mirror of
https://gitea.com/gitea/docs.git
synced 2026-09-17 19:55:34 +00:00
main
100
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Renovate Bot
|
627c52b40b |
chore(deps): update dependencies (#537)
Co-authored-by: Renovate Bot <[email protected]> |
||
|
|
e419d360c3 |
chore(deps): update dependencies (#527)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`7.2.0` → `7.2.3`](https://renovatebot.com/diffs/npm/astro/7.2.0/7.2.3) |  |  | | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | [`11.20.0` → `11.22.0`](https://renovatebot.com/diffs/npm/pnpm/11.20.0/11.22.0) |  |  | | [sharp](https://sharp.pixelplumbing.com) ([source](https://github.com/lovell/sharp), [changelog](https://github.com/lovell/sharp/blob/main/docs/src/content/docs/changelog.md)) | [`0.35.0` → `0.35.3`](https://renovatebot.com/diffs/npm/sharp/0.35.0/0.35.3) |  |  | | [starlight-openapi](https://github.com/HiDeoo/starlight-openapi) ([source](https://github.com/HiDeoo/starlight-openapi/tree/HEAD/packages/starlight-openapi)) | [`0.26.0` → `0.26.1`](https://renovatebot.com/diffs/npm/starlight-openapi/0.26.0/0.26.1) |  |  | | [tinyglobby](https://superchupu.dev/tinyglobby) ([source](https://github.com/SuperchupuDev/tinyglobby)) | [`0.2.15` → `0.2.17`](https://renovatebot.com/diffs/npm/tinyglobby/0.2.15/0.2.17) |  |  | | [typescript](https://www.typescriptlang.org/) ([source](https://github.com/microsoft/TypeScript)) | [`^5.9.3` → `^7.0.0`](https://renovatebot.com/diffs/npm/typescript/5.9.3/7.0.2) |  |  | --- ### Release Notes <details> <summary>withastro/astro (astro)</summary> ### [`v7.2.3`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#723) [Compare Source](https://github.com/withastro/astro/compare/[email protected]@7.2.3) ##### Patch Changes - [#​17724](https://github.com/withastro/astro/pull/17724) [`97140b2`](https://github.com/withastro/astro/commit/97140b23f4f8d5dae1b2bfe6c69bd602e262eee9) Thanks [@​ematipico](https://github.com/ematipico)! - Fixes an issue where Astro could run out of memory when `experimental.collectionStorage` is set to `chunked` and there are multiple concurrent updates to the same collection. - [#​17636](https://github.com/withastro/astro/pull/17636) [`51723b1`](https://github.com/withastro/astro/commit/51723b100a37d6dd6df793957d35d9216e872cef) Thanks [@​matthewp](https://github.com/matthewp)! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change - [#​17636](https://github.com/withastro/astro/pull/17636) [`51723b1`](https://github.com/withastro/astro/commit/51723b100a37d6dd6df793957d35d9216e872cef) Thanks [@​matthewp](https://github.com/matthewp)! - Fixes the composable request helpers (`astro/fetch`) throwing an error when used on a request that had been rewritten with `Astro.rewrite()` or `next()` - [#​17636](https://github.com/withastro/astro/pull/17636) [`51723b1`](https://github.com/withastro/astro/commit/51723b100a37d6dd6df793957d35d9216e872cef) Thanks [@​matthewp](https://github.com/matthewp)! - Refactors Astro's internal server-side request handling. This is an internal change: all documented public APIs, including `App` and `NodeApp`, keep their existing signatures and behavior. The undocumented internal `app.pipeline` property and the `AppPipeline` export from `astro/app` have been removed. Adapters that used `app.pipeline.getLogger()` to wait for the configured log destination can call the new `app.getLogger()` instead. As a result of this refactor, `new FetchState(request)` from `astro/fetch` now works anywhere inside a built Astro server — including custom `src/fetch.ts` entrypoints — without the request needing to first pass through `app.render()`. Previously this threw an error, breaking patterns like the Cloudflare adapter's advanced custom-worker setup. - [#​17723](https://github.com/withastro/astro/pull/17723) [`c3b9aed`](https://github.com/withastro/astro/commit/c3b9aed88d9a9b21015bab5cc6de95d1663869cf) Thanks [@​florian-lefebvre](https://github.com/florian-lefebvre)! - Fixes a link in font providers JSDoc annotations - [#​17699](https://github.com/withastro/astro/pull/17699) [`e28d227`](https://github.com/withastro/astro/commit/e28d22782bdc641261d0eca8ad00ba248a93d640) Thanks [@​ArmandPhilippot](https://github.com/ArmandPhilippot)! - Fixes several documentation issues related to the JSDoc for configuration options. - When hovering over the `server` and `fonts` options, the JSDoc for the nested options was displayed instead of the JSDoc for the top-level property. - Two i18n configuration options were being used incorrectly in the examples. - The indentation of some code blocks was broken on hover. - [#​17572](https://github.com/withastro/astro/pull/17572) [`2066f39`](https://github.com/withastro/astro/commit/2066f39c60707a100531b4ef4bb5dab8feafa7f2) Thanks [@​matthewp](https://github.com/matthewp)! - Fixes a crash when a request arrives with a malformed port in the `Host` header (for example `example.com:65536` or `example.com:8080:8080`). Such a host made the constructed request URL invalid, and the fallback that was meant to recover reused the same invalid host and threw again. The request URL now degrades to a host the server controls when the incoming host cannot be parsed, so the request is handled instead of erroring. - [#​17685](https://github.com/withastro/astro/pull/17685) [`9f15609`](https://github.com/withastro/astro/commit/9f156094ca89d1474fbf1c471354dc94e69398a9) Thanks [@​astrobot-houston](https://github.com/astrobot-houston)! - Fixes a dev server error where an SSR full reload triggered by a third-party Vite plugin (such as `@tailwindcss/vite`) could fail with `Failed to load url astro:server-app.js` - [#​17636](https://github.com/withastro/astro/pull/17636) [`51723b1`](https://github.com/withastro/astro/commit/51723b100a37d6dd6df793957d35d9216e872cef) Thanks [@​matthewp](https://github.com/matthewp)! - Improves error handling for custom log destinations. When the configured logger fails to load, Astro now reports the error and continues with the default console logger instead of failing the first request. - [#​17631](https://github.com/withastro/astro/pull/17631) [`cf29bec`](https://github.com/withastro/astro/commit/cf29bec66124bc7059ffe7013df040860bd197c5) Thanks [@​matthewp](https://github.com/matthewp)! - Fixes `getCollection()` and `getEntry()` throwing `DataCloneError` when a collection schema transform returns a `Temporal.PlainDate` or other class instance. - Updated dependencies \[[`8c193f6`](https://github.com/withastro/astro/commit/8c193f67cce77cf2e41fb702c88ca46f788f1277)]: - [@​astrojs/internal-helpers](https://github.com/astrojs/internal-helpers)@​0.10.3 - [@​astrojs/markdown-remark](https://github.com/astrojs/markdown-remark)@​7.2.3 - [@​astrojs/markdown-satteri](https://github.com/astrojs/markdown-satteri)@​0.3.6 ### [`v7.2.2`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#722) [Compare Source](https://github.com/withastro/astro/compare/[email protected]@7.2.2) ##### Patch Changes - [#​17611](https://github.com/withastro/astro/pull/17611) [`9bc3207`](https://github.com/withastro/astro/commit/9bc3207fdbcdf8991596d0caeb66b707405aad07) Thanks [@​thelazylamaGit](https://github.com/thelazylamaGit)! - Fixes component styles rendered from content entries remaining stale until a second save when an adapter uses Astro's fallback development environment - [#​17634](https://github.com/withastro/astro/pull/17634) [`2267eee`](https://github.com/withastro/astro/commit/2267eeec7e88a47013465682d5278d7ea9253e5b) Thanks [@​astrobot-houston](https://github.com/astrobot-houston)! - Fixes incremental builds dropping optimized images for cached pages when using a `collectStaticImages` prerenderer (e.g. `@astrojs/cloudflare` with compile-time image optimization) - [#​17650](https://github.com/withastro/astro/pull/17650) [`4cdf128`](https://github.com/withastro/astro/commit/4cdf12873970dc542a18188fca1a9289ca1b0368) Thanks [@​astrobot-houston](https://github.com/astrobot-houston)! - Fixes intermittent `ImageNotFound` errors during build on projects with many images. The build now limits concurrent image file reads to avoid exhausting OS file descriptors (EMFILE) and retries transient I/O errors with backoff. Non-transient errors are no longer silently swallowed. - [#​17683](https://github.com/withastro/astro/pull/17683) [`2378221`](https://github.com/withastro/astro/commit/23782215a3f49d205b3576280e788d7c714c6d0f) Thanks [@​astrobot-houston](https://github.com/astrobot-houston)! - Fixes `prerenderConflictBehavior` not applying to content collection duplicate ID warnings in the `glob()` and `file()` loaders. Setting it to `'error'` now throws during content sync, and `'ignore'` suppresses the warning. - [#​17659](https://github.com/withastro/astro/pull/17659) [`90c6ea4`](https://github.com/withastro/astro/commit/90c6ea4641e2ca9362c4ab0ea7a8590d07bd1868) Thanks [@​astrobot-houston](https://github.com/astrobot-houston)! - Fixes the Fonts API breaking `experimental.incrementalBuild` caching by embedding a build-local, randomly-assigned server port in generated code used for the dependency hash - [#​17630](https://github.com/withastro/astro/pull/17630) [`fd1d9ee`](https://github.com/withastro/astro/commit/fd1d9ee3f4a9c196153090d0523668febb1b6024) Thanks [@​ericclemmons](https://github.com/ericclemmons)! - Fixes incremental builds becoming prohibitively slow for sites with many pages or content entries that share a large dependency graph. - [#​17690](https://github.com/withastro/astro/pull/17690) [`93beecc`](https://github.com/withastro/astro/commit/93beeccc518d19caee01b0fa72f7e6244cb9288c) Thanks [@​NgoQuocViet2001](https://github.com/NgoQuocViet2001)! - Prevents files in directories whose names start with `pages` from being treated as page routes - [#​17671](https://github.com/withastro/astro/pull/17671) [`09f0dc7`](https://github.com/withastro/astro/commit/09f0dc7f90ef92f8520e13b7ba130e4b8aad31bd) Thanks [@​tarikermis](https://github.com/tarikermis)! - Fixes `astro dev` refusing to start after a Docker container restart when an unrelated process reuses the PID from a persisted lock file. Astro now checks the process command across platforms, so stale lock files are cleaned up and `--force` does not signal the unrelated process. ### [`v7.2.1`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#721) [Compare Source](https://github.com/withastro/astro/compare/[email protected]@7.2.1) ##### Patch Changes - [#​17612](https://github.com/withastro/astro/pull/17612) [`7133730`](https://github.com/withastro/astro/commit/71337304965425820e81cc27d54b95d23033c017) Thanks [@​thelazylamaGit](https://github.com/thelazylamaGit)! - Fixes CSS hot module replacement after navigating between pages with `ClientRouter` - [#​17628](https://github.com/withastro/astro/pull/17628) [`4ada248`](https://github.com/withastro/astro/commit/4ada24889fc1bcc1ee89f3f8e5c6bc4cbe87cce6) Thanks [@​astrobot-houston](https://github.com/astrobot-houston)! - Fixes a CSP violation when using both `security.csp` and `experimental.clientPrerender` with `data-astro-prefetch` links. The dynamically injected `<script type="speculationrules">` now uses a static `"source": "document"` approach with a CSS selector, producing a deterministic payload that is hashed and included in the CSP `script-src` directive at build time. - [#​17605](https://github.com/withastro/astro/pull/17605) [`89e4647`](https://github.com/withastro/astro/commit/89e4647bed74e65a2fc1c60ccb5a7fc6b7bf3bc4) Thanks [@​ashleigh-yeoman](https://github.com/ashleigh-yeoman)! - Fixes middleware HMR not responding to changes in imported modules. Previously, only direct edits to the middleware file would trigger a reload. - [#​17582](https://github.com/withastro/astro/pull/17582) [`bd2c1a5`](https://github.com/withastro/astro/commit/bd2c1a5a70666cc140c73a77edb41882fc88b277) Thanks [@​astrobot-houston](https://github.com/astrobot-houston)! - Fixes a regression where content collection `reference()` fields silently accepted entry IDs that don't exist, such as an ID that doesn't match a loader's slugified version of it. Astro now logs an error for references that point to a missing entry after all loaders finish syncing. - [#​17661](https://github.com/withastro/astro/pull/17661) [`97b0cc7`](https://github.com/withastro/astro/commit/97b0cc79c586bb1fc2ce2ffe4c420f3cf2db769e) Thanks [@​ArmandPhilippot](https://github.com/ArmandPhilippot)! - Improves Markdown options documentation with links to the Markdown guide and official processors. - [#​17349](https://github.com/withastro/astro/pull/17349) [`4328c73`](https://github.com/withastro/astro/commit/4328c736b18d36576429186445c8c89e8cd0d4b6) Thanks [@​astrobot-houston](https://github.com/astrobot-houston)! - Fixes an issue where requests handled by the dev prerender environment (e.g. `/_image` with `@astrojs/cloudflare`'s `prerenderEnvironment: 'node'`) returned a 500 when a prerendered catch-all route existed, because non-prerendered route modules were imported in an environment where their runtime-specific APIs are unavailable - [#​17603](https://github.com/withastro/astro/pull/17603) [`722eed6`](https://github.com/withastro/astro/commit/722eed64c4ec878a4778ab312599733b325b21ca) Thanks [@​astrobot-houston](https://github.com/astrobot-houston)! - Fixes `<video>` and `<audio>` elements being non-functional after navigating via view transitions (`<ClientRouter />`) - [#​17616](https://github.com/withastro/astro/pull/17616) [`3a890d2`](https://github.com/withastro/astro/commit/3a890d226482e98c41650fb66c0c14d45eba2717) Thanks [@​lazerg](https://github.com/lazerg)! - Fixes `experimental.incrementalBuild` re-rendering unchanged routes that import more than one asset. The route's dependency hash depended on the order the assets finished building, so two builds of identical sources could produce different hashes. The hash is now based on the file name each asset resolves to. - [#​17547](https://github.com/withastro/astro/pull/17547) [`fba468c`](https://github.com/withastro/astro/commit/fba468c228d8661d2383a80c74206075201a187b) Thanks [@​dmgawel](https://github.com/dmgawel)! - Improves `getCollection()` and `getEntry()` performance for entries without local image references - [#​17602](https://github.com/withastro/astro/pull/17602) [`16e0d9d`](https://github.com/withastro/astro/commit/16e0d9d5c1b289242d317887e8334506627f2233) Thanks [@​astrobot-houston](https://github.com/astrobot-houston)! - Fixes a build error caused by hash collisions in generated content collection image import identifiers </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.22.0`](https://github.com/pnpm/pnpm/releases/tag/v11.22.0): pnpm 11.22 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.21.0...v11.22.0) #### Minor Changes - Added `pnpm cache path`, which prints the directory pnpm uses for its metadata cache. CI setups can use it to cache that directory — including the lockfile verification log, which lets a job skip re-checking an unchanged lockfile against the configured supply-chain policies. - `--config.config-dir` no longer reaches the config through a project's `pnpm-workspace.yaml`, and neither do the `--config.` spellings of the other settings a project manifest may no longer contribute (`--config.pnpm-home-dir`, `--config.workspace-dir`, `--config.global-pkg-dir`, `--config.root-project-manifest-dir`). None of them was ever a supported way to set those directories: pnpm resolves them from the environment, and these flags took effect only because the project-manifest merge re-applied the command line afterwards. The dedicated flags, such as `--dir` and `--global-dir`, are unaffected [#​13629](https://github.com/pnpm/pnpm/issues/13629). - `pnpm config set` refuses to write a setting to a project's `pnpm-workspace.yaml` that pnpm does not read from there, rather than leaving a key in the file that does nothing. Those settings are `configDir`, `pnpmHomeDir`, `stateDir` and the others that name machine-level state. The command fails with `ERR_PNPM_CONFIG_SET_NOT_A_PROJECT_SETTING`, naming where the setting does belong when it belongs somewhere. `pnpm config delete` still clears one that a file already carries, in whichever spelling it uses [#​13629](https://github.com/pnpm/pnpm/issues/13629). - Added a new setting `minimumReleaseAgeExcludePrune`. When enabled, `pnpm add`, `pnpm update`, and `pnpm remove` prune the entries of `minimumReleaseAgeExclude` in `pnpm-workspace.yaml` that the freshly written lockfile no longer resolves: versions that are gone are dropped (an entry is removed once none of its versions remain), and entries for packages that are no longer in the lockfile are removed too. Name patterns (`@scope/*`) are always kept. The cleanup is skipped when the install's lockfile does not cover the whole workspace (`sharedWorkspaceLockfile: false`), since entries another project still needs would look stale. Renamed `cleanupUnusedCatalogs` to `catalogPrune`, so that catalog pruning and release-age exclude pruning use one vocabulary. `cleanupUnusedCatalogs` continues to work; when both are set, `catalogPrune` wins. - A project's `pnpm-workspace.yaml` can no longer choose where pnpm keeps its credentials, its own installation, or the registry it downloads its next version from. One of those settings is `configDir`, which decided where `pnpm login` writes the granted token. `bin`, `dir`, `globalBinDir`, `globalDir`, `npmrcAuthFile`, `pnpmHomeDir`, `stateDir`, `userconfig` and `workspaceDir` are ignored there now too, and pnpm warns about the ones it finds. `cacheDir` and `storeDir` are unaffected [#​13629](https://github.com/pnpm/pnpm/issues/13629). - Resolving a Node.js runtime version (`devEngines.runtime` / `runtime:` specifiers) is now much faster: the per-version release metadata is cached in the pnpm cache directory after its signature is verified, and an exact stable version such as `runtime:22.23.2` no longer downloads the Node.js release index. A pinned runtime whose metadata was fetched once resolves without any network access, which removes the noticeable delay on the first `node` invocation in a project pinning an already-downloaded runtime [#​13899](https://github.com/pnpm/pnpm/issues/13899). #### Patch Changes - Fixed intermittent `ERR_PNPM_ENOENT` and `ERR_PNPM_ENOTEMPTY` errors while renaming `_tmp_*` directories during installation with `nodeLinker: hoisted`, in workspaces that also use `patchedDependencies`. - `pnpm add` no longer re-resolves the dependency graph when `pnpm-lock.yaml` already holds a version satisfying the request — promoting a transitive dependency to a direct one, or adding to a second workspace package what a first one already depends on, now only saves the dependency in `package.json` and records its importer entry. A satisfying locked version is necessary but not sufficient: the install still falls back to a full resolution for a dist tag, an alias, a `workspace:`/`catalog:`/git/tarball specifier, `--save-peer`, an overridden package, a `catalogMode` other than `manual`, and — under `resolutionMode: time-based` or `lowest-direct`, which resolve a direct dependency to the low end of its range — a range several locked versions satisfy. - Global installs now switch over atomically. The command shims in the global bin directory point at a stable per-package link rather than at the directory a particular install produced, so `pnpm add -g` and `pnpm update -g` activate a new version by moving that one link instead of rewriting every shim. A command can no longer be missing from `PATH` while an install is in progress, and a failed install leaves the previous version in place. - `pnpm audit --fix` and `pnpm audit --fix update` no longer add `minimumReleaseAgeExclude` entries for patched versions that were published before the `minimumReleaseAge` cutoff. The publish time of each minimum patched version is now checked against the registry metadata, and only versions young enough to be blocked by the age gate get an exclusion entry [#​11563](https://github.com/pnpm/pnpm/issues/11563). - `pnpm add <pkg>@​<version>` and `pnpm update <pkg>@​<version>` under a non-manual `catalogMode` now move the catalog entry's resolution to the requested version. Previously, when the catalog entry was a range that covered the requested version but resolved to a different one, the request was dropped silently: nothing was installed, nothing was written, and no error was raised. - A project that wasn't part of an install that moved a catalog entry now follows the entry the next time it is installed. It used to keep the version the entry resolved to before — a version the entry no longer allowed — and no later install corrected it, so one catalog entry ended up resolved to two versions. - `pnpm add <pkg>@​<version>` and `pnpm update <pkg>@​<version>` under `catalogMode: strict` no longer fail with `ERR_PNPM_CATALOG_VERSION_MISMATCH` when the catalog entry is a range that the wanted version satisfies. The dependency keeps using the catalog; only a version that really falls outside the catalog's range is rejected [#​13715](https://github.com/pnpm/pnpm/issues/13715). - A changed `catalogs` or `pnpm.overrides` block no longer has to be the only change for `pnpm install` to update the lockfile in place. Editing an override while also removing a dependency, or changing a catalog entry in the same commit as a range bump, is now absorbed in one pass instead of re-resolving the whole dependency graph [#​13799](https://github.com/pnpm/pnpm/issues/13799). Fixed the lockfile an in-place override update wrote when the overridden package was also a catalog entry: the entry kept the version it had before the override moved the package. The same could happen in reverse, when a catalog entry moved a package an override pins. Both cases now re-resolve instead. - `pnpm install` now updates the lockfile in place even when several kinds of changes happened since the last install — for example a removed dependency together with a widened `ignoredOptionalDependencies` list, or a dependency edit alongside a patch or settings change. Previously any combination of changes forced a full re-resolution [#​13763](https://github.com/pnpm/pnpm/issues/13763). - `pnpm deploy` injects workspace dependencies again, so the deploy directory is self-contained instead of symlinking back into the source workspace [#​13754](https://github.com/pnpm/pnpm/issues/13754). Enabling `injectWorkspacePackages` with `dedupeInjectedDeps` disabled now also rewrites already-linked workspace dependencies to injected copies. - `pnpm deploy --no-optional` no longer writes a lockfile whose snapshots reference optional dependencies that the deploy excluded. - Removing the last dependency that references a catalog entry via the fast lockfile update no longer leaves the stale catalog entry in `pnpm-lock.yaml`. - A git dependency whose clone (or shallow fetch) fails now reports which package it belongs to, under the `ERR_PNPM_GIT_FETCH_FAILED` code, with credentials in the repository URL redacted. When the lockfile records an SSH remote, the error also explains that fetching it needs an SSH key for that host, and that a lockfile entry written before pnpm v11.21 can be re-recorded over HTTPS with `pnpm update <package>` [#​13743](https://github.com/pnpm/pnpm/issues/13743). - An `integrity` recorded on a git dependency's resolution (`resolution: {type: git, repo, commit, integrity: sha512-…}`) is no longer treated as a checksum. pnpm never verifies a git checkout against such a hash — the commit pins the content — so it is now dropped when the lockfile is rewritten, and `pnpm sbom` no longer republishes it as a CycloneDX/SPDX checksum. Lockfiles carrying one also load again instead of failing with `ERR_PNPM_BROKEN_LOCKFILE` [#​13042](https://github.com/pnpm/pnpm/issues/13042). `pnpm sbom` now also publishes the checksum of a `type: binary` runtime archive, which pnpm does verify. - A git dependency whose `git ls-remote` fails now reports the `ERR_PNPM_GIT_RESOLVE_FAILED` code, naming the dependency instead of printing a bare `git` invocation, with credentials in the repository URL redacted. A specifier that does not ask for SSH resolves over HTTPS, because the URL recorded in the lockfile has to work on every machine that installs it, so the error explains how to substitute the transport on a machine that can only reach the host over SSH (`git config --global url."git@<host>:".insteadOf "https://<host>/"`) [#​13743](https://github.com/pnpm/pnpm/issues/13743). A missing `git` executable is reported as one, instead of surfacing the raw failure to start the process. Credentials embedded in a git specifier are redacted from the "Could not resolve \<ref> to a commit of \<repo>" errors too. Resolving a public repository makes one `git ls-remote` round-trip instead of two. - `pnpm install` after moving a dependency between `dependencies`, `devDependencies`, and `optionalDependencies` now updates the lockfile in place instead of re-resolving the whole dependency graph [#​13696](https://github.com/pnpm/pnpm/issues/13696). - `syncInjectedDepsAfterScripts` no longer fails with `ERR_PNPM_UNSUPPORTED_INODE_TYPE` when a workspace package contains an inode that is neither a file nor a directory, such as the FIFO 1Password's environments create for `.env`. Such an inode cannot be hardlinked into the injected copy, so it is skipped and the rest of the package still syncs [#​13550](https://github.com/pnpm/pnpm/issues/13550). `syncInjectedDepsAfterScripts` also no longer fails with `EEXIST` when a workspace package replaced a file with a directory of the same name since the injected copy was last synced. - `syncInjectedDepsAfterScripts` no longer fails with `ENOTDIR` when a workspace package replaced a directory with a file of the same name and the injected copy still held that directory's contents. - `syncInjectedDepsAfterScripts` now removes the bin link of a bin the script dropped. Previously only new bins were linked, so a build step that stopped declaring one left its shim behind, pointing at a command that was no longer there. - `syncInjectedDepsAfterScripts` now identifies a file by its device as well as its inode number. An inode number is only unique within one filesystem, so on its own it could match an unrelated file on another device and leave that path stale in the injected copy. - `pnpm store prune` no longer deletes the lockfile verification log. The log records which lockfile passed which supply-chain policies, so it stays valid across a prune of the store; keeping it lets the next install skip re-verifying an unchanged lockfile. - Widening a dependency's range no longer leaves the project on an older version. The lockfile update now points the project at the highest version of that dependency already in the lockfile that satisfies the new range — matching what a full resolution records — instead of keeping the locked version whenever it happened to satisfy, which could leave a duplicate behind. A range change that only an already-locked version satisfies is now also handled without re-resolving [#​13778](https://github.com/pnpm/pnpm/issues/13778). - `resolutionMode` is no longer ignored when `minimumReleaseAge` is in effect. `lowest-direct` and `time-based` pick the lowest satisfying version of a direct dependency again; previously any active release-age cutoff — including the built-in default — silently forced the highest, so `resolutionMode` only worked when `minimumReleaseAge: 0` was set explicitly [#​13752](https://github.com/pnpm/pnpm/issues/13752). - Adding