You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
c112b61: Added a --dry-run option to pnpm install. It runs a full dependency resolution and reports what an install would change, but writes nothing to disk (no lockfile, no node_modules) and always exits with code 0. This mirrors the preview semantics of npm install --dry-run#7340.
179ebc4: pnpm run --no-bail now exits with a non-zero exit code when any of the executed scripts fail, while still running every matched script to completion. This makes the exit-code behavior of --no-bail consistent between recursive and non-recursive runs (recursive runs already failed at the end). Previously, a non-recursive pnpm run --no-bail always exited with code 0, even when a script failed #8013.
0474a9c: Added support for generating Node.js package maps at node_modules/.package-map.json during isolated and hoisted installs. Added the node-experimental-package-map setting to inject the generated map into pnpm-managed Node.js script environments, and the node-package-map-type setting to choose between standard and loose package maps.
dcededc: pnpm sbom now marks components reachable only through devDependencies with CycloneDX scope: "excluded" and the cdx:npm:package:development property. The excluded scope documents "component usage for test and other non-runtime purposes", which matches the semantics of a devDependency; the property is the CycloneDX npm-taxonomy marker emitted by @cyclonedx/cyclonedx-npm, so both modern (scope) and existing (property) consumers are covered. Components reachable at runtime (including installed optionalDependencies) omit scope and default to required.
1495cb0: Added per-package SBOM generation with --out and --split flags. Use --out out/%s.cdx.json to write one SBOM per workspace package to individual files, or --split for NDJSON output to stdout. When --filter selects a single package, the SBOM root component now uses that package's metadata. Workspace inter-dependencies (workspace: protocol) and their transitive dependencies are included. Author, repository, and license fall back to the root manifest when the package doesn't define them.
293921a: feat(view): support searching project manifest upward when package name is omitted
When running pnpm view without a package name, the command now searches
upward for the nearest project manifest (package.json, package.yaml, or package.json5) and uses its name field.
If the manifest exists but lacks a name field, an error is thrown.
This change also replaces the find-up dependency with empathic for
improved performance and consistency across workspace tools.
Patch Changes
29ab905: Fixed pnpm update overriding the version range policy of a named catalog whose name parses as a version (e.g. catalog:express4-21). The catalog: reference carries no pinning of its own, so the prefix from the catalog entry (such as ~) is now preserved instead of being widened to ^#10321.
bee4bf4: Security: validate config dependency names and versions from the env lockfile (pnpm-lock.yaml) before using them to build filesystem paths. A committed lockfile with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions; the same validation is applied to optional subdependencies of config dependencies, and to the legacy workspace-manifest format before any lockfile is written. See GHSA-qrv3-253h-g69c.
96bdd57: Fix link: workspace protocol switching to file: after pnpm rm is run from inside a workspace package whose target workspace dependency has its own dependencies, when injectWorkspacePackages: true is set. Follow-up to #10575, which fixed the same symptom for workspace packages without dependencies.
302a2f7: No longer warn about using both packageManager and devEngines.packageManager when the two fields pin the same package manager at the same version with the same integrity hash (e.g. both pnpm@11.5.1+sha512.…). Previously the hash was stripped from the legacy packageManager field but not from devEngines.packageManager, so even identical specifications looked like a mismatch #12028.
The warning still fires on any genuine divergence, and several cases now state the specific reason instead of a single generic message: a different package manager, a different version, or contradictory integrity hashes for the same version.
3f0fb21: Fixed the progress line showing leftover characters from external processes that write to the terminal between progress updates (e.g. an SSH passphrase prompt would leave a fragment like added 0sa':). The interactive reporter now redraws each frame in place, erasing to the end of the display before reprinting, so any such remnants are cleared #12350.
564619f: Fixed pnpm approve-builds reporting "no packages awaiting approval" when a build-script dependency whose approval was revoked (e.g. after git stash drops the allowBuilds from pnpm-workspace.yaml) is re-added. The revoked packages are now correctly recorded in .modules.yaml so approve-builds can find them. #12221
3d1fd20: Skip the redundant "target bin directory already contains an exe called node" warning on Windows when the existing node.exe already matches the target (same hard link or identical content) pnpm/pnpm#12203.
1b02b47: Fix macOS Gatekeeper blocking native binaries (.node, .dylib, .so) by removing the com.apple.quarantine extended attribute after importing them from the store.
When pnpm imports files from its content-addressable store into node_modules, macOS preserves extended attributes, including com.apple.quarantine. If this xattr is present on a store blob (e.g. it was first written under a Gatekeeper-enabled app such as a Git client), it propagates to node_modules, and Gatekeeper blocks the native binary from loading even though pnpm already verified the file's integrity against the lockfile.
After importing a package, pnpm now strips com.apple.quarantine from its native binaries, matching Homebrew's behaviour of dropping quarantine from verified downloads. The cleanup is macOS-only, runs in a single batched xattr call per package, is restricted to native binaries (other files are untouched), and is non-fatal (it logs a warning on unexpected errors).
61969fb: Fix pnpm install with optimisticRepeatInstall incorrectly reporting Already up to date when pnpm-lock.yaml changed but project manifests did not. This affected workflows such as checking out or restoring only the lockfile #12100.
