Update pnpm to v7.8.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pnpm (source)	7.4.1 -> 7.8.0

---

Release Notes

pnpm/pnpm

v7.8.0

Compare Source

Minor Changes

• When publishConfig.directory is set, only symlink it to other workspace projects if publishConfig.linkDirectory is set to true. Otherwise, only use it for publishing #​5115.

Patch Changes

• Don't incorrectly identify a lockfile out-of-date when the package has a publishConfig.directory field #​5124.
• Don't crash when a config file contains a setting with an env variable that doesn't exist #​5093.

Our Gold Sponsors

#### Our Silver Sponsors #### What's Changed * fix: don't incorrectly identify a lockfile out-of-date by @​zkochan in https://github.com/pnpm/pnpm/pull/5126 * feat: publishConfig.linkDirectory by @​zkochan in https://github.com/pnpm/pnpm/pull/5125 * fix: don't crash on a .npmrc with missing env var by @​zkochan in https://github.com/pnpm/pnpm/pull/5127 * chore: fix typo by @​LuciNyan in https://github.com/pnpm/pnpm/pull/5128 #### New Contributors * @​LuciNyan made their first contribution in https://github.com/pnpm/pnpm/pull/5128

Full Changelog: pnpm/pnpm@v7.7.1...v7.8.0

v7.7.1

Compare Source

Patch Changes

• pnpm should not consider a lockfile out-of-date if auto-install-peers is set to true and the peer dependency is in devDependencies or optionalDependencies #​5080.
• Don't incorrectly consider a lockfile out-of-date when workspace:^ or workspace:~ version specs are used in a workspace.

Our Gold Sponsors

#### Our Silver Sponsors #### What's Changed * fix: frozen install in a project with peer deps and `auto-install-peers=true` by @​zkochan in https://github.com/pnpm/pnpm/pull/5120 * fix: don't incorrectly consider a lockfile to be out-of-date by @​zkochan in https://github.com/pnpm/pnpm/pull/5121

Full Changelog: pnpm/pnpm@v7.7.0...v7.7.1

v7.7.0

Compare Source

Minor Changes

• Add experimental lockfile format that should merge conflict less in the importers section. Enabled by setting the use-inline-specifiers-lockfile-format = true feature flag in .npmrc.

  If this feature flag is committed to a repo, we recommend setting the minimum allowed version of pnpm to this release in the package.json engines field. Once this is set, older pnpm versions will throw on invalid lockfile versions.

• Add publishDirectory field to the lockfile and relink the project when it changes.

• verify-store-integrity=false makes pnpm skip checking the integrities of files in the global content-addressable store.

• Allow to set only-built-dependencies[] through .npmrc.

Patch Changes

• It should be possible to publish a package with local dependencies from a custom publish directory (set via publishConfig.directory) #​3901.
• pnpm deploy should inject local dependencies of all types (dependencies, optionalDependencies, devDependencies) #​5078.
• When a project in a workspace has a publishConfig.directory set, dependent projects should install the project from that directory #​3901
• pnpm deploy: accept absolute paths and use cwd instead of workspaceDir for deploy target directory #​4980.
• pnpm setup should update .zshrc in the right directory when a $ZDOTDIR is set.

Our Gold Sponsors

#### Our Silver Sponsors #### What's Changed * fix(deploy): inject all types of deps by @​zkochan in https://github.com/pnpm/pnpm/pull/5084 * fix(make-dedicated-lockfile): prepublishOnly script is automatically … by @​zkochan in https://github.com/pnpm/pnpm/pull/5083 * fix: symlink a workspace pkg correctly, when it has a custom publish dir by @​zkochan in https://github.com/pnpm/pnpm/pull/5089 * feat: add experimental use-inline-specifiers-lockfile-format by @​gluxon in https://github.com/pnpm/pnpm/pull/5091 * fix: plugin-commands-deploy use path resolve on deploy target dir by @​AWare in https://github.com/pnpm/pnpm/pull/5026 * fix: relink the project when its publish directory changes by @​zkochan in https://github.com/pnpm/pnpm/pull/5109 * fix: don't include specifiers field in new experimental lockfile format by @​zkochan in https://github.com/pnpm/pnpm/pull/5110 * feat: verify-store-integrity by @​zkochan in https://github.com/pnpm/pnpm/pull/5112 #### New Contributors * @​AWare made their first contribution in https://github.com/pnpm/pnpm/pull/5026

Full Changelog: pnpm/pnpm@v7.6.0...v7.7.0

v7.6.0

Compare Source

Minor Changes

• A new setting supported: prefer-symlinked-executables. When true, pnpm will create symlinks to executables in
  node_modules/.bin instead of command shims (but on POSIX systems only).

  This setting is true by default when node-linker is set to hoisted.

  Related issue: #​4782.

• When lockfile-include-tarball-url is set to true, every entry in pnpm-lock.yaml will contain the full URL to the package's tarball #​5054.

Patch Changes

• pnpm deploy should include all dependencies by default #​5035.

• Don't print warnings about file verifications. Just print info messages instead.

• pnpm publish --help should print the --recursive and --filter options #​5019.

• It should be possible to run exec/run/dlx with the --use-node-version option.

