[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/coverage-v8 (source)	^5.0.4 → ^5.0.5
c12	4.0.0-rc.2 → 4.0.0-rc.3
oxfmt (source)	^0.72.0 → ^0.74.0
oxlint (source)	^1.87.0 → ^1.89.0
pnpm (source)	11.26.0 → 11.28.7
rolldown (source)	^1.2.13 → ^1.2.15
vitest (source)	^5.0.4 → ^5.0.5

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.5

Compare Source

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in #​11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in #​11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in #​11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in #​11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in #​11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in #​11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in #​11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in #​11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in #​11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in #​11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in #​11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in #​11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in #​11596 (8dd67)
• reporter:
  • End reason &#​39;failed&#​39; on worker crash  -  by @​AriPerkkio in #​11568 (6ae8e)

    View changes on GitHub

oxc-project/oxc (oxfmt)

v0.74.0: oxfmt v0.74.0

Compare Source

🐛 Bug Fixes

• e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#​27957) (leaysgur)
• 782ab6e linter: Search string values without UTF-8 conversion (#​26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#​27955) (leaysgur)
• 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#​27948) (leaysgur)
• 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#​27947) (leaysgur)
• 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#​27946) (leaysgur)
• c22a9b2 formatter: Treat static block with only empty statements as empty (#​27945) (leaysgur)
• d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#​27823) (leaysgur)
• c4c1727 formatter/sort_imports: Keep comments after the last import (#​27822) (leaysgur)
• a64677e formatter: Print JSDoc embedded snippets with LF (#​27821) (leaysgur)
• 2c1cc20 formatter: Keep comment only Vue bindings as-is (#​27820) (leaysgur)
• 1bf236d formatter/sort_imports: Do not use comments as import source (#​27819) (leaysgur)
• 52ee29d formatter_yaml: Never start col-0 line with document marker or BOM (#​27818) (leaysgur)
• 81c75e7 formatter/css: Keep glued css-in-js statement placeholders glued (#​27814) (leaysgur)
• a1ef7f4 formatter: Keep typecast parens in same-operator binary and arrow chain (#​27812) (leaysgur)
• de110ce formatter: Keep more parens around TSInstantiationExpression (#​27811) (leaysgur)
• 8b02e90 formatter_json: Reject invalid JSON instead of dropping them (#​27785) (leaysgur)
• 6fe4c1b formatter: Treat lone CR in JSX text and argument blank lines (#​27780) (leaysgur)
• 5605362 oxfmt: Validate editorconfig as like oxfmtrc (#​27778) (leaysgur)
• 5b2acb0 formatter_core: Report error position releative to CRLF source (#​27777) (leaysgur)
• c78e80e formatter_core: Report parse error positions relative to the BOM-headed source (#​27776) (leaysgur)
• 3a980c9 formatter_toml: Handle BOM like other languages (#​27775) (leaysgur)
• 97c9fc4 oxfmt: Handle BOM in config JSON (#​27774) (leaysgur)
• 28eb4a7 oxfmt: Print trailing newline for --list-different (#​27773) (leaysgur)
• d2bea21 formatter: Glue comments to an opener in empty for-head slots and array holes (#​27737) (leaysgur)
• 6a95ec1 formatter: Keep comment position on holey array (#​27730) (leaysgur)
• 54769da formatter: Break after dangling line comment in holey array (#​27729) (leaysgur)
• 99077ef formatter_json: Reject unary expressions other than signed numbers (#​27728) (leaysgur)
• 22cd4cd formatter_json: Handle holey array and comments (#​27727) (leaysgur)
• 644ca1c formatter: Do not indent logical chains whose right sides all inline (#​27667) (leaysgur)
• a07a0fb formatter: Wrap comment-only JSX expression container in a group (#​27666) (leaysgur)

⚡ Performance

• e220293 formatter: Check only the operator suppression mark in is_quiet (#​27952) (leaysgur)
• e5fdc9c formatter_core: Write into one element stack through a concrete Formatter (#​27559) (leaysgur)
• a342f7e formatter: Skip comment handling for nodes with no comment near them (#​27557) (leaysgur)
• d8ce750 formatter: Write string literals with swapped quotes into the arena (#​27558) (Yuji Sugiura)
• 1c393c0 formatter_core: Skip scanning texts with nothing to rewrite (#​27561) (leaysgur)
• 1d3ef10 formatter_core: Keep the embedded IR when nothing in it is rewritten (#​27673) (leaysgur)