a package to a workspace no longer forces a full re-resolution when every dependency it declares is already locked for a sibling. The lockfile update writes the new project's importer entry from the versions the lockfile already holds; a dependency no locked version satisfies still reaches the resolver [#​13696](https://github.com/pnpm/pnpm/issues/13696). - `pnpm config delete <key>` no longer fails with `ENOENT` when the config file it would edit does not exist. Clearing a setting that was never set is a no-op [#​13651](https://github.com/pnpm/pnpm/issues/13651). - Changing a `pnpm.overrides` entry to a version range now updates the lockfile in place when a version the lockfile already holds satisfies the range, instead of re-resolving the whole dependency graph. Only exact versions were handled before [#​13696](https://github.com/pnpm/pnpm/issues/13696). - Changing a parent-scoped `pnpm.overrides` entry (`"parent>child": "2.0.0"`) now updates the lockfile in place instead of re-resolving the whole dependency graph. Only the named parent's dependency moves; every other package keeps the version it had [#​13795](https://github.com/pnpm/pnpm/issues/13795). - Removing a dependency, or moving one to another already-locked version, no longer re-resolves the whole dependency graph just because some package resolves a peer with the same name. The lockfile update now compares the peer suffixes against the exact `name@version` the removal severed, so a suffix that names a different — still present — version of that dependency is left alone [#​13781](https://github.com/pnpm/pnpm/issues/13781). - Projects with a pnpmfile now use the fast lockfile update paths: an unchanged pnpmfile (proven by the recorded `pnpmfileChecksum`) no longer forces a full re-resolution for removals, dependency group moves, compatible range changes, and the other in-place lockfile rewrites [#​13696](https://github.com/pnpm/pnpm/issues/13696). - A lockfile entry whose resolution is unchanged no longer loses its recorded `deprecated` marker when a registry serves the package's metadata inconsistently — re-resolving to the same version keeps the deprecation instead of silently dropping the line [#​13846](https://github.com/pnpm/pnpm/issues/13846). - `pnpm prune` is now recursive by default inside a workspace, just like `pnpm install`. This fixes `pnpm prune --prod` in a workspace root emptying the `node_modules` directories of the other workspace projects, dropping the links to the workspace packages they depend on in production [#​13718](https://github.com/pnpm/pnpm/issues/13718). - A setting written in kebab-case in the global `config.yaml` is now reported instead of being silently ignored [#​13650](https://github.com/pnpm/pnpm/issues/13650). - `pnpm remove` no longer re-resolves the dependency graph. The removed dependency's entries are dropped from `pnpm-lock.yaml` and anything they made unreachable is pruned, without registry access. The install still falls back to a full resolution when a surviving package resolves a peer dependency through the removed one. - Removing a package from a workspace no longer forces a full re-resolution. The lockfile update drops the departed project's importer entry and prunes whatever only it depended on. A project that is still linked from a surviving project continues to be reported as an error [#​13696](https://github.com/pnpm/pnpm/issues/13696). - An install sharing a global virtual store no longer removes an incomplete package directory that another importer is still writing, which could fail with `failed to remove existing directory ... prior to swap: Directory not empty`. Such a directory is now repaired in place, and a package file left damaged by an interrupted install is restored instead of being kept. - `pnpm sbom` no longer emits components for optional platform-specific dependencies that cannot be installed on the current platform (for example, the native `@rolldown/binding-*` variants for other operating systems). Such packages are present in the lockfile but are never downloaded, so their license (and other metadata) could not be resolved and they appeared in the SBOM without one. `pnpm sbom --lockfile-only` still describes the whole lockfile graph, which is platform-independent by design. - An `ssh://` git dependency pointing at a bracketed IPv6 host, such as `ssh://[::1]/repo.git`, is resolved now. Its colons were read as an SCP-style path separator, which turned the address into `[:/1]` and left the specifier unresolvable. Applies to both the TypeScript CLI and pacquet. In the TypeScript CLI, an `ssh://` git dependency written without user info — `ssh://git.example.com/team/repo.git`, `git+ssh://git.example.com:2222/team/repo.git` — no longer fails with `TypeError: Cannot read properties of undefined (reading 'includes')`. Only the `user@host` form worked before. - `packageExtensions` is now validated when the configuration is read, so a malformed entry (for instance a dependency range set to `null`) fails with an actionable error instead of crashing later during peer dependency resolution [#​13756](https://github.com/pnpm/pnpm/issues/13756). - Projects using `resolutionMode: time-based` now benefit from the fast lockfile update paths. A removal, a dependency group move, or a compatible range change no longer forces a full re-resolution just because the lockfile carries a `time` field [#​13696](https://github.com/pnpm/pnpm/issues/13696). - An install that drops the last dependent of a patched package no longer updates the lockfile in place and succeeds silently. Removing a dependency, widening `ignoredOptionalDependencies`, or adding a removal override could each prune the package while the patch stayed configured; such an install now falls back to a full resolution, which reports the unused patch with `ERR_PNPM_UNUSED_PATCH`. Under `allowUnusedPatches`, where the lockfile update is kept, the same install now warns that the patch went unused instead of saying nothing [#​13827](https://github.com/pnpm/pnpm/issues/13827). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.21.0`](https://github.com/pnpm/pnpm/releases/tag/v11.21.0): pnpm 11.21 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.20.0...v11.21.0) #### Minor Changes - Added interactive group selection to `pnpm update --global --interactive`. - Running `pnpm setup`, `pnpm self-update`, or a command that modifies the global installation (such as `pnpm add --global`) through `sudo` now prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail with `ERR_PNPM_SUDO_NOT_SUPPORTED` in pnpm v12. Read-only global commands (such as `pnpm bin --global`) are unaffected. #### Patch Changes - Fixed pnpm failing to start under asynchronous Node.js module loaders when no `.pnpmfile.mjs` exists [pnpm/pnpm#11701](https://github.com/pnpm/pnpm/issues/11701). - Fixed `minimumReleaseAge` fallback for custom dist-tags so the selected version does not exceed the registry’s original tag target. - Removing a dependency from `package.json` and reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped from `pnpm-lock.yaml`, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune. - Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in `pnpm-lock.yaml` directly, reusing the same check the `pnpm.overrides` fast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions. - Fixed a CI regression where `github:owner/repo` dependencies (and other shorthand Git specifiers) would fail to install with `Permission denied (publickey)` on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. `git+ssh://` or `git@host:...`): - The repository visibility probe (an HTTP HEAD request) now retries transient failures such as `429 Too Many Requests`, so host throttling of CI runners is no longer mistaken for a private repository. - For non-SSH specifiers, anonymous HTTPS `git ls-remote` access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured. - When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL. - A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. `codeload.github.com`, which would fail to download for a private repository); it stays a regular `git` resolution so installs can use ambient Git credentials such as credential helpers and tokens. Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL. Fixes [pnpm/pnpm#13276](https://github.com/pnpm/pnpm/issues/13276). <!-- cspell:ignore publickey --> - `ng build` and `nuxt build` now work under the global virtual store: pnpm's built-in compatibility extensions add the `tslib` dependency that `@angular/build` uses without declaring and the `unplugin` dependency that `@nuxt/vite-builder` v4 uses without declaring. - Fixed `link:` dependencies under `enableGlobalVirtualStore` so linked children are materialized and slots remain isolated by their resolved link targets. - An install that skips resolution because `pnpm-lock.yaml` is already up to date now reacts fully to packages the lockfile removed — for example after pulling a lockfile in which a dependency was deleted. The hoist layer is recomputed, so a package that became hoistable when a direct dependency was removed is hoisted, and `pendingBuilds` entries for removed packages are dropped instead of staying pending forever. - The held-back-update warning printed by `pnpm update` no longer fires when `minimumReleaseAge` is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See [#​13071](https://github.com/pnpm/pnpm/issues/13071). - Checking whether `ignoredOptionalDependencies` is up to date no longer reorders the configured patterns. The check sorted them in place, which could move an `!` exclusion ahead of the pattern it excludes from and flip which optional dependencies were ignored. - Changing `autoInstallPeers`, `dedupePeers`, `peersSuffixMaxLength`, `excludeLinksFromLockfile`, or `injectWorkspacePackages` no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it: no package or project declares a peer dependency for the peer settings, and no project depends on a directory or on another workspace project for the link and injection settings. The new setting is recorded in `pnpm-lock.yaml` and the install proceeds from the existing resolution. Every other case still falls back to a full resolution. - Adding, editing, or removing an entry in `patchedDependencies` no longer re-resolves the dependency graph. Resolution never reads a patch — it only records the patch file's hash against the package it matches — so the install now rewrites the affected entries in `pnpm-lock.yaml` and materializes the patched package from the store instead. Installs still fall back to a full resolution when the patched package is reachable as a peer dependency, and when the new configuration would leave a patch unused while `allowUnusedPatches` is off, so `ERR_PNPM_UNUSED_PATCH` is still reported. - Resolving a private git repository no longer blocks on an interactive credential prompt: `git ls-remote` now fails fast with an authentication error when git has no credentials for the repository [#​13522](https://github.com/pnpm/pnpm/issues/13522). - Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same `ERR_PNPM_NO_OFFLINE_META` condition used by offline resolution. - POSIX shell shims now follow symbolic links before computing `basedir`, preventing execution failures when a shim is invoked via an external symlink on `PATH` [#​13405](https://github.com/pnpm/pnpm/issues/13405). - The automatic `packageManager` version switch works again on registries whose tarball URLs point at a different host than the registry itself (load-balanced feed proxies, Artifactory-style mirrors). Package-manager entries are now always recorded with integrity-only resolutions — the download URL is derived from the trusted bootstrap registry instead — and entries persisted in an invalid shape by an earlier pnpm are discarded and re-resolved instead of failing every command [#​13619](https://github.com/pnpm/pnpm/issues/13619). - Registries that serve no npm signature metadata (private mirrors and feed proxies commonly strip `dist.signatures`) no longer break the automatic `packageManager` version switch and `pnpm self-update` [#​13147](https://github.com/pnpm/pnpm/issues/13147). When the configured registry cannot provide a verifiable signature, pnpm now fetches the signature from `registry.npmjs.org` and verifies it against the same embedded npm keys over the installed integrity — which proves exactly the same thing. If no signature can be obtained from either source (for example, both are unreachable, or the registry publishes only a `shasum`), pnpm proceeds with a warning instead of failing, but only when the packages resolve through a registry configured in the user's own (non-project) configuration; the download stays pinned by the lockfile integrity, and a signature that exists but does not validate still fails the switch. - `pnpm fetch`, and any install run with `virtualStoreOnly`, no longer writes a `.pnp.cjs` loader under `nodeLinker: pnp`. These installs populate the virtual store without linking the project, so the loader would have claimed the project resolves out of a store it was never linked into. The importer links and `node_modules/.package-map.json` were already skipped; the PnP loader now follows the same rule. - Prevent pnpm from removing project files when `modulesDir` resolves to the project root. - Speed up installs after adding `ignoredOptionalDependencies` patterns by removing newly ignored optional dependencies and pruning packages that are no longer reachable without resolving the dependency graph again. - When a failed install re-copies a bin script from the store, rerunning `pnpm install` now reapplies the executable bit to the bin instead of leaving it non-executable [#​12742](https://github.com/pnpm/pnpm/issues/12742). - `pnpm root -g` and `pnpm bin -g` now print warnings to stderr instead of stdout, so their stdout stays a clean, machine-readable path. Previously, running either command with `--global` in a project that pins a package manager (e.g. via the `packageManager` field) printed a warning like `[WARN] Using --global skips the package manager check for this project` ahead of the path, breaking programs that capture the output as a path [#​13672](https://github.com/pnpm/pnpm/issues/13672). In pnpm 12, `pnpm root -g` and `pnpm prefix -g` are now supported (they previously failed with `ERR_PNPM_CLI_ROOT_GLOBAL_UNSUPPORTED` / `ERR_PNPM_CLI_PREFIX_GLOBAL_UNSUPPORTED`), and the reporter output of `dlx`, `create`, `config`, `sbom`, `with`, `store`, `prefix`, `root`, and `bin` goes to stderr, matching pnpm 11. - `pnpm setup` no longer makes Node.js print a `MODULE_TYPELESS_PACKAGE_JSON` warning about `dist/worker.js` on every command. The `package.json` it writes next to a standalone executable now declares `"type": "module"`. - `pnpm update` without saving no longer records a version that the manifest's range excludes. The kept range stays authoritative: a requested version outside it is skipped with a warning, and a requested range, a dist tag, or `--latest` resolves within it instead of past it. Previously each of these could write a lockfile entry that contradicted its own specifier, which the next `pnpm install --frozen-lockfile` rejected with `ERR_PNPM_OUTDATED_LOCKFILE` [#​12764](https://github.com/pnpm/pnpm/issues/12764). - `pnpm version -r --json` now outputs `[]` instead of human-readable text when no pending changes exist [`pnpm/pnpm#13217`](https://github.com/pnpm/pnpm/issues/13217). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> <details> <summary>lovell/sharp (sharp)</summary> ### [`v0.35.3`](https://github.com/lovell/sharp/releases/tag/v0.35.3) [Compare Source](https://github.com/lovell/sharp/compare/v0.35.2...v0.35.3) - Tighten verification of `text` dimensions, TIFF tile dimensions and `extend` values. - Improve code bundler support by resolving path to libvips binary. - Increase default concurrency when use of `MALLOC_ARENA_MAX` is detected. - Emit warning about binaries provided by Electron for use on Linux. - Add `hasAlpha` property to output `info`. [#​4500](https://github.com/lovell/sharp/issues/4500) - TypeScript: Return more precise `Buffer<ArrayBuffer>` from `toBuffer`. [#​4520](https://github.com/lovell/sharp/pull/4520) [@​Andarist](https://github.com/Andarist) - Bound `clahe` width and height to avoid signed overflow. [#​4551](https://github.com/lovell/sharp/pull/4551) [@​metsw24-max](https://github.com/metsw24-max) - Bound `trim` margin to avoid signed overflow. [#​4552](https://github.com/lovell/sharp/pull/4552) [@​metsw24-max](https://github.com/metsw24-max) - Reject infinite values when validating numbers. [#​4553](https://github.com/lovell/sharp/pull/4553) [@​metsw24-max](https://github.com/metsw24-max) - Bound extract region to libvips coordinate limit. [#​4555](https://github.com/lovell/sharp/pull/4555) [@​metsw24-max](https://github.com/metsw24-max) - Verify background colour values are numbers. [#​4556](https://github.com/lovell/sharp/pull/4556) [@​metsw24-max](https://github.com/metsw24-max) - Bound create and raw input dimensions to coordinate limit. [#​4558](https://github.com/lovell/sharp/pull/4558) [@​metsw24-max](https://github.com/metsw24-max) - Tighten recomb and affine matrix verification. [#​4560](https://github.com/lovell/sharp/pull/4560) [@​chatman-media](https://github.com/chatman-media) - Verify cache memory limit to avoid overflow. [#​4561](https://github.com/lovell/sharp/pull/4561) [@​metsw24-max](https://github.com/metsw24-max) ### [`v0.35.2`](https://github.com/lovell/sharp/releases/tag/v0.35.2) [Compare Source](https://github.com/lovell/sharp/compare/v0.35.1...v0.35.2) - TypeScript: Add `mediaType` to metadata response. [#​4492](https://github.com/lovell/sharp/issues/4492) - Improve WebAssembly fallback detection. [#​4513](https://github.com/lovell/sharp/issues/4513) - Improve code bundler support with stub binaries. [#​4543](https://github.com/lovell/sharp/issues/4543) - Verify GIF `effort` option is an integer. [#​4544](https://github.com/lovell/sharp/pull/4544) [@​metsw24-max](https://github.com/metsw24-max) - Verify `recomb` matrix entries are numbers. [#​4545](https://github.com/lovell/sharp/pull/4545) [@​metsw24-max](https://github.com/metsw24-max) - TypeScript: Replace namespace with named exports for ESM. [#​4546](https://github.com/lovell/sharp/issues/4546) - Bound dilate and erode width to avoid mask-size overflow. [#​4548](https://github.com/lovell/sharp/pull/4548) [@​metsw24-max](https://github.com/metsw24-max) - Verify `convolve` kernel values are numbers. [#​4549](https://github.com/lovell/sharp/pull/4549) [@​metsw24-max](https://github.com/metsw24-max) ### [`v0.35.1`](https://github.com/lovell/sharp/releases/tag/v0.35.1) [Compare Source](https://github.com/lovell/sharp/compare/v0.35.0...v0.35.1) - TypeScript: Ensure type definitions are published for both ESM and CJS. [#​4537](https://github.com/lovell/sharp/issues/4537) - WebAssembly: Ensure wrapper file is published. [#​4538](https://github.com/lovell/sharp/issues/4538) </details> <details> <summary>HiDeoo/starlight-openapi (starlight-openapi)</summary> ### [`v0.26.1`](https://github.com/HiDeoo/starlight-openapi/blob/HEAD/packages/starlight-openapi/CHANGELOG.md#0261) [Compare Source](https://github.com/HiDeoo/starlight-openapi/compare/[email protected]@0.26.1) ##### Patch Changes - [#​172](https://github.com/HiDeoo/starlight-openapi/pull/172) [`0e1a6f4`](https://github.com/HiDeoo/starlight-openapi/commit/0e1a6f4b798c9d6fd5d326b520c607d71905aeee) Thanks [@​HiDeoo](https://github.com/HiDeoo)! - Fixes a build issue for operations with multiple tags. </details> <details> <summary>SuperchupuDev/tinyglobby (tinyglobby)</summary> ### [`v0.2.17`](https://github.com/SuperchupuDev/tinyglobby/blob/HEAD/CHANGELOG.md#0217) [Compare Source](https://github.com/SuperchupuDev/tinyglobby/compare/0.2.16...0.2.17) ##### Changed - Enabled staged publishing for stronger supply-chain security ##### Fixed - Defaults when `undefined` is passed to any of the options by [chloeelim](https://github.com/chloeelim) - Drive-relative paths on Windows by [Andrej730](https://github.com/Andrej730) - `FileSystemAdapter` is now exported again ### [`v0.2.16`](https://github.com/SuperchupuDev/tinyglobby/blob/HEAD/CHANGELOG.md#0216) [Compare Source](https://github.com/SuperchupuDev/tinyglobby/compare/0.2.15...0.2.16) ##### Fixed - Upgraded `picomatch` to 4.0.4, mitigating any potential exposure to [CVE-2026-33671](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj) and [CVE-2026-33672](https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p) ##### Changed - Overhauled and optimized most internals by [Torathion](https://github.com/Torathion) - Ignore patterns are no longer compiled twice by [webpro](https://github.com/webpro) </details> <details> <summary>microsoft/TypeScript (typescript)</summary> ### [`v7.0.2`](https://github.com/microsoft/TypeScript/releases/tag/v7.0.2): TypeScript 7.0.2 [Compare Source](https://github.com/microsoft/TypeScript/compare/v6.0.3...v7.0.2) <https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/> This tag was originally released at: <https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2> ### [`v6.0.3`](https://github.com/microsoft/TypeScript/releases/tag/v6.0.3): TypeScript 6.0.3 [Compare Source](https://github.com/microsoft/TypeScript/compare/v6.0.2...v6.0.3) For release notes, check out the [release announcement blog post](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/). - [fixed issues query for TypeScript 6.0.0 (Beta)](https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.0%22). - [fixed issues query for TypeScript 6.0.1 (RC)](https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.1%22). - [fixed issues query for TypeScript 6.0.2 (Stable)](https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.2%22). - [fixed issues query for TypeScript 6.0.3 (Stable)](https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.3%22). Downloads are available on: - [npm](https://www.npmjs.com/package/typescript) ### [`v6.0.2`](https://github.com/microsoft/TypeScript/releases/tag/v6.0.2): TypeScript 6.0 [Compare Source](https://github.com/microsoft/TypeScript/compare/v5.9.3...v6.0.2) For release notes, check out the [release announcement blog post](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/). - [fixed issues query for TypeScript 6.0.0 (Beta)](https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.0%22). - [fixed issues query for TypeScript 6.0.1 (RC)](https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.1%22). - [fixed issues query for TypeScript 6.0.2 (Stable)](https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.2%22). Downloads are available on: - [npm](https://www.npmjs.com/package/typescript) </details> --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/527 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
1524b67c00 |
fix(deps): update dependency sharp to v0.35.0 [security] (#524)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [sharp](https://sharp.pixelplumbing.com) ([source](https://github.com/lovell/sharp), [changelog](https://github.com/lovell/sharp/blob/main/docs/src/content/docs/changelog.md)) | [`0.34.5` → `0.35.0`](https://renovatebot.com/diffs/npm/sharp/0.34.5/0.35.0) |  |  | --- ### sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 [GHSA-f88m-g3jw-g9cj](https://github.com/advisories/GHSA-f88m-g3jw-g9cj) <details> <summary>More information</summary> #### Details ##### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with versions of sharp prior to 0.35.0 are affected. ##### Patches ##### Using prebuilt binaries provided by sharp? Most people rely on the prebuilt binaries provided by sharp. Please upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3. ##### Using a globally-installed libvips? Please ensure you are using the latest libvips 8.18.3. ##### Workarounds Add the following to your code to prevent sharp from decoding GIF, TIFF and VIPS images. ```js sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] }); ``` #### Severity - CVSS Score: 7.0 / 10 (High) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/libvips/libvips/security/advisories/GHSA-2fcj-gj27-279x](https://github.com/libvips/libvips/security/advisories/GHSA-2fcj-gj27-279x) - [https://github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76](https://github.com/libvips/libvips/security/advisories/GHSA-523x-vhfw-6r76) - [https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm](https://github.com/libvips/libvips/security/advisories/GHSA-jmwm-wc68-mhwm) - [https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7](https://github.com/libvips/libvips/security/advisories/GHSA-r98w-4fp7-m9c7) - [https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj](https://github.com/lovell/sharp/security/advisories/GHSA-f88m-g3jw-g9cj) - [https://github.com/lovell/sharp](https://github.com/lovell/sharp) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>lovell/sharp (sharp)</summary> ### [`v0.35.0`](https://github.com/lovell/sharp/releases/tag/v0.35.0) [Compare Source](https://github.com/lovell/sharp/compare/v0.34.5...v0.35.0) - Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0. - Breaking: Remove `install` script from `package.json` file. Compiling from source is now opt-in via the `build` script. - Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based `iq` quality metrics. - Breaking: Add `limitInputChannels` with a default value of 5. - Breaking: Remove deprecated `failOnError` constructor property. - Breaking: Remove deprecated `paletteBitDepth` from `metadata` response. - Breaking: Remove deprecated properties from `sharpen` operation. - Breaking: Rename `format.jp2k` as `format.jp2` for API consistency. - Upgrade to libvips v8.18.3 for upstream bug fixes. - Remove experimental status from WebAssembly binaries. - Add prebuilt binaries for FreeBSD (WebAssembly). - Deprecate Windows 32-bit (win32-ia32) prebuilt binaries. - Ensure TIFF output `bitdepth` option is limited to 1, 2 or 4. - Add AVIF/HEIF `tune` option for control over quality metrics. [#​4227](https://github.com/lovell/sharp/issues/4227) - Add `keepGainMap` and `withGainMap` to process HDR JPEG images with embedded gain maps. [#​4314](https://github.com/lovell/sharp/issues/4314) - Add `toUint8Array` for output image as a `TypedArray` backed by a transferable `ArrayBuffer`. [#​4355](https://github.com/lovell/sharp/issues/4355) - Require prebuilt binaries using static paths to aid code bundling. [#​4380](https://github.com/lovell/sharp/issues/4380) - TypeScript: Ensure `FormatEnum` keys match reality. [#​4475](https://github.com/lovell/sharp/issues/4475) - Add `margin` option to `trim` operation. [#​4480](https://github.com/lovell/sharp/issues/4480) [@​eddienubes](https://github.com/eddienubes) - Ensure HEIF primary item is used as default page/frame. [#​4487](https://github.com/lovell/sharp/issues/4487) - Add image Media Type (MIME Type) to metadata response. [#​4492](https://github.com/lovell/sharp/issues/4492) - Add `withDensity` to set output density in EXIF metadata. [#​4496](https://github.com/lovell/sharp/issues/4496) - Improve `pkg-config` path discovery. [#​4504](https://github.com/lovell/sharp/issues/4504) - Add WebP `exact` option for control over transparent pixel colour values. - Add support for ECMAScript Modules (ESM). [#​4509](https://github.com/lovell/sharp/pull/4509) [@​florian-lefebvre](https://github.com/florian-lefebvre) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> <!-- cloudflare-preview --> Preview: https://pr-524.docs-gitea-com.pages.dev Reviewed-on: https://gitea.com/gitea/docs/pulls/524 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandLunny Xiao
