You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The biggest change in this release is that we drop the built-in proxy server which we previously used.
this will mean that there's not a persistent connection, but it avoids a lot of the pain and potential problematic behaviour with having a proxy (either over socket, which can be flaky on different oses/runtimes - or over network, which is slow on windows).
we're also continuing to focus on performance, including dropping some dependencies, and migrating where possible to new unjs libraries like h3 v2 and srvx.
Fixed an installed optional dependency being left without one of its own required dependencies. When a package reached through optionalDependencies is installable on the current system but one of its regular dependencies is not, a lockfile-based install skipped that dependency and installed the parent anyway, so importing the parent failed with MODULE_NOT_FOUND. The dependency is now installed, and an install-check warning reports the incompatibility. A dependency is still only skipped when every path to it is optional, or when the package that pulls it in was itself skipped #13286.
pnpm setup now appends PNPM_HOME and the global bin directory to the GitHub Actions environment files (GITHUB_ENV and GITHUB_PATH), so later steps in the same job can run pnpm add --global and other global commands #9191.
Added support for publishConfig.name, which publishes a package under a different name than the one its manifest carries in the workspace. It is for a project whose published name is already taken by a sibling project, which otherwise has to be renamed by a build step just before publishing. Only the published artifact is renamed — dependents, pnpm-lock.yaml, and release tooling keep addressing the project by its manifest name — and the new name reaches the packed manifest, the tarball filename, and everything that addresses the package at the registry: the already-published check of pnpm publish -r, its registry selection, and the release-planning probes of pnpm change status and pnpm version -r#13345.
pnpm self-update no longer takes any instruction from the project it is run in:
pnpm is fetched through the same trusted registry and auth configuration used when switching pnpm versions, so a project .npmrc or pnpm-workspace.yaml can no longer redirect the download or attach credentials to it, and the project's default .pnpmfile.(c|m)js is no longer loaded. Pnpmfiles from trusted sources (the pnpmfile setting, the global pnpmfile, config dependencies) still apply.
The minimumReleaseAge settings in pnpm-workspace.yaml no longer affect self-update. They still govern the project's own dependencies; for self-update the cooldown now comes from the built-in default, your global config, a PNPM_CONFIG_* environment variable, or a command-line flag. This fixes self-update failing inside a workspace that raises the cutoff while succeeding everywhere else, and stops a repository from either waiving the cooldown or keeping you on an outdated pnpm by raising it.
The same applies to the trustPolicy settings and to ci: a project can no longer weaken the trust check that guards the pnpm download, nor re-enable the confirmation prompt that a CI run suppresses.
When self-update refuses a version that is younger than the cutoff, an interactive run now offers to update anyway; non-interactive runs still fail. CI never prompts, even on a runner that attaches a TTY.
Patch Changes
Fixed pnpm licenses list to report every version when the same package is installed under multiple aliases pnpm/pnpm#13438.
Sort pnpm dedupe --check snapshot changes for stable output across pnpm implementations.
Strip Unicode formatting characters from registry- and manifest-derived terminal output.
Speed up installs after compatible catalog or direct dependency range changes by retaining the locked version without resolving the dependency graph again.
Speed up installs after safe override changes by reusing unambiguous compatible dependency resolutions, pruning obsolete dependencies, applying independent replacements and removals together, and handling parent-scoped "-" overrides without full lockfile resolution.
Installing a local file: directory dependency with the global virtual store enabled no longer fails with TypeError: Cannot read properties of undefined (reading 'split')#13335.
Local directory dependencies — file: directories and injected workspace packages — now get a global-virtual-store slot of their own per project. They used to share one slot across every project that depended on a directory of the same name, so a project could end up linked to another project's copy of the dependency.
The Workspace column of pnpm update --interactive now falls back to the project's path when its name is only whitespace, as it already did for a missing or empty one — all three render an equally blank label otherwise.
