chore(deps): update pnpm to v9.12.2 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pnpm (source)	9.3.0 -> 9.12.2

---

Release Notes

pnpm/pnpm (pnpm)

v9.12.2: pnpm 9.12.2

Compare Source

Patch Changes

• When checking whether a file in the store has executable permissions, the new approach checks if at least one of the executable bits (owner, group, and others) is set to 1. Previously, a file was incorrectly considered executable only when all the executable bits were set to 1. This fix ensures that files with any executable permission, regardless of the user class, are now correctly identified as executable #​8546.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v9.12.1: pnpm 9.12.1

Compare Source

Patch Changes

• pnpm update --latest should not update the automatically installed peer dependencies #​6657.
• pnpm publish should be able to publish from a local tarball #​7950.
• The pnpx command should work correctly on Windows, when pnpm is installed via the standalone installation script #​8608.
• Prevent EBUSY errors caused by creating symlinks in parallel dlx processes #​8604.
• Fix maximum call stack size exceeded error related to circular workspace dependencies #​8599.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v9.12.0: pnpm 9.12

Compare Source

Minor Changes

• Fix peer dependency resolution dead lock #​8570. This change might change some of the keys in the snapshots field inside pnpm-lock.yaml but it should happen very rarely.

• pnpm outdated command supports now a --sort-by=name option for sorting outdated dependencies by package name #​8523.

• Added the ability for overrides to remove dependencies by specifying "-" as the field value #​8572. For example, to remove lodash from the dependencies, use this configuration in package.json:

  {
    "pnpm": {
      "overrides": {
        "lodash": "-"
      }
    }
  }

Patch Changes

• Fixed an issue where pnpm list --json pkg showed "private": false for a private package #​8519.
• Packages with libc that differ from pnpm.supportedArchitectures.libc are not downloaded #​7362.
• Prevent ENOENT errors caused by running store prune in parallel #​8586.
• Add issues alias to pnpm bugs #​8596.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v9.11.0

Compare Source

v9.10.0: pnpm 9.10

Compare Source

Minor Changes

• Support for a new CLI flag, --exclude-peers, added to the list and why commands. When --exclude-peers is used, peer dependencies are not printed in the results, but dependencies of peer dependencies are still scanned #​8506.

• Added a new setting to package.json at pnpm.auditConfig.ignoreGhsas for ignoring vulnerabilities by their GHSA code #​6838.

  For instance:

  {
    "pnpm": {
      "auditConfig": {
        "ignoreGhsas": [
          "GHSA-42xw-2xvc-qx8m",
          "GHSA-4w2v-q235-vp99",
          "GHSA-cph5-m8f7-6c5x",
          "GHSA-vh95-rmgr-6w4m"
        ]
      }
    }
  }

Patch Changes

• Throw an exception if pnpm switches to the same version of itself.
• Reduce memory usage during peer dependencies resolution.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v9.9.0

Compare Source

v9.8.0

Compare Source

v9.7.1

Compare Source

v9.7.0: pnpm 9.7

Compare Source

Minor Changes

• Added pnpm version management. If the manage-package-manager-versions setting is set to true, pnpm will switch to the version specified in the packageManager field of package.json #​8363. This is the same field used by Corepack. Example:

  {
    "packageManager": "pnpm@9.3.0"
  }

• Added the ability to apply patch to all versions #​8337.

  If the key of pnpm.patchedDependencies is a package name without a version (e.g. pkg), pnpm will attempt to apply the patch to all versions of the package. Failures will be skipped. If there's only one version of pkg installed, pnpm patch pkg and subsequent pnpm patch-commit $edit_dir will create an entry named pkg in pnpm.patchedDependencies. And pnpm will attempt to apply this patch to other versions of pkg in the future.

• Change the default edit dir location when running pnpm patch from a temporary directory to node_modules/.pnpm_patches/pkg[@​version] to allow the code editor to open the edit dir in the same file tree as the main project #​8379.

• Substitute environment variables in config keys #​6679.

