fix(deps): update dependencies (non-major) #294
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
24.9.1->24.10.124.10.3(+1)3.42.0->3.47.09.6.0->9.6.116.2.0->16.5.024.10.0->24.11.1v24.12.010.12.1->10.24.010.25.02.5.15->2.5.205.8.3->5.9.3Release Notes
zloirock/core-js (core-js)
v3.47.0Compare Source
JSON.parsesource text access proposal :JSON.isRawJSONJSON.parseJSON.rawJSONJSON.stringifyes.namespace modules,/es/and/stable/namespaces entriesJSON.stringifyinternalsIteratorsequencing proposal:Iterator.concates.namespace modules,/es/and/stable/namespaces entriesIterator.zipIterator.zipKeyed/actual/namespace entries, unconditional forced replacement changed to feature detection.sizeinURLSearchParams.prototype.appendpolyfill in IE8-Iterator.concatmarked as shipped in FF147Mapupsert proposal features marked as shipped in Safari 26.2Math.sumPrecisemarked as shipped in Safari 26.2Uint8Array.{ fromBase64, prototype.setFromBase64 }marked as fixed in Safari 26.2v3.46.0Compare Source
Mapupsert stage 3 proposal:WeakMap.prototype.getOrInsertComputedbug with callback calling before validation a keyIteratorchunking proposal:Iterator.prototype.chunksIterator.prototype.windowsIterator.prototype.slidingmethod replaced with an extra parameter ofIterator.prototype.windowsmethod, tc39/proposal-iterator-chunking/#24, tc39/proposal-iterator-chunking/#26Iterator.zipandIterator.zipKeyedbehavior withmode: 'longest'option, #1469, thanks @lionel-roweObject.groupByandIterator.zipKeyedtogether withSymbolpolyfill - some cases of symbol keys on resultnull-prototype object were able to leak out tofor-inMapupsert proposal features marked as shipped from FF144v3.45.1Compare Source
Mapupsert proposal with polyfilled methods in the pure versionbugsfields topackage.jsonof all packagesMapupsert proposal features marked as shipped from Bun 1.2.20v3.45.0Compare Source
Uint8Arrayto / from base64 and hex proposal:Uint8Array.fromBase64Uint8Array.fromHexUint8Array.prototype.setFromBase64Uint8Array.prototype.setFromHexUint8Array.prototype.toBase64Uint8Array.prototype.toHexes.namespace modules,/es/and/stable/namespaces entriesUint8ArrayfromBase64 / setFromBase64 does not throw an error on incorrect length of base64 stringMath.sumPreciseproposal:Math.sumPrecisees.namespace module,/es/and/stable/namespaces entriesIteratorsequencing proposal:Iterator.concat/actual/namespace entries, unconditional forced replacement changed to feature detectionMapupsert proposal:Map.prototype.getOrInsertMap.prototype.getOrInsertComputedWeakMap.prototype.getOrInsertWeakMap.prototype.getOrInsertComputed/actual/namespace entries, unconditional forced replacement changed to feature detectionIteratormethods/stage/entriesUint8Arrayto / from base64 and hex proposal features marked as supported from V8 ~ Chromium 140Uint8Array.{ fromBase64, prototype.setFromBase64 }marked as unsupported in Safari and supported only from Bun 1.2.20 because of a bug: it does not throw an error on incorrect length of base64 string%TypedArray%.prototype.withmarked as fixed in Safari 26.0v3.44.0Compare Source
Uint8Arrayto / from base64 and hex stage 3 proposal:Uint8Array.fromHexandUint8Array.prototype.{ setFromBase64, toBase64, toHex }, thanks @brc-ddGetinIterator.zipKeyed, following tc39/proposal-joint-iteration#43Iteratorsequencing stage 2.7 proposal:Iterator.concatno longer reusesIteratorResultobject of concatenated iterators, following tc39/proposal-iterator-sequencing#26Iteratorchunking stage 2 proposal:Iterator.prototype.slidingNumber.prototype.clampstage 2 proposal:clampno longer throws an error onNaNasminormax, following tc39/proposal-math-clamp#d2387791c265edf66fbe2455eab919016717ce6fSet.prototype.{ symmetricDifference, union }detectionIteratormethods/full/{ instance, number/virtual }/clampentriesIteratorhelpers marked as fixed and updated following the latest spec changes in Safari 26.0Set.prototype.{ difference, symmetricDifference, union }marked as fixed in Safari 26.0SuppressedErrormarked as fixed in FF141Error.isErrormarked as fixed in Node 24.3setImmediateandclearImmediatemarked as available from Deno 2.4Math.sumPrecisemarked as shipped in Bun 1.2.18%TypedArray%.prototype.withmarked as fixed in Bun 1.2.18v3.43.0Compare Source