Checking GitHub Actions dependencies for updates is now opt-in for every command. Neither pnpm outdated nor pnpm update reads the workflow files unless --include-github-actions is passed or update.githubActions is set to true in pnpm-workspace.yaml. Reading them runs git ls-remote against every referenced repository, which fails in environments where GitHub is not reachable the way pnpm assumes (a GitHub Enterprise Server, a custom certificate authority, or an offline network) #13254.
pnpm outdated accepts the --include-github-actions option too.
pnpm update --interactive now measures its table in terminal columns rather than in characters. A package name, workspace name, or version containing wide characters (CJK, most emoji) no longer knocks its row's columns out of line with the rest of the group, and a wide character in a version no longer aborts the command with Subject parameter value width cannot be greater than the container width#13357.
The Workspace column of pnpm update --interactive is more informative in two cases. A dependency outdated at the same version in several workspace projects is offered as one choice, since selecting it updates every project — that choice now names all of them instead of only the first. And a workspace project without a name is now labelled with its path rather than left blank, so several unnamed projects can be told apart.
An auto-installed optional peer is no longer hoisted at a version the workspace root's own dependency on that package excludes. resolvePeersFromWorkspaceRoot already made the workspace root's specifier decide which version a missing required peer is installed at; the optional-peer picker ignored it and always took the highest version present anywhere in the graph. In a workspace whose root pins postcss: 8.5.10, an importer that depends on webpack and declares no postcss of its own got postcss@8.5.22 hoisted for terser-webpack-plugin's optional postcss peer, leaving two postcss@8.5.x instances in the graph #13320.
overrides now also govern peers that pnpm auto-installs. Previously an override only rewrote dependencies declared in a manifest, so a peer nobody declares — installed because autoInstallPeers is on — resolved against its declared peer range and could bring in a second copy of the very package the override pinned. For example, with overrides: { react: npm:react@19.2.0 } and a lone lucide-react dependency, pnpm installed react@18.3.1; it now installs the pinned react@19.2.0#13320.
Under resolvePeersFromWorkspaceRoot, a workspace root dependency declared with link: or file: (or the path form of workspace:, such as workspace:../pkg) now satisfies another project's missing peer dependency at the linked package's own version, instead of being hoisted as a path. Those specifiers are relative to the project that declares them, so the same specifier reached a different directory — or none — from the project the peer was hoisted into, leaving a broken link. The root now has the same authority over the peer as it has when it declares the package with a version range #13373.
Installs through a pnpr server now apply the project's whole verification policy. minimumReleaseAgeExclude, minimumReleaseAgeIgnoreMissingTime, trustPolicy, trustPolicyExclude, trustPolicyIgnoreAfter, and trustLockfile were ignored, so excluded packages were still held back and a lockfile containing them could be rejected.
trustPolicy: no-downgrade no longer fails with TRUST_POLICY_INCOMPATIBLE_WITH_PNPR when a pnpr server is configured.
--frozen-lockfile and --no-prefer-frozen-lockfile are now honored on the pnpr path, instead of resolving and rewriting the lockfile anyway. Since frozenLockfile defaults to true on CI, a CI install through a pnpr server now fails on an out-of-date lockfile rather than updating it.
Workspace installs through a pnpr server no longer crash with Cannot read properties of undefined (reading 'filter') after linking, when minimumReleaseAge is active #13275.
Fixed pnpm dedupe updating valid catalog resolutions when another matching version exists in the lockfile.
pnpm -r run "/pattern/" --no-bail no longer exits zero when one of a project's matched scripts fails and a later one passes. The run summary carries a single status per project, and the passing script overwrote the recorded failure.
Restored the store block a first install prints, naming how packages were materialized and where the stores live #13315:
Packages are hard linked from the content-addressable store to the virtual store.
