fix(deps): update all non-major dependencies #1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
bf905e0 to
7c0cb6c
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
20dfb4a to
9e7a813
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
587353c to
274dac9
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
10eff1b to
c01d3cc
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
00ee9a2 to
4c3c961
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
4c3c961 to
743404c
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^4.0.1->^4.0.5^1.10.0->^1.11.1^0.20.0->^0.23.2^18.15.5->^18.19.124^7.3.13->^7.7.1^7.1.1->^7.2.022->22.19.0^3.3.1->^3.3.210.0.0->10.16.1^7.3.8->^7.7.2^2.8.1->^2.13.1^4.19.2->^4.20.5Release Notes
actions/toolkit (@actions/cache)
v4.0.5v4.0.4@protobuf-ts/pluginto dev dependencies #2106v4.0.3v4.0.2antfu-collective/ni (@antfu/ni)
v0.23.2Compare Source
No significant changes
View changes on GitHub
v0.23.1Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v0.23.0Compare Source
🚨 Breaking Changes
parseNietc. now returnResolvedCommandobject instead of string, migrate totinyexec- by @userquin, Ben McCann and @antfu in #231 (3d323)View changes on GitHub
v0.22.4Compare Source
🐞 Bug Fixes
View changes on GitHub
v0.22.3Compare Source
🐞 Bug Fixes
@jsdevtools/ez-spawn, fix #224 - by @antfu in #224 (af1b1)View changes on GitHub
v0.22.2Compare Source
No significant changes
View changes on GitHub
v0.22.1Compare Source
🚀 Features
🐞 Bug Fixes
bun xinstead ofbunx- by @MAttila42 in #219 (13282)View changes on GitHub
v0.22.0Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v0.21.12Compare Source
🐞 Bug Fixes
yarn@>1andpnpm@<7- by @auvred in antfu#190 (2fbce)View changes on GitHub
v0.21.11Compare Source
🐞 Bug Fixes
View changes on GitHub
v0.21.10Compare Source
🐞 Bug Fixes
View changes on GitHub
v0.21.9Compare Source
🚀 Features
🐞 Bug Fixes
-vflag not working foryarn@berry- by @Dimava in antfu#175 (9e3c9)View changes on GitHub
v0.21.8Compare Source
🚀 Features
args- by @antfu (7a165)View changes on GitHub
v0.21.7Compare Source
🚀 Features
🐞 Bug Fixes
View changes on GitHub
v0.21.6Compare Source
🚀 Features
nusupport for bun - by @jatindotdev in antfu#167 (63b6a)View changes on GitHub
v0.21.5Compare Source
🚀 Features
getCliCommandfunction - by @ghengeveld and @antfu in antfu#164 (17d8e)🐞 Bug Fixes
View changes on GitHub
v0.21.4Compare Source
🚀 Features
View changes on GitHub
v0.21.3Compare Source
No significant changes
View changes on GitHub
v0.21.2Compare Source
🐞 Bug Fixes
View changes on GitHub
v0.21.1Compare Source
v0.21.0Compare Source
🚨 Breaking Changes
nixtonlx- by @antfu (ee46d)🚀 Features
🐞 Bug Fixes
🏎 Performance
View changes on GitHub
actions/node-versions (node)
v22.19.0: 22.19.0Compare Source
Node.js 22.19.0
v22.18.0: 22.18.0Compare Source
Node.js 22.18.0
v22.17.1: 22.17.1Compare Source
Node.js 22.17.1
v22.17.0: 22.17.0Compare Source
Node.js 22.17.0
v22.16.0: 22.16.0Compare Source
Node.js 22.16.0
v22.15.1: 22.15.1Compare Source
Node.js 22.15.1
v22.15.0: 22.15.0Compare Source
Node.js 22.15.0
v22.14.0: 22.14.0Compare Source
Node.js 22.14.0
v22.13.1: 22.13.1Compare Source
Node.js 22.13.1
v22.13.0: 22.13.0Compare Source
Node.js 22.13.0
v22.12.0: 22.12.0Compare Source
Node.js 22.12.0
v22.11.0: 22.11.0Compare Source
Node.js 22.11.0
v22.10.0: 22.10.0Compare Source
Node.js 22.10.0
v22.9.0: 22.9.0Compare Source
Node.js 22.9.0
v22.8.0: 22.8.0Compare Source
Node.js 22.8.0
v22.7.0: 22.7.0Compare Source
Node.js 22.7.0
v22.6.0: 22.6.0Compare Source
Node.js 22.6.0
v22.5.1: 22.5.1Compare Source
Node.js 22.5.1
v22.5.0: 22.5.0Compare Source
Node.js 22.5.0
v22.4.1: 22.4.1Compare Source
Node.js 22.4.1
v22.4.0: 22.4.0Compare Source
Node.js 22.4.0
v22.3.0: 22.3.0Compare Source
Node.js 22.3.0
v22.2.0: 22.2.0Compare Source
Node.js 22.2.0
v22.1.0: 22.1.0Compare Source
Node.js 22.1.0
pnpm/pnpm (pnpm)
v10.16.1Compare Source
Patch Changes
v10.16.0Compare Source
Minor Changes
There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies. In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour.