|
0ab104854b |
chore(deps): update dependencies (#500)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | [@easyops-cn/docusaurus-search-local](https://github.com/easyops-cn/docusaurus-search-local) ([source](https://github.com/easyops-cn/docusaurus-search-local/tree/HEAD/packages/docusaurus-search-local)) | [`0.55.2` → `0.55.3`](https://renovatebot.com/diffs/npm/@easyops-cn%2fdocusaurus-search-local/0.55.2/0.55.3) |  |  | dependencies | patch | | | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | [`11.17.0` → `11.20.0`](https://renovatebot.com/diffs/npm/pnpm/11.17.0/11.20.0) |  |  | packageManager | minor | `11.21.0` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) ([changelog](https://github.com/pnpm/action-setup/compare/0ebf47130e4866e96fce0953f49152a61190b271..0977fd99725f1db4007ccb2928dbb4e90d06cc86)) | `0ebf471` → `0977fd9` | | | action | digest | | --- ### Release Notes <details> <summary>easyops-cn/docusaurus-search-local (@​easyops-cn/docusaurus-search-local)</summary> ### [`v0.55.3`](https://github.com/easyops-cn/docusaurus-search-local/releases/tag/v0.55.3) [Compare Source](https://github.com/easyops-cn/docusaurus-search-local/compare/v0.55.2...v0.55.3) ##### Bug Fixes - trigger a release for refining search icon for [#​577](https://github.com/easyops-cn/docusaurus-search-local/issues/577) ([9a7eb91](https://github.com/easyops-cn/docusaurus-search-local/commit/9a7eb91393f389838cc31f45e4f4737dc4bb325e)) </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.20.0`](https://github.com/pnpm/pnpm/releases/tag/v11.20.0): pnpm 11.20 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.19.0...v11.20.0) #### Minor Changes - **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. Packages resolved from a named registry are now recorded under registry-qualified keys (`<name>@​<registryName>:<version>`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. ##### If you use named registries Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it. There is no setting to keep the old behavior: the old shape is the vulnerability. Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the `namedRegistries` setting on demand. To use named registries, map your aliases in `pnpm-workspace.yaml`: ```yaml namedRegistries: work: https://npm.enterprise.example.com/ ``` ##### New built-in `npmjs:` alias `npmjs:` now resolves to `https://registry.npmjs.org/` with no configuration, alongside the existing `gh:` alias for GitHub Packages. It pins a dependency to the public registry even when `registry` points elsewhere, such as an internal proxy: ```json { "dependencies": { "left-pad": "npmjs:^1.3.0" } } ``` `npm:` cannot do this — it is the alias protocol (`npm:<name>@​<range>`) and resolves through whatever `registry` points at. **If you mirror or proxy npmjs, point the alias at your mirror:** ```yaml namedRegistries: npmjs: https://npm.internal.example.com/ ``` Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on `registry.npmjs.org` is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, `minimumReleaseAge`, or `trustPolicy` check runs. Overriding the alias is the same escape hatch GHES users already have for `gh`. Every alias the lockfile references must stay in `namedRegistries`: reading an entry whose alias is gone fails with `ERR_PNPM_MISSING_NAMED_REGISTRY` rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it. Named registry aliases that shadow a reserved dependency specifier prefix (`file`, `link`, `workspace`, `runtime`, `npm`, `jsr`, ...) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed by the corresponding resolver. `pnpm licenses` and `pnpm sbom` now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl `repository_url` qualifier. #### Patch Changes - An empty `http-proxy`, `https-proxy`, `proxy`, or `no-proxy` value — from the `.npmrc`, `pnpm-workspace.yaml`, the CLI, or the `HTTP_PROXY` / `HTTPS_PROXY` / `PROXY` / `NO_PROXY` environment variables — no longer fails the install with `ERR_PNPM_INVALID_PROXY`. Empty settings read as unset, so a shell exporting `HTTP_PROXY=` disables the proxy, and an empty `proxy=` in the `.npmrc` no longer suppresses `HTTPS_PROXY` [#​13533](https://github.com/pnpm/pnpm/issues/13533). `proxy=false` in the `.npmrc` or `proxy: false` in `pnpm-workspace.yaml` now turns proxying off instead of being read as a proxy host named `false`. `false` and `null` on `https-proxy` / `http-proxy` / `no-proxy` read as unset, and on the command line they are ordinary host names, since a flag carries its value verbatim. - The env lockfile no longer pins `@pnpm/exe` alongside `pnpm` when the wanted pnpm version is 12 or newer. From v12 the unscoped `pnpm` package is itself the native executable, so `@pnpm/exe` is not published for it and resolving it would fail. The engine identity check now verifies the native binary through whichever package ships it. - `lexCompare` and `nerfDart` are now published as `@pnpm/text.ordinal-comparator` and `@pnpm/config.registry-auth-key`. Use these instead of `@pnpm/util.lex-comparator` and `@pnpm/config.nerf-dart`. - Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs. - Dependency resolution is faster: package metadata is now filtered once per packument instead of once per dependency edge when `minimumReleaseAge` is active, and parsed semver versions and ranges are reused instead of re-parsed on every comparison. - Security: `pnpm rebuild` now refuses a lockfile whose `packages` key carries a path traversal in the package name (e.g. `../../../[email protected]`), instead of running that package's lifecycle scripts and linking its bins in a directory outside the virtual store. Such a name is rejected with `ERR_PNPM_INVALID_DEPENDENCY_NAME`. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.19.0`](https://github.com/pnpm/pnpm/releases/tag/v11.19.0): pnpm 11.19 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.18.0...v11.19.0) #### Minor Changes - `pnpm login` no longer requires an interactive terminal when the registry supports web-based login: without a TTY it prints the authentication URL (skipping the QR code and the "Press ENTER to open the URL in your browser" prompt) and polls the registry until the browser approval completes. Only the classic username/password login still fails with `ERR_PNPM_LOGIN_NON_INTERACTIVE` in a non-interactive terminal. - The `save-prefix` setting now accepts `=`: newly added dependencies are saved with an explicit `=` operator (`=1.2.3`) instead of the setting being silently treated as the default `^`. #### Patch Changes - `allowBuilds` entries can now approve git-hosted packages that pnpm downloads as a tarball, such as `github:` dependencies (which are fetched from `codeload.github.com` rather than cloned), by their repository URL without the resolved commit hash. This matches the hashless `git+` matching already supported for cloned git dependencies. For example: ```yaml allowBuilds: "foo@git+https://github.com/org/foo.git": true ``` This approves the package whether pnpm clones it or downloads a tarball, so the entry no longer has to be updated every time the pinned commit changes. GitLab and Bitbucket tarball downloads are matched the same way. Approving or denying a specific resolved commit by its full tarball dep path continues to work. - `pnpm outdated --include-github-actions` no longer blocks on an interactive git credential prompt when a workflow uses a private action repo. - Prevented `minimumReleaseAge` from replacing `latest` with a SemVer-greater version than the registry tag target [#​13034](https://github.com/pnpm/pnpm/issues/13034). - Fixed empty `bundledDependencies` and `bundleDependencies` arrays causing nondeterministic lockfile changes. See [#​13123](https://github.com/pnpm/pnpm/issues/13123). - The install summary no longer prints `(X is available)` when the registry's `dist-tags.latest` is still held back by the active `minimumReleaseAge` policy. The hint only ever names the actual latest tag, so an immature latest suppresses the hint instead of advertising the version pnpm just refused to install [#​11698](https://github.com/pnpm/pnpm/issues/11698). - `pnpm update` keeps the explicit `=` operator of an exact version pin: a dependency saved as `=3.5.1` now updates to `=3.5.2` instead of the bare `3.5.2`. See [#​13168](https://github.com/pnpm/pnpm/issues/13168). - Preserve a workspace dependency's `link:` entry when a run does not target it — e.g. `pnpm update <other-pkg>` (with or without `--recursive`), or a plain install after a root/catalog dependency change — with `injectWorkspacePackages`, instead of spuriously rewriting it to a peer-suffixed `file:` protocol. See [#​10433](https://github.com/pnpm/pnpm/issues/10433). - Workspace dependencies declared with a relative path (e.g. `"foo": "workspace:../foo"`) are no longer silently dropped from the workspace projects graph, so `--filter` selection and the topological order of recursive commands take them into account. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.18.0`](https://github.com/pnpm/pnpm/releases/tag/v11.18.0): pnpm 11.18 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.17.0...v11.18.0) #### Minor Changes - Fixed an installed optional dependency being left without one of its own required dependencies. When a package reached through `optionalDependencies` is installable on the current system but one of its regular `dependencies` is not, a lockfile-based install skipped that dependency and installed the parent anyway, so importing the parent failed with `MODULE_NOT_FOUND`. The dependency is now installed, and an install-check warning reports the incompatibility. A dependency is still only skipped when every path to it is optional, or when the package that pulls it in was itself skipped [#​13286](https://github.com/pnpm/pnpm/issues/13286). - `pnpm setup` now appends `PNPM_HOME` and the global bin directory to the GitHub Actions environment files (`GITHUB_ENV` and `GITHUB_PATH`), so later steps in the same job can run `pnpm add --global` and other global commands [#​9191](https://github.com/pnpm/pnpm/issues/9191). - Added support for `publishConfig.name`, which publishes a package under a different name than the one its manifest carries in the workspace. It is for a project whose published name is already taken by a sibling project, which otherwise has to be renamed by a build step just before publishing. Only the published artifact is renamed — dependents, `pnpm-lock.yaml`, and release tooling keep addressing the project by its manifest name — and the new name reaches the packed manifest, the tarball filename, and everything that addresses the package at the registry: the already-published check of `pnpm publish -r`, its registry selection, and the release-planning probes of `pnpm change status` and `pnpm version -r` [#​13345](https://github.com/pnpm/pnpm/issues/13345). - `pnpm self-update` no longer takes any instruction from the project it is run in: - pnpm is fetched through the same trusted registry and auth configuration used when switching pnpm versions, so a project `.npmrc` or `pnpm-workspace.yaml` can no longer redirect the download or attach credentials to it, and the project's default `.pnpmfile.(c|m)js` is no longer loaded. Pnpmfiles from trusted sources (the `pnpmfile` setting, the global pnpmfile, config dependencies) still apply. - The `minimumReleaseAge` settings in `pnpm-workspace.yaml` no longer affect `self-update`. They still govern the project's own dependencies; for `self-update` the cooldown now comes from the built-in default, your global config, a `PNPM_CONFIG_*` environment variable, or a command-line flag. This fixes `self-update` failing inside a workspace that raises the cutoff while succeeding everywhere else, and stops a repository from either waiving the cooldown or keeping you on an outdated pnpm by raising it. - The same applies to the `trustPolicy` settings and to `ci`: a project can no longer weaken the trust check that guards the pnpm download, nor re-enable the confirmation prompt that a CI run suppresses. When `self-update` refuses a version that is younger than the cutoff, an interactive run now offers to update anyway; non-interactive runs still fail. CI never prompts, even on a runner that attaches a TTY. #### Patch Changes - Fixed `pnpm licenses list` to report every version when the same package is installed under multiple aliases [pnpm/pnpm#13438](https://github.com/pnpm/pnpm/issues/13438). - Sort `pnpm dedupe --check` snapshot changes for stable output across pnpm implementations. - Strip Unicode formatting characters from registry- and manifest-derived terminal output. - Speed up installs after compatible catalog or direct dependency range changes by retaining the locked version without resolving the dependency graph again. - Speed up installs after safe override changes by reusing unambiguous compatible dependency resolutions, pruning obsolete dependencies, applying independent replacements and removals together, and handling parent-scoped `"-"` overrides without full lockfile resolution. - Installing a local `file:` directory dependency with the global virtual store enabled no longer fails with `TypeError: Cannot read properties of undefined (reading 'split')` [#​13335](https://github.com/pnpm/pnpm/issues/13335). Local directory dependencies — `file:` directories and injected workspace packages — now get a global-virtual-store slot of their own per project. They used to share one slot across every project that depended on a directory of the same name, so a project could end up linked to another project's copy of the dependency. - The `Workspace` column of `pnpm update --interactive` now falls back to the project's path when its `name` is only whitespace, as it already did for a missing or empty one — all three render an equally blank label otherwise. - Checking GitHub Actions dependencies for updates is now opt-in for every command. Neither `pnpm outdated` nor `pnpm update` reads the workflow files unless `--include-github-actions` is passed or `update.githubActions` is set to `true` in `pnpm-workspace.yaml`. Reading them runs `git ls-remote` against every referenced repository, which fails in environments where GitHub is not reachable the way pnpm assumes (a GitHub Enterprise Server, a custom certificate authority, or an offline network) [#​13254](https://github.com/pnpm/pnpm/issues/13254). `pnpm outdated` accepts the `--include-github-actions` option too. - `pnpm update --interactive` now measures its table in terminal columns rather than in characters. A package name, workspace name, or version containing wide characters (CJK, most emoji) no longer knocks its row's columns out of line with the rest of the group, and a wide character in a version no longer aborts the command with `Subject parameter value width cannot be greater than the container width` [#​13357](https://github.com/pnpm/pnpm/issues/13357). - The `Workspace` column of `pnpm update --interactive` is more informative in two cases. A dependency outdated at the same version in several workspace projects is offered as one choice, since selecting it updates every project — that choice now names all of them instead of only the first. And a workspace project without a `name` is now labelled with its path rather than left blank, so several unnamed projects can be told apart. - An auto-installed *optional* peer is no longer hoisted at a version the workspace root's own dependency on that package excludes. `resolvePeersFromWorkspaceRoot` already made the workspace root's specifier decide which version a missing *required* peer is installed at; the optional-peer picker ignored it and always took the highest version present anywhere in the graph. In a workspace whose root pins `postcss: 8.5.10`, an importer that depends on `webpack` and declares no `postcss` of its own got `[email protected]` hoisted for `terser-webpack-plugin`'s optional `postcss` peer, leaving two `[email protected]` instances in the graph [#​13320](https://github.com/pnpm/pnpm/issues/13320). - `overrides` now also govern peers that pnpm auto-installs. Previously an override only rewrote dependencies declared in a manifest, so a peer nobody declares — installed because `autoInstallPeers` is on — resolved against its declared peer range and could bring in a second copy of the very package the override pinned. For example, with `overrides: { react: npm:[email protected] }` and a lone `lucide-react` dependency, pnpm installed `[email protected]`; it now installs the pinned `[email protected]` [#​13320](https://github.com/pnpm/pnpm/issues/13320). - Under `resolvePeersFromWorkspaceRoot`, a workspace root dependency declared with `link:` or `file:` (or the path form of `workspace:`, such as `workspace:../pkg`) now satisfies another project's missing peer dependency at the linked package's own version, instead of being hoisted as a path. Those specifiers are relative to the project that declares them, so the same specifier reached a different directory — or none — from the project the peer was hoisted into, leaving a broken link. The root now has the same authority over the peer as it has when it declares the package with a version range [#​13373](https://github.com/pnpm/pnpm/issues/13373). - Installs through a pnpr server now apply the project's whole verification policy. `minimumReleaseAgeExclude`, `minimumReleaseAgeIgnoreMissingTime`, `trustPolicy`, `trustPolicyExclude`, `trustPolicyIgnoreAfter`, and `trustLockfile` were ignored, so excluded packages were still held back and a lockfile containing them could be rejected. `trustPolicy: no-downgrade` no longer fails with `TRUST_POLICY_INCOMPATIBLE_WITH_PNPR` when a pnpr server is configured. `--frozen-lockfile` and `--no-prefer-frozen-lockfile` are now honored on the pnpr path, instead of resolving and rewriting the lockfile anyway. Since `frozenLockfile` defaults to `true` on CI, a CI install through a pnpr server now fails on an out-of-date lockfile rather than updating it. - Workspace installs through a pnpr server no longer crash with `Cannot read properties of undefined (reading 'filter')` after linking, when `minimumReleaseAge` is active [#​13275](https://github.com/pnpm/pnpm/issues/13275). - Fixed `pnpm dedupe` updating valid catalog resolutions when another matching version exists in the lockfile. - `pnpm -r run "/pattern/" --no-bail` no longer exits zero when one of a project's matched scripts fails and a later one passes. The run summary carries a single status per project, and the passing script overwrote the recorded failure. - Restored the store block a first install prints, naming how packages were materialized and where the stores live [#​13315](https://github.com/pnpm/pnpm/issues/13315): ```text Packages are hard linked from the content-addressable store to the virtual store. Content-addressable store is at: ~/.local/share/pnpm/store/v11 Virtual store is at: node_modules/.pnpm ``` - The root project's `pnpm:devPreinstall` script now runs before resolution and linking, as it does in pnpm 11. It is skipped under `--ignore-scripts`, `--lockfile-only` and `--dry-run`, by `pnpm fetch` and `pnpm rebuild`, and by a repeat install that is already up to date. Workspaces that use the hook to prepare state the install depends on — such as [next.js](https://github.com/vercel/next.js), which generates a placeholder `next` bin with it — were left with dependents linked against files that were never created [#​13313](https://github.com/pnpm/pnpm/issues/13313). - Prevented `pnpm dedupe --check` from removing an incompatible `node_modules` directory. - `pnpm update --workspace` no longer links dependencies the user never named: - Running it with `updateConfig.ignoreDependencies` configured no longer fails with `ERR_PNPM_WORKSPACE_PACKAGE_NOT_FOUND` for a dependency that is only published to the registry. Such dependencies keep their specifiers, as they already did when no dependencies were ignored. - Passing package selectors that match no direct dependency no longer falls back to linking every workspace dependency. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> <!-- cloudflare-preview --> Preview: https://pr-500.docs-gitea-com.pages.dev --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/500 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandLunny Xiao
|
f8efe463a6 |
chore(deps): update pnpm to v11.17.0 (#483)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | [`11.15.1` → `11.17.0`](https://renovatebot.com/diffs/npm/pnpm/11.15.1/11.17.0) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.17.0`](https://github.com/pnpm/pnpm/releases/tag/v11.17.0): pnpm 11.17 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.16.0...v11.17.0) #### Minor Changes - Added a new setting, `update.githubActionsServer`, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the `GITHUB_SERVER_URL` environment variable, falling back to `https://github.com`. The URL must use the `https://` or `http://` protocol [#​13220](https://github.com/pnpm/pnpm/issues/13220). `pnpm outdated` and `pnpm update` no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning. Setting `update.githubActions` to `false` now makes `pnpm outdated` and the interactive `pnpm update` skip GitHub Actions dependencies. #### Patch Changes - The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll [pnpm/pnpm#12721](https://github.com/pnpm/pnpm/issues/12721). - Fixed `catalog:` references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '<name>' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g. `packages/foo`) through a pnpr server [#​13232](https://github.com/pnpm/pnpm/issues/13232). - Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#​13164](https://github.com/pnpm/pnpm/issues/13164). - Revert script ordering change for `pnpm run --sequential /regex/` - Support the `from-git` argument in the `pnpm version` command. - When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication [pnpm/pnpm#12721](https://github.com/pnpm/pnpm/issues/12721). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.16.0`](https://github.com/pnpm/pnpm/releases/tag/v11.16.0): pnpm 11.16 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.15.1...v11.16.0) #### Minor Changes - The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it. `pnpm version -r` and `pnpm change status` check the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at `1100.0.0` with a `minor` changeset is therefore published as `1100.0.0` rather than skipping straight to `1100.1.0`. - Added a `--changeset` flag to `pnpm update`. Set `update.changeset` to `true` in `pnpm-workspace.yaml` to enable this behavior by default, and use `--no-changeset` to override the setting for one update. After the update completes, pnpm writes a `.changeset/pnpm-update-<suffix>.md` file declaring a patch bump for every workspace package whose `dependencies` or `optionalDependencies` were changed by the update and a major bump when `peerDependencies` changed, including packages that consume an updated catalog entry via the `catalog:` protocol. Private packages, packages without a name, and packages listed in the `ignore` array of `.changeset/config.json` are skipped. If `.changeset/config.json` does not exist, a warning is printed and no changeset is generated. - Added GitHub Actions dependencies to `pnpm outdated` and interactive `pnpm update`. Non-interactive updates can include them with `--include-github-actions` or by setting `update.githubActions` to `true` in `pnpm-workspace.yaml`. Updated actions are pinned to exact commit hashes with their release tags preserved in comments. - Added `update` and `audit` settings sections to `pnpm-workspace.yaml`, superseding the awkwardly named `updateConfig`, `auditConfig`, and top-level `auditLevel` settings: ```yaml update: ignoreDeps: # was updateConfig.ignoreDependencies - webpack - "@​babel/*" audit: level: high # was auditLevel ignore: # was auditConfig.ignoreGhsas - GHSA-xxxx-yyyy-zzzz ``` `update.ignoreDeps` lists dependency name patterns that `pnpm update` and `pnpm outdated` should skip. `audit.level` and `audit.ignore` tune `pnpm audit`. The deprecated `updateConfig`, `auditConfig`, and `auditLevel` settings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections. #### Patch Changes - Fixed `pnpm add --save-exact`/`--save-prefix` and `pnpm update` writing a package's version with the `peerDependencies` range's prefix (e.g. `^19.2.7` instead of the requested `19.2.7`) whenever the same package also appeared in `peerDependencies`. A real `dependencies`/`devDependencies`/`optionalDependencies` entry now takes precedence over a same-named `peerDependencies` entry when computing the current specifiers [#​13108](https://github.com/pnpm/pnpm/issues/13108). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/483 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
9f3bb6cc19 |
chore(deps): pin dependencies (#475)
This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | pinDigest | → `3d3c42e` | | | | [actions/setup-node](https://github.com/actions/setup-node) | action | pinDigest | → `8207627` | | | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | action | pinDigest | → `e6de054` | | | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | action | pinDigest | → `0ebf471` | | | | [react](https://react.dev/) ([source](https://github.com/react/react/tree/HEAD/packages/react)) | dependencies | patch | [`19.2.7` → `19.2.8`](https://renovatebot.com/diffs/npm/react/19.2.7/19.2.8) |  |  | | [react-dom](https://react.dev/) ([source](https://github.com/react/react/tree/HEAD/packages/react-dom)) | dependencies | patch | [`19.2.7` → `19.2.8`](https://renovatebot.com/diffs/npm/react-dom/19.2.7/19.2.8) |  |  | --- ### Release Notes <details> <summary>react/react (react)</summary> ### [`v19.2.8`](https://github.com/react/react/releases/tag/v19.2.8): 19.2.8 (July 21st, 2026) [Compare Source](https://github.com/react/react/compare/v19.2.7...v19.2.8) #### React Server Components - Performance improvements when decoding ([#​37087](https://github.com/facebook/react/pull/37087) by [@​eps1lon](https://github.com/eps1lon)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/docs/pulls/475 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandLunny Xiao
|
56a8d295b4 |