Content-addressable store is at: ~/.local/share/pnpm/store/v11
Virtual store is at: node_modules/.pnpm
The root project's pnpm:devPreinstall script now runs before resolution and linking, as it does in pnpm 11. It is skipped under --ignore-scripts, --lockfile-only and --dry-run, by pnpm fetch and pnpm rebuild, and by a repeat install that is already up to date. Workspaces that use the hook to prepare state the install depends on — such as next.js, which generates a placeholder next bin with it — were left with dependents linked against files that were never created #13313.
Prevented pnpm dedupe --check from removing an incompatible node_modules directory.
pnpm update --workspace no longer links dependencies the user never named:
Running it with updateConfig.ignoreDependencies configured no longer fails with `ERR_PNPM_WORKSPACE_P
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
Branch creation
"on Monday"
Automerge
At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
If you want to rebase/retry this PR, check this box
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/eslint-plugin-jsdoc@63.3.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
>=3.26.0→>=3.37.063.3.1→63.3.263.3.3^6.29.0→^6.31.024.18.0→24.18.124.18.0→24.18.1^0.6.8→^0.6.9^0.6.8→^0.6.9^0.0.80→^0.0.8611.17.0→11.18.0^4.62.3→^4.62.4^0.12.4→^0.12.5^1.0.0→^1.0.1^1.2.4→^1.3.0^1.2.4→^1.3.0^3.3.8→^3.3.9Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
nuxt/cli (@nuxt/cli)
v3.37.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
nubpackage manager (#1360)🤖 CI
7fc085b)18b4417)❤️ Contributors
v3.36.1Compare Source
👉 Changelog
compare changes
🩹 Fixes
server.ws(vite 8.1+) (#1355)❤️ Contributors
v3.36.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
aube(#1348)vue-tscandtypescript(#1316)🩹 Fixes
nuxt.configfiles (#1345)ee31f82)✅ Tests
2b179ca)🤖 CI
f123be8)🎉 New Contributors
❤️ Contributors
v3.35.2Compare Source
👉 Changelog
compare changes
🩹 Fixes
readPackageJSON(#1307)🏡 Chore
❤️ Contributors
v3.35.1Compare Source
👉 Changelog
compare changes
🩹 Fixes
❤️ Contributors
v3.35.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
🔥 Performance
templateNamesto separate chunk to decrease parse time (#1290)🩹 Fixes
:(e14ce27)🏡 Chore
🤖 CI
❤️ Contributors
v3.34.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
--profilesupport (#1243)🔥 Performance
tinyclipinstead ofcopy-paste(#1238)📖 Documentation
🏡 Chore
🤖 CI
❤️ Contributors
v3.33.1Compare Source
👉 Changelog
compare changes
🩹 Fixes
🏡 Chore
@clack/promptsnow that it's stable (d3cf87c)❤️ Contributors
v3.33.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
🩹 Fixes
❤️ Contributors
v3.32.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
module add->addand add newtemplate-addcommand (#1176)🩹 Fixes
❤️ Contributors
v3.31.3Compare Source
👉 Changelog
compare changes
🩹 Fixes
NODE_ENVoverride when initialising server (#1161)🤖 CI
❤️ Contributors
v3.31.2Compare Source
👉 Changelog
compare changes
📦 Build
❤️ Contributors
v3.31.1Compare Source
👉 Changelog
compare changes
🔥 Performance
joinrather thanresolveif adding static string (b0b8fd5)🩹 Fixes
tsconfig.jsonexists before starting dev server (0aa3a0f)npm create nuxt(#1149)✅ Tests
create-nuxtcli (3650f92)❤️ Contributors
v3.31.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
@bomb.sh/tab(#1082)🩹 Fixes
@clack/prompts(#1117)--hostwithout explicit host (5278c9e)nitroversion + remove buildModules for v3+ (3eaca44)BuildModulesis defined (ce9694f)💅 Refactors
🏡 Chore
🤖 CI
❤️ Contributors
v3.30.0Compare Source
👀 Highlights
The biggest change in this release is that we drop the built-in proxy server which we previously used.
this will mean that there's not a persistent connection, but it avoids a lot of the pain and potential problematic behaviour with having a proxy (either over socket, which can be flaky on different oses/runtimes - or over network, which is slow on windows).
we're also continuing to focus on performance, including dropping some dependencies, and migrating where possible to new unjs libraries like h3 v2 and srvx.