📚 Documentation

• 1325225 oxfmt: Update useless comment prefix (#​27956) (leaysgur)
• d0dd140 formatter: Note lossy cooked round-trip in template embeds (#​27944) (leaysgur)
• 8a3a6c8 oxfmt: Update stale notes on the JSDoc string-out channel and fixture origins (#​27824) (leaysgur)

v0.73.0

Compare Source

🚀 Features

• a495e82 oxfmt: Support associations config to specify language over filepath (#​27437) (leaysgur)
• 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#​27386) (leaysgur)

📚 Documentation

• 408d87f oxfmt: Simplify oxfmtrc docs (#​27432) (leaysgur)
• 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#​27362) (leaysgur)

oxc-project/oxc (oxlint)

v1.89.0

Compare Source

🐛 Bug Fixes

• 9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (#​27699) (camc314)

v1.88.0

Compare Source

🚀 Features

• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#​27346) (Mikhail Baev)

pnpm/pnpm (pnpm)

v11.28.7: pnpm 11.28.7

Compare Source

This release rejects registry metadata that names a different package than the one requested, applies trustPolicy to the pnpm version a project pins, and caps unpacked package size with maxTarballUnpackedSize. It also removes support for registry revisions, fixes verifyDepsBeforeRun after filtered installs, and finishes commands with their own exit code when a pipe reader exits early.

Patch Changes

Security

• pnpm now fails with ERR_PNPM_REGISTRY_NAME_MISMATCH if a registry returns metadata for a package other than the one requested. Before, pnpm installed the package under the name in the metadata, so allowBuilds rules for the requested package did not apply to it.

• pnpm now applies trustPolicy to the pnpm version a project pins in packageManager or devEngines.packageManager. A pinned version whose trust evidence was downgraded fails the command before pnpm switches to it or records it in the lockfile #​16319.

• minimumReleaseAgeExcludePrune and trustPolicyExcludePrune now keep exclusions for resolved configuration dependencies and their transitive dependencies #​17142.

• Added the maxTarballUnpackedSize setting. pnpm install fails with ERR_PNPM_TARBALL_TOO_LARGE when the files of one package unpack to more than this many bytes, 4 GiB by default pnpm/tasks#81.

Resolving dependencies

• Registry revisions are no longer supported. pnpm now fails with ERR_PNPM_REGISTRY_REVISIONS_UNSUPPORTED on registry metadata that selects a revision, on a +rN version specifier, and on a lockfile entry with a revision field. pnpm update --patches is removed.

• When pnpm install resolves a dependency again, it now reuses a version that the install already resolved for the same package, as a fresh install does. Before, it kept the version the lockfile pinned and added a second copy of the package. A locked version still stays when nothing else in the install prefers another version. To pin a transitive dependency on purpose, use overrides #​17084.

• When another workspace project adds a different version of a package, a project's auto-installed peer on that package now moves to the version a fresh install picks. It used to stay on its locked version while any other project still accepted that version #​17058.

• An optional peer that pnpm adds to a project now keeps the version the lockfile recorded for that project only while the dependency graph still holds it. Otherwise it follows its provider to a version the graph holds. Before, pnpm kept a higher version that only the lockfile held, which left two copies of the peer #​16443.

• A package that lists the same dependency in dependencies and as an optional peer now gets the peer bound when a project adds a provider for it later. The lockfile now records every peer a package declares, including one its own dependency supplies #​17056.

• pnpm install --prod no longer drops a dependency that a package declares both as an optional peer and as its own dependency, when the package resolved it as its own dependency and a dev dependency provides the same package under another alias.

• pnpm now measures a pnpm.overrides entry written as a workspace: path, such as workspace:./packages/foo, from the directory holding pnpm-workspace.yaml. It used to be measured from each package the override rewrote. The install then linked a directory that does not exist, or failed if workspace packages were injected #​17010.