Also fixes checkDepsStatus to use the correct lockfile path when useGitBranchLockfile is enabled, so the optimistic fast-path and lockfile modification detection work with pnpm-lock.<branch>.yaml files instead of always stat'ing pnpm-lock.yaml. Merge-conflict detection now reads the resolved lockfile name as well, and with mergeGitBranchLockfiles enabled every pnpm-lock.*.yaml is scanned for modifications and conflicts. The git branch is now resolved by reading .git/HEAD directly (no process spawn) and uses the workspace directory rather than process.cwd().
5c12968: Fix recursive updates of transitive dependencies when the update command mixes transitive dependency patterns with direct dependency selectors. For example, pnpm up -r "@​babel/core" uuid now updates matching transitive @babel/core dependencies even when uuid is a direct dependency selector #12103.
9d79ba1: Register the pnpm update --no-save flag in the CLI help and option parser.
0474a9c: Fixed pnpm import for Yarn v2 lockfiles when js-yaml v4 is installed.
9e0c375: Fixed pnpm install repeatedly prompting to remove and reinstall node_modules in a workspace package when enableGlobalVirtualStore is enabled. The post-install build step recorded a per-project node_modules/.pnpm virtual store directory in node_modules/.modules.yaml, overwriting the global <storeDir>/links value the install step had written. The next install then detected a virtual-store mismatch (ERR_PNPM_UNEXPECTED_VIRTUAL_STORE). The build step now derives the same global virtual store directory as the install step #12307.
223d060: Document the --cpu, --os and --libc flags in the output of pnpm install --help. These flags were already supported but were only documented on the website #12359.
e85aea2: Avoid reading README.md from disk when publishing if the publish manifest already provides a readme field. The README is now only read lazily, inside createExportableManifest, when it is actually needed.
3188ae7: Fixed pnpm peers check to accept loose peer dependency ranges such as >=3.16.0 || >=4.0.0- when the installed peer version satisfies the range #12149.
531f2a3: Fixed pnpm update rewriting a workspace: dependency that points at a local path (e.g. workspace:../packages/foo/dist) into a normalized link: or version-range specifier. Such specifiers are now preserved verbatim when the workspace protocol is preserved #3902.
fe66535: Fixed a lockfile non-convergence bug where an incremental install kept a duplicate transitive dependency that a fresh install would not produce. When a package is reused from the lockfile, its child edges are taken verbatim and bypass the preferred-versions walk, so a transitive dependency could stay pinned to an older version even after a direct dependency resolved to a higher version that satisfies the same range. The resolver now refreshes such a stale pin to the higher direct-dependency version during resolution — so the older version is never resolved or fetched, and the incremental result converges to the fresh one.
6d35338: pnpm install detects changes inside local file dependencies again. The optimistic repeat-install fast path only tracks manifest and lockfile modification times, so edits inside a local dependency's directory (or a repacked local tarball) were reported as "Already up to date". Projects with local file dependencies (file: and bare local path or tarball specifiers, declared directly or through pnpm.overrides) now always run a full install, which refetches those dependencies, matching pnpm v10 behavior #11795.
4ca9247: Preserve the existing Node.js runtime version prefix when resolving node@runtime:<range> to a concrete version.
30c7590: Create shorter CAFS temporary package directories to leave room for lifecycle scripts that create IPC socket paths under TMPDIR.
13815ad: Reporter output (warnings, progress) for pnpm store and pnpm config subcommands now goes to stderr instead of stdout. This fixes scripts that capture their stdout (e.g. PNPM_STORE=$(pnpm store path), pnpm config list --json | jq) from getting warnings mixed into the result.
1c05876: Avoid relinking unchanged child dependencies and remove stale child links during warm installs.
817f99d: Fixed lockfile churn where a package's transitivePeerDependencies could be dropped (and shift between packages) when the package participates in a dependency cycle. A cycle re-entry resolves against truncated children, so it must not be cached as "pure"; otherwise sibling occurrences of the same package short-circuit and lose transitive peers depending on traversal order #5108.
eba03e0: Fix pnpm install reporting "Already up to date" after a catalog entry in pnpm-workspace.yaml was reverted to a previous version. After an update modified a catalog, the workspace state cache stored the pre-update catalog versions, so reverting the entry back to its original version was not detected as an outdated state #12418.
3b54d79: pnpm update now keeps lockfile overrides that resolve through a catalog in sync with the catalog. Previously, when an override referenced a catalog (e.g. overrides: { foo: 'catalog:' }) and pnpm update bumped that catalog entry, the lockfile's catalogs advanced while the resolved overrides kept the old version. The resulting lockfile was internally inconsistent, so a later pnpm install --frozen-lockfile failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH.
9d0a300: Fixed pnpm version --recursive so it honors the workspace selection. In recursive mode the version bump now applies to the packages resolved from the workspace filter (selectedProjectsGraph), matching the behavior of pnpm publish --recursive, instead of always bumping every workspace package #11348.