The new setting is called
minimumReleaseAge. It specifies the number of minutes that must pass after a version is published before pnpm will install it. For example, settingminimumReleaseAge: 1440ensures that only packages released at least one day ago can be installed.If you set
minimumReleaseAgebut need to disable this restriction for certain dependencies, you can list them under theminimumReleaseAgeExcludesetting. For instance, with the following configuration pnpm will always install the latest version of webpack, regardless of its release time:Related issue: #9921.
Added support for
finders#9946.In the past,
pnpm listandpnpm whycould only search for dependencies by name (and optionally version). For example:prints the chain of dependencies to any installed instance of
minimist:What if we want to search by other properties of a dependency, not just its name? For instance, find all packages that have
react@17in their peer dependencies?This is now possible with "finder functions". Finder functions can be declared in
.pnpmfile.cjsand invoked with the--find-by=<function name>flag when runningpnpm listorpnpm why.Let's say we want to find any dependencies that have React 17 in peer dependencies. We can add this finder to our
.pnpmfile.cjs:Now we can use this finder function by running:
pnpm will find all dependencies that have this React in peer dependencies and print their exact locations in the dependency graph.
It is also possible to print out some additional information in the output by returning a string from the finder. For example, with the following finder:
Every matched package will also print out the license from its
package.json:Patch Changes
nodeVersionis not set to an exact semver version #9934.pnpm publishshould be able to publish a.tar.gzfile #9927.pnpm runreturn a non-zero exit code #9626.v10.15.1Compare Source
Patch Changes
.pnp.cjscrash when importing subpath #9904.v10.15.0Compare Source
Minor Changes
cleanupUnusedCatalogsconfiguration. When set totrue, pnpm will remove unused catalog entries during installation #9793.@*/pnpm-plugin-*#9780.pnpm config getnow prints an INI string for an object value #9797.pnpm config getnow accepts property paths (e.g.pnpm config get catalog.react,pnpm config get .catalog.react,pnpm config get 'packageExtensions["@​babel/parser"].peerDependencies["@​babel/types"]'), andpnpm config setnow accepts dot-leading or subscripted keys (e.g.pnpm config set .ignoreScripts true).pnpm config get --jsonnow prints a JSON serialization of config value, andpnpm config set --jsonnow parses the input value as JSON.Patch Changes
pnpm createcommand, must verify whether the node version is supported even if a cache already exists #9775.*/*to theAcceptheader to avoid getting a 406 error on AWS CodeArtifact #9862.pnpm dlx pkg --helpdoesn't pass--helptopkg#9823.v10.14.0Compare Source
Minor Changes
Added support for JavaScript runtime resolution
Declare Node.js, Deno, or Bun in
devEngines.runtime(insidepackage.json) and let pnpm download and pin it automatically.Usage example:
{ "devEngines": { "runtime": { "name": "node", "version": "^24.4.0", "onFail": "download" (we only support the "download" value for now) } } }How it works:
pnpm installresolves your specified range to the latest matching runtime version.Why this is better:
useNodeVersionandexecutionEnv.nodeVersion)executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.devEngines.runtimesetting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.Related PR: #9755.