• pnpm deploy should not modify the lockfile #​5071

• pnpm deploy should not fail in CI #​5071

• When auto-install-peers is set to true, automatically install direct peer dependencies #​5028.

  So if your project the next manifest:

  {
    "dependencies": {
      "lodash": "^4.17.21"
    },
    "peerDependencies": {
      "react": "^18.2.0"
    }
  }

  pnpm will install both lodash and react as a regular dependencies.

Our Gold Sponsors

#### Our Silver Sponsors #### What's Changed * pnpm rebuild accepts --store-dir by @​chengcyber in https://github.com/pnpm/pnpm/pull/5036 * fix(deploy): include all deps by default by @​zkochan in https://github.com/pnpm/pnpm/pull/5040 * chore(deps): upgrade nock to v13 by @​mcmxcdev in https://github.com/pnpm/pnpm/pull/5043 * fix: log more info on HTTP error by @​zkochan in https://github.com/pnpm/pnpm/pull/4917 * fix: document the -r option by @​zkochan in https://github.com/pnpm/pnpm/pull/5044 * chore(deps): upgrade sinon to v14 by @​mcmxcdev in https://github.com/pnpm/pnpm/pull/5045 * fix(audit): add authentication to pnpm-audit by @​sled in https://github.com/pnpm/pnpm/pull/5053 * feat: prefer-symlinked-executables by @​zkochan in https://github.com/pnpm/pnpm/pull/5048 * chore: update pnpm-workspace.yaml by @​ayu14214 in https://github.com/pnpm/pnpm/pull/5060 * feat: add `lockfile-include-tarball-url` option by @​MBelniak in https://github.com/pnpm/pnpm/pull/5054 * fix: auto install root peer deps when auto-install-peers=true by @​zkochan in https://github.com/pnpm/pnpm/pull/5067 * fix(deploy): don't modify the lockfile and fail in CI by @​zkochan in https://github.com/pnpm/pnpm/pull/5074 #### New Contributors * @​mcmxcdev made their first contribution in https://github.com/pnpm/pnpm/pull/5043 * @​sled made their first contribution in https://github.com/pnpm/pnpm/pull/5053 * @​ayu14214 made their first contribution in https://github.com/pnpm/pnpm/pull/5060 * @​MBelniak made their first contribution in https://github.com/pnpm/pnpm/pull/5054

Full Changelog: pnpm/pnpm@v7.5.2...v7.6.0

v7.5.2

Compare Source

Patch Changes

• Don't print any info messages about .pnpmfile.cjs #​5027.
• Do not print a package with unchanged version in the installation summary #​5031.

Our Gold Sponsors

#### Our Silver Sponsors #### What's Changed * fix: summary reporting by @​zkochan in https://github.com/pnpm/pnpm/pull/5031 * fix: don't print info messages about .pnpmfile.cjs by @​zkochan in https://github.com/pnpm/pnpm/pull/5032

Full Changelog: pnpm/pnpm@v7.5.1...v7.5.2

v7.5.1

Compare Source

Patch Changes

• Don't symlink the autoinstalled peer dependencies to the root of node_modules #​4988.
• Avoid retaining a copy of the contents of files deleted during patching #​5003.
• Remove file reporter logging. Logged file is not useful #​4949.

Our Gold Sponsors

#### Our Silver Sponsors #### What's Changed * fix: don't symlink the autoinstalled peers to the root of node_modules by @​zkochan in https://github.com/pnpm/pnpm/pull/4998 * feat: use irreversible-delete in pnpm patch-commit by @​webstrand in https://github.com/pnpm/pnpm/pull/5008 * feat(file-reporter): remove file reporter by @​william2958 in https://github.com/pnpm/pnpm/pull/5012 #### New Contributors * @​webstrand made their first contribution in https://github.com/pnpm/pnpm/pull/5008 * @​william2958 made their first contribution in https://github.com/pnpm/pnpm/pull/5012

Full Changelog: pnpm/pnpm@v7.5.0...v7.5.1

v7.5.0

Compare Source

Minor Changes

• A new value rolling for option save-workspace-protocol. When selected, pnpm will save workspace versions using a rolling alias (e.g. "foo": "workspace:^") instead of pinning the current version number (e.g. "foo": "workspace:^1.0.0"). Usage example, in the root of your workspace, create a .npmrc with the following content:

  save-workspace-protocol=rolling
  

Patch Changes

• pnpm remove <pkg> should not fail in a workspace that has patches #​4954
• The hash of the patch file should be the same on both Windows and POSIX #​4961.
• pnpm env use should throw an error on a system that use the MUSL libc.

Our Gold Sponsors

#### Our Silver Sponsors #### What's Changed * fix(env): throw an error on a system that uses MUSL libc by @​zkochan in https://github.com/pnpm/pnpm/pull/4958 * feat: use workspace spec alias by default in pnpm add by @​javier-garcia-meteologica in https://github.com/pnpm/pnpm/pull/4947 * fix(patch): the hash of the patch file should be the same on both Windows and POSIX by @​zkochan in https://github.com/pnpm/pnpm/pull/4969

Full Changelog: pnpm/pnpm@v7.4.1...v7.5.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by Mend Renovate. View repository job log here.