Added a new setting frozenStore (--frozen-store) that lets pnpm install run against a package store on a read-only filesystem (e.g. a Nix store, a read-only bind mount, an OCI layer). When enabled, pnpm opens the store's SQLite index.db through the immutable=1 URI — bypassing the WAL/-shm sidecar creation that otherwise fails on a read-only directory — and suppresses every store-write path (the index.db writer and the project-registry write). Pair it with --offline --frozen-lockfile against a fully-populated store. Under the global virtual store, package directories live inside the store, so if the store is missing the build output of a package whose lifecycle scripts are approved (or that has a patch), pnpm fails up front with ERR_PNPM_FROZEN_STORE_NEEDS_BUILD rather than crashing mid-build on a read-only write — seed the store with those builds first. Incompatible with --force and with a configured pnpr server, since both write into the store; the side-effects cache is likewise not written under frozenStore. If the store is missing its content directory, the install fails fast with ERR_PNPM_FROZEN_STORE_INCOMPLETE rather than attempting to initialize it. The read-only immutable=1 open requires Node.js >=22.15.0, >=23.11.0, or >=24.0.0; on older runtimes --frozen-store fails with a clear ERR_PNPM_FROZEN_STORE_UNSUPPORTED_NODE error. Bin-linking also tolerates a read-only store: under the global virtual store a package's bin source lives inside the store, so the chmod that makes it executable would be refused — with EPERM/EACCES, or with EROFS on a genuinely read-only filesystem. That chmod is redundant when the seed already ships its bins executable with a normalized shebang, so it is now skipped in that case, while a non-executable bin (or one still carrying a Windows CRLF shebang) on a read-only store still errors.
When pacquet (the Rust port of pnpm) is declared in configDependencies, pnpm now delegates dependency resolution to it too — not just materialization — provided the installed pacquet is new enough to support full resolving installs (>= 0.11.7).
Previously pacquet only ran in frozen-install mode: pnpm always resolved the dependency graph itself (writing pnpm-lock.yaml) and handed pacquet a finished lockfile to fetch / import / link. With pacquet >= 0.11.7, a non-frozen pnpm install (default isolated nodeLinker, plain install) is delegated to pacquet end-to-end in a single pass — pacquet resolves the manifests, writes the lockfile, and materializes node_modules. pnpm detects the capability from the installed pacquet's version; older pacquet releases keep the resolve-then-materialize split, and add / update / remove still resolve in pnpm (it has to mutate the manifests first). This remains an opt-in preview of the Rust install engine #11723.
Added a new opt-in --batch flag to pnpm publish --recursive that sends all selected packages to the registry in a single PUT /-/pnpm/v1/publish request instead of one request per package. The target registry has to implement the batch publish endpoint (pnpr does); registries that don't are reported with a clear ERR_PNPM_BATCH_PUBLISH_UNSUPPORTED error. The batch is processed all-or-nothing by pnpr: if any package in the batch fails validation, none of the packages are published.
Patch Changes
Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.
The fix adds two layers:
The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests.
The lockfile verification gate (verifyLockfileResolutions) now runs an always-on, policy-independent check that rejects any importer or snapshot dependency alias that is not a valid package name, failing the install early — before any fetch or filesystem work — for every node linker at once.
Made shared package child resolution deterministic when the same package is reached through multiple contexts. pnpm now chooses the shallowest occurrence, then importer order, then parent path, instead of letting request timing decide the child context and missing-peer report pnpm/pnpm#12358.
Fix garbled summary line after submitting pnpm update -i and pnpm audit --fix -i. The interactive checkbox prompt previously printed every selected choice's full table row (label, current/target versions, workspace, URL) joined by commas, producing a wall of text after pressing Enter. The summary now lists only the selected package names (or vulnerability keys) by setting an explicit short per choice; the in-progress selection UI is unchanged.
Prevent pnpm patch-remove from removing files outside the configured patches directory.