Add
--cpu,--libc, and--ostopnpm install,pnpm add, andpnpm dlxto customizesupportedArchitecturesvia the CLI #7510.Patch Changes
pnpm adddownloads packages whoselibcdiffer frompnpm.supportedArchitectures.libc.dlxto parse CLI flags and options between thedlxcommand and the command to run or between thedlxcommand and--#9719.pnpm install --prodshould removing hoisted dev dependencies #9782.pnpm installto incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.v10.13.1Compare Source
Patch Changes
v10.13.0Compare Source
Minor Changes
Added the possibility to load multiple pnpmfiles. The
pnpmfilesetting can now accept a list of pnpmfile locations #9702.pnpm will now automatically load the
pnpmfile.cjsfile from any config dependency named@pnpm/plugin-*orpnpm-plugin-*#9729.The order in which config dependencies are initialized should not matter — they are initialized in alphabetical order. If a specific order is needed, the paths to the
pnpmfile.cjsfiles in the config dependencies can be explicitly listed using thepnpmfilesetting inpnpm-workspace.yaml.Patch Changes
pkg.pr.new, treat them as Git tarball URLs #9694.dangerouslyAllowAllBuilds,onlyBuiltDependencies,onlyBuiltDependenciesFile, andneverBuiltDependencies#9628.pnpm-workspace.yamlwith deep #9701.pnpm rebuildcommand should not add pkgs included inignoredBuiltDependenciestoignoredBuildsinnode_modules/.modules.yaml#9338.shell-quotewithshlexfor quoting command arguments #9381.v10.12.4Compare Source
Patch Changes
Fix
pnpm licensescommand for local dependencies #9583.Fix a bug in which
pnpm ls --filter=not-exist --jsonprints nothing instead of an empty array #9672.Fix a deadlock that sometimes happens during peer dependency resolution #9673.
Running
pnpm installafterpnpm fetchshould hoist all dependencies that need to be hoisted.Fixes a regression introduced in [v10.12.2] by [#9648]; resolves [#9689].
[v10.12.2]: https://redirect.github.com/pnpm/pnpm/releases/tag/v10.12.2Add commentMore actions
[#9648]: https://github.com/pnpm/pnpm/pull/9648
[#9689]: https://github.com/pnpm/pnpm/issues/9689
v10.12.3Compare Source
Patch Changes
Regression introduced in v10.12.2 by #9648; resolves #9685.
v10.12.2Compare Source
Patch Changes
enableGlobalVirtualStoreset totrue#9648.--helpand-hflags not working as expected for thepnpm createcommand.pnpm licenses list --jsoncommand is incorrect.pnpm deployfails due to overridden dependencies having peer dependencies causingERR_PNPM_OUTDATED_LOCKFILE#9595.v10.12.1Minor Changes
Experimental. Added support for global virtual stores. When enabled,
node_modulescontains only symlinks to a central virtual store, rather tonode_modules/.pnpm. By default, this central store is located at<store-path>/links(you can find the store path by runningpnpm store path).In the central virtual store, each package is hard linked into a directory whose name is the hash of its dependency graph. This allows multiple projects on the system to symlink shared dependencies from this central location, significantly improving installation speed when a warm cache is available.
To enable the global virtual store, set
enableGlobalVirtualStore: truein your rootpnpm-workspace.yaml, or globally via:NOTE: In CI environments, where caches are typically cold, this setting may slow down installation. pnpm automatically disables the global virtual store when running in CI.
Related PR: #8190
pnpm updatecommand now supports updatingcatalog:protocol dependencies and writes new specifiers topnpm-workspace.yaml.--save-catalogand--save-catalog-name=<name>) topnpm addto save new dependencies as catalog entries.catalog:orcatalog:<name>will be added topackage.jsonand the package specifier will be added to thecatalogsorcatalog[<name>]object inpnpm-workspace.yaml#9425.cifor explicitly telling pnpm if the current environment is a CI or not.Patch Changes
pnpm patchusing semantic versioning rules.v10.11.1Compare Source
Patch Changes
pnpm deploy --legacycreates unexpected directories when the rootpackage.jsonhas a workspace package as a peer dependency #9550.strictPeerDependenciesistruebut all issues are ignored bypeerDependencyRules#9505.pnpm_config_env variables instead ofnpm_config_#9571.--lockfile-onlyflag onpnpm updateto produce a differentpnpm-lock.yamlthan an update without the flag.pnpm deploywork in repos withoverrideswheninject-workspace-packages=true#9283.pnpm -r --silent runshould not print out section #9563.v10.11.0Compare Source
Minor Changes
A new setting added for
pnpm initto create apackage.jsonwithtype=module, wheninit-typeismodule. Works as a flag for the init command too #9463.Added support for Nushell to
pnpm setup#6476.Added two new flags to the
pnpm auditcommand,--ignoreand--ignore-unfixable#8474.Ignore all vulnerabilities that have no solution:
> pnpm audit --ignore-unfixableProvide a list of CVE's to ignore those specifically, even if they have a resolution.