Symbol.disposeSymbol.asyncDisposeSuppressedErrorDisposableStackDisposableStack.prototype.disposeDisposableStack.prototype.useDisposableStack.prototype.adoptDisposableStack.prototype.deferDisposableStack.prototype.moveDisposableStack.prototype[@​@​dispose]AsyncDisposableStackAsyncDisposableStack.prototype.disposeAsyncAsyncDisposableStack.prototype.useAsyncDisposableStack.prototype.adoptAsyncDisposableStack.prototype.deferAsyncDisposableStack.prototype.moveAsyncDisposableStack.prototype[@​@​asyncDispose]Iterator.prototype[@​@​dispose]AsyncIterator.prototype[@​@​asyncDispose]es.namespace module,/es/and/stable/namespaces entriesArray.fromAsyncproposal:Array.fromAsynces.namespace module,/es/and/stable/namespaces entriesError.isErrorproposal:Error.isErrores.namespace module,/es/and/stable/namespaces entriesIterator.zipIterator.zipKeyedIteratorchunking stage 2 proposal:Iterator.prototype.chunksIterator.prototype.windowsNumber.prototype.clampproposal:Number.prototype.clampMath.clampwas replaced withNumber.prototype.clampRangeErrorifmin <= maxor+0min and-0max, tc39/proposal-math-clamp/#22flagsgetter PR. Native methods are not fixed, only own implementation updated for:RegExp.prototype[@​@​match]RegExp.prototype[@​@​replace]RegExpflags in polyfills of some methods in engines without proper support ofRegExp.prototype.flagsand without polyfill of this getterthisis updated whileSet.prototype.differenceis being executedthisin the following methods:Set.prototype.symmetricDifferenceSet.prototype.unionIterator.prototype.dropIterator.prototype.filterIterator.prototype.flatMapIterator.prototype.mapIterator.fromwhen underlying iterator'sreturnmethod isnullArray.prototype.withwhen index coercion failsTypedArray.prototype.withshould truncate negative fractional index to zero, but instead throws an errorPromisepolyfill in the pure version/iterator/flat-mapentriesError.isErrormarked not supported in Node because of a bugSet.prototype.differencemarked as not supported in Safari and supported only from Bun 1.2.5 because of a bugSet.prototype.{ symmetricDifference, union }marked as not supported in Safari and supported only from Bun 1.2.5 because of a bugIterator.frommarked as not supported in Safari and supported only from Bun 1.2.5 because of a bugIteratorhelpers marked as implemented from FF141Array.prototype.withmarked as supported only from FF140 because it throws an incorrect exception when index coercion failsTypedArray.prototype.withmarked as unsupported in Bun and Safari because it should truncate negative fractional index to zero, but instead throws an errorDisposableStackandAsyncDisposableStackmarked as shipped in FF141 (SuppressedErrorhas a bug)AsyncDisposableStackbugs marked as fixed in Deno 2.3.2SuppressedErrorbugs (extra arguments support and arity) marked as fixed in Bun 1.2.15sindresorhus/execa (execa)
v9.6.1Compare Source
VerboseOptiontype not being properly exported (#1215)7891c39sindresorhus/globals (globals)
v16.5.0Compare Source
6d441caea31521v16.4.0Compare Source
8b8a2d6v16.3.0Compare Source
8c029d9nodejs/node (node)
v24.11.1Compare Source
v24.11.0Compare Source
pnpm/pnpm (pnpm)
v10.24.0Compare Source
v10.23.0: pnpm 10.23Compare Source
Minor Changes
--lockfile-onlyoption topnpm list#10020.Patch Changes
pnpm self-updateshould download pnpm from the configured npm registry #10205.pnpm self-updateshould always install the non-executable pnpm package (pnpm in the registry) and never the@pnpm/exepackage, when installing v11 or newer. We currently cannot ship@pnpm/exeaspkgdoesn't work with ESM #10190.pnpm add, if there's aengines.runtimesetting declared inpackage.json#10209.pnpm listandpnpm whynow display npm: protocol for aliased packages (e.g.,foo npm:[email protected]) #8660.pnpm store pruneshould not fail if the store contains Node.js packages #10131.Platinum Sponsors
Gold Sponsors
v10.22.0: pnpm 10.22Compare Source
Minor Changes
Added support for
trustPolicyExclude#10164.You can now list one or more specific packages or versions that pnpm should allow to install, even if those packages don't satisfy the trust policy requirement. For example:
Allow to override the
enginesfield on publish by thepublishConfig.enginesfield.Patch Changes
Platinum Sponsors
Gold Sponsors
v10.21.0Compare Source
v10.20.0Compare Source
Minor Changes
--alloption inpnpm --helpto list all commands #8628.Patch Changes
latestversion doesn't satisfy the maturity requirement configured byminimumReleaseAge, pick the highest version that is mature enough, even if it has a different major version #10100.createcommand should not verify patch info.managePackageManagerVersionstofalse, when switching to a different version of pnpm CLI, in order to avoid subsequent switches #10063.v10.19.0Compare Source
Minor Changes
You can now allow specific versions of dependencies to run postinstall scripts.
onlyBuiltDependenciesnow accepts package names with lists of trusted versions. For example:Related PR: #10104.