Fixed pnpm publish ignoring strictSsl: false when publ
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
Branch creation
Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
If you want to rebase/retry this PR, check this box
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: this dependency update bumps vite-plus 0.1.24→0.2.1 and pnpm 11.6→11.8 with a large lockfile churn, which exceeds the low-risk approval threshold. The zrr-website-slides Workers build also failed; human review is needed before merge. Requested reviewer: zrr1999.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Risk: medium. Not approving: this dependency update bumps vite-plus 0.1.24→0.2.1 and pnpm 11.6→11.8 with large lockfile churn, exceeding the low-risk threshold; prek CI failed on minimumReleaseAge for oxlint 1.71.0 and Workers builds are failing. Reviewer zrr1999 is already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
renovate
Bot
force-pushed
the
renovate/dependencies-(non-major)
branch
from
This PR contains the following updates:
1.18.0→1.21.02.0.2→2.0.41.69.0→1.71.011.6.0→11.8.00.1.24→0.2.10.1.24→0.2.14.100.0→4.103.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
lucide-icons/lucide (@lucide/astro)
v1.21.0: Version 1.21.0Compare Source
What's Changed
versionscripts in package scripts by @ericfennis in #4479broken-boneicon by @Patolord in #4131New Contributors
Full Changelog: lucide-icons/lucide@1.20.0...1.21.0
v1.20.0: Version 1.20.0Compare Source
What's Changed
square-arrow-*icons by @jguddas in #3926search-icons by @jamiemlaw in #4099save-checkicon by @Konixy in #3120tag-plusandtag-xicons by @adam-kov in #3980banknote-checkicon by @mfjramirezf in #3956clock-arrow-inicon by @jguddas in #2403summaryicon by @jpjacobpadilla in #3114user-round-arrow-inicon by @jguddas in #2283clock-arrow-outicon by @jguddas in #2404pencil-sparklesicon by @jennieboops in #4445New Contributors
Full Changelog: lucide-icons/lucide@1.19.0...1.20.0
v1.19.0: Version 1.19.0Compare Source
What's Changed
star-*icons by @RajnishKMehta in #3918save-penicon by @vaporvee in #4179wrench-officon by @nilsjonsson in #4434adicon by @jamiemlaw in #4323eye-dashedicon by @karsa-mistmere in #4415save-plusicon by @jwlinqx in #4448list-sort-descendingicon by @ericfennis in #4457wallet-cardsicon by @jguddas in #3888podiumicon by @jguddas in #2124New Contributors
Full Changelog: lucide-icons/lucide@1.18.0...1.19.0
joesaby/astro-mermaid (astro-mermaid)
v2.0.4Compare Source
Bug Fixes
v2.0.3Compare Source
Bug Fixes
oxc-project/oxc (oxlint)
v1.71.0Compare Source
🚀 Features
0dc2405linter: Add schema foreslint/no-restricted-properties(#23619) (Sysix)b638d0elinter: Add schema fornode/callback-return(#23615) (Sysix)eb8bedclinter: Add schema forimport/extensions(#23557) (WaterWhisperer)46f3625linter: Implement node/no-sync rule (#23589) (fujitani sora)b01739alinter: Add schema forunicorn/numeric-separators-style(#23554) (Mikhail Baev)68afd2alinter/node: Implementno-mixed-requiresrule (#23539) (fujitani sora)a421215linter: Add schema foreslint/prefer-destructuring(#23410) (WaterWhisperer)84438belinter/jsdoc: Added missing options torequire-param-description(#23416) (kapobajza)51910dflinter/jsdoc: Add missing options torequire-param-typerule (#23418) (kapobajza)e90925flinter/unicorn: Implement prefer-number-coercion rule (#23497) (Shekhudd1c866linter/vue: Implement no-async-in-computed-properties rule (#23493) (bab)b02444elinter: Add schema forreact/jsx-no-script-url(#23475) (WaterWhisperer)a8dce46linter/unicorn: Implementmax-nested-callsrule (#23461) (arieleli01212)🐛 Bug Fixes
a303c23linter/jsx-a11y: Alignanchor-is-validconfig with upstream (#23446) (camc314)📚 Documentation
b50bf4dlinter: Remove manually written options doc foreslint/arrow-body-style(#23490) (Mikhail Baev)v1.70.0Compare Source
🚀 Features
2e8bda4linter/vue: Implement no-dupe-keys rule (#23350) (bab)1490a0alinter/react: Implement react-compiler rule (#23202) (Boshen)dd560aelinter/unicorn: Implementno-array-fill-with-reference-typerule (#23397) (Mikhail Baev)af36c2flinter: Add schema forreact/jsx-curly-brace-presence(#23400) (WaterWhisperer)47d34a3linter: Add schema forreact/jsx-handler-names(#23393) (WaterWhisperer)f4250d0linter: Add schema forunicorn/import-style(#23386) (WaterWhisperer)30c74celinter: Add schema forjsx_a11y/no-noninteractive-element-to-interactive-role(#23384) (Sysix)cfbe8dclinter: Add schema forjsx_a11y/no-interactive-element-to-noninteractive-role(#23382) (WaterWhisperer)d15b7fflinter: Add schema fortypescript/no-restricted-types(#23381) (WaterWhisperer)028a811linter: Add schema forjsx-a11y/media-has-caption(#23377) (Sysix)b3b1038linter: Add schema forjsx-a11y/label-has-associated-control(#23376) (Sysix)7ada6b2linter: Add schema forjsx_a11y/no-distracting-elements(#23379) (WaterWhisperer)ee3dd49linter: Add schema forjsx-a11y/img-redundant-alt(#23374) (Sysix)df5f8ddlinter: Add short