprepareandpostpreparescripts of the project should be executed #8989.strip-ansiwith the built-inutil.stripVTControlCharacters#9009.Platinum Sponsors
Gold Sponsors
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.