fix(deps): update docusaurus monorepo to v3.10.2 - abandoned (#466)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@docusaurus/core](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus)) | [`3.10.1` → `3.10.2`](https://renovatebot.com/diffs/npm/@docusaurus%2fcore/3.10.1/3.10.2) |  |  | | [@docusaurus/faster](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-faster)) | [`3.10.1` → `3.10.2`](https://renovatebot.com/diffs/npm/@docusaurus%2ffaster/3.10.1/3.10.2) |  |  | | [@docusaurus/module-type-aliases](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-module-type-aliases)) | [`3.10.1` → `3.10.2`](https://renovatebot.com/diffs/npm/@docusaurus%2fmodule-type-aliases/3.10.1/3.10.2) |  |  | | [@docusaurus/plugin-content-docs](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs)) | [`3.10.1` → `3.10.2`](https://renovatebot.com/diffs/npm/@docusaurus%2fplugin-content-docs/3.10.1/3.10.2) |  |  | | [@docusaurus/preset-classic](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic)) | [`3.10.1` → `3.10.2`](https://renovatebot.com/diffs/npm/@docusaurus%2fpreset-classic/3.10.1/3.10.2) |  |  | --- ### Release Notes <details> <summary>facebook/docusaurus (@​docusaurus/core)</summary> ### [`v3.10.2`](https://github.com/facebook/docusaurus/blob/HEAD/CHANGELOG.md#3102-2026-07-10) [Compare Source](https://github.com/facebook/docusaurus/compare/v3.10.1...v3.10.2) Backport and cherry-pick commits from main for v3.10.2 patch release: - [fix(bundler): do not import `@swc/html`, fix StackBlitz playground #​12055](https://github.com/facebook/docusaurus/pull/12055) - [fix(core): use locale url in site config #​12054](https://github.com/facebook/docusaurus/pull/12054) - [fix(theme-classic): remove redundant sidebar label titles #​11966](https://github.com/facebook/docusaurus/pull/11966) - [fix(mdx-loader): avoid transforming dotted directory links into asset… #​11944](https://github.com/facebook/docusaurus/pull/11944) - [fix(dev-server): for HTTPS, support non-RSA TLS certs #​12065](https://github.com/facebook/docusaurus/pull/12065) - [fix(utils): fix `extractLeadingEmoji()` edge cases #​12100](https://github.com/facebook/docusaurus/pull/12100) - [fix(gtag.js, faster): Fix StackBlitz, vendor `@types/gtag.js`, upgrade `@swc/html` #​12080](https://github.com/facebook/docusaurus/pull/12080) - [fix(create-docusaurus): init template README should use npm commands by default #​12138](https://github.com/facebook/docusaurus/pull/12138) - [fix(cli): `docusaurus serve` should pass `--host` to `server.listen()` #​12127](https://github.com/facebook/docusaurus/pull/12127) - [fix(core): bump detect-port to v2.1, fix pnpm `trustPolicy` downgrade issue #​12012](https://github.com/facebook/docusaurus/pull/12012) - [fix(i18n): complete Spanish translations for theme-common and theme-l… #​12180](https://github.com/facebook/docusaurus/pull/12180) - [chore(deps): migrate to `@11ty/gray-matter` #​12181](https://github.com/facebook/docusaurus/pull/12181) - [fix(core): fix BaseUrlIssueBanner little security issue #​12260](https://github.com/facebook/docusaurus/pull/12260) - [fix(core): accept boolean attributes in headTags config validation #​12238](https://github.com/facebook/docusaurus/pull/12238) - [fix(sitemap): don't drop lastmod for an epoch (0) timestamp #​12212](https://github.com/facebook/docusaurus/pull/12212) - [fix(utils): preserve author names containing commas in git log parsing #​12069](https://github.com/facebook/docusaurus/pull/12069) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/466 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
45724f19ac |
chore(deps): update pnpm to v11.15.1 (#472)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | [`11.15.0` → `11.15.1`](https://renovatebot.com/diffs/npm/pnpm/11.15.0/11.15.1) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.15.1`](https://github.com/pnpm/pnpm/releases/tag/v11.15.1): pnpm 11.15.1 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.15.0...v11.15.1) #### Patch Changes - `pnpm install` now detects a `supportedArchitectures` change and re-evaluates previously skipped platform-specific optional dependencies, instead of reporting the project as up to date and leaving the packages for the old architecture set in place. - `pnpm setup` now removes leftover v10-layout shims at the top of `PNPM_HOME`, so `pnpm self-update` no longer warns about a v10 installation layout after PATH has been migrated to the v11 `PNPM_HOME/bin` layout. Applies to both the TypeScript CLI and pacquet. In the TypeScript CLI, `self-update` also no longer treats a dangling legacy shim (one whose install target was garbage-collected) as a real v10 layout, so the warning can no longer fire on dead shim files. Closes [#​12496](https://github.com/pnpm/pnpm/issues/12496). - Completed pnpm runtime installation parity for Node.js, Deno, and Bun, including runtime failure policy, target architecture selection, and dependency runtime engines. Runtime failure overrides now preserve explicit runtime dependencies without matching engine entries. - Fixed `pnpm install` running out of memory while resolving large dependency graphs [#​8441](https://github.com/pnpm/pnpm/issues/8441). The resolver kept full registry documents — per-version readmes, scripts, descriptions, and other install-irrelevant bulk — in memory for every package fetched with full metadata (optional dependencies, and packages re-fetched for `minimumReleaseAge`'s publish timestamps). Every retained document is now condensed down to the field set installation actually reads, which reduces peak resolution memory by several times on workspaces with more than a thousand packages. - When a dependency's build script fails under `enableGlobalVirtualStore`, the global virtual store directory it was being built in is now removed for scoped packages too. Previously the cleanup resolved one directory level short of the hash directory for a scoped name, leaving a half-built directory behind that later installs would reuse. - Fixed `pnpm login`, `pnpm adduser`, and `pnpm logout` against a registry hosted under a URL subpath (e.g. `https://example.com/npm/registry`) when the configured URL has no trailing slash. Such URLs were left unnormalized, so the last path segment was dropped when building the login and token endpoints and the auth token was stored under a truncated key. Registry URLs with a path now always get a trailing slash appended during normalization, matching how root-level registry URLs are handled. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/docs/pulls/472 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandLunny Xiao
|
7d6eae703d |
chore(deps): update pnpm to v11.15.0 (#469)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | [`11.11.0` → `11.15.0`](https://renovatebot.com/diffs/npm/pnpm/11.11.0/11.15.0) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.15.0`](https://github.com/pnpm/pnpm/releases/tag/v11.15.0): pnpm 11.15 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.14.0...v11.15.0) ##### Minor Changes - Optional peer dependencies declared only via `peerDependenciesMeta` (for example `debug`'s `supports-color` peer) are now resolved from a satisfying version already present in the dependency graph, the same way explicitly declared optional peer dependencies are. Previously such peers were only resolved this way when the package's metadata was read back from the lockfile, so an unrelated dependency change could rewrite peer resolutions across the whole lockfile. ##### Patch Changes - Updated `adm-zip` to prevent crafted ZIP archives from causing excessive memory allocation. - `pnpm version -r` no longer writes a versioning-ledger entry with no consumed intents as a bare `intents:` key, which the next run failed to read with `ERR_PNPM_INVALID_VERSIONING_LEDGER`. Empty intent lists are now written as `intents: []`, and the ledger reader accepts the bare form left by earlier releases. - Fixed pnpr workspace resolution to preserve project names and versions for `workspace:` dependencies. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.14.0`](https://github.com/pnpm/pnpm/releases/tag/v11.14.0): pnpm 11.14 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.13.1...v11.14.0) #### Minor Changes - `peerDependencies` now accept dependency specifiers that carry a scheme — a named-registry spec (`<registry>:<version>`), an `npm:` alias, or a `file:`/git/URL spec — instead of rejecting them with `ERR_PNPM_INVALID_PEER_DEPENDENCY_SPECIFICATION` [#​13095](https://github.com/pnpm/pnpm/issues/13095). Such a peer is matched against the semver range carried by the specifier (`work:5.x.x` is checked as `5.x.x`, `npm:bar@^5` as `^5`), or against `*` when it carries no version, while the original specifier still selects the package to auto-install. Bare `name@version` values, which are almost always a mistake, are still rejected. - Added `pnpm doctor`, which diagnoses the pnpm installation and the environment it runs in: the versions and install method, whether the global bin directory is on `PATH`, whether the store and cache are writable, which link strategies (reflink, hardlink, symlink) the store's filesystem supports, registry connectivity, and an offline `file:` install that exercises the resolve/store/link path end to end. Each check reports how to fix what it finds, and the command exits non-zero when any check fails. Use `--offline` to skip the checks that need network access, `--json` for machine-readable output, and `--benchmark` to time the filesystem and install checks. - Added support for executing multiple scripts matching a RegExp passed to `pnpm run` (e.g., `pnpm run "/^build:.*/"`), running matched scripts in deterministic lexicographical order. Restored the `--sequential` (`-s`) CLI option for `pnpm run`, which forces `workspaceConcurrency` to 1 so that matched scripts run sequentially one by one across and within packages. #### Patch Changes - Fixed `pnpm install` failing with `ERR_PNPM_LOCKFILE_IS_SYMLINK` when `pnpm-lock.yaml` is a symlink, as build sandboxes such as Bazel and Nix stage it [#​13073](https://github.com/pnpm/pnpm/issues/13073). Reading a lockfile through a symlink is allowed again, and an install that leaves the lockfile unchanged no longer rewrites it, so `--frozen-lockfile` no longer needs to write at all. Writing a *changed* lockfile through a symlink is still refused, as that would redirect the write onto the symlink's target. - Fixed frozen installs incorrectly treating equivalent Git dependency specifiers as a stale lockfile. See [#​13039](https://github.com/pnpm/pnpm/issues/13039). - `pnpm owner ls` now reports authentication and authorization failures (401/403) as dedicated errors that include the registry's response body, matching `pnpm owner add`/`rm`, instead of a generic `Failed to fetch owners` message. - Recover from a metadata cache entry that disappears (concurrent cache cleanup, antivirus) after the registry has already answered the conditional request with `304 Not Modified`. The metadata is re-requested once without cache validators instead of failing the install with `ERR_PNPM_CACHE_MISSING_AFTER_304`. - A project pinned to a broken pnpm release via `packageManager` or `devEngines.packageManager` now reports which release is broken and what to do about it, instead of failing inside the installer. `pnpm self-update` already refused these releases; the version switch does too. - Prevent broken-lockfile errors from including snippets of the lockfile's contents. - `pnpm self-update` now checks that the version it installed can run before making it the active pnpm. A release that installs but cannot execute is discarded with an error instead of replacing a working installation. - Fixed an out-of-memory regression when workspace projects concurrently resolve a package with large registry metadata [pnpm/pnpm#13077](https://github.com/pnpm/pnpm/issues/13077). - Fixed `pnpm update` rewriting exact version pins that use the `=` operator (for example `=3.5.1`) to a caret range (`^3.5.1`). Exact pins are now preserved and written back as the bare version. See [#​12745](https://github.com/pnpm/pnpm/issues/12745). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.13.1`](https://github.com/pnpm/pnpm/releases/tag/v11.13.1): pnpm 11.13.1 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.13.0...v11.13.1) #### Patch Changes - Fixed `pnpm pack` applying workspace-root ignore rules when a workspace package has its own `.npmignore` file. - Keep the interactive `minimumReleaseAge` approval prompt visible during `pnpm install`. The progress reporter now pauses its redraws while a prompt is waiting for input instead of overwriting it, so the install no longer hangs on a question the user cannot see [#​13019](https://github.com/pnpm/pnpm/issues/13019). - Fixed `pnpm self-update` failing to link native platform binaries stored in sibling global virtual store slots. ### [`v11.13.0`](https://github.com/pnpm/pnpm/releases/tag/v11.13.0): pnpm 11.13 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.12.0...v11.13.0) #### Minor Changes - Added `versioning.epics` to `pnpm-workspace.yaml`. An epic ties a group of member packages to a lead package, constraining every member's major version to a band derived from the lead's major: while the lead is on major `M`, members live in `M*100 … M*100+99`. Members move independently inside the band (patch, minor, and a `major` intent that stays in-band); a bump that would carry a member past the band ceiling is rejected until the lead advances its own major. When a release plan takes the lead to a new stable major, every member re-bases to the band floor in the same plan. Membership is matched with pnpm's package selectors — name globs, `./`-prefixed directory globs, and `!`-prefixed negations. - Added the `team` command for managing organization teams and team memberships on the registry, with create, destroy, add, rm, and ls subcommands and support for --otp, --parseable, and --json flags. - Added native workspace release management [#​12952](https://github.com/pnpm/pnpm/issues/12952): the new `pnpm change` command records change intents as changesets-compatible `.changeset/*.md` files (`pnpm change status` shows the pending release plan), and the bare `pnpm version -r` consumes them — bumping versions across the workspace with dependent propagation through `workspace:` ranges, fixed groups, a `maxBump` cap, `--filter` narrowing, and `--dry-run` — writing changelogs, and recording consumed intents in a committed ledger that keeps cherry-picks and merge-backs between release branches safe. Packages can be moved onto per-package release lanes with the new `pnpm lane <name> --filter <pkg>` command and back with `pnpm lane main --filter <pkg>` (`pnpm lane` shows the membership), releasing `X.Y.Z-lane.N` prereleases from the same runs that release stable versions of the packages on the main lane. Configuration lives under the new `versioning` key of `pnpm-workspace.yaml` (`fixed`, `ignore`, `maxBump`, `lanes`, `changelog`). When two workspace projects publish the same name, intent files, `versioning.lanes`, and `versioning.fixed`/`ignore` may reference a project by its workspace-relative directory path (e.g. `"./pnpm/npm/pnpm"`) — the one additive extension to the changesets format, applied automatically by `pnpm change`. Release changelogs default to `registry` storage (`versioning.changelog.storage`): no `CHANGELOG.md` is committed. Each release's section is composed at publish time and packed into the published tarball on top of the previously published version's changelog, and the consumed change intents are garbage-collected by a later `pnpm version -r` only once the registry confirms the version is published with its section. Set `versioning.changelog.storage: repository` to keep committed `CHANGELOG.md` files instead. - Added a new override selector form with an empty range — `"pkg@": "<version>"` — called a convergence override. It rewrites a dependency edge only when its exact version satisfies the edge's declared range, so compatible consumers converge on one version while incompatible consumers keep their own resolution — now and for any dependent added in the future [#​12794](https://github.com/pnpm/pnpm/issues/12794). ```yaml overrides: "form-data@": 4.0.6 ``` The value must be an exact version. When a full resolution detects that every declared range also admits a newer version, pnpm warns that the override is stale and names the version to converge on. Previously an empty range in an override selector was undocumented and behaved like a bare (unscoped) override. #### Patch Changes - A `tokenHelper` set in the global pnpm `auth.ini` is no longer rejected as project-level configuration. The guard that blocks `tokenHelper` from a project `.npmrc` only treated `~/.npmrc` as a trusted source, so a helper written to `auth.ini` (for example by `pnpm config set`) failed on every command and could not even be removed with `pnpm config delete`. A `tokenHelper` in a workspace or project `.npmrc` is still rejected. - `pnpm cache delete` now removes a package's metadata from every metadata cache directory (`metadata`, `metadata-full`, and `metadata-full-filtered`), instead of only the one the current resolution mode reads. Previously a package cached under a different mode (e.g. `metadata-full-filtered`) was left behind. Closes [#​12753](https://github.com/pnpm/pnpm/issues/12753). - Fixed an injected workspace dependency (`injectWorkspacePackages: true`) incorrectly staying as `file:` instead of deduping back to `link:` when an unrelated, ordinary shared dependency resolved to a peer-suffixed variant for the target project's own copy but not for the injected occurrence. See [#​10433](https://github.com/pnpm/pnpm/issues/10433). - `pnpm deploy` now supports workspaces that use catalogs. - Fixed `pnpm deploy` with a shared lockfile so local `file:` tarball dependencies keep their package name in the generated deploy lockfile. This prevents warm-store deploys from failing with `ERR_PNPM_UNEXPECTED_PKG_CONTENT_IN_STORE` when the tarball filename includes the version. - Options that follow `create`, `exec`, or `test` appearing as a subcommand of another command are now parsed instead of being silently treated as positional parameters. For example, `pnpm team create @​org:team --registry <url>` previously ignored the `--registry` option and sent the request to the default registry. - `pnpm add -g`, `pnpm update -g`, `pnpm setup`, and the self-updater no longer fail with `ERR_PNPM_MISSING_TIME` when `trustPolicy: no-downgrade` or `resolutionMode: time-based` is set in the global config [#​12883](https://github.com/pnpm/pnpm/issues/12883). The decision to fetch full registry metadata now lives in one place, and the `no-downgrade` trust policy always requests full metadata (matching the self-updater), since the trust evidence it checks is missing from abbreviated metadata even on registries that include the `time` field. - `pnpm list` and `pnpm why` no longer crash with `EMFILE: too many open files` when a project has a large number of unsaved dependencies (packages present in `node_modules` but not in the lockfile). The reads of those packages are now concurrency-limited. - The published `pnpm` package no longer declares `dependencies` or `devDependencies`. Because the CLI bundles its runtime dependencies into `dist/node_modules`, those fields are dropped when packing, so `npm install` of the tarball no longer tries to resolve internal-only packages such as `@pnpm/test-ipc-server`. Closes [#​12955](https://github.com/pnpm/pnpm/issues/12955). - Fixed `pnpm publish --otp` and `pnpm publish --batch --otp` to send the configured OTP to the registry. - `pnpm publish` again sends the package's README to the registry as metadata, so registries can render it on the package page. The readme is always included in the published metadata (matching the npm CLI), while the `embed-readme` setting continues to control only whether the readme is written into the `package.json` inside the tarball. This restores the behavior that was lost when publishing became fully native. Closes [#​12966](https://github.com/pnpm/pnpm/issues/12966). - Fixed the dependency status check wrongly reporting "up to date" when a `package.json`, `.pnpmfile.cjs`, or patch file was edited in the same second as the previous install, on filesystems that record mtimes at whole-second resolution (for example ext4 with 128-byte inodes). The optimistic repeat-install fast path and `verify-deps-before-run` compared mtimes strictly, so a same-second edit whose mtime rounded down looked unchanged and re-resolution was skipped. Such a file's whole second is now treated as possibly-modified, falling through to the content check; behavior on sub-second filesystems is unchanged. - Retry package metadata requests when a registry or proxy returns `304 Not Modified` to an unconditional request, preventing false `ERR_PNPM_CACHE_MISSING_AFTER_304` failures [pnpm/pnpm#12882](https://github.com/pnpm/pnpm/issues/12882). If the retry also returns `304`, report `ERR_PNPM_META_NOT_MODIFIED_WITHOUT_CACHE` instead. - Fixed `pnpm update` removing transitive lockfile entries when `dedupePeerDependents` is disabled and the selected package is absent [pnpm/pnpm#12456](https://github.com/pnpm/pnpm/issues/12456). - Limit modern deploy lockfiles and localized virtual stores to dependencies reachable from the selected dependency groups. - A `tokenHelper` command is now given a 60-second time limit. A helper that hangs (deadlock, stuck I/O) is killed and reported as an error instead of leaving the command waiting forever. - Fixed orphaned child processes on Windows when pnpm exits on an error while commands spawned by `pnpm exec` or `pnpm dlx` are still running (for example, when one project's command fails during `pnpm --recursive exec`). The PIDs of these commands are now recorded when they are spawned and their whole process trees are terminated with `taskkill` on an error exit. Previously the cleanup relied on enumerating the system process list, which is so slow on Windows that the enumeration hit its timeout and the cleanup was silently skipped [#​12406](https://github.com/pnpm/pnpm/issues/12406). - `pnpm pack` now respects workspace-root `.npmignore` and `.gitignore` files when packing workspace packages. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.12.0`](https://github.com/pnpm/pnpm/releases/tag/v11.12.0): pnpm 11.12 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.11.0...v11.12.0) #### Minor Changes - [`a897ef7`](https://github.com/pnpm/pnpm/commit/a897ef7): Custom fetchers exported from a pnpmfile can now delegate by returning a `{ delegate: <resolution> }` envelope: pnpm rewrites the package's resolution to the delegated shape and runs the built-in fetcher on it. This is the portable delegation form that also works in pacquet, where `cafs` and `fetchers` cannot be passed to the hook. Related to [pnpm/pnpm#11685](https://github.com/pnpm/pnpm/issues/11685). #### Patch Changes - [`2b02764`](https://github.com/pnpm/pnpm/commit/2b02764): The changed-packages filter (`--filter "...[<since>]"`) no longer allows an option-like `<since>` value (such as `--output=<path>`) to be interpreted as a git option — git now rejects it as a bad revision. The repository root is also resolved to the nearest `.git` entry, so the filter works in a git worktree checked out inside another repository's tree. - [`43711ce`](https://github.com/pnpm/pnpm/commit/43711ce): `pnpm outdated` no longer checks the registry for dependencies that are resolved from local `link:`, `file:`, or `workspace:` references in the lockfile [#​12827](https://github.com/pnpm/pnpm/issues/12827). - [`3c6718b`](https://github.com/pnpm/pnpm/commit/3c6718b): Fixed a deadlock in peer dependency resolution: `pnpm install` hung forever when a peer dependency cycle spanned a project's own dependencies and auto-installed peer providers, for example when installing `[email protected].3` [#​12921](https://github.com/pnpm/pnpm/issues/12921). - [`252f15e`](https://github.com/pnpm/pnpm/commit/252f15e): Fixed peer dependency auto-install picking a version the peer range rejects. In a workspace with several projects, a package declaring a peer dependency with a semver range (for example `^1.0.0`) could get the highest version found anywhere in the workspace (for example a `2.0.0` resolved for another project) instead of a version that satisfies the range. Peers are now deduplicated onto the highest preferred version that satisfies the declared range, and when none does, the range is resolved from the registry. Also fixed re-resolving with an existing lockfile hoisting a different peer version than a fresh install of the same manifest: root dependencies reused from the lockfile were invisible to peer hoisting, so a peer that a root dependency provides could be bound to another version. - [`a38adda`](https://github.com/pnpm/pnpm/commit/a38adda): `pnpm self-update <version>` now installs the requested pnpm version when it matches the currently running version but is missing from the global self-update directory. - [`6a85968`](https://github.com/pnpm/pnpm/commit/6a85968): `pnpm stage list` now stops paginating after a fail-safe cap of 1000 pages, so a misbehaving registry cannot keep the command looping forever. - [`eee7c9a`](https://github.com/pnpm/pnpm/commit/eee7c9a): `verify-deps-before-run` no longer spawns a `pnpm install` when pnpm is executed in a directory that has no `package.json`. A mistyped command run outside a project (for example `pnpm witch 10 login`) used to crash with a confusing error from the spawned install; now it fails with the regular "no package.json found" error. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/469 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
54a5a37796 |