👉 Changelog
compare changes
🚀 Enhancements
🔥 Performance
clipboardytocopy-paste(#1087)🩹 Fixes
nitroversion (70dcc9b)💅 Refactors
srvxto serve analysis results (97d8172)📦 Build
🏡 Chore
verifyDepsBeforeRun: install(#1106)ignoredBuiltDependencies(#1107)✅ Tests
❤️ Contributors
v3.29.3Compare Source
👉 Changelog
compare changes
🩹 Fixes
❤️ Contributors
v3.29.2Compare Source
👉 Changelog
compare changes
🩹 Fixes
process.getBuiltinModule(fa5d5e6)🏡 Chore
🤖 CI
packages/dir from size parsing script (5b3d7a3)❤️ Contributors
v3.29.1Compare Source
👉 Changelog
compare changes
🩹 Fixes
🏡 Chore
🤖 CI
❤️ Contributors
v3.29.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
v3,v4,v3-nightlyandv4-nightlychannels (#1019)🔥 Performance
create-nuxt(#1044)🩹 Fixes
falsefor installing official modules (0399e22)clearargument default to command definition (#1054)portargument alias to command definition (#1055)🏡 Chore
✅ Tests
🤖 CI
❤️ Contributors
v3.28.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
--nightlyflag (#650)🩹 Fixes
latest(6b80c59)🏡 Chore
join(e61d334)🤖 CI
pull_request_target(#999)❤️ Contributors
v3.27.0Compare Source
👉 Changelog
compare changes
🚀 Enhancements
-ealias for--extends(#986)🩹 Fixes
rootDir(67b9dab)❤️ Contributors
v3.26.4Compare Source
👉 Changelog
compare changes
🩹 Fixes
devServer.close(0d9ab2c)❤️ Contributors
v3.26.3Compare Source
👉 Changelog
compare changes
🩹 Fixes
options.devServer(#970)get-port-pleaseto handle socket paths (#973)🤖 CI
❤️ Contributors
v3.26.2Compare Source
👉 Changelog
compare changes
🩹 Fixes
v4(beb7fb4)❤️ Contributors
v3.26.1Compare Source
👉 Changelog
compare changes
🩹 Fixes
💅 Refactors
formatSocketURLlogic (11330aa)❤️ Contributors
gajus/eslint-plugin-jsdoc (eslint-plugin-jsdoc)
v63.3.2Compare Source
Bug Fixes
require-example: support fixer with 1-line JSDoc blocks; fixes #1736 (36f8e9e)webpro-nl/knip (knip)
v6.31.0: Release 6.31.0Compare Source
c6b1516) - thanks @caseycarroll!5aadf47)6fa9c26)6d8e9bf)v6.30.0: Release 6.30.0Compare Source
actions/node-versions (node)
v24.18.1: 24.18.1Compare Source
Node.js 24.18.1
nodejs/node (node)
v24.18.1: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbolCompare Source
This is a security release.