• pnpm install now removes config dependencies that are no longer declared, including when the entire configDependencies setting is removed. Frozen installs reject a lockfile that still records removed config dependencies.

• pnpm add now reads the package name correctly from a tarball URL under a registry URL that has a path, such as https://example.com/npm/. Before, the registry path became part of the name, so a scoped package failed with ERR_PNPM_INVALID_PACKAGE_NAME.

• pnpm add no longer warns that a gist dependency was replaced from a different source when the new specifier names the same gist in another form, such as gist:<id> and https://gist.github.com/<user>/<id>.

• With minimumReleaseAge set, pnpm now revalidates a package's cached full metadata with a single ETag request so an unchanged registry answers with 304, and keeps using the cached copy once the registry confirms it is current, even when the metadata does not list a publish time for every version. Previously, pnpm downloaded that metadata again whenever the cached copy was older than minimumReleaseAge. Packages listed in minimumReleaseAgeExclude also resolve from cached metadata without a registry request when the lockfile already has the version their range picks.

Linking node_modules and workspaces

• Concurrent installs that import the same package into one project now all complete. One of them used to fail with ENOTEMPTY when its copy of the package collided with the copy another install had already placed pnpm/tasks#48.

• pnpm install no longer fails on macOS with EISDIR when it creates store directories in a group-writable store under a umask that removes owner read, such as 0o477.

• pnpm install now succeeds when node_modules is a symlink to an existing directory. Dependency hoisting previously rejected a symlinked node_modules as an invalid destination #​17157.

• A filtered pnpm install --no-lockfile with hoistWorkspacePackages now hoists every workspace project into node_modules/.pnpm/node_modules. It used to hoist only the selected projects pnpm/tasks#168.

• Filtered installs remove obsolete dependencies from the installed lockfile while preserving dependencies still needed by unselected projects.

• With sharedWorkspaceLockfile: false, pnpm install now runs the preResolution hooks and custom resolvers and fetchers of the workspace root's pnpmfile for every project, next to the project's own. A global pnpmfile now runs once per project, and each project's lockfile records the checksum of the root pnpmfile when the project has none of its own. Before, a project's own pnpmfile replaced these root hooks, the global hooks ran twice, and edits to the root pnpmfile could go unnoticed.

• pnpm prune now removes extraneous direct packages from node_modules when package.json and pnpm-lock.yaml are already in sync. pnpm prune also accepts --filter and --recursive to prune selected workspace projects without removing dependencies of unselected projects.

Injected workspace packages

• pnpm install --frozen-lockfile now fails with ERR_PNPM_OUTDATED_LOCKFILE when the dependencies of an injected workspace package or local directory dependency no longer match the lockfile. This covers sharedWorkspaceLockfile: false #​17008, a dependency changed to a different tarball URL or git commit #​17129, and a change in a transitive injected or local directory dependency #​17128.

• pnpm install --frozen-lockfile no longer fails with ERR_PNPM_OUTDATED_LOCKFILE when an injected workspace package depends on a local directory under another name, such as "renamed": "file:../b" #​17130.

• An injected workspace dependency now becomes a link when its dependencies match the workspace package's own, also on an install that leaves the package's installed dependencies as they are. Before, such an install kept it as a copy #​17094.

• An injected workspace package that was linked now becomes a copy when the project that depends on it starts providing one of its peers at a version the package's own workspace context lacks. The link used to stay until that dependency was updated, so the package could not find the peer the project provides #​17057.

• An injected workspace package now keeps only the files its manifest lists after a lifecycle script or a script named in syncInjectedDepsAfterScripts rebuilds it. Before, these refreshes copied every file of the package directory into the injected copy, including files that files or .npmignore leave out. With deployAllFiles: true the copy still gets every file.

• A script listed in syncInjectedDepsAfterScripts now keeps a package's links to its own files as links in the injected copies, the way pnpm install writes them. It no longer fails when the package links to one directory twice or links back to a directory above the link. pnpm install with deployAllFiles no longer fails on such a link back either.

• A script listed in syncInjectedDepsAfterScripts now updates the injected copies of the package it ran in when sharedWorkspaceLockfile is false or the package publishes from publishConfig.directory. Before, those copies kept the files from the last install.