chore(deps): update actions/setup-node action to v7 (#467)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://github.com/actions/setup-node) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](https://github.com/actions/setup-node/compare/v7.0.0...v7.0.0) ##### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@​gowridurgad](https://github.com/gowridurgad) in [#​1577](https://github.com/actions/setup-node/pull/1577) - Migrate to ESM and upgrade dependencies by [@​gowridurgad](https://github.com/gowridurgad) in [#​1574](https://github.com/actions/setup-node/pull/1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@​gowridurgad](https://github.com/gowridurgad) in [#​1558](https://github.com/actions/setup-node/pull/1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@​deiga](https://github.com/deiga) in [#​1548](https://github.com/actions/setup-node/pull/1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@​chiranjib-swain](https://github.com/chiranjib-swain) in [#​1536](https://github.com/actions/setup-node/pull/1536) - docs: Update restore-only cache documentation by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​1550](https://github.com/actions/setup-node/pull/1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@​chiranjib-swain](https://github.com/chiranjib-swain) in [#​1567](https://github.com/actions/setup-node/pull/1567) ##### Dependency update: - Upgrade [@​actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@​jasongin](https://github.com/jasongin) in [#​1569](https://github.com/actions/setup-node/pull/1569) ##### New Contributors - [@​chiranjib-swain](https://github.com/chiranjib-swain) made their first contribution in [#​1536](https://github.com/actions/setup-node/pull/1536) - [@​deiga](https://github.com/deiga) made their first contribution in [#​1548](https://github.com/actions/setup-node/pull/1548) - [@​jasongin](https://github.com/jasongin) made their first contribution in [#​1569](https://github.com/actions/setup-node/pull/1569) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v7.0.0> ### [`v7`](https://github.com/actions/setup-node/compare/v6.5.0...v7.0.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.5.0...v7.0.0) ### [`v6.5.0`](https://github.com/actions/setup-node/releases/tag/v6.5.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0) ##### What's Changed - Update [@​actions/cache](https://github.com/actions/cache) to 5.1.0 and add security overrides for undici and fast-xml-parser by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​1579](https://github.com/actions/setup-node/pull/1579) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0> ### [`v6.4.0`](https://github.com/actions/setup-node/releases/tag/v6.4.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.3.0...v6.4.0) ##### What's Changed ##### Dependency updates: - Upgrade [@​actions](https://github.com/actions) dependencies by [@​Copilot](https://github.com/Copilot) in [#​1525](https://github.com/actions/setup-node/pull/1525) - Update Node.js versions in versions.yml and bump package to v6.4.0 by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​1533](https://github.com/actions/setup-node/pull/1533) ##### New Contributors - [@​Copilot](https://github.com/Copilot) made their first contribution in [#​1525](https://github.com/actions/setup-node/pull/1525) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-node/releases/tag/v6.3.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.2.0...v6.3.0) ##### What's Changed ##### Enhancements: - Support parsing `devEngines` field by [@​susnux](https://github.com/susnux) in [#​1283](https://github.com/actions/setup-node/pull/1283) > When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node. ##### Dependency updates: - Fix npm audit issues by [@​gowridurgad](https://github.com/gowridurgad) in [#​1491](https://github.com/actions/setup-node/pull/1491) - Replace uuid with crypto.randomUUID() by [@​trivikr](https://github.com/trivikr) in [#​1378](https://github.com/actions/setup-node/pull/1378) - Upgrade minimatch from 3.1.2 to 3.1.5 by [@​dependabot](https://github.com/dependabot) in [#​1498](https://github.com/actions/setup-node/pull/1498) ##### Bug fixes: - Remove hardcoded bearer for mirror-url [@​marco-ippolito](https://github.com/marco-ippolito) in [#​1467](https://github.com/actions/setup-node/pull/1467) - Scope test lockfiles by package manager and update cache tests by [@​gowridurgad](https://github.com/gowridurgad) in [#​1495](https://github.com/actions/setup-node/pull/1495) ##### New Contributors - [@​susnux](https://github.com/susnux) made their first contribution in [#​1283](https://github.com/actions/setup-node/pull/1283) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-node/releases/tag/v6.2.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.1.0...v6.2.0) ##### What's Changed ##### Documentation - Documentation update related to absence of Lockfile by [@​mahabaleshwars](https://github.com/mahabaleshwars) in [#​1454](https://github.com/actions/setup-node/pull/1454) - Correct mirror option typos by [@​MikeMcC399](https://github.com/MikeMcC399) in [#​1442](https://github.com/actions/setup-node/pull/1442) - Readme update on checkout version v6 by [@​deining](https://github.com/deining) in [#​1446](https://github.com/actions/setup-node/pull/1446) - Readme typo fixes [@​munyari](https://github.com/munyari) in [#​1226](https://github.com/actions/setup-node/pull/1226) - Advanced document update on checkout version v6 by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​1468](https://github.com/actions/setup-node/pull/1468) ##### Dependency updates: - Upgrade [@​actions/cache](https://github.com/actions/cache) to v5.0.1 by [@​salmanmkc](https://github.com/salmanmkc) in [#​1449](https://github.com/actions/setup-node/pull/1449) ##### New Contributors - [@​mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#​1454](https://github.com/actions/setup-node/pull/1454) - [@​MikeMcC399](https://github.com/MikeMcC399) made their first contribution in [#​1442](https://github.com/actions/setup-node/pull/1442) - [@​deining](https://github.com/deining) made their first contribution in [#​1446](https://github.com/actions/setup-node/pull/1446) - [@​munyari](https://github.com/munyari) made their first contribution in [#​1226](https://github.com/actions/setup-node/pull/1226) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-node/releases/tag/v6.1.0) [Compare Source](https://github.com/actions/setup-node/compare/v6...v6.1.0) #### What's Changed ##### Enhancement: - Remove always-auth configuration handling by [@​priyagupta108](https://github.com/priyagupta108) in [#​1436](https://github.com/actions/setup-node/pull/1436) ##### Dependency updates: - Upgrade [@​actions/cache](https://github.com/actions/cache) from 4.0.3 to 4.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1384](https://github.com/actions/setup-node/pull/1384) - Upgrade actions/checkout from 5 to 6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1439](https://github.com/actions/setup-node/pull/1439) - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1435](https://github.com/actions/setup-node/pull/1435) ##### Documentation update: - Add example for restore-only cache in documentation by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​1419](https://github.com/actions/setup-node/pull/1419) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/docs/pulls/467 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
5c84535011 |
chore(deps): update pnpm to v11.11.0 (#465)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | [`11.10.0` → `11.11.0`](https://renovatebot.com/diffs/npm/pnpm/11.10.0/11.11.0) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.11.0`](https://github.com/pnpm/pnpm/blob/HEAD/pnpm11/pnpm/CHANGELOG.md#11110) [Compare Source](https://github.com/pnpm/pnpm/compare/v11.10.0...v11.11.0) ##### Minor Changes - [`508b8c2`](https://github.com/pnpm/pnpm/commit/508b8c2): Added the `pnpm access` command for managing package access and visibility on the registry, supporting listing packages and collaborators, getting and setting package status and MFA requirements, and granting or revoking team access. ##### Patch Changes - [`c70e33e`](https://github.com/pnpm/pnpm/commit/c70e33e): Allow `allowBuilds` entries for git-hosted packages to match by repository URL without pinning the resolved commit hash. This lets trusted git repositories keep running their build scripts after branch updates without approving each new commit, while package-name-only rules still do not approve git-hosted artifacts. - [`3067e4f`](https://github.com/pnpm/pnpm/commit/3067e4f): Reduced peak memory usage during cold-cache dependency resolution. The metadata fetch is memoized for the whole resolution phase, and it was retaining each package's raw registry response body (used only to mirror the response to disk) for that entire time. The memoized cache now holds a body-less copy, so the raw body only lives as long as the call that writes the disk mirror. On large graphs that fetch full metadata (e.g. with `minimumReleaseAge` or `trustPolicy` enabled) this cuts peak RSS by roughly 30%, back in line with pnpm 10. The resolved lockfile is unchanged. - [`51300fd`](https://github.com/pnpm/pnpm/commit/51300fd): Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/[email protected]`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `formatGlobalVirtualStorePath`, the single point every global-virtual-store slot path funnels through — closing the same escape in the isolated linker, the resolver's dependency-graph builder, and the config-dependency installer. - [`f8058eb`](https://github.com/pnpm/pnpm/commit/f8058eb): Reject symlinked `pnpm-lock.yaml` files when reading or writing the env lockfile document. - [`9318a11`](https://github.com/pnpm/pnpm/commit/9318a11): Allow `registries` and `namedRegistries` to be configured in the global `config.yaml` file. - [`51300fd`](https://github.com/pnpm/pnpm/commit/51300fd): Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../<path>`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker. - [`14332f0`](https://github.com/pnpm/pnpm/commit/14332f0): Fail instead of silently removing an optional dependency's locked entries from `pnpm-lock.yaml` when the registry cannot resolve it. Previously, when registry metadata lacked a version that the lockfile already pinned (for example, a mirror that had not synced a recent release yet), `pnpm install` and `pnpm dedupe` silently dropped the optional dependency's entries — emptying maps such as the platform binaries of `@napi-rs/canvas` — so the lockfile differed between machines and frozen installs on other hosts had nothing to link [#​12853](https://github.com/pnpm/pnpm/issues/12853). - [`fecfe83`](https://github.com/pnpm/pnpm/commit/fecfe83): Fixed peer dependency resolution with `autoInstallPeers` when a workspace package depends on a version of a package that a transitive dependency's self-contained closure also provides for itself. The peer providers that are attached to the root project for reuse are no longer peer-resolved a second time in the root context, so packages inside such a closure no longer get their peers bound to the root project's incompatible version [#​4993](https://github.com/pnpm/pnpm/issues/4993). - [`5a4daec`](https://github.com/pnpm/pnpm/commit/5a4daec): `${...}` environment-variable placeholders in the `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and `noproxy` settings are no longer expanded when these settings come from a project's `pnpm-workspace.yaml`. They now receive the same protection already applied to `registry`, `namedRegistries`, and `pnprServer`. - [`d1da02e`](https://github.com/pnpm/pnpm/commit/d1da02e): `pnpm publish` no longer prints credentials when the target registry is configured with inline `user:pass@` credentials (e.g. `registry=https://user:[email protected]/`). They are now redacted both from the "publishing to registry" line and from the OIDC (trusted publishing) failure messages. - [`dcfc611`](https://github.com/pnpm/pnpm/commit/dcfc611): `pnpm self-update` now honors `trustPolicy=no-downgrade`. It resolves the target pnpm version against full registry metadata, so it refuses to switch to a version whose supply-chain trust evidence is weaker than an earlier-published one, the same way a regular install does. - [`a8ad82d`](https://github.com/pnpm/pnpm/commit/a8ad82d): Register the `pn` alias in generated shell completion scripts. - [`25bd5c3`](https://github.com/pnpm/pnpm/commit/25bd5c3): Fixed standalone installer downgrades from pnpm v12 to v11. - [`23996e9`](https://github.com/pnpm/pnpm/commit/23996e9): `pnpm runtime set <name> <version>` now validates its arguments: the name must be `node`, `deno`, or `bun`, and the version must not contain a comma. Previously these were interpolated straight into a `pnpm add` selector, where an unsupported name or a comma (e.g. `node 22,is-positive`) could be misread as a list of packages or a local directory and install unintended packages or bins. </details> --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/docs/pulls/465 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandLunny Xiao
|
70a3b7f602 |
chore(deps): update pnpm to v11.10.0 (#460)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | [`11.9.0` → `11.10.0`](https://renovatebot.com/diffs/npm/pnpm/11.9.0/11.10.0) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.10.0`](https://github.com/pnpm/pnpm/blob/HEAD/pnpm11/pnpm/CHANGELOG.md#11100) [Compare Source](https://github.com/pnpm/pnpm/compare/v11.9.0...v11.10.0) ##### Minor Changes - [`e2e3c81`](https://github.com/pnpm/pnpm/commit/e2e3c81): Added the `issues` command as an alias of `bugs`, so `pnpm issues` opens the package's bug tracker URL in the browser. - [`8491f8e`](https://github.com/pnpm/pnpm/commit/8491f8e): Added the `prefix` command which prints the current package prefix directory (or global prefix directory if `-g` / `--global` is used). - [`3425e80`](https://github.com/pnpm/pnpm/commit/3425e80): Added an `_auth` setting for configuring registry authentication as a single structured (URL-keyed) value. It can be set in the **global** pnpm config (`config.yaml`) or, for CI, via the `pnpm_config__auth` environment variable. The env form sidesteps the GitHub Actions / bash / zsh limitation that broke the existing `pnpm_config_//host/:_authToken=…` form (env var names containing `/`, `:`, or `.` are silently dropped). Closes [#​12314](https://github.com/pnpm/pnpm/issues/12314). The value is keyed by registry URL so each secret is explicitly bound to the host that may receive it. Registry URL keys must use `http` or `https` and must not include credentials, query strings, or fragments: ```sh export pnpm_config__auth='{"https://registry.npmjs.org":{"@​":{"authToken":"npm-token"},"@​org":{"authToken":"org-token"}}}' ``` The equivalent in the global `config.yaml`: ```yaml _auth: https://registry.npmjs.org: "@​": authToken: npm-token "@​org": authToken: org-token ``` Within each registry URL, `@` means registry-wide/default credentials and package scopes like `@org` bind credentials to that scope on the same host. The only supported credential field is `authToken` (maps to `_authToken` / bearer auth); the deprecated `basicAuth` / `username` + `password` forms are intentionally not accepted here. Each entry also infers a trusted registry route: `@` routes the default registry (and `pnpm add <pkg>` resolves there), and `@org` routes that scope. Because the credential and destination host arrive in one trusted value, repo-controlled `pnpm-workspace.yaml` or project `.npmrc` cannot redirect the token to a different host. `_auth` is honored **only** from the env var and the global config — it is ignored in a project `pnpm-workspace.yaml` / `.npmrc`, so repo-controlled config can never supply registry auth. Precedence: CLI flags (`--registry`, `--@​scope:registry`) > `pnpm_config__auth` > global `config.yaml` `_auth` > `pnpm-workspace.yaml`. Both `pnpm_config__auth` (lowercase, documented form) and `PNPM_CONFIG__AUTH` (all-caps, the shell convention some CI runners apply) are honored. If both are set, lowercase wins unless it is empty, in which case uppercase is used. The env var wins over the global `config.yaml` `_auth` on a conflicting key. `tokenHelper` is not supported in `_auth`. Parsing is strict: a malformed value (bad JSON, wrong shape, invalid registry URL or scope, an unsupported credential field) fails fast with an error rather than being silently dropped. **Pacquet parity note:** the pacquet (Rust) port supports the same single credential field as the TS CLI: `authToken`. - [`a33eeec`](https://github.com/pnpm/pnpm/commit/a33eeec): `pnpm self-update` and `packageManager` version-switching can now install and link pnpm v12 (the Rust port), published with equal content under both the `pnpm` and `@pnpm/exe` names on the `next-12` dist-tag. Its native binaries ship as `@pnpm/exe.<platform>-<arch>` packages, which pnpm's built-in installer links directly — no Node.js launcher, so the command pays no Node startup cost. v12 is initialized exactly like `@pnpm/exe`, including per-platform global-virtual-store hashing. From v12 onward the install converges on the unscoped `pnpm` package (the Rust exe) — even when updating from the SEA `@pnpm/exe` build. - [`1dd12bd`](https://github.com/pnpm/pnpm/commit/1dd12bd): When resolving through a pnpr install-accelerator server, pnpm no longer forwards its own upstream registry credentials in the resolve request. Only the `Authorization` header identifying the caller to pnpr is sent. The pnpr server now selects upstream credentials from its own route policy (operator-configured upstream credential aliases), so private dependencies resolve through a pnpr-managed alias the caller is authorized to use, rather than by sending the client's registry tokens to the server. - [`1e81761`](https://github.com/pnpm/pnpm/commit/1e81761): Expose web authentication `authUrl` and `doneUrl` in JSON error output when OTP is required in a non-interactive terminal [#​12724](https://github.com/pnpm/pnpm/issues/12724). ##### Patch Changes - [`2f389d6`](https://github.com/pnpm/pnpm/commit/2f389d6): Added the Node.js release team's new signing key (Stewart X Addison, `655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD`) to the embedded Node.js release keys, so runtimes whose `SHASUMS256.txt` is signed by the new releaser verify successfully. - [`acbdb94`](https://github.com/pnpm/pnpm/commit/acbdb94): Fixed shell tab completion not suggesting workspaces after the `-F` alias for `--filter` option. - [`dcabb78`](https://github.com/pnpm/pnpm/commit/dcabb78): Fixed `pnpm up -r <pkg>` bumping unrelated packages that have open semver ranges. Previously, any update mutation nullified the lockfile-derived `preferredVersions` globally, so packages with `^x.y.z` ranges could re-resolve to newer compatible versions even though the user only asked to update a specific package. The install layer now always seeds `preferredVersions` from the lockfile, and caller-supplied preferred versions (such as the vulnerability penalties of `pnpm audit --fix`) layer on top of the seed instead of replacing it. The targeted package still bumps: the per-resolve `updateRequested` flag makes the resolver ignore the target's own lockfile pins. Closes [#​10662](https://github.com/pnpm/pnpm/issues/10662). - [`d539172`](https://github.com/pnpm/pnpm/commit/d539172): Fixed pnpm pack and pnpm publish failing when prepack generates files that are included in the package and postpack cleans them up. - [`be6505a`](https://github.com/pnpm/pnpm/commit/be6505a): Hardened global package management: - On Windows, removing or updating a global package now also cleans up the `node.exe` flavor of a bin, so a stale `node.exe` no longer survives on `PATH` after uninstall, and a new global install no longer silently overwrites an existing `node.exe`. - `pnpm add -g pnpm@<version>` (and `@pnpm/exe@<version>`) is now rejected like the bare `pnpm` form, pointing to `pnpm self-update`. - Dependency aliases read from a global package's manifest are validated before being joined onto `node_modules` paths, preventing a tampered manifest from escaping the install directory. - Each global install group is created in its own freshly-made directory (no longer reusing a colliding or pre-existing path). - Removing or updating a global package no longer unlinks a bin that belongs to a different globally installed package. - [`25c7388`](https://github.com/pnpm/pnpm/commit/25c7388): pnpm now rejects `jsr:` specifiers whose package name is not a valid npm package name — an empty scope or name (e.g. `jsr:@​scope/`), path separators inside the name, or any other shape `validate-npm-package-name` rejects — with `ERR_PNPM_INVALID_JSR_PACKAGE_NAME` instead of silently converting them into a malformed `@jsr/...` npm package name. - [`25c7388`](https://github.com/pnpm/pnpm/commit/25c7388): pnpm now rejects named-registry specifiers (e.g. `gh:`) whose package name is not a valid npm package name — an empty scope (e.g. `gh:@​/bar`), path separators inside the name (e.g. `gh:@​scope/../name`), or any other shape `validate-npm-package-name` rejects — with `ERR_PNPM_INVALID_NAMED_REGISTRY_PACKAGE_NAME` instead of passing the name through to registry URLs and metadata cache file paths. - [`96da7c5`](https://github.com/pnpm/pnpm/commit/96da7c5): node-gyp's `gyp_main.py` and `gyp` entrypoints are now packed with the executable bit in the `pnpm` and `@pnpm/exe` tarballs. Without it, building native addons from source could fail with a permission error. - [`99982b9`](https://github.com/pnpm/pnpm/commit/99982b9): Sped up resolution and reduced memory use against registries that ignore npm's abbreviated metadata format and always return the full package document (for example, Azure DevOps Artifacts). pnpm now strips such documents down to the abbreviated field set before caching them. Resolution output is unchanged, and registries that honor the abbreviated format (such as the npm registry) pay no extra cost. - [`11a7fdd`](https://github.com/pnpm/pnpm/commit/11a7fdd): Sped up offline and `--prefer-offline` resolution on large workspaces (e.g. `pnpm dedupe --offline`, `pnpm install --offline`). Package metadata loaded from the local cache is now kept in memory, so each package's metadata is parsed once per command instead of once per dependent that references it. - [`2c7369d`](https://github.com/pnpm/pnpm/commit/2c7369d): `pnpm pack-app` now rejects `--entry` / `pnpm.app.entry` and `--output-dir` / `pnpm.app.outputDir` values that are absolute paths or escape the project directory via `..` (or a symlink that resolves outside it), and refuses to write the produced executable when its target path already exists as a symlink (or other non-regular file). This prevents a repository-controlled `package.json` from embedding host files (such as an SSH key) into the produced executable, writing build artifacts outside the project, or overwriting an arbitrary file through a committed symlink. The new error codes are `ERR_PNPM_PACK_APP_ENTRY_OUTSIDE_PROJECT`, `ERR_PNPM_PACK_APP_OUTPUT_DIR_OUTSIDE_PROJECT`, and `ERR_PNPM_PACK_APP_OUTPUT_FILE_NOT_REGULAR`. When ad-hoc signing macOS targets, `pnpm pack-app` now runs the system `codesign` by absolute path and resolves `ldid` to a location outside the project, so a repository-controlled `node_modules/.bin` on `PATH` cannot hijack the signer. - [`ce5d5a5`](https://github.com/pnpm/pnpm/commit/ce5d5a5): Relative paths in `patchedDependencies` are now resolved against the lockfile directory when computing patch file hashes, so running `pnpm install` from a subdirectory no longer fails with `ENOENT` looking for the patch file in the wrong location [#​12762](https://github.com/pnpm/pnpm/pull/12762). - [`ebb4096`](https://github.com/pnpm/pnpm/commit/ebb4096): `pnpm peers` no longer reports a conflict for a missing peer dependency that is ignored via `pnpm.peerDependencyRules.ignoreMissing`. - [`dcabb78`](https://github.com/pnpm/pnpm/commit/dcabb78): Fixed a prototype-pollution hazard when seeding preferred versions: a dependency named `__proto__` in a manifest or in `pnpm-lock.yaml` could write through `Object.prototype` (or crash the install) while the preferred-versions map was being built. The maps are now null-prototype objects, so crafted package names land as plain keys. - [`f38e696`](https://github.com/pnpm/pnpm/commit/f38e696): Hardened `pnpm deploy --force` so it refuses unsafe deploy targets such as workspace roots, parent directories, out-of-workspace paths, and symlinked target parents. - [`806c3ec`](https://github.com/pnpm/pnpm/commit/806c3ec): pnpm no longer warns about ignored project-level auth settings when `PNPM_CONFIG_NPMRC_AUTH_FILE` points at the project `.npmrc` — setting it to that file is an explicit opt-in to trusting it, so auth env variables in it are expanded [pnpm/pnpm#12480](https://github.com/pnpm/pnpm/issues/12480). - [`991405e`](https://github.com/pnpm/pnpm/commit/991405e): Restore differential rendering (`ansi-diff`) to fix duplicated output lines introduced by [#​12351](https://github.com/pnpm/pnpm/issues/12351). - [`c121235`](https://github.com/pnpm/pnpm/commit/c121235): Fixed the topological order of `--filter`ed commands (`pnpm run`, `pnpm exec`, `pnpm publish`, `pnpm pack`, `pnpm rebuild`) when the selected projects depend on each other only transitively through projects that were not selected. Previously such selected projects could run concurrently or in the wrong order; now a project always runs after the selected projects it transitively depends on, while projects without a real dependency relationship still run concurrently. This now also holds for prod-only filters (`--filter-prod`), which resolve order through the production dependency graph so transitive production dependencies are respected without pulling back the dev dependencies the filter drops, and for selections that mix `--filter` with `--filter-prod` [#​8335](https://github.com/pnpm/pnpm/issues/8335). - [`d539172`](https://github.com/pnpm/pnpm/commit/d539172): `pnpm pack` and `pnpm publish` no longer follow a symlinked workspace `LICENSE` file when injecting it into a package that has no license of its own. Following the symlink could pack bytes from outside the workspace into the published tarball. - [`dcabb78`](https://github.com/pnpm/pnpm/commit/dcabb78): Fixed `pnpm up <pkg>` producing a different result than a fresh install of the same manifests would. The resolver now distinguishes `updateRequested` (true only for packages that match the user's update target) from the broader `update` flag, and for the targeted package ignores only its own lockfile-derived preferred-version pins — so the target re-resolves exactly as if its lockfile entries were deleted and `pnpm install` ran. Preferred versions a fresh install applies (manifest pins, versions propagated down the dependency chain, and the vulnerability-avoidance penalties of `pnpm audit --fix`) stay in effect, so an update never installs duplicate versions that a reinstall from scratch would not reproduce. When a preferred version holds the update target below the newest version its range admits, pnpm now prints a warning explaining that reaching the newer version everywhere requires an override. - [`dcabb78`](https://github.com/pnpm/pnpm/commit/dcabb78): `pnpm update <dep>@​<version>` now prints a warning when `<dep>` is only present as a transitive dependency: the requested version cannot be applied there (updates resolve the target the way a fresh install would), and the warning recommends adding the version to `pnpm.overrides` instead, which is the mechanism that does pin transitive dependencies. Closes [#​12744](https://github.com/pnpm/pnpm/issues/12744). - [`a6c4d5f`](https://github.com/pnpm/pnpm/commit/a6c4d5f): When a dependency cannot be found in the registry (404) or the registry has no matching version, and a workspace project with the same name exists only at non-matching versions, the error now reports the available workspace versions (`ERR_PNPM_NO_MATCHING_VERSION_INSIDE_WORKSPACE`) instead of the raw registry failure [pnpm/pnpm#1379](https://github.com/pnpm/pnpm/issues/1379). Other registry failures (authorization, network, server errors) still propagate unchanged. The pacquet (Rust) resolver applies the same behavior. </details> --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/460 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandLunny Xiao
|
690cf6b9a0 |