Notable Changes
Commits
6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #647139d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#9298a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#92134ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #6375295ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#9119a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#9266c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#89605f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931stackblitz-labs/pkg.pr.new (pkg-pr-new)
v0.0.86Compare Source
v0.0.84Compare Source
v0.0.83Compare Source
v0.0.82Compare Source
v0.0.81Compare Source
pnpm/pnpm (pnpm)
v11.18.0: pnpm 11.18Compare Source
Minor Changes
Fixed an installed optional dependency being left without one of its own required dependencies. When a package reached through
optionalDependenciesis installable on the current system but one of its regulardependenciesis not, a lockfile-based install skipped that dependency and installed the parent anyway, so importing the parent failed withMODULE_NOT_FOUND. The dependency is now installed, and an install-check warning reports the incompatibility. A dependency is still only skipped when every path to it is optional, or when the package that pulls it in was itself skipped #13286.pnpm setupnow appendsPNPM_HOMEand the global bin directory to the GitHub Actions environment files (GITHUB_ENVandGITHUB_PATH), so later steps in the same job can runpnpm add --globaland other global commands #9191.Added support for
publishConfig.name, which publishes a package under a different name than the one its manifest carries in the workspace. It is for a project whose published name is already taken by a sibling project, which otherwise has to be renamed by a build step just before publishing. Only the published artifact is renamed — dependents,pnpm-lock.yaml, and release tooling keep addressing the project by its manifest name — and the new name reaches the packed manifest, the tarball filename, and everything that addresses the package at the registry: the already-published check ofpnpm publish -r, its registry selection, and the release-planning probes ofpnpm change statusandpnpm version -r#13345.pnpm self-updateno longer takes any instruction from the project it is run in:.npmrcorpnpm-workspace.yamlcan no longer redirect the download or attach credentials to it, and the project's default.pnpmfile.(c|m)jsis no longer loaded. Pnpmfiles from trusted sources (thepnpmfilesetting, the global pnpmfile, config dependencies) still apply.minimumReleaseAgesettings inpnpm-workspace.yamlno longer affectself-update. They still govern the project's own dependencies; forself-updatethe cooldown now comes from the built-in default, your global config, aPNPM_CONFIG_*environment variable, or a command-line flag. This fixesself-updatefailing inside a workspace that raises the cutoff while succeeding everywhere else, and stops a repository from either waiving the cooldown or keeping you on an outdated pnpm by raising it.trustPolicysettings and toci: a project can no longer weaken the trust check that guards the pnpm download, nor re-enable the confirmation prompt that a CI run suppresses.When
self-updaterefuses a version that is younger than the cutoff, an interactive run now offers to update anyway; non-interactive runs still fail. CI never prompts, even on a runner that attaches a TTY.Patch Changes
Fixed
pnpm licenses listto report every version when the same package is installed under multiple aliases pnpm/pnpm#13438.Sort
pnpm dedupe --checksnapshot changes for stable output across pnpm implementations.Strip Unicode formatting characters from registry- and manifest-derived terminal output.
Speed up installs after compatible catalog or direct dependency range changes by retaining the locked version without resolving the dependency graph again.
Speed up installs after safe override changes by reusing unambiguous compatible dependency resolutions, pruning obsolete dependencies, applying independent replacements and removals together, and handling parent-scoped
"-"overrides without full lockfile resolution.Installing a local
file:directory dependency with the global virtual store enabled no longer fails withTypeError: Cannot read properties of undefined (reading 'split')#13335.Local directory dependencies —
file:directories and injected workspace packages — now get a global-virtual-store slot of their own per project. They used to share one slot across every project that depended on a directory of the same name, so a project could end up linked to another project's copy of the dependency.The
Workspacecolumn ofpnpm update --interactivenow falls back to the project's path when itsnameis only whitespace, as it already did for a missing or empty one — all three render an equally blank label otherwise.Checking GitHub Actions dependencies for updates is now opt-in for every command. Neither
pnpm outdatednorpnpm updatereads the workflow files unless--include-github-actionsis passed orupdate.githubActionsis set totrueinpnpm-workspace.yaml. Reading them runsgit ls-remoteagainst every referenced repository, which fails in environments where GitHub is not reachable the way pnpm assumes (a GitHub Enterprise Server, a custom certificate authority, or an offline network) #13254.pnpm outdatedaccepts the--include-github-actionsoption too.pnpm update --interactivenow measures its table in terminal columns rather than in characters. A package name, workspace name, or version containing wide characters (CJK, most emoji) no longer knocks its row's columns out of line with the rest of the group, and a wide character in a version no longer aborts the command withSubject parameter value width cannot be greater than the container width#13357.The
Workspacecolumn ofpnpm update --interactiveis more informative in two cases. A dependency outdated at the same version in several workspace projects is offered as one choice, since selecting it updates every project — that choice now names all of them instead of only the first. And a workspace project without anameis now labelled with its path rather than left blank, so several unnamed projects can be told apart.An auto-installed optional peer is no longer hoisted at a version the workspace root's own dependency on that package excludes.