Added support for exact versions in
minimumReleaseAgeExclude#9985.You can now list one or more specific versions that pnpm should allow to install, even if those versions don’t satisfy the maturity requirement set by
minimumReleaseAge. For example:v10.18.3Compare Source
Patch Changes
verifyDepsBeforeInstall: installand pre/post install scripts that called other pnpm scripts #10060.@scope:registry) being parsed as property paths inpnpm config getwhen--location=projectis used #9362.pnpm config set --location=projectincorrectly handling keys with slashes (auth tokens, registry settings) #9884.pnpm-workspace.yamland.npmrcexist,pnpm config set --location=projectnow writes topnpm-workspace.yaml(matching read priority) #10072.pnpm outdated --long#10040.v10.18.2Compare Source
Patch Changes
pnpm outdated --longshould work #10040.pnpm dlxshould request the full metadata of packages, whenminimumReleaseAgeis set #9963.EPIPEerrors when piping output to other commands #10027.v10.18.1Compare Source
Patch Changes
--lockfile-onlyis used #8320.pnpm setupcreates a command shim to the pnpm executable. This is needed to be able to runpnpm self-updateon Windows #5700.pnpm install, pnpm produced false positive warnings for "skip adding to the default catalog because it already exists". This warning now only prints when usingpnpm add --save-catalogas originally intended.v10.18.0Compare Source
Minor Changes
Added network performance monitoring to pnpm by implementing warnings for slow network requests, including both metadata fetches and tarball downloads.
Added configuration options for warning thresholds:
fetchWarnTimeoutMsandfetchMinSpeedKiBps.Warning messages are displayed when requests exceed time thresholds or fall below speed minimums
Related PR: #10025.
Patch Changes
minimumReleaseAgeconfiguration #10030.cleanupUnusedCatalogsconfiguration when removing dependent packages.scriptShellis set tofalse#8748.pnpm dlxshould not fail whenminimumReleaseAgeis set #10037.v10.17.1Compare Source
Patch Changes
minimumReleaseAgesetting, print this information out in the error message #9974.state.jsoncreation path when executingpnpm patchin a workspace project #9733.minimumReleaseAgeis set and thelatesttag is not mature enough, prefer a non-deprecated version as the newlatest#9987.v10.17.0Compare Source
Minor Changes
The
minimumReleaseAgeExcludesetting now supports patterns. For instance:Related PR: #9984.
Patch Changes
minimumReleaseAgecheck, when the package is requested by exact version and the packument is loaded from cache #9978.minimumReleaseAgeis set and the active version under a dist-tag is not mature enough, do not downgrade to a prerelease version in case the original version wasn't a prerelease one #9979.v10.16.1Compare Source
Patch Changes
v10.16.0Compare Source
Minor Changes
There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies. In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour.
The new setting is called
minimumReleaseAge. It specifies the number of minutes that must pass after a version is published before pnpm will install it. For example, settingminimumReleaseAge: 1440ensures that only packages released at least one day ago can be installed.If you set
minimumReleaseAgebut need to disable this restriction for certain dependencies, you can list them under theminimumReleaseAgeExcludesetting. For instance, with the following configuration pnpm will always install the latest version of webpack, regardless of its release time:Related issue: #9921.
Added support for
finders#9946.In the past,
pnpm listandpnpm whycould only search for dependencies by name (and optionally version). For example:prints the chain of dependencies to any installed instance of
minimist:What if we want to search by other properties of a dependency, not just its name? For instance, find all packages that have
react@17in their peer dependencies?This is now possible with "finder functions". Finder functions can be declared in
.pnpmfile.cjsand invoked with the--find-by=<function name>flag when runningpnpm listorpnpm why.Let's say we want to find any dependencies that have React 17 in peer dependencies. We can add this finder to our
.pnpmfile.cjs:Now we can use this finder function by running:
pnpm will find all dependencies that have this React in peer dependencies and print their exact locations in the dependency graph.