fix(deps): update dependency @mui/material to v9.2.0 (#459)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@mui/material](https://mui.com/material-ui/) ([source](https://github.com/mui/material-ui/tree/HEAD/packages/mui-material)) | [`9.1.2` → `9.2.0`](https://renovatebot.com/diffs/npm/@mui%2fmaterial/9.1.2/9.2.0) |  |  | --- ### Release Notes <details> <summary>mui/material-ui (@​mui/material)</summary> ### [`v9.2.0`](https://github.com/mui/material-ui/blob/HEAD/CHANGELOG.md#920) [Compare Source](https://github.com/mui/material-ui/compare/v9.1.2...v9.2.0) <!-- generated comparing v9.1.2..master --> *Jul 3, 2026* A big thanks to the 9 contributors who made this release possible. - ⚙️ Add support for [`data-*` attributes on `slotProps`](https://mui.com/material-ui/guides/typescript/#allowing-data-attributes-on-slotprops). ##### `@mui/[email protected]` - \[l10n] Add missing MuiPagination localization to zh-CN locale ([#​48741](https://github.com/mui/material-ui/issues/48741)) [@​greymoth-jp](https://github.com/greymoth-jp) - \[select] Guard display ref during mouse down ([#​48744](https://github.com/mui/material-ui/issues/48744)) [@​michelengelen](https://github.com/michelengelen) ##### `@mui/[email protected]` - \[utils] Add opt-in `DataAttributesOverrides` augmentation for slot props ([#​48554](https://github.com/mui/material-ui/issues/48554)) [@​LukasTy](https://github.com/LukasTy) ##### Docs - \[docs] Improve Icon Dialog responsiveness on small screens ([#​48639](https://github.com/mui/material-ui/issues/48639)) [@​Prakash1185](https://github.com/Prakash1185) - \[docs] Fix invalid UTF-8 in skill references ([#​48739](https://github.com/mui/material-ui/issues/48739)) [@​mturac](https://github.com/mturac) ##### Core - \[code-infra] Resolve Renovate dashboard warnings ([#​48700](https://github.com/mui/material-ui/issues/48700)) [@​Sushantplive](https://github.com/Sushantplive) - \[code-infra] Validate npm publishing through dry run ([#​48691](https://github.com/mui/material-ui/issues/48691)) [@​brijeshb42](https://github.com/brijeshb42) - \[code-infra] Run prettier after renovate update ([#​48754](https://github.com/mui/material-ui/issues/48754)) [@​Janpot](https://github.com/Janpot) - \[code-infra] Fix 'A11y results committed?' check on react-pinned nightly jobs ([#​48740](https://github.com/mui/material-ui/issues/48740)) [@​Janpot](https://github.com/Janpot) - \[core] Remove leftover Joy UI references ([#​48719](https://github.com/mui/material-ui/issues/48719)) [@​siriwatknp](https://github.com/siriwatknp) - \[code-infra] Bump react-router to 7.15.1 ([#​48725](https://github.com/mui/material-ui/issues/48725)) [@​Janpot](https://github.com/Janpot) - \[docs-infra] Drive docs analytics IDs via ANALYTICS\_ENV ([#​48694](https://github.com/mui/material-ui/issues/48694)) [@​Janpot](https://github.com/Janpot) - \[docs-infra] Pre-render API page descriptions ([#​48693](https://github.com/mui/material-ui/issues/48693)) [@​brijeshb42](https://github.com/brijeshb42) - \[code-infra]\[icons-material] Build lib/package.json with code-infra --no-expand ([#​48689](https://github.com/mui/material-ui/issues/48689)) [@​Janpot](https://github.com/Janpot) - \[code-infra] Fix react\@​18/next nightly workflow ([#​48635](https://github.com/mui/material-ui/issues/48635)) [@​Janpot](https://github.com/Janpot) All contributors of this release in alphabetical order: [@​brijeshb42](https://github.com/brijeshb42), [@​greymoth-jp](https://github.com/greymoth-jp), [@​Janpot](https://github.com/Janpot), [@​LukasTy](https://github.com/LukasTy), [@​michelengelen](https://github.com/michelengelen), [@​mturac](https://github.com/mturac), [@​Prakash1185](https://github.com/Prakash1185), [@​siriwatknp](https://github.com/siriwatknp), [@​Sushantplive](https://github.com/Sushantplive) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/459 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
c0f8a04185 |
fix(deps): update dependency redocusaurus to v2.5.2 (#456)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [redocusaurus](https://redocusaurus.vercel.app/) ([source](https://github.com/rohit-gohri/redocusaurus)) | [`2.5.0` → `2.5.2`](https://renovatebot.com/diffs/npm/redocusaurus/2.5.0/2.5.2) |  |  | --- ### Release Notes <details> <summary>rohit-gohri/redocusaurus (redocusaurus)</summary> ### [`v2.5.2`](https://github.com/rohit-gohri/redocusaurus/blob/HEAD/CHANGELOG.md#redocusaurus252) [Compare Source](https://github.com/rohit-gohri/redocusaurus/compare/v2.5.0...v2.5.2) ##### Patch Changes - [#​450](https://github.com/rohit-gohri/redocusaurus/pull/450) [`b84704a`](https://github.com/rohit-gohri/redocusaurus/commit/b84704ad2473a90e43f0aef5a0ca1f54c0c2328c) Thanks [@​copilot-swe-agent](https://github.com/apps/copilot-swe-agent)! - chore: upgrade Yarn, Node.js, and GitHub Actions </details> --------- Reviewed-on: https://gitea.com/gitea/docs/pulls/456 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandLunny Xiao
|
24fdff218d |
fix(deps): update dependency @mui/material to v9.1.2 (#450)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@mui/material](https://mui.com/material-ui/) ([source](https://github.com/mui/material-ui/tree/HEAD/packages/mui-material)) | [`9.1.1` → `9.1.2`](https://renovatebot.com/diffs/npm/@mui%2fmaterial/9.1.1/9.1.2) |  |  | --- ### Release Notes <details> <summary>mui/material-ui (@​mui/material)</summary> ### [`v9.1.2`](https://github.com/mui/material-ui/blob/HEAD/CHANGELOG.md#912) [Compare Source](https://github.com/mui/material-ui/compare/v9.1.1...v9.1.2) <!-- generated comparing v9.1.1..master --> *Jun 23, 2026* A big thanks to the 5 contributors who made this release possible. ##### `@mui/[email protected]` - \[autocomplete] Don't submit forms when committing `freeSolo` value with Enter key ([#​48679](https://github.com/mui/material-ui/issues/48679)) [@​mj12albert](https://github.com/mj12albert) - \[transitions] Fix RTG import in ESM ([#​48645](https://github.com/mui/material-ui/issues/48645)) [@​mj12albert](https://github.com/mj12albert) ##### `@mui/[email protected]` - \[InitColorSchemeScript] Fix script tag warning in Next.js 16 dev mode ([#​48671](https://github.com/mui/material-ui/issues/48671)) [@​siriwatknp](https://github.com/siriwatknp) ##### Docs - Fix typos in release instructions ([#​48687](https://github.com/mui/material-ui/issues/48687)) [@​brijeshb42](https://github.com/brijeshb42) - Update [@​mui/x-](https://github.com/mui/x-)\* packages to latest ([#​48661](https://github.com/mui/material-ui/issues/48661)) [@​Janpot](https://github.com/Janpot) ##### Core - \[code-infra] Convert leaf [@​mui/system](https://github.com/mui/system) .js+.d.ts pairs to TypeScript (part 1) ([#​48578](https://github.com/mui/material-ui/issues/48578)) [@​Janpot](https://github.com/Janpot) - \[code-infra] Bump to latest code-infra packages ([#​48672](https://github.com/mui/material-ui/issues/48672)) [@​brijeshb42](https://github.com/brijeshb42) - \[code-infra] Resolve remaining minimatch advisory ([#​48662](https://github.com/mui/material-ui/issues/48662)) [@​Janpot](https://github.com/Janpot) - \[code-infra] Bump nx to resolve minimatch advisory ([#​48658](https://github.com/mui/material-ui/issues/48658)) [@​Janpot](https://github.com/Janpot) - \[core] Drop @​babel/\* pnpm overrides ([#​48710](https://github.com/mui/material-ui/issues/48710)) [@​Janpot](https://github.com/Janpot) - \[docs-infra] Revert "Pin StackBlitz demo vite to v7 and plugin-react to v5" ([#​48709](https://github.com/mui/material-ui/issues/48709)) [@​Janpot](https://github.com/Janpot) - \[docs-infra] Fix code-block copy button broken on direct page load ([#​48653](https://github.com/mui/material-ui/issues/48653)) [@​brijeshb42](https://github.com/brijeshb42) - \[test] Stabilize Data Grid demo data in Argos screenshots ([#​48654](https://github.com/mui/material-ui/issues/48654)) [@​LukasTy](https://github.com/LukasTy) All contributors of this release in alphabetical order: [@​brijeshb42](https://github.com/brijeshb42), [@​Janpot](https://github.com/Janpot), [@​LukasTy](https://github.com/LukasTy), [@​mj12albert](https://github.com/mj12albert), [@​siriwatknp](https://github.com/siriwatknp) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/450 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
09bde5a387 |
chore(deps): update pnpm to v11.9.0 (#446)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`11.7.0` → `11.9.0`](https://renovatebot.com/diffs/npm/pnpm/11.7.0/11.9.0) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.9.0`](https://github.com/pnpm/pnpm/releases/tag/v11.9.0): pnpm 11.9 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.8.0...v11.9.0) #### Minor Changes - [`bae694f`](https://github.com/pnpm/pnpm/commit/bae694f): Some registries generate tarballs on-demand and cannot provide an integrity checksum in their package metadata. In that case pnpm now computes the integrity from the downloaded tarball and stores it in the lockfile, so the entry is verifiable on subsequent installs instead of being written without an integrity (which would fail the next install). This also applies to `--lockfile-only`: the tarball is downloaded so its integrity can be computed. A lockfile entry that is still missing its integrity is rejected as a `ERR_PNPM_MISSING_TARBALL_INTEGRITY` lockfile verification violation (the install fails closed) rather than being silently re-fetched. - [`6c35a43`](https://github.com/pnpm/pnpm/commit/6c35a43): Added `--exclude-peers` to `pnpm sbom`. With `auto-install-peers` (the default), peer dependencies resolve into the lockfile and are otherwise indistinguishable from the package's own dependencies. The flag drops peer dependencies (and any transitive subtree reachable only through them) from the SBOM. CycloneDX 1.7 has no scope or relationship that expresses "consumer-provided peer", so omission is the only spec-clean handling. The flag name matches `pnpm list --exclude-peers`; note the SBOM flag prunes a peer's exclusive subtree, which is stricter than `pnpm list` (which only hides leaf peers). #### Patch Changes - [`25a829e`](https://github.com/pnpm/pnpm/commit/25a829e): `pnpm audit --fix` now writes a single combined `minimumReleaseAgeExclude` entry per package (e.g. `[email protected].1 || 0.21.1`) instead of one entry per version, matching the format documented for the setting. Existing per-version entries in `pnpm-workspace.yaml` are merged into the combined form rather than left as duplicates. Installs that auto-collect immature versions into `minimumReleaseAgeExclude` now report the same combined entries, so the "Added N entries" message matches what is written to the manifest [#​12534](https://github.com/pnpm/pnpm/issues/12534). - [`1cbb5f2`](https://github.com/pnpm/pnpm/commit/1cbb5f2): Fixed non-deterministic peer resolution that could add or remove an optional transitive peer — for example `@babel/core`, reached through `styled-jsx` — from a package's peer-dependency suffix across otherwise identical installs, churning the lockfile and causing intermittent `pnpm dedupe --check` failures in CI. When a package's children are resolved by one occurrence (the "owner") and reused by a deeper consumer, whether that consumer inherited the owner's missing peers depended on whether the owner's resolution had finished yet — a race under concurrent resolution. The decision is now a function of the dependency graph's structure rather than resolution-completion order. - [`d577eea`](https://github.com/pnpm/pnpm/commit/d577eea): Fixed a Windows flakiness in `pnpm dlx` where a failed install could surface a spurious `EBUSY: resource busy or locked` error. The cleanup of a partially-populated dlx cache is now best-effort with retries and no longer masks the original error. - [`ec7cf70`](https://github.com/pnpm/pnpm/commit/ec7cf70): Shortened the `pnpm dlx` cache path so deep dependency trees no longer overflow Windows' `MAX_PATH`, which could make a dependency's lifecycle script fail with `spawn cmd.exe ENOENT`. - [`05b95ab`](https://github.com/pnpm/pnpm/commit/05b95ab): Fixed `pnpm` hanging (and crashing with an unhandled promise rejection) when a non-retryable network error such as `SELF_SIGNED_CERT_IN_CHAIN` occurs while fetching from a registry. The error is now rejected through the returned promise instead of being thrown inside the detached retry callback. - [`d3f68e2`](https://github.com/pnpm/pnpm/commit/d3f68e2): Fix a `pnpm audit` performance regression on lockfiles that contain dependency cycles. The reachable-vulnerability pruning added in pnpm 11.5.1 only memoized acyclic subtrees, so any node whose subtree touched a cycle — together with all of its ancestors — was recomputed on every query, making the path walk quadratic. Reachability is now computed once per node using Tarjan's strongly-connected-components algorithm, so cyclic graphs are handled in linear time [#​12212](https://github.com/pnpm/pnpm/issues/12212). The audit path walk also no longer recurses, so a deeply nested dependency graph can no longer overflow the call stack, and the install path to each finding is tracked without per-node copying, keeping memory linear in the graph depth. - [`322f88f`](https://github.com/pnpm/pnpm/commit/322f88f): Fix failed optional dependency updates so they don't rewrite unrelated dependency specs [#​11267](https://github.com/pnpm/pnpm/issues/11267). - [`1488db1`](https://github.com/pnpm/pnpm/commit/1488db1): When `enableGlobalVirtualStore` is toggled on for a project that was previously installed without it, stale hoisted symlinks under `node_modules/.pnpm/node_modules` are now replaced instead of being left pointing at the old per-project virtual store location [#​9739](https://github.com/pnpm/pnpm/issues/9739). - [`6545793`](https://github.com/pnpm/pnpm/commit/6545793): Fixed `pnpm install --ignore-workspace` overwriting the `allowBuilds` map in `pnpm-workspace.yaml`. The ignored builds of a package with a build script were auto-populated into `allowBuilds` even though `--ignore-workspace` was passed, clobbering committed `true`/`false` values with the `set this to true or false` placeholder [#​12469](https://github.com/pnpm/pnpm/issues/12469). - [`fbdc0eb`](https://github.com/pnpm/pnpm/commit/fbdc0eb): Fixed `minimumReleaseAgeExclude` and `trustPolicyExclude` so multiple exact-version entries for the same package behave the same as a single `||` disjunction entry. Previously only the first matching rule's versions were honored, so a config like `[[email protected], [email protected]]` could still flag `[email protected]` as violating `minimumReleaseAge`, while `[[email protected] || 2.5.6]` worked as expected [#​12463](https://github.com/pnpm/pnpm/issues/12463). - [`fa7004b`](https://github.com/pnpm/pnpm/commit/fa7004b): The in-memory package metadata cache is now populated on the exact-version disk fast path, so repeated resolutions of the same package within one install no longer re-read and re-parse the on-disk metadata. In large monorepos this brings the time for adding a new package down from minutes to seconds. The in-memory cache key now also includes the registry, so a package of the same name served by two different registries in a single install can no longer share a cache slot and resolve the wrong tarball. - [`0a154b1`](https://github.com/pnpm/pnpm/commit/0a154b1): Fixed `pnpm patch` dropping the package name (and leaking internal option fields) when the patched dependency resolves to a single git-hosted version. - [`4d3fe4b`](https://github.com/pnpm/pnpm/commit/4d3fe4b): The pnpr resolver endpoints moved under the reserved `/-/pnpr` namespace: `POST /v1/resolve` is now `POST /-/pnpr/v0/resolve` and `POST /v1/verify-lockfile` is now `POST /-/pnpr/v0/verify-lockfile`. The capability handshake at `GET /-/pnpr` advertises protocol version `0` to match. This keeps every pnpr-proprietary route in npm's reserved namespace, so it can never collide with a package path. - [`0ec878d`](https://github.com/pnpm/pnpm/commit/0ec878d): Removing a runtime dependency now removes the matching `devEngines.runtime` or `engines.runtime` entry that was materialized from it. Blank runtime selectors are normalized to `latest`. - [`17e7f2c`](https://github.com/pnpm/pnpm/commit/17e7f2c): `pnpm sbom` now emits a CycloneDX `issue-tracker` external reference for components (and the root) whose `package.json` declares a `bugs` URL. Email-only `bugs` entries are skipped, since the reference requires a URL. - [`a84d2a1`](https://github.com/pnpm/pnpm/commit/a84d2a1): Add `@pnpm/resolving.tarball-url`, which builds and recognizes the canonical npm tarball URL of a package. It vendors `getNpmTarballUrl` (previously the external `get-npm-tarball-url` package) and adds `isCanonicalRegistryTarballUrl`, the predicate the lockfile writer uses to decide whether a tarball URL is derivable from name+version+registry (and can therefore be omitted from `pnpm-lock.yaml`). Exposing `isCanonicalRegistryTarballUrl` lets a custom resolver (pnpmfile `resolvers`) fronting a proxy that serves tarballs on a non-canonical path (e.g. an ephemeral `localhost:<port>`) rewrite the resolved tarball to the canonical form, so nothing host-specific is persisted to the lockfile. Previously this logic was private to `@pnpm/lockfile.utils`. Two correctness fixes are included while consolidating the logic: the scoped-package unescape now handles uppercase `%2F` as well as `%2f` (percent-encoding is case-insensitive), and protocol-insensitive comparison strips only a leading `http(s)://` scheme instead of splitting on the first `://` (which could truncate URLs containing a later `://`). - [`852d537`](https://github.com/pnpm/pnpm/commit/852d537): Lockfile verification no longer reports a registry metadata fetch failure (for example a `403`/`401` on a private registry, or a network error) as `ERR_PNPM_TARBALL_URL_MISMATCH`. When the registry can't be reached to verify an entry, the install now aborts with the registry's own fetch error (such as `ERR_PNPM_FETCH_403`, which already explains the authentication situation) instead of mislabeling a transport failure as lockfile tampering. Registry fetch errors no longer leak basic-auth credentials embedded in the registry URL (`https://user:pass@host/`) into their message. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.8.0`](https://github.com/pnpm/pnpm/releases/tag/v11.8.0): pnpm 11.8 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.7.0...v11.8.0) #### Minor Changes - [`c112b61`](https://github.com/pnpm/pnpm/commit/c112b61): Added a `--dry-run` option to `pnpm install`. It runs a full dependency resolution and reports what an install would change, but writes nothing to disk (no lockfile, no `node_modules`) and always exits with code 0. This mirrors the preview semantics of `npm install --dry-run` [#​7340](https://github.com/pnpm/pnpm/issues/7340). - [`179ebc4`](https://github.com/pnpm/pnpm/commit/179ebc4): `pnpm run --no-bail` now exits with a non-zero exit code when any of the executed scripts fail, while still running every matched script to completion. This makes the exit-code behavior of `--no-bail` consistent between recursive and non-recursive runs (recursive runs already failed at the end). Previously, a non-recursive `pnpm run --no-bail` always exited with code 0, even when a script failed [#​8013](https://github.com/pnpm/pnpm/issues/8013). - [`0474a9c`](https://github.com/pnpm/pnpm/commit/0474a9c): Added support for generating Node.js package maps at `node_modules/.package-map.json` during isolated and hoisted installs. Added the `node-experimental-package-map` setting to inject the generated map into pnpm-managed Node.js script environments, and the `node-package-map-type` setting to choose between `standard` and `loose` package maps. - [`dcededc`](https://github.com/pnpm/pnpm/commit/dcededc): `pnpm sbom` now marks components reachable only through `devDependencies` with CycloneDX `scope: "excluded"` and the `cdx:npm:package:development` property. The `excluded` scope documents "component usage for test and other non-runtime purposes", which matches the semantics of a devDependency; the property is the CycloneDX npm-taxonomy marker emitted by `@cyclonedx/cyclonedx-npm`, so both modern (scope) and existing (property) consumers are covered. Components reachable at runtime (including installed `optionalDependencies`) omit `scope` and default to `required`. - [`1495cb0`](https://github.com/pnpm/pnpm/commit/1495cb0): Added per-package SBOM generation with `--out` and `--split` flags. Use `--out out/%s.cdx.json` to write one SBOM per workspace package to individual files, or `--split` for NDJSON output to stdout. When `--filter` selects a single package, the SBOM root component now uses that package's metadata. Workspace inter-dependencies (`workspace:` protocol) and their transitive dependencies are included. Author, repository, and license fall back to the root manifest when the package doesn't define them. - [`293921a`](https://github.com/pnpm/pnpm/commit/293921a): feat(view): support searching project manifest upward when package name is omitted When running `pnpm view` without a package name, the command now searches upward for the nearest project manifest (`package.json`, `package.yaml`, or `package.json5`) and uses its `name` field. If the manifest exists but lacks a `name` field, an error is thrown. This change also replaces the `find-up` dependency with `empathic` for improved performance and consistency across workspace tools. #### Patch Changes - [`29ab905`](https://github.com/pnpm/pnpm/commit/29ab905): Fixed `pnpm update` overriding the version range policy of a named catalog whose name parses as a version (e.g. `catalog:express4-21`). The `catalog:` reference carries no pinning of its own, so the prefix from the catalog entry (such as `~`) is now preserved instead of being widened to `^` [#​10321](https://github.com/pnpm/pnpm/issues/10321). - [`bee4bf4`](https://github.com/pnpm/pnpm/commit/bee4bf4): Security: validate config dependency names and versions from the env lockfile (`pnpm-lock.yaml`) before using them to build filesystem paths. A committed lockfile with a traversal-shaped `configDependencies` name (such as `../../PWNED`) or version (such as `../../../PWNED`) could previously cause `pnpm install` to create symlinks or write package files outside `node_modules/.pnpm-config` and the store. Names must now be valid npm package names and versions must be exact semver versions; the same validation is applied to optional subdependencies of config dependencies, and to the legacy workspace-manifest format before any lockfile is written. See [GHSA-qrv3-253h-g69c](https://github.com/pnpm/pnpm/security/advisories/GHSA-qrv3-253h-g69c). - [`96bdd57`](https://github.com/pnpm/pnpm/commit/96bdd57): Fix `link:` workspace protocol switching to `file:` after `pnpm rm` is run from inside a workspace package whose target workspace dependency has its own dependencies, when `injectWorkspacePackages: true` is set. Follow-up to [#​10575](https://github.com/pnpm/pnpm/pull/10575), which fixed the same symptom for workspace packages without dependencies. - [`302a2f7`](https://github.com/pnpm/pnpm/commit/302a2f7): No longer warn about using both `packageManager` and `devEngines.packageManager` when the two fields pin the same package manager at the same version with the same integrity hash (e.g. both `[email protected]+sha512.…`). Previously the hash was stripped from the legacy `packageManager` field but not from `devEngines.packageManager`, so even identical specifications looked like a mismatch [#​12028](https://github.com/pnpm/pnpm/issues/12028). The warning still fires on any genuine divergence, and several cases now state the specific reason instead of a single generic message: a different package manager, a different version, or contradictory integrity hashes for the same version. - [`3f0fb21`](https://github.com/pnpm/pnpm/commit/3f0fb21): Fixed the progress line showing leftover characters from external processes that write to the terminal between progress updates (e.g. an SSH passphrase prompt would leave a fragment like `added 0sa':`). The interactive reporter now redraws each frame in place, erasing to the end of the display before reprinting, so any such remnants are cleared [#​12350](https://github.com/pnpm/pnpm/issues/12350). - [`564619f`](https://github.com/pnpm/pnpm/commit/564619f): Fixed `pnpm approve-builds` reporting "no packages awaiting approval" when a build-script dependency whose approval was revoked (e.g. after `git stash` drops the `allowBuilds` from `pnpm-workspace.yaml`) is re-added. The revoked packages are now correctly recorded in `.modules.yaml` so `approve-builds` can find them. [#​12221](https://github.com/pnpm/pnpm/issues/12221) - [`3d1fd20`](https://github.com/pnpm/pnpm/commit/3d1fd20): Skip the redundant "target bin directory already contains an exe called node" warning on Windows when the existing `node.exe` already matches the target (same hard link or identical content) [pnpm/pnpm#12203](https://github.com/pnpm/pnpm/issues/12203). - [`1b02b47`](https://github.com/pnpm/pnpm/commit/1b02b47): Fix macOS Gatekeeper blocking native binaries (`.node`, `.dylib`, `.so`) by removing the `com.apple.quarantine` extended attribute after importing them from the store. When pnpm imports files from its content-addressable store into `node_modules`, macOS preserves extended attributes, including `com.apple.quarantine`. If this xattr is present on a store blob (e.g. it was first written under a Gatekeeper-enabled app such as a Git client), it propagates to `node_modules`, and Gatekeeper blocks the native binary from loading even though pnpm already verified the file's integrity against the lockfile. After importing a package, pnpm now strips `com.apple.quarantine` from its native binaries, matching Homebrew's behaviour of dropping quarantine from verified downloads. The cleanup is macOS-only, runs in a single batched `xattr` call per package, is restricted to native binaries (other files are untouched), and is non-fatal (it logs a warning on unexpected errors). Fixes [#​11056](https://github.com/pnpm/pnpm/issues/11056) - [`61969fb`](https://github.com/pnpm/pnpm/commit/61969fb): Fix `pnpm install` with `optimisticRepeatInstall` incorrectly reporting `Already up to date` when `pnpm-lock.yaml` changed but project manifests did not. This affected workflows such as checking out or restoring only the lockfile [#​12100](https://github.com/pnpm/pnpm/issues/12100). Also fixes `checkDepsStatus` to use the correct lockfile path when `useGitBranchLockfile` is enabled, so the optimistic fast-path and lockfile modification detection work with `pnpm-lock.<branch>.yaml` files instead of always stat'ing `pnpm-lock.yaml`. Merge-conflict detection now reads the resolved lockfile name as well, and with `mergeGitBranchLockfiles` enabled every `pnpm-lock.