descriptions to most lint rules. (#23365) (Connor Shea)e3fd735linter: Add schema forjsx_a11y/alt-text(#23369) (Sysix)0f2fff4linter: Add schema forreact/exhaustive-deps(#23372) (Mikhail Baev)e3e4e10linter: Add schema forreact_perf/jsx-no-new-object-as-prop(#23368) (Mikhail Baev)9366d44linter: Add schema forunicorn/prefer-at(#23366) (WaterWhisperer)f57b55dlinter: Add schema fortypescript/array-type(#23355) (Sysix)0dcf912linter: Add schema fortypescript/ban-ts-comment(#23354) (Sysix)51fa83elinter: Add schema forreact/no-did-update-set-state(#23357) (Mikhail Baev)59db0bdlinter: Add schema forconsistent-generic-constructors(#23353) (Sysix)c4775c0linter: Add schema fortypescript/consistent-type-assertions(#23349) (Sysix)6e516f7linter: Add schema fortypescript/consistent-type-imports(#23348) (Sysix)012134dlinter: Add schema forreact/jsx-no-target-blank(#23345) (WaterWhisperer)0806aaelinter: Add schema forjsx_a11y/no-noninteractive-tabindex(#23337) (Mikhail Baev)0708b5alinter: Add schema forreact/jsx-filename-extension(#23315) (Mikhail Baev)150bce1linter: Add schema fortypescript/no-empty-object-type(#23309) (Sysix)f9e36f1linter: Add schema fortypescript/no-duplicate-type-constituents(#23308) (Sysix)937accflinter: Add schema fortypescript/no-invalid-void-type(#23307) (Sysix)3e042b9linter: Add schema fortypescript/no-misused-promises(#23306) (Sysix)da212d1linter: Add schema fortypescript/no-unnecessary-condition(#23305) (Sysix)f8f0d38linter: Add schema fortypescript/parameter-properties(#23304) (Sysix)2275fc7linter: Add schema fortypescript/prefer-nullish-coalescing(#23302) (Sysix)d353858linter: Add schema fortypescript/prefer-string-starts-ends-with(#23301) (Sysix)03060f5linter: Add schema fortypescript/triple-slash-reference(#23300) (Sysix)6619ceelinter: Add schema forpromise/param-names(#23298) (Sysix)8bf108elinter: Add schema forpromise/catch-or-return(#23297) (Sysix)48158d0linter: Add schema forvitest/consistent-each-for(#23294) (Sysix)7e74c98linter: Add schema forvitest/consistent-test-filename(#23293) (Sysix)ff94d4alinter: Add schema forvitest/consistent-vitest-vi(#23292) (Sysix)2409a10linter: Add schema forvitest/prefer-import-in-mock(#23291) (Sysix)3d782b7linter: Add schema forreact/no-unstable-nested-components(#23287) (Mikhail Baev)0a0bc2flinter/jsx-a11y: AddallowedRedundantRolesoption tono-redundant-roles(#22820) (bab)80758a5linter/vue: Implement no-side-effects-in-computed-properties rule (#23282) (bab)e3869aclinter: Add schema forreact/no-object-type-as-default-prop(#23279) (Mikhail Baev)4480609linter: Add schema forreact/jsx-props-no-spreading(#23276) (Mikhail Baev)08d68a5linter/react: Implementjsx-no-literalsrule (#23145) (kapobajza)9a2788blinter/unicorn: Implementprefer-export-fromrule (#22935) (AliceLanniste)bdb723clinter/unicorn: Implement prefer-single-call rule (#23235) (Yuzhe Shi)31543edlinter: Add schema forvue/define-props-destructuring(#23252) (Sysix)21b6c3dlinter: Add schema foroxc/no-async-endpoint-handlers(#23251) (Sysix)e77ff81linter: Add schema forunicorn/prefer-object-from-entries(#23249) (Mikhail Baev)bcac2d6linter: Add schema forjest/vitest/no-restricted-matchers(#23247) (Sysix)539f036linter: Add schema forjest/vitest/no-restricted-*-methods(#23246) (Sysix)dd1b927linter/vue: Implement require-default-prop rule (#22951) (bab)3f018e7linter: Add schema forunicorn/no-instanceof-builtins(#23225) (Mikhail Baev)e0d0f78linter: Verify promise/no-callback-in-promise schema (#23141) (beanscg)123d4f4linter: Add schema forjest/vitest/valid-expect(#23185) (Sysix)46c8a21linter: Add schema forjest/vitest/require-top-level-describe(#23184) (Sysix)41465cflinter: Add schema forjest/vitest/prefer-snapshot-hint(#23183) (Sysix)d068b9blinter: Add schema forjest/vitest/prefer-expect-assertions(#23181) (Sysix)064a1eelinter: Add schema forjest/prefer-ending-with-an-expect(#23180) (Sysix)d046797linter: Add schema forjest/vitest/no-standalone-expect(#23179) (Sysix)137b9a6linter: Add schema forjest/vitest/no-large-snapshots(#23178) (Sysix)0f3e4a5linter: Add schema forjest/vitest/no-hooks(#23177) (Sysix)cd0b384linter: Add schema forunicorn/explicit-length-check(#23155) (Mikhail Baev)01b74c4linter: Add schema forjest/no-deprecated-functions(#23136) (Sysix)9d6a387linter: Add schema forunicorn/catch-error-name(#23137) (Mikhail Baev)0da8efalinter: Add schema forjest/vitest/max-nested-describe(#23131) (Sysix)d71c9fdlinter: Add schema foreslint/no-use-before-define(#23129) (Sysix)🐛 Bug Fixes
26ddac6linter: Avoid config schema generation forjsx_a11y/no-noninteractive-element-interactions(#23385) (Sysix)40556adlinter: Parsejsx-a11y/control-has-associated-labelconfig withDefaultRuleConfig(#23373) (Sysix)71e9648linter: Expose no-noninteractive-element-interactions schema (#23283) (camc314)6c86d1clinter/react-perf: Correct nativeAllowList all schema (#23229) (camc314)4dd52delinter/react-perf: Re-generate stale snapshots (#23228) (camc314)8f3db61linter: Allow options foreslint/capitalized-comments(#23139) (Sysix)⚡ Performance