Running scripts and checking dependencies

• When the reader of pnpm's output exits early, as in pnpm outdated | head, pnpm now finishes the command and exits with the command's own exit code pnpm/tasks#133. It used to exit with code 0 at the first write to the closed pipe. That hid the result of commands such as pnpm outdated and stopped pnpm clean before it removed anything.

• With enableGlobalVirtualStore, a Node.js resolve hook that a script registers now sees the importer as context.parentURL after pnpm's NODE_PATH fallback fails to find a bare specifier. Hooks that resolve tsconfig paths aliases from the importer failed with ERR_MODULE_NOT_FOUND #​16979.

• pnpm run, pnpm exec, and pnpm restart now pass the install flags they were given, such as --lockfile-dir, --modules-dir, --store-dir, --offline, and --ignore-scripts, to the pnpm install that verifyDepsBeforeRun: install starts. When that install leaves node_modules out of date, pnpm now prints a warning.

• After pnpm install --filter, pnpm run and pnpm exec now notice a changed manifest or lockfile in a project that the filtered install left out, including the workspace root after a filtered install with pruneDirectDependencies: true pnpm/tasks#181. A filtered install also preserves the recorded ignored build scripts of unselected projects, and pnpm dedupe --check and pnpm install --dry-run no longer record outdated dependencies as installed.

• The verifyDepsBeforeRun check now holds the workspace projects that the selected project depends on, including link: workspace dependencies. --filter=<project>... now selects link: dependencies as well. With sharedWorkspaceLockfile: false, verifyDepsBeforeRun also reports dependencies as outdated when a selected project's pnpm-lock.yaml is missing pnpm/tasks#138.

• verifyDepsBeforeRun and repeat pnpm install runs now apply overrides before comparing a modified package.json with pnpm-lock.yaml #​17127. verifyDepsBeforeRun also checks whether each importer's resolved catalog versions match the catalog snapshot in pnpm-lock.yaml, and respects lockfileDir in single-project repositories.

• verifyDepsBeforeRun now compares manifests, lockfiles, and patch files by content hash. It notices an edit that kept the file's modification time, as cp -p, rsync -a, or an archive extraction leave it, and a patch file that was copied or touched without changing its content no longer marks dependencies as outdated #​16988.

Deploying and other commands

• pnpm deploy now records the peer dependencies of the workspace packages it copies into the deployed lockfile. Before, pnpm rejected that lockfile with --frozen-lockfile when a deployed workspace package declared a peer and injectWorkspacePackages was off #​17093.

• pnpm install --frozen-lockfile and verifyDepsBeforeRun now succeed inside a directory created by pnpm deploy. pnpm deploy writes self-contained workspace and lockfile settings, prunes unused patchedDependencies, and preserves workspace-level dependency resolutions on deployed directory dependencies.

• In workspaces with sharedWorkspaceLockfile: false, pnpm patch, pnpm patch-commit, and pnpm patch-remove now resolve patch files and patchedDependencies entries at the workspace root. pnpm install checks configured patches across all workspace projects before reporting unused patches.

• Trusted publishing with OIDC now works with registries whose URL has a path, such as https://registry.example/npm/private/. pnpm previously sent the token exchange request to the root of the registry host.

• pnpm owner ls now lists the owners of a package on the npm registry. It reported every package as not found.

• pnpm sbom now reads project lockfiles in workspaces with sharedWorkspaceLockfile: false, including filtered and split output, and reports the repository of a package whose repository field is a gist: shorthand.

• pnpm licenses list reports no licenses for workspace projects not recorded in the lockfile. It errors when pnpm-lock.yaml is missing. Empty results now use the requested text or JSON format pnpm/tasks#174.

• pnpm why now reads each selected workspace project's lockfile and modules directory when sharedWorkspaceLockfile is false pnpm/tasks#169.

• pnpm pkg fix now converts a repository string such as github:pnpm/example to the object form, as npm pkg fix does. It also normalizes a GitHub, GitLab, or Bitbucket repository URL the way npm pkg fix does #​16980.

