build(deps-dev): Bump pnpm from 10.30.3 to 10.32.0

[dependabot]

Bumps pnpm from 10.30.3 to 10.32.0.

Release notes

Sourced from pnpm's releases.

pnpm 10.32

Minor Changes

• Added --all flag to pnpm approve-builds that approves all pending builds without interactive prompts #10136.

Patch Changes

• Reverted change related to setting explicitly the npm config file path, which caused regressions.
• Reverted fix related to lockfile-include-tarball-url. Fixes #10915.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.32.0

Minor Changes

• Added --all flag to pnpm approve-builds that approves all pending builds without interactive prompts #10136.

Patch Changes

• Reverted change related to setting explicitly the npm config file path, which caused regressions.
• Reverted fix related to lockfile-include-tarball-url. Fixes #10915.

10.31.0

Minor Changes

• When pnpm updates the pnpm-workspace.yaml, comments, string formatting, and whitespace will be preserved.

Patch Changes

• Added -F as a short alias for the --filter option in the help output.

• Handle undefined pkgSnapshot in pnpm why -r #10700.

• Fix headless install not being used when a project has an injected self-referencing file: dependency that resolves to link: in the lockfile.

• Fixed a race condition when multiple worker threads import the same package to the global virtual store concurrently. The rename operation now tolerates ENOTEMPTY/EEXIST errors if another thread already completed the import.

• When lockfile-include-tarball-url is set to false, tarball URLs are now always excluded from the lockfile. Previously, tarball URLs could still appear for packages hosted under non-standard URLs, making the behavior flaky and inconsistent #6667.

• Fixed optimisticRepeatInstall skipping install when overrides, packageExtensions, ignoredOptionalDependencies, patchedDependencies, or peersSuffixMaxLength changed.

• Fixed pnpm patch-commit failing with "unable to access '/.config/git/attributes': Permission denied" error in environments where HOME is unset or non-standard (Docker containers, CI systems).

  The issue occurred because pnpm was setting HOME and the Windows user profile env var to empty strings to suppress user git configuration when running git diff. This caused git to resolve the home directory (~) as root (/), leading to permission errors when attempting to access /.config/git/attributes.

  Now uses GIT_CONFIG_GLOBAL: os.devNull instead, which is git's proper mechanism for bypassing user-level configuration without corrupting the home directory path resolution.

  Fixes #6537

• Fix pnpm why -r --parseable missing dependents when multiple workspace packages share the same dependency #8100.

• Fix link-workspace-packages=true incorrectly linking workspace packages when the requested version doesn't match the workspace package's version. Previously, on fresh installs the version constraint is overridden to * in the fallback resolution paths, causing any workspace package with a matching name to be linked regardless of version #10173.

• Fixed pnpm update --interactive table breaking with long version strings (e.g., prerelease versions like 7.0.0-dev.20251209.1) by dynamically calculating column widths instead of using hardcoded values #10316.

• Explicitly tell npm the path to the global rc config file.

• The parameter set by the --allow-build flag is written to allowBuilds.

• Fix a bug in which specifying filter on pnpm-workspace.yaml would cause pnpm to not detect any projects.

• Print help message on running pnpm dlx without arguments and exit.

Commits

• 49d249b chore(release): 10.32.0
• f733456 revert: "fix: explicitly tell npm the config file path (#10154)"
• 229c244 chore(release): 10.31.0
• 80be7f5 chore: update sponsors list to match main branch
• 733447a fix(test): use npm_config_ prefix for env var override test
• 9c7b3ca fix(dlx): print help message when no arguments are provided (#10690)
• 6899966 fix: allow env vars and updateConfig hook to override frozen-lockfile in CI (...
• e5fab27 fix: sync --allow-build flag value to allowBuilds (#10343)
• c6cbb25 fix: explicitly tell npm the config file path (#10154)
• 6eedf82 fix: filter on pnpm-workspace.yaml (#10127)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)