It is also possible to print out some additional information in the output by returning a string from the finder. For example, with the following finder:
Every matched package will also print out the license from its
package.json:Patch Changes
nodeVersionis not set to an exact semver version #9934.pnpm publishshould be able to publish a.tar.gzfile #9927.pnpm runreturn a non-zero exit code #9626.v10.15.1Compare Source
Patch Changes
.pnp.cjscrash when importing subpath #9904.v10.15.0Compare Source
Minor Changes
cleanupUnusedCatalogsconfiguration. When set totrue, pnpm will remove unused catalog entries during installation #9793.@*/pnpm-plugin-*#9780.pnpm config getnow prints an INI string for an object value #9797.pnpm config getnow accepts property paths (e.g.pnpm config get catalog.react,pnpm config get .catalog.react,pnpm config get 'packageExtensions["@​babel/parser"].peerDependencies["@​babel/types"]'), andpnpm config setnow accepts dot-leading or subscripted keys (e.g.pnpm config set .ignoreScripts true).pnpm config get --jsonnow prints a JSON serialization of config value, andpnpm config set --jsonnow parses the input value as JSON.Patch Changes
pnpm createcommand, must verify whether the node version is supported even if a cache already exists #9775.*/*to theAcceptheader to avoid getting a 406 error on AWS CodeArtifact #9862.pnpm dlx pkg --helpdoesn't pass--helptopkg#9823.v10.14.0Compare Source
Minor Changes
Added support for JavaScript runtime resolution
Declare Node.js, Deno, or Bun in
devEngines.runtime(insidepackage.json) and let pnpm download and pin it automatically.Usage example:
{ "devEngines": { "runtime": { "name": "node", "version": "^24.4.0", "onFail": "download" (we only support the "download" value for now) } } }How it works:
pnpm installresolves your specified range to the latest matching runtime version.Why this is better:
useNodeVersionandexecutionEnv.nodeVersion)executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.devEngines.runtimesetting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.Related PR: #9755.
Add
--cpu,--libc, and--ostopnpm install,pnpm add, andpnpm dlxto customizesupportedArchitecturesvia the CLI #7510.Patch Changes
pnpm adddownloads packages whoselibcdiffer frompnpm.supportedArchitectures.libc.dlxto parse CLI flags and options between thedlxcommand and the command to run or between thedlxcommand and--#9719.pnpm install --prodshould removing hoisted dev dependencies #9782.pnpm installto incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.v10.13.1Compare Source
Patch Changes
v10.13.0Compare Source
Minor Changes
Added the possibility to load multiple pnpmfiles. The
pnpmfilesetting can now accept a list of pnpmfile locations #9702.pnpm will now automatically load the
pnpmfile.cjsfile from any config dependency named@pnpm/plugin-*orpnpm-plugin-*#9729.The order in which config dependencies are initialized should not matter — they are initialized in alphabetical order. If a specific order is needed, the paths to the
pnpmfile.cjsfiles in the config dependencies can be explicitly listed using thepnpmfilesetting inpnpm-workspace.yaml.Patch Changes
pkg.pr.new, treat them as Git tarball URLs #9694.dangerouslyAllowAllBuilds,onlyBuiltDependencies,onlyBuiltDependenciesFile, andneverBuiltDependencies#9628.pnpm-workspace.yamlwith deep #9701.pnpm rebuildcommand should not add pkgs included inignoredBuiltDependenciestoignoredBuildsinnode_modules/.modules.yaml#9338.shell-quotewithshlexfor quoting command arguments #9381.v10.12.4Compare Source
Patch Changes
Fix
pnpm licensescommand for local dependencies #9583.Fix a bug in which
pnpm ls --filter=not-exist --jsonprints nothing instead of an empty array #9672.Fix a deadlock that sometimes happens during peer dependency resolution #9673.
Running
pnpm installafterpnpm fetchshould hoist all dependencies that need to be hoisted.Fixes a regression introduced in [v10.12.2] by [#9648]; resolves [#9689].
[v10.12.2]: https://github.com/pnpm/pnpm/releases/tag/v10.12.2Add commentMore actions
[#9648]: #9648
[#9689]: #9689
v10.12.3Compare Source
Patch Changes
Regression introduced in v10.12.2 by #9648; resolves #9685.
v10.12.2Compare Source
Patch Changes
enableGlobalVirtualStoreset totrue#9648.--helpand-hflags not working as expected for thepnpm createcommand.pnpm licenses list --jsoncommand is incorrect.pnpm deployfails due to overridden dependencies having peer dependencies causingERR_PNPM_OUTDATED_LOCKFILE#9595.matzkoh/prettier-plugin-packagejson (prettier-plugin-packagejson)
v2.5.20Compare Source
Bug Fixes
v2.5.19Compare Source
Bug Fixes
v2.5.18Compare Source
Bug Fixes
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.