Configuration and setting up pnpm

• pnpm now recognizes externalDependencies and autoInstallPeersFromHighestMatch in pnpm-workspace.yaml without warning and forwards both settings to pnpm install. Previously, setting externalDependencies in pnpm-workspace.yaml with nodeLinker: hoisted crashed pnpm install with externalDependencies.has is not a function pnpm/tasks#166.

• pnpm now ignores a PNPM_CONFIG_* environment variable for a URL setting, such as PNPM_CONFIG_REGISTRY, when its value is not a URL. Such a value used to make every command fail with Invalid URL.

• The warning about unrecognized settings in pnpm-workspace.yaml and the global config.yaml now names addMissingPeerTypes, autoDedupe, bootConfig, macosBackup, nodePackageMap, permissions, pipelineBase, publishWaitTimeout, python, remoteCache, saveTypes, skills, storeIndexFormat, and tools as pnpm v12 settings pnpm/tasks#167.

• When a config file has a setting pnpm cannot read, pnpm --version now prints the version, and pmOnFail and lockfileDir in pnpm-workspace.yaml stay in force. Previously, pnpm switched to the pinned version despite pmOnFail: ignore. pnpm also no longer writes the pinned version to pnpm-lock.yaml when it cannot read every setting and the running pnpm already matches the pin.

• pnpm now records the pinned pnpm version in the pnpm-lock.yaml under the lockfileDir set in pnpm-workspace.yaml, and resolves a relative lockfileDir from the workspace root. pnpm used to write a second pnpm-lock.yaml at the workspace root.

• pnpm self-update now updates the project's pnpm pin when Homebrew installed pnpm or Corepack runs it. The global pnpm is left alone #​17001.

• pnpm setup now completes when Windows registry environment values cannot be read or written. It prints PowerShell commands to configure PNPM_HOME and PATH without registry access #​17167.

• pnpm setup now succeeds when it cannot tell which shell configuration file to update, for example in a container where SHELL is not set. It installs pnpm and prints the PNPM_HOME and PATH lines to add yourself. Previously it failed with ERR_PNPM_UNKNOWN_SHELL, and so did the installer script at get.pnpm.io #​16973.

Platinum Sponsors

Gold Sponsors

v11.28.6: pnpm 11.28.6

Compare Source

This release stops pnpm publish from sending a CI identity token to a registry it was not issued for. It also fixes installs that dropped a dependency also declared as an optional peer, and accepts empty httpProxy and httpsProxy settings again.

Patch Changes

Security

• pnpm publish now uses an NPM_ID_TOKEN only if its aud claim matches the selected registry, such as npm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.

• The warning about renamed package files with invalid names no longer prints control characters from those file names.

Configuration

• pnpm again accepts httpProxy and httpsProxy set to null or written with no value in pnpm-workspace.yaml and the global config file, and treats them as unset. Since 11.28.5 these values failed with ERR_PNPM_INVALID_SETTING.

• pnpm now switches to the pnpm version a project pins even when it cannot read its configuration. Previously, a setting it rejected in the global config file, an .npmrc file, _auth, or pnpm-workspace.yaml stopped every command, pnpm --version included.

• A key under a registry URL in the _auth setting that does not start with @ is now skipped with a warning, so a field a later pnpm version adds there no longer breaks this one. A key that holds an authToken object but lacks its @, such as org for @org, is still an error.

Resolving dependencies

• pnpm no longer drops a dependency that a package also declares as an optional peer dependency, for example ajv of ajv-formats. Since 11.28.0, in some dependency graphs the package got the dependency neither as a dependency nor as a peer, and failed to import it #​16901.

• pnpm install no longer fails with ERR_PNPM_NO_MATCHING_VERSION after a change to overrides when the lockfile resolves an optional peer dependency to an npm alias of another package #​16654.

• pnpm install and pnpm dedupe now link an optional peer to the workspace package that the workspace root depends on when the picked version matches it. Previously they installed the registry package with the same name and version #​16706.

• Removal overrides such as "debug>supports-color": "-" now also apply to an optional peer that a package declares only in peerDependenciesMeta #​16681.

• pnpm dedupe now preserves a hoisted workspace package when another package uses a separately installed peer with the same name #​16935.