f09707elinter:jest/no-deprecated-functionsstore config version asusize(#23138) (Sysix)📚 Documentation
f682e25linter: Remove manually written options doc foreslint/prefer-arrow-callback(#23438) (Mikhail Baev)64c942clinter: Remove manually written options doc foreslint/no-sequences(#23420) (Mikhail Baev)14abf32linter/react-perf: Use autogenerated docs (#23227) (camc314)pnpm/pnpm (pnpm)
v11.8.0Compare Source
Minor Changes
c112b61: Added a--dry-runoption topnpm install. It runs a full dependency resolution and reports what an install would change, but writes nothing to disk (no lockfile, nonode_modules) and always exits with code 0. This mirrors the preview semantics ofnpm install --dry-run#7340.179ebc4:pnpm run --no-bailnow exits with a non-zero exit code when any of the executed scripts fail, while still running every matched script to completion. This makes the exit-code behavior of--no-bailconsistent between recursive and non-recursive runs (recursive runs already failed at the end). Previously, a non-recursivepnpm run --no-bailalways exited with code 0, even when a script failed #8013.0474a9c: Added support for generating Node.js package maps atnode_modules/.package-map.jsonduring isolated and hoisted installs. Added thenode-experimental-package-mapsetting to inject the generated map into pnpm-managed Node.js script environments, and thenode-package-map-typesetting to choose betweenstandardandloosepackage maps.dcededc:pnpm sbomnow marks components reachable only throughdevDependencieswith CycloneDXscope: "excluded"and thecdx:npm:package:developmentproperty. Theexcludedscope documents "component usage for test and other non-runtime purposes", which matches the semantics of a devDependency; the property is the CycloneDX npm-taxonomy marker emitted by@cyclonedx/cyclonedx-npm, so both modern (scope) and existing (property) consumers are covered. Components reachable at runtime (including installedoptionalDependencies) omitscopeand default torequired.1495cb0: Added per-package SBOM generation with--outand--splitflags. Use--out out/%s.cdx.jsonto write one SBOM per workspace package to individual files, or--splitfor NDJSON output to stdout. When--filterselects a single package, the SBOM root component now uses that package's metadata. Workspace inter-dependencies (workspace:protocol) and their transitive dependencies are included. Author, repository, and license fall back to the root manifest when the package doesn't define them.293921a: feat(view): support searching project manifest upward when package name is omittedWhen running
pnpm viewwithout a package name, the command now searchesupward for the nearest project manifest (
package.json,package.yaml, orpackage.json5) and uses itsnamefield.If the manifest exists but lacks a
namefield, an error is thrown.This change also replaces the
find-updependency withempathicforimproved performance and consistency across workspace tools.
Patch Changes
29ab905: Fixedpnpm updateoverriding the version range policy of a named catalog whose name parses as a version (e.g.catalog:express4-21). Thecatalog:reference carries no pinning of its own, so the prefix from the catalog entry (such as~) is now preserved instead of being widened to^#10321.bee4bf4: Security: validate config dependency names and versions from the env lockfile (pnpm-lock.yaml) before using them to build filesystem paths. A committed lockfile with a traversal-shapedconfigDependenciesname (such as../../PWNED) or version (such as../../../PWNED) could previously causepnpm installto create symlinks or write package files outsidenode_modules/.pnpm-configand the store. Names must now be valid npm package names and versions must be exact semver versions; the same validation is applied to optional subdependencies of config dependencies, and to the legacy workspace-manifest format before any lockfile is written. See GHSA-qrv3-253h-g69c.96bdd57: Fixlink:workspace protocol switching tofile:afterpnpm rmis run from inside a workspace package whose target workspace dependency has its own dependencies, wheninjectWorkspacePackages: trueis set. Follow-up to #10575, which fixed the same symptom for workspace packages without dependencies.302a2f7: No longer warn about using bothpackageManageranddevEngines.packageManagerwhen the two fields pin the same package manager at the same version with the same integrity hash (e.g. bothpnpm@11.5.1+sha512.…). Previously the hash was stripped from the legacypackageManagerfield but not fromdevEngines.packageManager, so even identical specifications looked like a mismatch #12028.The warning still fires on any genuine divergence, and several cases now state the specific reason instead of a single generic message: a different package manager, a different version, or contradictory integrity hashes for the same version.