> pnpm audit --ignore=CVE-2021-1234 --ignore=CVE-2021-5678Added support for recursively running pack in every project of a workspace #4351.
Now you can run
pnpm -r packto pack all packages in the workspace.Patch Changes
dangerouslyAllowAllBuildsis set totrue#9472.pnpm linkshould work from inside a workspace #9506.workspaceConcurrencytoMath.min(os.availableParallelism(), 4)#9493.strictPeerDependenciesistruebut all issues are ignored bypeerDependencyRules#9505.updateConfigfrompnpm-workspace.yaml#9500.recursive packurl.parseusage to fix warning on Node.js 24 #9492.pnpm runshould be able to run commands from the workspace root, ifignoreScriptsis set tottrue#4858.v10.10.0Compare Source
Minor Changes
preResolution,importPackage, andfetchershooks from local pnpmfile.Patch Changes
cdcommand, whenshellEmulatoristrue#7838.pnpm-workspace.yaml#9453.npm_package_jsonenvironment variable to the executed scripts #9452.--reporter=silentoption.v10.9.0Compare Source
Minor Changes
Added support for installing JSR packages. You can now install JSR packages using the following syntax:
or with a version range:
For example, running:
will add the following entry to your
package.json:{ "dependencies": { "@​foo/bar": "jsr:^0.1.2" } }When publishing, this entry will be transformed into a format compatible with npm, older versions of Yarn, and previous pnpm versions:
{ "dependencies": { "@​foo/bar": "npm:@​jsr/foo__bar@^0.1.2" } }Related issue: #8941.
Note: The
@jsrscope defaults to https://npm.jsr.io/ if the@jsr:registrysetting is not defined.Added a new setting,
dangerouslyAllowAllBuilds, for automatically running any scripts of dependencies without the need to approve any builds. It was already possible to allow all builds by adding this topnpm-workspace.yaml:dangerouslyAllowAllBuildshas the same effect but also allows to be set globally via:It can also be set when running a command:
Patch Changes
verifyDepsBeforeRunwhennodeLinkerishoistedand there is a workspace package without dependencies andnode_modulesdirectory #9424.verifyDepsBeforeRunsupport fornodeLinker: pnp. CombiningverifyDepsBeforeRunandnodeLinker: pnpwill now print a warning.v10.8.1Compare Source
Patch Changes
package.json,onlyBuiltDependencieswill be written topnpm-workspace.yamlfile #9404.v10.8.0Compare Source
Minor Changes
Experimental. A new hook is supported for updating configuration settings. The hook can be provided via
.pnpmfile.cjs. For example:Now you can use the
pnpm addcommand with the--configflag to install new configurational dependencies #9377.Patch Changes
!/inpnpm-workspace.yaml. This fixes a regression introduced by #9169.pnpm audit --fixshould update the overrides inpnpm-workspace.yaml.pnpm linkshould update overrides inpnpm-workspace.yaml, not inpackage.json#9365.v10.7.1Compare Source
Patch Changes
pnpm config setshould convert the settings to their correct type before adding them topnpm-workspace.yaml#9355.pnpm config getshould read auth related settings via npm CLI #9345.~/in a path in.npmrcwith the home directory #9217.v10.7.0Compare Source
Minor Changes
pnpm config getandlistalso show settings set inpnpm-workspace.yamlfiles #9316.It should be possible to use env variables in
pnpm-workspace.yamlsetting names and value.Add an ability to patch dependencies by version ranges. Exact versions override version ranges, which in turn override name-only patches. Version range
*is the same as name-only, except that patch application failure will not be ignored.For example:
The above configuration would apply
patches/foo-3.patchto[email protected],patches/foo-2.patchto allfooversions which satisfy^2.0.0except2.1.0, andpatches/foo-1.patchto the remainingfooversions.pnpm config set --location=projectsaves the setting to apnpm-workspace.yamlfile if no.npmrcfile is present in the directory #9316.Rename
pnpm.allowNonAppliedPatchestopnpm.allowUnusedPatches. The old name is still supported but it would print a deprecation warning message.Add
pnpm.ignorePatchFailuresto manage whether pnpm would ignore patch application failures.If
ignorePatchFailuresis not set, pnpm would throw an error when patches with exact versions or version ranges fail to apply, and it would ignore failures from name-only patches.If
ignorePatchFailuresis explicitly set tofalse, pnpm would throw an error when any type of patch fails to apply.If
ignorePatchFailuresis explicitly set totrue, pnpm would print a warning when any type of patch fails to appConfiguration
📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.