• pnpm install and pnpm add --config now apply minimumReleaseAge when they resolve a config dependency. A config dependency range resolves to the newest version that is old enough, so a later clean pnpm install --frozen-lockfile accepts the lockfile #​16660.

• pnpm install --fix-lockfile no longer removes the deprecated and hasBin fields from lockfile entries #​6600.

Workspaces and catalogs

• A filtered install, such as pnpm install --filter <pkg>, now keeps the pnpm-lock.yaml entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk #​16931.

• catalogPrune no longer removes catalog entries that pnpm-lock.yaml still records for workspace projects missing from disk. This affected pnpm remove and installs that leave the lockfile unchanged, such as frozen installs. Before, a following frozen install failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH #​16679.

• Sped up workspace discovery with subtree exclusions such as !generated/**.

Linking node_modules

• pnpm install no longer fails on Windows with EPERM on rmdir node_modules/@scope when several workspace packages under one scope are hoisted, for example with nodeLinker: hoisted #​16690.

• pnpm install hardlinks files from a group-writable or world-writable store again. Before this fix, pnpm copied every file from such a store into node_modules #​16677.

• With enableGlobalVirtualStore, an install that updates node_modules now restores the dependency links of a package in the global virtual store that an interrupted install left without them. Before, such an install kept the incomplete package if the project's node_modules already recorded it #​16642.

• Removing a link: dependency now also removes its symlink from node_modules when nodeLinker is hoisted #​16884.

• An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store #​16929.

Injected workspace packages

• With sharedWorkspaceLockfile: false, an injected workspace package installed in the same run as its dependent now holds only the files its files field selects. The copy used to also hold other files of the project, such as tsconfig.json #​16683.

• A script listed in syncInjectedDepsAfterScripts no longer fails when it rewrites package.json while pnpm is copying its edits into the injected copies. The sync after the script now replaces a half-copied manifest.

• Sped up frozen installs of unchanged injected workspace packages that use hardlinks.

Deploying

• pnpm deploy without injectWorkspacePackages now binds a peer dependency of a linked workspace package to the version its parent provides, as an injected install does. Previously the deploy failed with ERR_PNPM_DEPLOY_AMBIGUOUS_PEER whenever other packages in the deployed graph depended on different versions of that peer #​16807.

• pnpm deploy in a workspace with injectWorkspacePackages no longer crashes when a linked workspace package declares a peer dependency named after an Object.prototype member, such as constructor.

Setting up pnpm

• pnpm now relinks the bins of a pnpm version it installed earlier for packageManager or pnpm with. A pnpm 12 version installed by a pnpm release older than 11.28.4 could keep a launcher that ran node on the native binary, so every command failed with SyntaxError: Invalid or unexpected token #​16646.

• pnpm setup no longer tries to install pnpm globally from npm's bin directory when pnpm was installed with npm. It printed Failed to create bin at <PNPM_HOME>/bin/pnpm #​16855.

Output

• Escape codes in script output that moved the cursor or cleared the screen garbled pnpm's output. pnpm now drops them and keeps only color codes. Color codes are dropped too when pnpm's own output is not in color.

• When the registry rejects pnpm stage publish, the error message now starts with "Failed to stage package".

Platinum Sponsors

Gold Sponsors

v11.28.5: pnpm 11.28.5

Compare Source

This release reads cached registry metadata faster and makes pnpm config get --global ignore project settings. It also carries several security fixes for package archives, git dependencies, and config dependencies.

Patch Changes

Security

• pnpm now verifies locked config dependencies against their registry before installing them. Config dependencies must come from an npm registry. The lockfile can no longer replace the integrity of a config dependency pinned with version+integrity.

• Lockfile verification now checks the tarballs inside a variations resolution against the registry. A name@version lockfile entry with an empty variations resolution is now rejected.

• pnpm audit signatures now

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 1am and before 5am"
• Automerge
  • "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6b01917c-bd69-4eef-abde-0b473f9788ee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.73%. Comparing base (10796d9) to head (58d89e3).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #98   +/-   ##
=======================================
  Coverage   84.73%   84.73%           
=======================================
  Files          10       10           
  Lines         773      773           
  Branches      229      229           
=======================================
  Hits          655      655           
  Misses        105      105           
  Partials       13       13           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.