*.yaml` is scanned for modifications and conflicts. The git branch is now resolved by reading `.git/HEAD` directly (no process spawn) and uses the workspace directory rather than `process.cwd()`. - [`5c12968`](https://github.com/pnpm/pnpm/commit/5c12968): Fix recursive updates of transitive dependencies when the update command mixes transitive dependency patterns with direct dependency selectors. For example, `pnpm up -r "@​babel/core" uuid` now updates matching transitive `@babel/core` dependencies even when `uuid` is a direct dependency selector [#​12103](https://github.com/pnpm/pnpm/issues/12103). - [`9d79ba1`](https://github.com/pnpm/pnpm/commit/9d79ba1): Register the `pnpm update --no-save` flag in the CLI help and option parser. - [`0474a9c`](https://github.com/pnpm/pnpm/commit/0474a9c): Fixed `pnpm import` for Yarn v2 lockfiles when `js-yaml` v4 is installed. - [`9e0c375`](https://github.com/pnpm/pnpm/commit/9e0c375): Fixed `pnpm install` repeatedly prompting to remove and reinstall `node_modules` in a workspace package when `enableGlobalVirtualStore` is enabled. The post-install build step recorded a per-project `node_modules/.pnpm` virtual store directory in `node_modules/.modules.yaml`, overwriting the global `<storeDir>/links` value the install step had written. The next install then detected a virtual-store mismatch (`ERR_PNPM_UNEXPECTED_VIRTUAL_STORE`). The build step now derives the same global virtual store directory as the install step [#​12307](https://github.com/pnpm/pnpm/issues/12307). - [`223d060`](https://github.com/pnpm/pnpm/commit/223d060): Document the `--cpu`, `--os` and `--libc` flags in the output of `pnpm install --help`. These flags were already supported but were only documented on the website [#​12359](https://github.com/pnpm/pnpm/issues/12359). - [`e85aea2`](https://github.com/pnpm/pnpm/commit/e85aea2): Avoid reading `README.md` from disk when publishing if the publish manifest already provides a `readme` field. The README is now only read lazily, inside `createExportableManifest`, when it is actually needed. - [`3188ae7`](https://github.com/pnpm/pnpm/commit/3188ae7): Fixed `pnpm peers check` to accept loose peer dependency ranges such as `>=3.16.0 || >=4.0.0-` when the installed peer version satisfies the range [#​12149](https://github.com/pnpm/pnpm/issues/12149). - [`531f2a3`](https://github.com/pnpm/pnpm/commit/531f2a3): Fixed `pnpm update` rewriting a `workspace:` dependency that points at a local path (e.g. `workspace:../packages/foo/dist`) into a normalized `link:` or version-range specifier. Such specifiers are now preserved verbatim when the workspace protocol is preserved [#​3902](https://github.com/pnpm/pnpm/issues/3902). - [`fe66535`](https://github.com/pnpm/pnpm/commit/fe66535): Fixed a lockfile non-convergence bug where an incremental install kept a duplicate transitive dependency that a fresh install would not produce. When a package is reused from the lockfile, its child edges are taken verbatim and bypass the preferred-versions walk, so a transitive dependency could stay pinned to an older version even after a direct dependency resolved to a higher version that satisfies the same range. The resolver now refreshes such a stale pin to the higher direct-dependency version during resolution — so the older version is never resolved or fetched, and the incremental result converges to the fresh one. - [`6d35338`](https://github.com/pnpm/pnpm/commit/6d35338): `pnpm install` detects changes inside local file dependencies again. The optimistic repeat-install fast path only tracks manifest and lockfile modification times, so edits inside a local dependency's directory (or a repacked local tarball) were reported as "Already up to date". Projects with local file dependencies (`file:` and bare local path or tarball specifiers, declared directly or through `pnpm.overrides`) now always run a full install, which refetches those dependencies, matching pnpm v10 behavior [#​11795](https://github.com/pnpm/pnpm/issues/11795). - [`4ca9247`](https://github.com/pnpm/pnpm/commit/4ca9247): Preserve the existing Node.js runtime version prefix when resolving `node@runtime:<range>` to a concrete version. - [`30c7590`](https://github.com/pnpm/pnpm/commit/30c7590): Create shorter CAFS temporary package directories to leave room for lifecycle scripts that create IPC socket paths under TMPDIR. - [`13815ad`](https://github.com/pnpm/pnpm/commit/13815ad): Reporter output (warnings, progress) for `pnpm store` and `pnpm config` subcommands now goes to stderr instead of stdout. This fixes scripts that capture their stdout (e.g. `PNPM_STORE=$(pnpm store path)`, `pnpm config list --json | jq`) from getting warnings mixed into the result. - [`1c05876`](https://github.com/pnpm/pnpm/commit/1c05876): Avoid relinking unchanged child dependencies and remove stale child links during warm installs. - [`817f99d`](https://github.com/pnpm/pnpm/commit/817f99d): Fixed lockfile churn where a package's `transitivePeerDependencies` could be dropped (and shift between packages) when the package participates in a dependency cycle. A cycle re-entry resolves against truncated children, so it must not be cached as "pure"; otherwise sibling occurrences of the same package short-circuit and lose transitive peers depending on traversal order [#​5108](https://github.com/pnpm/pnpm/issues/5108). - [`eba03e0`](https://github.com/pnpm/pnpm/commit/eba03e0): Fix `pnpm install` reporting "Already up to date" after a catalog entry in `pnpm-workspace.yaml` was reverted to a previous version. After an update modified a catalog, the workspace state cache stored the pre-update catalog versions, so reverting the entry back to its original version was not detected as an outdated state [#​12418](https://github.com/pnpm/pnpm/issues/12418). - [`3b54d79`](https://github.com/pnpm/pnpm/commit/3b54d79): `pnpm update` now keeps lockfile `overrides` that resolve through a catalog in sync with the catalog. Previously, when an override referenced a catalog (e.g. `overrides: { foo: 'catalog:' }`) and `pnpm update` bumped that catalog entry, the lockfile's `catalogs` advanced while the resolved `overrides` kept the old version. The resulting lockfile was internally inconsistent, so a later `pnpm install --frozen-lockfile` failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`. - [`9d0a300`](https://github.com/pnpm/pnpm/commit/9d0a300): Fixed `pnpm version --recursive` so it honors the workspace selection. In recursive mode the version bump now applies to the packages resolved from the workspace filter (`selectedProjectsGraph`), matching the behavior of `pnpm publish --recursive`, instead of always bumping every workspace package [#​11348](https://github.com/pnpm/pnpm/issues/11348). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/docs/pulls/446 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
c9216685d5 |
chore(deps): update actions/checkout action to v7 (#445)
Reviewed-on: https://gitea.com/gitea/docs/pulls/445 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
6d5451918d |
fix(deps): update dependency @mui/material to v9.1.1 (#439)
Reviewed-on: https://gitea.com/gitea/docs/pulls/439 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
4b2bcc99a2 |
chore(deps): update pnpm to v10.34.3 (#440)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`10.34.2` → `10.34.3`](https://renovatebot.com/diffs/npm/pnpm/10.34.2/10.34.3) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v10.34.3`](https://github.com/pnpm/pnpm/releases/tag/v10.34.3): pnpm 10.34.3 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.34.2...v10.34.3) ##### ⚠️ Security fix — environment variables in a project `.npmrc` (action may be required) Following [GHSA-3qhv-2rgh-x77r](https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r), pnpm no longer expands `${ENV_VAR}` placeholders that come from a **repository-controlled** config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to: - the project/workspace `.npmrc` — `registry`, `@scope:registry`, proxy URLs, URL-scoped keys (`//host/…`), and credential values (`_authToken`, `_auth`, `_password`, `username`, `tokenHelper`, `cert`, `key`); - registry URLs in `pnpm-workspace.yaml`. This release also closes a bypass where a project `.npmrc` could set `userconfig`, `globalconfig`, or `prefix` to make pnpm load a repo-supplied file as *trusted* config (via `@pnpm/[email protected]`). Environment variables are **still** expanded in trusted config: your user-level `~/.npmrc`, the global config, CLI options, and environment config. **If your authentication broke after upgrading**, move the token out of the committed `.npmrc`: ```sh # Writes to your user/global config, not the repository: pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN" ``` Or keep the `${NPM_TOKEN}` line but put it in your user-level `~/.npmrc` instead of the repo. In **GitHub Actions**, `actions/setup-node` with `registry-url` already writes a user-level `.npmrc`, so `NODE_AUTH_TOKEN` keeps working. For other CI where editing each pipeline is hard, set `NPM_CONFIG_USERCONFIG=.npmrc` in the CI environment to declare the project `.npmrc` trusted. See <https://pnpm.io/npmrc> for full migration details. #### Patch Changes - Improved the warning printed when a project `.npmrc` uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running `pnpm config set "<key>" <value>` to store it in the global config, or by keeping the `${...}` line in the user-level `~/.npmrc` — with a link to <https://pnpm.io/npmrc>. - A repository-controlled project or workspace `.npmrc` can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set `userconfig`, `globalconfig`, or `prefix` to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set `tokenHelper`. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace `.npmrc` files are read. Fixed by upgrading `@pnpm/npm-conf` to `3.0.3`. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/docs/pulls/440 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
49dec05ddd |
chore(deps): update pnpm to v10.34.2 (#438)
Reviewed-on: https://gitea.com/gitea/docs/pulls/438 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
7737ef98a4 |
chore(deps): update dependency @mui/material to v9.1.0 (#437)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@mui/material](https://mui.com/material-ui/) ([source](https://github.com/mui/material-ui/tree/HEAD/packages/mui-material)) | [`9.0.1` → `9.1.0`](https://renovatebot.com/diffs/npm/@mui%2fmaterial/9.0.1/9.1.0) |  |  | --- ### Release Notes <details> <summary>mui/material-ui (@​mui/material)</summary> ### [`v9.1.0`](https://github.com/mui/material-ui/blob/HEAD/CHANGELOG.md#910) [Compare Source](https://github.com/mui/material-ui/compare/v9.0.1...v9.1.0) <!-- generated comparing v9.0.1..master --> *Jun 8, 2026* A big thanks to the 15 contributors who made this release possible. Here are some highlights ✨: - ⚙️ Support for the [prefers-reduced-motion](https://mui.com/material-ui/transitions/#reduced-motion) setting. - ♿️ Improved support for Windows High Contrast mode with the [enhanceHighContrast](https://mui.com/material-ui/customization/palette/#windows-high-contrast-mode) theme wrapper. ##### `@mui/[email protected]` - \[autocomplete] Enable clearing highlight when mouse leaves popup ([#​48354](https://github.com/mui/material-ui/issues/48354)) [@​mj12albert](https://github.com/mj12albert) - \[autocomplete] Fix `freeSolo` controlled values cleared by initial `null` ([#​48611](https://github.com/mui/material-ui/issues/48611)) [@​mj12albert](https://github.com/mj12albert) - \[autocomplete] Fix item removal when it receives focus from VoiceOver before using Backspace ([#​48572](https://github.com/mui/material-ui/issues/48572)) [@​silviuaavram](https://github.com/silviuaavram) - \[autocomplete] Fix `resetHighlightOnMouseLeave` JSdoc ([#​48536](https://github.com/mui/material-ui/issues/48536)) [@​mj12albert](https://github.com/mj12albert) - \[autocomplete] Guard against null inputRef during unmount ([#​48617](https://github.com/mui/material-ui/issues/48617)) [@​noam3127](https://github.com/noam3127) - \[badge] Add `aria-hidden` to badge content and polish docs demos ([#​48471](https://github.com/mui/material-ui/issues/48471)) [@​mj12albert](https://github.com/mj12albert) - \[badge] Use inline CSS variables for anchorOrigin/overlap positioning ([#​48549](https://github.com/mui/material-ui/issues/48549)) [@​siriwatknp](https://github.com/siriwatknp) - \[button] Fix customized flex gap styles ([#​48542](https://github.com/mui/material-ui/issues/48542)) [@​mj12albert](https://github.com/mj12albert) - \[dialog] Fix unwanted `DialogPaper` focus ring ([#​48535](https://github.com/mui/material-ui/issues/48535)) [@​mj12albert](https://github.com/mj12albert) - \[focus trap] Fix incorrect tab order when `tabIndex >= 1` ([#​48546](https://github.com/mui/material-ui/issues/48546)) [@​mj12albert](https://github.com/mj12albert) - \[progress] Show runtime errors only once ([#​48591](https://github.com/mui/material-ui/issues/48591)) [@​silviuaavram](https://github.com/silviuaavram) - \[select] Allow spacebar to select elements ([#​48615](https://github.com/mui/material-ui/issues/48615)) [@​silviuaavram](https://github.com/silviuaavram) - \[select] Support typeahead when closed ([#​48563](https://github.com/mui/material-ui/issues/48563)) [@​mj12albert](https://github.com/mj12albert) - \[step button] Choose higher contrast ripple color for dark mode focus ([#​48612](https://github.com/mui/material-ui/issues/48612)) [@​silviuaavram](https://github.com/silviuaavram) - \[stepper] Include StepConnector inside Step element ([#​48492](https://github.com/mui/material-ui/issues/48492)) [@​silviuaavram](https://github.com/silviuaavram) - \[stepper] Proper support for vertical alternativeLabel ([#​48485](https://github.com/mui/material-ui/issues/48485)) [@​silviuaavram](https://github.com/silviuaavram) - \[tabs] Fix React 18 roving tabindex and dedupe invalid-value warning ([#​48605](https://github.com/mui/material-ui/issues/48605)) [@​Janpot](https://github.com/Janpot) - \[theme] Add HighContrast theme enhancer ([#​48319](https://github.com/mui/material-ui/issues/48319)) [@​silviuaavram](https://github.com/silviuaavram) - \[timeline item] Fix extra ::before spacing when TimelineOppositeContent is present ([#​46663](https://github.com/mui/material-ui/issues/46663)) [@​tyalau](https://github.com/tyalau) - \[tooltip] Prevent stuck-open tooltip when child becomes disabled ([#​48606](https://github.com/mui/material-ui/issues/48606)) [@​Janpot](https://github.com/Janpot) - \[transitions] Custom `Transition` component ([#​48325](https://github.com/mui/material-ui/issues/48325)) [@​mj12albert](https://github.com/mj12albert) - \[transitions] Support `prefers-reduced-motion` ([#​48357](https://github.com/mui/material-ui/issues/48357)) [@​mj12albert](https://github.com/mj12albert) ##### `@mui/[email protected]` - \[utils] Prevent prototype pollution in fastDeepAssign ([#​48580](https://github.com/mui/material-ui/issues/48580)) [@​Janpot](https://github.com/Janpot) ##### Docs - \[docs] Add function `slotProps` documentation ([#​48574](https://github.com/mui/material-ui/issues/48574)) [@​mj12albert](https://github.com/mj12albert) - \[docs] Clarify styled-components version compatibility ([#​48533](https://github.com/mui/material-ui/issues/48533)) [@​nightt5879](https://github.com/nightt5879) - \[docs] Fix broken URLs ([#​48520](https://github.com/mui/material-ui/issues/48520)) [@​oliviertassinari](https://github.com/oliviertassinari) - \[docs] Fix invalid JSON in Zed MCP setup example ([#​48490](https://github.com/mui/material-ui/issues/48490)) [@​pavan-sh](https://github.com/pavan-sh) - \[docs] Mention release version for enhanceHighContrast ([#​48609](https://github.com/mui/material-ui/issues/48609)) [@​silviuaavram](https://github.com/silviuaavram) - \[docs] Remove outdated MUI X v8 notification ([#​48600](https://github.com/mui/material-ui/issues/48600)) [@​cherniavskii](https://github.com/cherniavskii) - \[docs] Remove redundant enhanceHighContrast information ([#​48632](https://github.com/mui/material-ui/issues/48632)) [@​silviuaavram](https://github.com/silviuaavram) - \[docs-infra] Decrease loaded bundle size on docs ([#​48584](https://github.com/mui/material-ui/issues/48584)) [@​brijeshb42](https://github.com/brijeshb42) - \[docs-infra] Drop multi-locale plumbing from API pages ([#​48370](https://github.com/mui/material-ui/issues/48370)) [@​brijeshb42](https://github.com/brijeshb42) - \[docs-infra] Fix Cookie banner heading ([#​48529](https://github.com/mui/material-ui/issues/48529)) [@​oliviertassinari](https://github.com/oliviertassinari) - \[docs-infra] Infinitely cache all static assets ([#​48627](https://github.com/mui/material-ui/issues/48627)) [@​brijeshb42](https://github.com/brijeshb42) - \[docs-infra] Remove outdated noSEOadvantage entries ([#​48527](https://github.com/mui/material-ui/issues/48527)) [@​oliviertassinari](https://github.com/oliviertassinari) - \[docs-infra] Restore build-only invariant throws via `NEXT_RUNTIME` guard ([#​48475](https://github.com/mui/material-ui/issues/48475)) [@​Janpot](https://github.com/Janpot) - \[docs-infra] Test HTML validation in broken links checker ([#​48088](https://github.com/mui/material-ui/issues/48088)) [@​Janpot](https://github.com/Janpot) - \[docs]\[icons] Fix Font Awesome Chip demo in dark mode ([#​48576](https://github.com/mui/material-ui/issues/48576)) [@​siriwatknp](https://github.com/siriwatknp) - \[docs]\[icons] Remove redundant font awesome demo ([#​48493](https://github.com/mui/material-ui/issues/48493)) [@​ZeeshanTamboli](https://github.com/ZeeshanTamboli) - \[docs]\[modal] Add nested modal guidance ([#​46507](https://github.com/mui/material-ui/issues/46507)) [@​JakeSaterlay](https://github.com/JakeSaterlay) - \[docs]\[stepper] Fix focus management in examples ([#​48494](https://github.com/mui/material-ui/issues/48494)) [@​silviuaavram](https://github.com/silviuaavram) ##### Core - Eslint markdown ([#​48371](https://github.com/mui/material-ui/issues/48371)) [@​Janpot](https://github.com/Janpot) - \[agents] Fix some docs links ([#​48561](https://github.com/mui/material-ui/issues/48561)) [@​silviuaavram](https://github.com/silviuaavram) - \[blog] Copy editing improvement on v9 announcement blog posts ([#​48543](https://github.com/mui/material-ui/issues/48543)) [@​joserodolfofreitas](https://github.com/joserodolfofreitas) - \[code-infra] Cleanup unused jss packages ([#​48590](https://github.com/mui/material-ui/issues/48590)) [@​brijeshb42](https://github.com/brijeshb42) - \[code-infra] Collapse canary workflows into nightly and nightly-cron ([#​48556](https://github.com/mui/material-ui/issues/48556)) [@​Janpot](https://github.com/Janpot) - \[code-infra] Convert [@​mui/private-theming](https://github.com/mui/private-theming) to TypeScript ([#​48565](https://github.com/mui/material-ui/issues/48565)) [@​Janpot](https://github.com/Janpot) - \[code-infra] Convert [@​mui/styled-engine](https://github.com/mui/styled-engine) to TypeScript ([#​48544](https://github.com/mui/material-ui/issues/48544)) [@​Janpot](https://github.com/Janpot) - \[code-infra] Convert [@​mui/styled-engine-sc](https://github.com/mui/styled-engine-sc) to TypeScript ([#​48577](https://github.com/mui/material-ui/issues/48577)) [@​Janpot](https://github.com/Janpot) - \[code-infra] Fix duplicate resource\_class in test\_regressions CI job ([#​48601](https://github.com/mui/material-ui/issues/48601)) [@​LukasTy](https://github.com/LukasTy) - \[code-infra] Make [@​mui/internal-docs-utils](https://github.com/mui/internal-docs-utils) compatible with TypeScript 6 ([#​48594](https://github.com/mui/material-ui/issues/48594)) [@​Janpot](https://github.com/Janpot) - \[code-infra] Migrate CircleCI jobs to Gen2 resource classes ([#​48593](https://github.com/mui/material-ui/issues/48593)) [@​LukasTy](https://github.com/LukasTy) - \[code-infra] Parallelize visual regression screenshots ([#​48557](https://github.com/mui/material-ui/issues/48557)) [@​Janpot](https://github.com/Janpot) - \[code-infra] Run nightly-cron on v7.x ([#​48579](https://github.com/mui/material-ui/issues/48579)) [@​Janpot](https://github.com/Janpot) - \[core] Fix typescript\@​next typecheck ([#​48587](https://github.com/mui/material-ui/issues/48587)) [@​Janpot](https://github.com/Janpot) - \[pnpm] Add security settings to pnpm-workspace.yaml ([#​48582](https://github.com/mui/material-ui/issues/48582)) [@​Janpot](https://github.com/Janpot) - \[styled-engine-sc] Fix compatibility with Vite and Vitest ([#​48558](https://github.com/mui/material-ui/issues/48558)) [@​mj12albert](https://github.com/mj12albert) - \[test] Add axe-core tests for mui-material ([#​48341](https://github.com/mui/material-ui/issues/48341)) [@​siriwatknp](https://github.com/siriwatknp) - \[test] Configure Tailwind CSS in the visual-regression app ([#​48575](https://github.com/mui/material-ui/issues/48575)) [@​Janpot](https://github.com/Janpot) All contributors of this release in alphabetical order: [@​brijeshb42](https://github.com/brijeshb42), [@​cherniavskii](https://github.com/cherniavskii), [@​JakeSaterlay](https://github.com/JakeSaterlay), [@​Janpot](https://github.com/Janpot), [@​joserodolfofreitas](https://github.com/joserodolfofreitas), [@​LukasTy](https://github.com/LukasTy), [@​mj12albert](https://github.com/mj12albert), [@​nightt5879](https://github.com/nightt5879), [@​noam3127](https://github.com/noam3127), [@​oliviertassinari](https://github.com/oliviertassinari), [@​pavan-sh](https://github.com/pavan-sh), [@​silviuaavram](https://github.com/silviuaavram), [@​siriwatknp](https://github.com/siriwatknp), [@​tyalau](https://github.com/tyalau), [@​ZeeshanTamboli](https://github.com/ZeeshanTamboli) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/docs/pulls/437 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
45165ceb22 |
chore(deps): update pnpm to v10.34.1 (#430)
Reviewed-on: https://gitea.com/gitea/docs/pulls/430 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
fb856b8432 |
chore(deps): update dependency @easyops-cn/docusaurus-search-local to v0.55.2 (#431)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@easyops-cn/docusaurus-search-local](https://github.com/easyops-cn/docusaurus-search-local) ([source](https://github.com/easyops-cn/docusaurus-search-local/tree/HEAD/packages/docusaurus-search-local)) | [`0.55.1` → `0.55.2`](https://renovatebot.com/diffs/npm/@easyops-cn%2fdocusaurus-search-local/0.55.1/0.55.2) |  |  | --- ### Release Notes <details> <summary>easyops-cn/docusaurus-search-local (@​easyops-cn/docusaurus-search-local)</summary> ### [`v0.55.2`](https://github.com/easyops-cn/docusaurus-search-local/releases/tag/v0.55.2) [Compare Source](https://github.com/easyops-cn/docusaurus-search-local/compare/v0.55.1...v0.55.2) ##### Bug Fixes - some languages need lunr wordcut ([1e60641](https://github.com/easyops-cn/docusaurus-search-local/commit/1e60641f5d26399ec2407f5c36ea28f6a3048028)) - some languages need lunr wordcut ([d871555](https://github.com/easyops-cn/docusaurus-search-local/commit/d87155582f62b1fb42377f3af0cfc17f8784ff47)), closes [#​438](https://github.com/easyops-cn/docusaurus-search-local/issues/438) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/docs/pulls/431 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
8bb0e9f105 |
chore(deps): update react monorepo to v19.2.7 (#432)
Reviewed-on: https://gitea.com/gitea/docs/pulls/432 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
eea1d90216 |
chore(deps): update react monorepo to v19.2.6 (#423)
Reviewed-on: https://gitea.com/gitea/docs/pulls/423 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
19c2342e2f |
chore(deps): update dependency @mui/material to v9.0.1 (#422)
Reviewed-on: https://gitea.com/gitea/docs/pulls/422 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
|
d9effabc6c |
chore(deps): update pnpm to v10.33.4 (#418)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`10.33.2` → `10.33.4`](https://renovatebot.com/diffs/npm/pnpm/10.33.2/10.33.4) |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/114) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjAuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/418 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
173bc20908 |
chore(deps): update docusaurus monorepo to v3.10.1 (#392)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@docusaurus/core](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus)) | [`3.10.0` → `3.10.1`](https://renovatebot.com/diffs/npm/@docusaurus%2fcore/3.10.0/3.10.1) |  |  | | [@docusaurus/faster](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-faster)) | [`3.10.0` → `3.10.1`](https://renovatebot.com/diffs/npm/@docusaurus%2ffaster/3.10.0/3.10.1) |  |  | | [@docusaurus/module-type-aliases](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-module-type-aliases)) | [`3.10.0` → `3.10.1`](https://renovatebot.com/diffs/npm/@docusaurus%2fmodule-type-aliases/3.10.0/3.10.1) |  |  | | [@docusaurus/plugin-content-docs](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs)) | [`3.10.0` → `3.10.1`](https://renovatebot.com/diffs/npm/@docusaurus%2fplugin-content-docs/3.10.0/3.10.1) |  |  | | [@docusaurus/preset-classic](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic)) | [`3.10.0` → `3.10.1`](https://renovatebot.com/diffs/npm/@docusaurus%2fpreset-classic/3.10.0/3.10.1) |  |  | --- ### Release Notes <details> <summary>facebook/docusaurus (@​docusaurus/core)</summary> ### [`v3.10.1`](https://github.com/facebook/docusaurus/blob/HEAD/CHANGELOG.md#3101-2026-04-30) [Compare Source](https://github.com/facebook/docusaurus/compare/v3.10.0...v3.10.1) ##### 🐛 Bug Fix - `docusaurus-bundler` - [#​11981](https://github.com/facebook/docusaurus/pull/11981) fix(bundler): fix v3 webpackbar bug due to webpack breaking change ([@​slorber](https://github.com/slorber)) ##### 🔧 Maintenance - `docusaurus` - [#​11982](https://github.com/facebook/docusaurus/pull/11982) chore: cherry-pick commits for v3.10.1 patch release ([@​slorber](https://github.com/slorber)) ##### Committers: 1 - Sébastien Lorber ([@​slorber](https://github.com/slorber)) </details> --- Reviewed-on: https://gitea.com/gitea/docs/pulls/392 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
a0802c6748 |
chore(deps): update pnpm to v10.33.2 (#388)
Reviewed-on: https://gitea.com/gitea/docs/pulls/388 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
9fe613c7de |
chore(deps): update react monorepo to v19.2.5 (#379)
Reviewed-on: https://gitea.com/gitea/docs/pulls/379 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
3c6ead6e59 |
chore(deps): update pnpm/action-setup action to v6 (#382)
Reviewed-on: https://gitea.com/gitea/docs/pulls/382 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
c2b6f71085 |
chore(deps): update docusaurus monorepo to v3.10.0 (#374)
Reviewed-on: https://gitea.com/gitea/docs/pulls/374 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
b339770f3c |
fix(deps): update dependency @mui/material to v9 (#375)
Reviewed-on: https://gitea.com/gitea/docs/pulls/375 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
c39f423da6 |
chore(deps): update pnpm to v10.33.0 (#370)
Reviewed-on: https://gitea.com/gitea/docs/pulls/370 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Botandsilverwind
|
74c1904736 |
chore(deps): update pnpm/action-setup action to v5 (#365)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pnpm/action-setup](https://github.com/pnpm/action-setup) | action | major | `v4` → `v5` | --- ### Release Notes <details> <summary>pnpm/action-setup (pnpm/action-setup)</summary> ### [`v5`](https://github.com/pnpm/action-setup/compare/v4...v5) [Compare Source](https://github.com/pnpm/action-setup/compare/v4...v5) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My43Ni41IiwidXBkYXRlZEluVmVyIjoiNDMuNzYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/365 Reviewed-by: silverwind <[email protected]> Reviewed-by: Nicolas <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
243178ce69 |
chore(deps): update pnpm to v10.32.1 (#363)
Reviewed-on: https://gitea.com/gitea/docs/pulls/363 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
22834c60c8 |
chore(deps): update dependency @mui/material to v7.3.9 (#356)
Reviewed-on: https://gitea.com/gitea/docs/pulls/356 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
29908bd89a |
chore(deps): update pnpm to v10.32.0 (#358)
Reviewed-on: https://gitea.com/gitea/docs/pulls/358 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
4ca96900ee |
chore(deps): update pnpm to v10.31.0 (#345)
Reviewed-on: https://gitea.com/gitea/docs/pulls/345 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
9aac00df18 |
chore(deps): update dependency @easyops-cn/docusaurus-search-local to v0.55.1 (#354)
Reviewed-on: https://gitea.com/gitea/docs/pulls/354 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
6c587e819f |
fix(deps): update dependency @easyops-cn/docusaurus-search-local to ^0.55.0 (#344)
Reviewed-on: https://gitea.com/gitea/docs/pulls/344 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
4b8bf4a2cd |
chore(deps): update dependency @mui/material to v7.3.8 (#343)
Reviewed-on: https://gitea.com/gitea/docs/pulls/343 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
d071d5ed50 |
chore(deps): update pnpm to v10.29.3 (#342)
Reviewed-on: https://gitea.com/gitea/docs/pulls/342 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
d5e2f3ed5b |
chore(deps): update dependency @easyops-cn/docusaurus-search-local to v0.54.1 (#341)
Reviewed-on: https://gitea.com/gitea/docs/pulls/341 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
672ae2ae2f |
chore(deps): update pnpm to v10.29.2 (#339)
