deps: skuba v12.14.1 and pnpm v10.17

[renovate]

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

---

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pnpm (source)	10.17.0 -> 10.18.0
skuba	12.3.0 -> 12.4.1

---

Release Notes

pnpm/pnpm (pnpm)

v10.18.0

Compare Source

Minor Changes

• Added network performance monitoring to pnpm by implementing warnings for slow network requests, including both metadata fetches and tarball downloads.

  Added configuration options for warning thresholds: fetchWarnTimeoutMs and fetchMinSpeedKiBps.
  Warning messages are displayed when requests exceed time thresholds or fall below speed minimums

  Related PR: #​10025.

Patch Changes

• Retry filesystem operations on EAGAIN errors #​9959.
• Outdated command respects minimumReleaseAge configuration #​10030.
• Correctly apply the cleanupUnusedCatalogs configuration when removing dependent packages.
• Don't fail with a meaningless error when scriptShell is set to false #​8748.
• pnpm dlx should not fail when minimumReleaseAge is set #​10037.

v10.17.1

Compare Source

Patch Changes

• When a version specifier cannot be resolved because the versions don't satisfy the minimumReleaseAge setting, print this information out in the error message #​9974.
• Fix state.json creation path when executing pnpm patch in a workspace project #​9733.
• When minimumReleaseAge is set and the latest tag is not mature enough, prefer a non-deprecated version as the new latest #​9987.

seek-oss/skuba (skuba)

v12.4.1

Compare Source

Patch Changes

• template/oss-npm-template: Replace invalid $default-branch configuration in workflows (#​2085)

• lint: Add CI=true to production install step in Dockerfile (#​2082)

  Our API templates include a RUN pnpm install --prod Dockerfile instruction to prune devDependencies from node_modules. However, pruning may not behave as expected in the absence of the CI flag, and pnpm v10.16.0 emits the following error if the environment variable is not set:

  ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY  Aborted removal of modules directory due to no TTY
  If you are running pnpm in CI, set the CI environment variable to "true".

  We will try to apply a one-time patch to your project to add the CI environment variable to Dockerfiles that have a RUN pnpm install --prod instruction:

  - RUN pnpm install --offline --prod
  + RUN CI=true pnpm install --offline --prod

v12.4.0

Compare Source

Minor Changes

• build: Default esbuild output to CJS format (#​2074)

  Note: This only affects projects that have manually set package.json#/skuba/build to "esbuild". There are less than 10 of these at time of writing.

  skuba build now defaults to CJS output when using the esbuild configuration. ESM output is only used when the following conditions are met:

  • "type": "module" is set in package.json
  • The module field in tsconfig.json is not set to "commonjs"

• lint: Remove Dockerfile syntax parser directive (#​2075)

  Our containerisation guidance mounts the NPM_TOKEN environment variable as a build secret. This requires Dockerfile frontend version 1.10+, and we previously recommended adding a syntax parser directive to ensure availability of the feature in your build context.

---

Configuration

📅 Schedule: Branch creation - "before 6:00 am every 2 weeks on Thursday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9428c70

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.