3f0fb21: Fixed the progress line showing leftover characters from external processes that write to the terminal between progress updates (e.g. an SSH passphrase prompt would leave a fragment likeadded 0sa':). The interactive reporter now redraws each frame in place, erasing to the end of the display before reprinting, so any such remnants are cleared #12350.564619f: Fixedpnpm approve-buildsreporting "no packages awaiting approval" when a build-script dependency whose approval was revoked (e.g. aftergit stashdrops theallowBuildsfrompnpm-workspace.yaml) is re-added. The revoked packages are now correctly recorded in.modules.yamlsoapprove-buildscan find them. #122213d1fd20: Skip the redundant "target bin directory already contains an exe called node" warning on Windows when the existingnode.exealready matches the target (same hard link or identical content) pnpm/pnpm#12203.1b02b47: Fix macOS Gatekeeper blocking native binaries (.node,.dylib,.so) by removing thecom.apple.quarantineextended attribute after importing them from the store.When pnpm imports files from its content-addressable store into
node_modules, macOS preserves extended attributes, includingcom.apple.quarantine. If this xattr is present on a store blob (e.g. it was first written under a Gatekeeper-enabled app such as a Git client), it propagates tonode_modules, and Gatekeeper blocks the native binary from loading even though pnpm already verified the file's integrity against the lockfile.After importing a package, pnpm now strips
com.apple.quarantinefrom its native binaries, matching Homebrew's behaviour of dropping quarantine from verified downloads. The cleanup is macOS-only, runs in a single batchedxattrcall per package, is restricted to native binaries (other files are untouched), and is non-fatal (it logs a warning on unexpected errors).Fixes #11056
61969fb: Fixpnpm installwithoptimisticRepeatInstallincorrectly reportingAlready up to datewhenpnpm-lock.yamlchanged but project manifests did not. This affected workflows such as checking out or restoring only the lockfile #12100.Also fixes
checkDepsStatusto use the correct lockfile path whenuseGitBranchLockfileis enabled, so the optimistic fast-path and lockfile modification detection work withpnpm-lock.<branch>.yamlfiles instead of always stat'ingpnpm-lock.yaml. Merge-conflict detection now reads the resolved lockfile name as well, and withmergeGitBranchLockfilesenabled everypnpm-lock.*.yamlis scanned for modifications and conflicts. The git branch is now resolved by reading.git/HEADdirectly (no process spawn) and uses the workspace directory rather thanprocess.cwd().5c12968: Fix recursive updates of transitive dependencies when the update command mixes transitive dependency patterns with direct dependency selectors. For example,pnpm up -r "@​babel/core" uuidnow updates matching transitive@babel/coredependencies even whenuuidis a direct dependency selector #12103.9d79ba1: Register thepnpm update --no-saveflag in the CLI help and option parser.0474a9c: Fixedpnpm importfor Yarn v2 lockfiles whenjs-yamlv4 is installed.9e0c375: Fixedpnpm installrepeatedly prompting to remove and reinstallnode_modulesin a workspace package whenenableGlobalVirtualStoreis enabled. The post-install build step recorded a per-projectnode_modules/.pnpmvirtual store directory innode_modules/.modules.yaml, overwriting the global<storeDir>/linksvalue the install step had written. The next install then detected a virtual-store mismatch (ERR_PNPM_UNEXPECTED_VIRTUAL_STORE). The build step now derives the same global virtual store directory as the install step #12307.223d060: Document the--cpu,--osand--libcflags in the output ofpnpm install --help. These flags were already supported but were only documented on the website #12359.e85aea2: Avoid readingREADME.mdfrom disk when publishing if the publish manifest already provides areadmefield. The README is now only read lazily, insidecreateExportableManifest, when it is actually needed.3188ae7: Fixedpnpm peers checkto accept loose peer dependency ranges such as>=3.16.0 || >=4.0.0-when the installed peer version satisfies the range #12149.531f2a3: Fixedpnpm updaterewriting aworkspace:dependency that points at a local path (e.g.workspace:../packages/foo/dist) into a normalizedlink:or version-range specifier. Such specifiers are now preserved verbatim when the workspace protocol is preserved #3902.fe66535: Fixed a lockfile non-convergence bug where an incremental install kept a duplicate transitive dependency that a fresh install would not produce. When a package is reused from the lockfile, its child edges are taken verbatim and bypass the preferred-versions walk, so a transitive dependency could stay pinned to an older version even after a direct dependency resolved to a higher version that satisfies the same range. The resolver now refreshes such a stale pin to the higher direct-dependency version during resolution — so the older version is never resolved or fetched, and the incremental result converges to the fresh one.6d35338:pnpm installdetects changes inside local file dependencies again. The optimistic repeat-install fast path only tracks manifest and lockfile modification times, so edits inside a local dependency's directory (or a repacked local tarball) were reported as "Already up to date". Projects with local file dependencies (file:and bare local path or tarball specifiers, declared directly or throughpnpm.overrides) now always run a full install, which refetches those dependencies, matching pnpm v10 behavior #11795.4ca9247: Preserve the existing Node.js runtime version prefix when resolvingnode@runtime:<range>to a concrete version.30c7590: Create shorter CAFS temporary package directories to leave room for lifecycle scripts that create IPC socket paths under TMPDIR.13815ad: Reporter output (warnings, progress) forpnpm storeandpnpm configsubcommands now goes to stderr instead of stdout. This fixes scripts that capture their stdout (e.g.PNPM_STORE=$(pnpm store path),pnpm config list --json | jq) from getting warnings mixed into the result.1c05876: Avoid relinking unchanged child dependencies and remove stale child links during warm installs.817f99d: Fixed lockfile churn where a