Reviewed-on: https://gitea.com/gitea/docs/pulls/339 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
2357df4a5d |
fix(deps): update dependency @easyops-cn/docusaurus-search-local to ^0.54.0 (#338)
Reviewed-on: https://gitea.com/gitea/docs/pulls/338 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
be69b0e820 |
chore(deps): update pnpm to v10.29.1 (#335)
Reviewed-on: https://gitea.com/gitea/docs/pulls/335 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
28c7352a3a |
fix(deps): update dependency @easyops-cn/docusaurus-search-local to ^0.53.0 (#334)
Reviewed-on: https://gitea.com/gitea/docs/pulls/334 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
4ae4299d5c |
chore(deps): update aws-actions/configure-aws-credentials action to v6 (#333)
Reviewed-on: https://gitea.com/gitea/docs/pulls/333 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
bff1114ff6 |
chore(deps): update pnpm to v10.28.2 (#332)
Reviewed-on: https://gitea.com/gitea/docs/pulls/332 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
ed033ac9ed |
chore(deps): update dependency node to v24 (#329)
Reviewed-on: https://gitea.com/gitea/docs/pulls/329 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
91f0151966 |
fix(deps): update dependency @easyops-cn/docusaurus-search-local to v0.52.3 (#325)
Reviewed-on: https://gitea.com/gitea/docs/pulls/325 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
ac0bb5e71d |
fix(deps): update react monorepo to v19.2.4 (#324)
Reviewed-on: https://gitea.com/gitea/docs/pulls/324 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
228b6be436 |
fix(deps): update dependency @mui/material to v7.3.7 (#319)
Reviewed-on: https://gitea.com/gitea/docs/pulls/319 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
188314ea14 |
chore(deps): update actions/cache action to v5 (#314)
Reviewed-on: https://gitea.com/gitea/docs/pulls/314 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
44db30edac |
fix(deps): update react monorepo to v19.2.3 (#313)
Reviewed-on: https://gitea.com/gitea/docs/pulls/313 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
d62d758d36 |
fix(deps): update dependency @easyops-cn/docusaurus-search-local to v0.52.2 (#310)
Reviewed-on: https://gitea.com/gitea/docs/pulls/310 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
4c7d0220c9 |
fix(deps): update dependency @mui/material to v7.3.6 (#311)
Reviewed-on: https://gitea.com/gitea/docs/pulls/311 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
e0888b2130 |
fix(deps): update react monorepo to v19.2.1 (#312)
Reviewed-on: https://gitea.com/gitea/docs/pulls/312 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
8ba2066894 |
chore(deps): update actions/checkout action to v6 (#303)
Reviewed-on: https://gitea.com/gitea/docs/pulls/303 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandLunny Xiao
|
00a36086b0 |
fix(deps): update docusaurus monorepo to v3.9.2 (#276)
This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [@docusaurus/core](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus)) | [`3.8.1` -> `3.9.2`](https://renovatebot.com/diffs/npm/@docusaurus%2fcore/3.8.1/3.9.2) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [@docusaurus/faster](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-faster)) | [`3.8.1` -> `3.9.2`](https://renovatebot.com/diffs/npm/@docusaurus%2ffaster/3.8.1/3.9.2) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [@docusaurus/module-type-aliases](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-module-type-aliases)) | [`3.8.1` -> `3.9.2`](https://renovatebot.com/diffs/npm/@docusaurus%2fmodule-type-aliases/3.8.1/3.9.2) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | | [@docusaurus/preset-classic](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic)) | [`3.8.1` -> `3.9.2`](https://renovatebot.com/diffs/npm/@docusaurus%2fpreset-classic/3.8.1/3.9.2) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>facebook/docusaurus (@​docusaurus/core)</summary> ### [`v3.9.2`](https://github.com/facebook/docusaurus/blob/HEAD/CHANGELOG.md#392-2025-10-17) [Compare Source](https://github.com/facebook/docusaurus/compare/v3.9.1...v3.9.2) ##### 🐛 Bug Fix - `docusaurus-plugin-content-docs` - [#​11490](https://github.com/facebook/docusaurus/pull/11490) fix(docs): add support for missing `sidebar_key` front matter attribute ([@​slorber](https://github.com/slorber)) - `docusaurus-cssnano-preset` - [#​11487](https://github.com/facebook/docusaurus/pull/11487) fix(cssnano-preset): disable CSS counter minification ([@​YDKK](https://github.com/YDKK)) - `docusaurus-theme-search-algolia` - [#​11468](https://github.com/facebook/docusaurus/pull/11468) fix(theme-search-algolia): Fix Algolia AskAI validation logic ([@​slorber](https://github.com/slorber)) - `docusaurus-theme-translations` - [#​11431](https://github.com/facebook/docusaurus/pull/11431) fix(theme-translation): add missing Polish (pl) theme translations ([@​mariuszkrzaczkowski](https://github.com/mariuszkrzaczkowski)) - `docusaurus-theme-classic`, `docusaurus-theme-common` - [#​11466](https://github.com/facebook/docusaurus/pull/11466) fix(theme): Fix CSS `scroll-margin-top` when clicking footnote items, factorize code ([@​slorber](https://github.com/slorber)) - `docusaurus` - [#​11452](https://github.com/facebook/docusaurus/pull/11452) fix(core): allow `i18n.localeConfigs.translate` in validation ([@​trofim24](https://github.com/trofim24)) - `docusaurus-theme-mermaid` - [#​11437](https://github.com/facebook/docusaurus/pull/11437) fix(theme-mermaid): Fix Mermaid ELK layout dependency required bug on v3.9 ([@​slorber](https://github.com/slorber)) ##### :running\_woman: Performance - `docusaurus-theme-mermaid` - [#​11438](https://github.com/facebook/docusaurus/pull/11438) perf(theme-mermaid): lazy load the Mermaid library ([@​slorber](https://github.com/slorber)) ##### :nail\_care: Polish - `docusaurus-theme-classic` - [#​11463](https://github.com/facebook/docusaurus/pull/11463) fix(theme): remove "Edit this page" button from print view ([@​richk21](https://github.com/richk21)) ##### 🤖 Dependencies - [#​11479](https://github.com/facebook/docusaurus/pull/11479) chore(deps): bump stefanzweifel/git-auto-commit-action from 6 to 7 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11480](https://github.com/facebook/docusaurus/pull/11480) chore(deps): bump github/codeql-action from 3.26.5 to 4.30.8 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11481](https://github.com/facebook/docusaurus/pull/11481) chore(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11446](https://github.com/facebook/docusaurus/pull/11446) chore(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) ##### :globe\_with\_meridians: Translations - `docusaurus-theme-translations` - [#​11484](https://github.com/facebook/docusaurus/pull/11484) fix(translations): improve Arabic theme translations ([@​maysara-elshewehy](https://github.com/maysara-elshewehy)) ##### Committers: 9 - Alexander Trofimov ([@​trofim24](https://github.com/trofim24)) - Dan Roscigno ([@​DanRoscigno](https://github.com/DanRoscigno)) - Eleni Grosdouli ([@​egrosdou01](https://github.com/egrosdou01)) - Ethan ([@​ethanppl](https://github.com/ethanppl)) - Mariusz Krzaczkowski ([@​mariuszkrzaczkowski](https://github.com/mariuszkrzaczkowski)) - Maysara ([@​maysara-elshewehy](https://github.com/maysara-elshewehy)) - Richa Kiran ([@​richk21](https://github.com/richk21)) - Sébastien Lorber ([@​slorber](https://github.com/slorber)) - [@​YDKK](https://github.com/YDKK) ### [`v3.9.1`](https://github.com/facebook/docusaurus/blob/HEAD/CHANGELOG.md#391-2025-09-26) [Compare Source](https://github.com/facebook/docusaurus/compare/v3.9.0...v3.9.1) ##### 🐛 Bug Fix - `docusaurus` - [#​11434](https://github.com/facebook/docusaurus/pull/11434) fix(core): fix Docusaurus outDir for sites using baseUrl ([@​slorber](https://github.com/slorber)) ##### Committers: 1 - Sébastien Lorber ([@​slorber](https://github.com/slorber)) ### [`v3.9.0`](https://github.com/facebook/docusaurus/blob/HEAD/CHANGELOG.md#390-2025-09-25) [Compare Source](https://github.com/facebook/docusaurus/compare/v3.8.1...v3.9.0) ##### 🚀 New Feature - `docusaurus-theme-search-algolia` - [#​11421](https://github.com/facebook/docusaurus/pull/11421) feat(theme-search-algolia): use DocSearch v4.1, optimize integration ([@​slorber](https://github.com/slorber)) - `docusaurus-plugin-content-blog`, `docusaurus-theme-classic` - [#​11425](https://github.com/facebook/docusaurus/pull/11425) feat(blog): Add support for email social icon + resize default social icon a bit ([@​slorber](https://github.com/slorber)) - `docusaurus-theme-classic`, `docusaurus-theme-common` - [#​11426](https://github.com/facebook/docusaurus/pull/11426) feat(theme): Add theme-tabs-container stable className ([@​slorber](https://github.com/slorber)) - `docusaurus-theme-classic`, `docusaurus-theme-search-algolia`, `docusaurus-theme-translations` - [#​11327](https://github.com/facebook/docusaurus/pull/11327) feat(search): add runtime support for DocSearch v4 ([@​dylantientcheu](https://github.com/dylantientcheu)) - `docusaurus-faster`, `docusaurus` - [#​11415](https://github.com/facebook/docusaurus/pull/11415) feat(faster): upgrade Rspack to 1.5, use lazyBarrel experiment, remove deprecated option ([@​slorber](https://github.com/slorber)) - [#​11294](https://github.com/facebook/docusaurus/pull/11294) feat(faster): Upgrade to Rspack 1.4 ([@​slorber](https://github.com/slorber)) - `docusaurus-utils` - [#​11397](https://github.com/facebook/docusaurus/pull/11397) feat(mdx): resolve `@site/*` markdown links, fix resolution priority bugs ([@​slorber](https://github.com/slorber)) - `docusaurus-theme-mermaid` - [#​11357](https://github.com/facebook/docusaurus/pull/11357) feat(mermaid): support elk layout ([@​Feez2403](https://github.com/Feez2403)) - `docusaurus-plugin-pwa`, `docusaurus-theme-classic`, `docusaurus-theme-common`, `docusaurus-types`, `docusaurus-utils`, `docusaurus` - [#​11316](https://github.com/facebook/docusaurus/pull/11316) feat(core): Add `i18n.localeConfigs[locale].{url,baseUrl}` config options, fix multi-domain deployments ([@​slorber](https://github.com/slorber)) - `docusaurus-plugin-content-blog`, `docusaurus-plugin-content-docs`, `docusaurus-plugin-content-pages`, `docusaurus-types`, `docusaurus-utils`, `docusaurus` - [#​11304](https://github.com/facebook/docusaurus/pull/11304) feat(core): add `i18n.localeConfigs.translate` + skip translation process if `i18n/<locale>` dir doesn't exist ([@​slorber](https://github.com/slorber)) - `docusaurus-plugin-content-docs` - [#​11228](https://github.com/facebook/docusaurus/pull/11228) feat(docs): sidebar item `key` attribute - fix docs translations key conflicts ([@​slorber](https://github.com/slorber)) - `create-docusaurus` - [#​11293](https://github.com/facebook/docusaurus/pull/11293) feat(create-docusaurus): use respectPrefersColorScheme in init template ([@​slorber](https://github.com/slorber)) - `docusaurus-mdx-loader`, `docusaurus-types`, `docusaurus` - [#​11282](https://github.com/facebook/docusaurus/pull/11282) feat(core): add `siteConfig.markdown.emoji` config option to disable `remark-emoji` ([@​slorber](https://github.com/slorber)) - `create-docusaurus`, `docusaurus-mdx-loader`, `docusaurus-plugin-content-blog`, `docusaurus-plugin-content-docs`, `docusaurus-types`, `docusaurus` - [#​11283](https://github.com/facebook/docusaurus/pull/11283) feat(core): Add `siteConfig.markdown.hooks`, deprecate `siteConfig.onBrokenMarkdownLinks` ([@​slorber](https://github.com/slorber)) ##### 🐛 Bug Fix - `docusaurus-theme-classic`, `docusaurus` - [#​11422](https://github.com/facebook/docusaurus/pull/11422) fix(theme): fix copy of indented code blocks, replace copy-text-to-clipboard by clipboard API ([@​slorber](https://github.com/slorber)) - `docusaurus-theme-classic` - [#​11407](https://github.com/facebook/docusaurus/pull/11407) fix(theme): remove hardcoded fill from Bluesky and LinkedIn icons ([@​Simek](https://github.com/Simek)) - [#​11389](https://github.com/facebook/docusaurus/pull/11389) fix(theme): render sidebar category index with unlisted children as a simple doc/link item ([@​slorber](https://github.com/slorber)) - [#​11360](https://github.com/facebook/docusaurus/pull/11360) fix(theme): Add translate no to heading anchors and blog authors ([@​slorber](https://github.com/slorber)) - [#​11356](https://github.com/facebook/docusaurus/pull/11356) fix(theme): Doc sidebar links/categories with long labels should display properly ([@​slorber](https://github.com/slorber)) - [#​11338](https://github.com/facebook/docusaurus/pull/11338) fix(theme-classic): fix collapsed sidebar category expansion when navigating to another link within that category ([@​qqq614](https://github.com/qqq614)) - [#​11289](https://github.com/facebook/docusaurus/pull/11289) fix(theme): Fix footnote ref scrolling behind the navbar when footnote back reference clicked ([@​slorber](https://github.com/slorber)) - `docusaurus` - [#​11410](https://github.com/facebook/docusaurus/pull/11410) fix(deps): upgrade webpack-dev-server to v5, fix security warning ([@​slorber](https://github.com/slorber)) - [#​11347](https://github.com/facebook/docusaurus/pull/11347) fix(core): Fix docusaurus start on macOS when exec throws a synchronous error ([@​slorber](https://github.com/slorber)) - [#​11271](https://github.com/facebook/docusaurus/pull/11271) fix(dev-server): use correct dev server HTML lang attribute ([@​enumura1](https://github.com/enumura1)) - `docusaurus-theme-common` - [#​11405](https://github.com/facebook/docusaurus/pull/11405) fix(theme): fix `useColorMode()` visual glitches due to provider unmounts/remounts ([@​slorber](https://github.com/slorber)) - [#​11280](https://github.com/facebook/docusaurus/pull/11280) fix(theme-common): Export FooterColumnItem type ([@​stubinubin](https://github.com/stubinubin)) - `docusaurus-bundler`, `docusaurus-faster` - [#​11383](https://github.com/facebook/docusaurus/pull/11383) fix(ssg): HTML minifier should preserve `<head>` for `og:image` crawlers ([@​slorber](https://github.com/slorber)) - `docusaurus-theme-classic`, `docusaurus-theme-translations` - [#​11331](https://github.com/facebook/docusaurus/pull/11331) fix(theme): Add `aria-label` to `IconExternalLink` with value `'(opens in new tab)'` ([@​WestonThayer](https://github.com/WestonThayer)) - `docusaurus-plugin-content-docs` - [#​11281](https://github.com/facebook/docusaurus/pull/11281) fix(docs): Fix empty sidebar item category `className` lost when post-processed to a doc ([@​slorber](https://github.com/slorber)) - [#​11251](https://github.com/facebook/docusaurus/pull/11251) fix(docs): prevent docs ids conflicts within a version ([@​slorber](https://github.com/slorber)) - `docusaurus-theme-classic`, `docusaurus-theme-common` - [#​11263](https://github.com/facebook/docusaurus/pull/11263) fix(theme): make `useHistorySelector()` hydration-safe + use it read search/hash in theme ([@​slorber](https://github.com/slorber)) ##### 📝 Documentation - [#​11339](https://github.com/facebook/docusaurus/pull/11339) docs: clarify impact of document ID on the URL ([@​shanti2530](https://github.com/shanti2530)) ##### 🤖 Dependencies - [#​11402](https://github.com/facebook/docusaurus/pull/11402) chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11401](https://github.com/facebook/docusaurus/pull/11401) chore(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11403](https://github.com/facebook/docusaurus/pull/11403) chore(deps): bump actions/setup-node from 4.4.0 to 5.0.0 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11373](https://github.com/facebook/docusaurus/pull/11373) chore(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.2 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11365](https://github.com/facebook/docusaurus/pull/11365) chore(deps): bump actions/checkout from 4 to 5 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11342](https://github.com/facebook/docusaurus/pull/11342) chore(deps): bump form-data from 4.0.1 to 4.0.4 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11341](https://github.com/facebook/docusaurus/pull/11341) chore(deps): bump marocchino/sticky-pull-request-comment from 2.9.3 to 2.9.4 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11285](https://github.com/facebook/docusaurus/pull/11285) chore(deps): bump marocchino/sticky-pull-request-comment from 2.9.2 to 2.9.3 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11272](https://github.com/facebook/docusaurus/pull/11272) chore(deps): bump stefanzweifel/git-auto-commit-action from 5 to 6 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) - [#​11273](https://github.com/facebook/docusaurus/pull/11273) chore(deps): bump treosh/lighthouse-ci-action from 12.1.0 to 12.6.1 ([@​dependabot\[bot\]](https://github.com/apps/dependabot)) ##### 🔧 Maintenance - `create-docusaurus`, `docusaurus-babel`, `docusaurus-bundler`, `docusaurus-cssnano-preset`, `docusaurus-faster`, `docusaurus-logger`, `docusaurus-mdx-loader`, `docusaurus-plugin-client-redirects`, `docusaurus-plugin-content-blog`, `docusaurus-plugin-content-docs`, `docusaurus-plugin-content-pages`, `docusaurus-plugin-css-cascade-layers`, `docusaurus-plugin-debug`, `docusaurus-plugin-google-analytics`, `docusaurus-plugin-google-gtag`, `docusaurus-plugin-google-tag-manager`, `docusaurus-plugin-ideal-image`, `docusaurus-plugin-pwa`, `docusaurus-plugin-rsdoctor`, `docusaurus-plugin-sitemap`, `docusaurus-plugin-svgr`, `docusaurus-plugin-vercel-analytics`, `docusaurus-preset-classic`, `docusaurus-remark-plugin-npm2yarn`, `docusaurus-theme-classic`, `docusaurus-theme-common`, `docusaurus-theme-live-codeblock`, `docusaurus-theme-mermaid`, `docusaurus-theme-search-algolia`, `docusaurus-theme-translations`, `docusaurus-utils-common`, `docusaurus-utils-validation`, `docusaurus-utils`, `docusaurus`, `eslint-plugin`, `lqip-loader` - [#​11408](https://github.com/facebook/docusaurus/pull/11408) chore: drop support for Node 18, that reached End-of-Life ([@​slorber](https://github.com/slorber)) - `docusaurus-theme-classic` - [#​11317](https://github.com/facebook/docusaurus/pull/11317) chore: minor reduction to inline svg/js code ([@​SethFalco](https://github.com/SethFalco)) - `docusaurus-plugin-content-docs` - [#​11307](https://github.com/facebook/docusaurus/pull/11307) test(docs): fix docs tests issues ([@​slorber](https://github.com/slorber)) - `docusaurus-bundler` - [#​11290](https://github.com/facebook/docusaurus/pull/11290) chore: upgrade website to Rspack 1.4 + fix Rspack internal performance tracing ([@​slorber](https://github.com/slorber)) - Other - [#​11287](https://github.com/facebook/docusaurus/pull/11287) chore(website): split changelog per version + adjust changelog plugin implementation ([@​slorber](https://github.com/slorber)) ##### :globe\_with\_meridians: Translations - `docusaurus-theme-translations` - [#​11315](https://github.com/facebook/docusaurus/pull/11315) fix(theme-translations): Add missing Portuguese (pt-BR) theme translations and improve some of it. ([@​marcelocell](https://github.com/marcelocell)) - [#​11305](https://github.com/facebook/docusaurus/pull/11305) fix(translations): Add missing Ukrainian translations ([@​maluke](https://github.com/maluke)) ##### Committers: 18 - Akshat Sinha ([@​akshatsinha0](https://github.com/akshatsinha0)) - Bartosz Kaszubowski ([@​Simek](https://github.com/Simek)) - Dylan Tientcheu ([@​dylantientcheu](https://github.com/dylantientcheu)) - Guo Ci ([@​guoci](https://github.com/guoci)) - Jaime Iniesta ([@​jaimeiniesta](https://github.com/jaimeiniesta)) - Joshua Chen ([@​Josh-Cena](https://github.com/Josh-Cena)) - Marcelo Junior ([@​marcelocell](https://github.com/marcelocell)) - Maria Stellini ([@​shanti2530](https://github.com/shanti2530)) - Riccardo ([@​3v0k4](https://github.com/3v0k4)) - Sergey Schetinin ([@​maluke](https://github.com/maluke)) - Seth Falco ([@​SethFalco](https://github.com/SethFalco)) - Sébastien Lorber ([@​slorber](https://github.com/slorber)) - Weston Thayer ([@​WestonThayer](https://github.com/WestonThayer)) - [@​Feez2403](https://github.com/Feez2403) - [@​stubinubin](https://github.com/stubinubin) - [@​ya-dvorovenko](https://github.com/ya-dvorovenko) - enumura ([@​enumura1](https://github.com/enumura1)) - hjcho ([@​qqq614](https://github.com/qqq614)) </details> --- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/276 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
0787ea1fbe |
chore(deps): update dependency ubuntu to v24 (#172)
Reviewed-on: https://gitea.com/gitea/docs/pulls/172 Reviewed-by: techknowlogick <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
4ca7e068c2 |
fix(deps): update dependency @mui/material to v7.3.5 (#294)
Reviewed-on: https://gitea.com/gitea/docs/pulls/294 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
dedfbf1f27 |
chore(deps): update dependency cross-env to v10.1.0 (#277)
Reviewed-on: https://gitea.com/gitea/docs/pulls/277 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
f9ff323873 |
fix(deps): update dependency @mui/material to v7.3.4 (#278)
Reviewed-on: https://gitea.com/gitea/docs/pulls/278 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
1046625638 |
fix(deps): update react monorepo to v19.2.0 (#279)
Reviewed-on: https://gitea.com/gitea/docs/pulls/279 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
200479a1a3 |
chore(deps): update actions/setup-node action to v6 (#282)
Reviewed-on: https://gitea.com/gitea/docs/pulls/282 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
83da675c59 |
chore(deps): update actions/setup-node action to v5 (#270)
Reviewed-on: https://gitea.com/gitea/docs/pulls/270 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
135f34d09a |
chore(deps): update aws-actions/configure-aws-credentials action to v5 (#271)
Reviewed-on: https://gitea.com/gitea/docs/pulls/271 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
312cbc2a6e |
fix(deps): update dependency @mdx-js/react to v3.1.1 (#267)
Reviewed-on: https://gitea.com/gitea/docs/pulls/267 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
4164f4df06 |
fix(deps): update dependency @mui/material to v7.3.2 (#268)
Reviewed-on: https://gitea.com/gitea/docs/pulls/268 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
6b64b97e3b |
chore(deps): update actions/checkout action to v5 (#261)
Reviewed-on: https://gitea.com/gitea/docs/pulls/261 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
90ab1c20c2 |
fix(deps): update dependency @easyops-cn/docusaurus-search-local to ^0.52.0 (#230)
Reviewed-on: https://gitea.com/gitea/docs/pulls/230 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
d61eaecbb1 |
fix(deps): update docusaurus monorepo to v3.8.1 (#225)
Reviewed-on: https://gitea.com/gitea/docs/pulls/225 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
b30993162c |
fix(deps): update dependency @mui/material to v7.3.1 (#242)
Reviewed-on: https://gitea.com/gitea/docs/pulls/242 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
004bebe6b4 |
fix(deps): update react monorepo to v19.1.1 (#254)
Reviewed-on: https://gitea.com/gitea/docs/pulls/254 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
fbd73fd263 |
chore(deps): update dependency cross-env to v10 (#250)
Reviewed-on: https://gitea.com/gitea/docs/pulls/250 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
63c75a97c6 |
fix(deps): update dependency @emotion/styled to v11.14.1 (#240)
Reviewed-on: https://gitea.com/gitea/docs/pulls/240 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
50aad0431b |
fix(deps): update dependency @mui/material to v7.1.2 (#233)
Reviewed-on: https://gitea.com/gitea/docs/pulls/233 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
95544e7847 |
fix(deps): update dependency @mui/material to v7.1.1 (#228)
Reviewed-on: https://gitea.com/gitea/docs/pulls/228 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
af373024a0 |
fix(deps): update dependency @easyops-cn/docusaurus-search-local to ^0.50.0 (#229)
Reviewed-on: https://gitea.com/gitea/docs/pulls/229 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
753dbfb4aa |
fix(deps): update dependency redocusaurus to v2.5.0 (#226)
Reviewed-on: https://gitea.com/gitea/docs/pulls/226 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
7ec1b19826 |
fix(deps): update dependency redocusaurus to v2.3.0 (#223)
Reviewed-on: https://gitea.com/gitea/docs/pulls/223 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
5bf02bcd9c |
fix(deps): update dependency @mui/material to v7.1.0 (#221)
Reviewed-on: https://gitea.com/gitea/docs/pulls/221 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
ac2186b6fb |
fix(deps): update dependency redocusaurus to v2.2.3 (#205)
Reviewed-on: https://gitea.com/gitea/docs/pulls/205 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
b2b64a0401 |
fix(deps): update dependency @mui/material to v7.0.2 (#204)
Reviewed-on: https://gitea.com/gitea/docs/pulls/204 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
3275094871 |
fix(deps): update dependency @easyops-cn/docusaurus-search-local to v0.49.2 (#192)
Reviewed-on: https://gitea.com/gitea/docs/pulls/192 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
10e315d235 |
fix(deps): update dependency @mui/material to v7.0.1 (#193)
Reviewed-on: https://gitea.com/gitea/docs/pulls/193 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
10c3198134 |
fix(deps): update dependency @mui/material to v7 (#189)
Reviewed-on: https://gitea.com/gitea/docs/pulls/189 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
aedc957200 |
fix(deps): update react monorepo to v19.1.0 (#190)
Reviewed-on: https://gitea.com/gitea/docs/pulls/190 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
8d3a6af0de |
fix(deps): update dependency @easyops-cn/docusaurus-search-local to ^0.49.0 (#184)
Reviewed-on: https://gitea.com/gitea/docs/pulls/184 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
3c69e687b4 |
fix(deps): update dependency @mui/material to v6.4.8 (#185)
Reviewed-on: https://gitea.com/gitea/docs/pulls/185 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
4809b3d4c8 |
fix(deps): update dependency redocusaurus to v2.2.2 (#186)
Reviewed-on: https://gitea.com/gitea/docs/pulls/186 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
4cacad97aa |
fix(deps): update dependency @mui/material to v6.4.7 (#178)
Reviewed-on: https://gitea.com/gitea/docs/pulls/178 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
003bc73398 |
fix(deps): update dependency @mui/material to v6.4.6 (#171)
Reviewed-on: https://gitea.com/gitea/docs/pulls/171 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
a7d3ff1ea1 |
fix(deps): update dependency @easyops-cn/docusaurus-search-local to v0.48.5 (#169)
Reviewed-on: https://gitea.com/gitea/docs/pulls/169 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
eb0c2f7ccc |
fix(deps): update dependency @mui/material to v6.4.4 (#165)
Reviewed-on: https://gitea.com/gitea/docs/pulls/165 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
93d5d77bfd |
fix(deps): update dependency @mui/material to v6.4.2 (#161)
Reviewed-on: https://gitea.com/gitea/docs/pulls/161 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
6ebfe37c28 |
fix(deps): update dependency @easyops-cn/docusaurus-search-local to v0.48.4 (#157)
Reviewed-on: https://gitea.com/gitea/docs/pulls/157 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
9acb2b3eb7 |
fix(deps): update dependency redocusaurus to v2.2.1 (#151)
Reviewed-on: https://gitea.com/gitea/docs/pulls/151 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