Patch Changes

• pnpm install should run node-gyp rebuild if the project has a binding.gyp file even if the project doesn't have an install script #​8293.
• Print warnings to stderr #​8342.
• Peer dependencies of optional peer dependencies should be automatically installed #​8323.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v9.6.0: pnpm 9.6

Compare Source

Minor Changes

• Support specifying node version (via pnpm.executionEnv.nodeVersion in package.json) for running lifecycle scripts per each package in a workspace #​6720.
• Overrides now support the catalogs: protocol #​8303.

Patch Changes

• The pnpm deploy command now supports the catalog: protocol #​8298.
• The pnpm outdated command now supports the catalog: protocol #​8304.
• Correct the error message when trying to run pnpm patch without node_modules/.modules.yaml #​8257.
• Silent reporting fixed with the pnpm exec command #​7608.
• Add registries information to the calculation of dlx cache hash #​8299.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

v9.5.0

Compare Source

v9.4.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "after 10:00 before 19:00 every weekday except after 13:00 before 14:00" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Thank you for following the naming conventions! 🙏

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 55.36%. Comparing base (2c1ab03) to head (fb6994c).
Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #42   +/-   ##
=======================================
  Coverage   55.36%   55.36%           
=======================================
  Files          23       23           
  Lines        1109     1109           
  Branches      100       99    -1     
=======================================
  Hits          614      614           
  Misses        484      484           
  Partials       11       11           

Flag	Coverage Δ
rc	96.08% <ø> (ø)
semantic-release-pnpm	44.70% <ø> (ø)

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/lodash-es@4.17.21	eval	0	636 kB	bnjmnt4n
npm/normalize-url@8.0.1	None	0	25.9 kB	sindresorhus
npm/prettier@3.3.3	environment, filesystem, unsafe	0	7.7 MB	prettier-bot
npm/registry-auth-token@5.0.2	environment Transitive: filesystem, network	+7	133 kB	rexxars
npm/resolve-from@5.0.0	filesystem, unsafe	0	5.82 kB	sindresorhus
npm/secretlint@9.0.0	Transitive: environment, eval, filesystem, unsafe	+28	3.12 MB	secretlint-bot
npm/typescript@5.6.3	None	0	22.4 MB	typescript-bot
npm/yargs@17.7.2	environment, filesystem	+15	635 kB	oss-bot

🚮 Removed packages: npm/@rushstack/eslint-plugin-security@0.8.3, npm/@semantic-release/changelog@6.0.3, npm/@semantic-release/commit-analyzer@13.0.0, npm/@semantic-release/error@4.0.0, npm/@semantic-release/exec@6.0.3, npm/@semantic-release/git@10.0.1, npm/@semantic-release/github@11.0.0, npm/@semantic-release/release-notes-generator@14.0.1, npm/@semrel-extra/topo@1.14.1, npm/@types/dockerode@3.3.31, npm/@types/ini@4.1.1, npm/@types/node@18.19.59, npm/@types/semantic-release__error@3.0.3, npm/@types/stream-buffers@3.0.7, npm/@visulima/fs@2.2.2, npm/@visulima/package@3.1.4, npm/@visulima/packem@1.1.1, npm/@visulima/path@1.1.1, npm/@vitest/coverage-v8@2.1.3, npm/@vitest/ui@2.1.3, npm/aggregate-error@5.0.0, npm/audit-ci@7.1.0, npm/blork@9.3.0, npm/browserslist-config-anolilab@5.0.14, npm/commitizen@4.3.1, npm/conventional-changelog-conventionalcommits@8.0.0, npm/cosmiconfig@9.0.0, npm/cross-env@7.0.3, npm/detect-newline@4.0.1, npm/dockerode@4.0.2, npm/esbuild@0.24.0, npm/eslint-plugin-deprecation@3.0.0, npm/eslint-plugin-editorconfig@4.0.3, npm/eslint-plugin-etc@2.0.3, npm/eslint-plugin-i@2.29.1, npm/eslint-plugin-mdx@3.1.5, npm/eslint-plugin-n@17.11.1, npm/eslint-plugin-vitest-globals@1.5.0, npm/eslint-plugin-vitest@0.4.1, npm/eslint-plugin-you-dont-need-lodash-underscore@6.14.0, npm/eslint@8.57.0, npm/execa@9.4.1, npm/file-url@4.0.0, npm/git-log-parser@1.2.1, npm/got@14.4.3

View full report↗︎

[socket-security]

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report↗︎