package'stransitivePeerDependenciescould be dropped (and shift between packages) when the package participates in a dependency cycle. A cycle re-entry resolves against truncated children, so it must not be cached as "pure"; otherwise sibling occurrences of the same package short-circuit and lose transitive peers depending on traversal order #5108.eba03e0: Fixpnpm installreporting "Already up to date" after a catalog entry inpnpm-workspace.yamlwas reverted to a previous version. After an update modified a catalog, the workspace state cache stored the pre-update catalog versions, so reverting the entry back to its original version was not detected as an outdated state #12418.3b54d79:pnpm updatenow keeps lockfileoverridesthat resolve through a catalog in sync with the catalog. Previously, when an override referenced a catalog (e.g.overrides: { foo: 'catalog:' }) andpnpm updatebumped that catalog entry, the lockfile'scatalogsadvanced while the resolvedoverrideskept the old version. The resulting lockfile was internally inconsistent, so a laterpnpm install --frozen-lockfilefailed withERR_PNPM_LOCKFILE_CONFIG_MISMATCH.9d0a300: Fixedpnpm version --recursiveso it honors the workspace selection. In recursive mode the version bump now applies to the packages resolved from the workspace filter (selectedProjectsGraph), matching the behavior ofpnpm publish --recursive, instead of always bumping every workspace package #11348.v11.7.0Compare Source
Minor Changes
Added a new setting
frozenStore(--frozen-store) that letspnpm installrun against a package store on a read-only filesystem (e.g. a Nix store, a read-only bind mount, an OCI layer). When enabled, pnpm opens the store's SQLiteindex.dbthrough theimmutable=1URI — bypassing the WAL/-shmsidecar creation that otherwise fails on a read-only directory — and suppresses every store-write path (theindex.dbwriter and the project-registry write). Pair it with--offline --frozen-lockfileagainst a fully-populated store. Under the global virtual store, package directories live inside the store, so if the store is missing the build output of a package whose lifecycle scripts are approved (or that has a patch), pnpm fails up front withERR_PNPM_FROZEN_STORE_NEEDS_BUILDrather than crashing mid-build on a read-only write — seed the store with those builds first. Incompatible with--forceand with a configured pnpr server, since both write into the store; the side-effects cache is likewise not written underfrozenStore. If the store is missing its content directory, the install fails fast withERR_PNPM_FROZEN_STORE_INCOMPLETErather than attempting to initialize it. The read-onlyimmutable=1open requires Node.js >=22.15.0, >=23.11.0, or >=24.0.0; on older runtimes--frozen-storefails with a clearERR_PNPM_FROZEN_STORE_UNSUPPORTED_NODEerror. Bin-linking also tolerates a read-only store: under the global virtual store a package's bin source lives inside the store, so thechmodthat makes it executable would be refused — withEPERM/EACCES, or withEROFSon a genuinely read-only filesystem. Thatchmodis redundant when the seed already ships its bins executable with a normalized shebang, so it is now skipped in that case, while a non-executable bin (or one still carrying a Windows CRLF shebang) on a read-only store still errors.When
pacquet(the Rust port of pnpm) is declared inconfigDependencies, pnpm now delegates dependency resolution to it too — not just materialization — provided the installed pacquet is new enough to support full resolving installs (>= 0.11.7).Previously pacquet only ran in frozen-install mode: pnpm always resolved the dependency graph itself (writing
pnpm-lock.yaml) and handed pacquet a finished lockfile to fetch / import / link. With pacquet >= 0.11.7, a non-frozenpnpm install(default isolatednodeLinker, plain install) is delegated to pacquet end-to-end in a single pass — pacquet resolves the manifests, writes the lockfile, and materializesnode_modules. pnpm detects the capability from the installed pacquet's version; older pacquet releases keep the resolve-then-materialize split, andadd/update/removestill resolve in pnpm (it has to mutate the manifests first). This remains an opt-in preview of the Rust install engine #11723.Added a new opt-in
--batchflag topnpm publish --recursivethat sends all selected packages to the registry in a singlePUT /-/pnpm/v1/publishrequest instead of one request per package. The target registry has to implement the batch publish endpoint (pnpr does); registries that don't are reported with a clearERR_PNPM_BATCH_PUBLISH_UNSUPPORTEDerror. The batch is processed all-or-nothing by pnpr: if any package in the batch fails validation, none of the packages are published.Patch Changes
Reject path-traversal and reserved dependency aliases (such as
../../../escape,.bin,.pnpm, ornode_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoistednode_modulesdirectory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.The fix adds two layers:
nodeLinker: hoistedgraph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests.verifyLockfileResolutions) now runs an always-on, policy-independent check that rejects any importer or snapshot dependency alias that is not a valid package name, failing the install early — before any fetch or filesystem work — for every node linker at once.Made shared package child resolution deterministic when the same package is reached through multiple contexts. pnpm now chooses the shallowest occurrence, then importer order, then parent path, instead of letting request timing decide the child context and missing-peer report pnpm/pnpm#12358.
Fix garbled summary line after submitting
pnpm update -iandpnpm audit --fix -i. The interactive checkbox prompt previously printed every selected choice's full table row (label, current/target versions, workspace, URL) joined by commas, producing a wall of text after pressing Enter. The summary now lists only the selected package names (or vulnerability keys) by setting an explicitshortper choice; the in-progress selection UI is unchanged.Prevent
pnpm patch-removefrom removing files outside the configured patches directory.Fixed
pnpm publishignoringstrictSsl: falsewhen publConfiguration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.