resolvePeersFromWorkspaceRootalready made the workspace root's specifier decide which version a missing required peer is installed at; the optional-peer picker ignored it and always took the highest version present anywhere in the graph. In a workspace whose root pinspostcss: 8.5.10, an importer that depends onwebpackand declares nopostcssof its own gotpostcss@8.5.22hoisted forterser-webpack-plugin's optionalpostcsspeer, leaving twopostcss@8.5.xinstances in the graph #13320.overridesnow also govern peers that pnpm auto-installs. Previously an override only rewrote dependencies declared in a manifest, so a peer nobody declares — installed becauseautoInstallPeersis on — resolved against its declared peer range and could bring in a second copy of the very package the override pinned. For example, withoverrides: { react: npm:react@19.2.0 }and a lonelucide-reactdependency, pnpm installedreact@18.3.1; it now installs the pinnedreact@19.2.0#13320.Under
resolvePeersFromWorkspaceRoot, a workspace root dependency declared withlink:orfile:(or the path form ofworkspace:, such asworkspace:../pkg) now satisfies another project's missing peer dependency at the linked package's own version, instead of being hoisted as a path. Those specifiers are relative to the project that declares them, so the same specifier reached a different directory — or none — from the project the peer was hoisted into, leaving a broken link. The root now has the same authority over the peer as it has when it declares the package with a version range #13373.Installs through a pnpr server now apply the project's whole verification policy.
minimumReleaseAgeExclude,minimumReleaseAgeIgnoreMissingTime,trustPolicy,trustPolicyExclude,trustPolicyIgnoreAfter, andtrustLockfilewere ignored, so excluded packages were still held back and a lockfile containing them could be rejected.trustPolicy: no-downgradeno longer fails withTRUST_POLICY_INCOMPATIBLE_WITH_PNPRwhen a pnpr server is configured.--frozen-lockfileand--no-prefer-frozen-lockfileare now honored on the pnpr path, instead of resolving and rewriting the lockfile anyway. SincefrozenLockfiledefaults totrueon CI, a CI install through a pnpr server now fails on an out-of-date lockfile rather than updating it.Workspace installs through a pnpr server no longer crash with
Cannot read properties of undefined (reading 'filter')after linking, whenminimumReleaseAgeis active #13275.Fixed
pnpm dedupeupdating valid catalog resolutions when another matching version exists in the lockfile.pnpm -r run "/pattern/" --no-bailno longer exits zero when one of a project's matched scripts fails and a later one passes. The run summary carries a single status per project, and the passing script overwrote the recorded failure.Restored the store block a first install prints, naming how packages were materialized and where the stores live #13315:
The root project's
pnpm:devPreinstallscript now runs before resolution and linking, as it does in pnpm 11. It is skipped under--ignore-scripts,--lockfile-onlyand--dry-run, bypnpm fetchandpnpm rebuild, and by a repeat install that is already up to date. Workspaces that use the hook to prepare state the install depends on — such as next.js, which generates a placeholdernextbin with it — were left with dependents linked against files that were never created #13313.Prevented
pnpm dedupe --checkfrom removing an incompatiblenode_modulesdirectory.pnpm update --workspaceno longer links dependencies the user never named:updateConfig.ignoreDependenciesconfigured no longer fails with `ERR_PNPM_WORKSPACE_PConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.