This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | [@astrojs/starlight](https://starlight.astro.build) ([source](https://github.com/withastro/starlight/tree/HEAD/packages/starlight)) | [`0.42.7` → `0.42.8`](https://renovatebot.com/diffs/npm/@astrojs%2fstarlight/0.42.7/0.42.8) |  |  | dependencies | patch | `0.42.10` (+1) | | [@pagefind/default-ui](https://github.com/Pagefind/pagefind) | [`1.5.2` → `1.6.0`](https://renovatebot.com/diffs/npm/@pagefind%2fdefault-ui/1.5.2/1.6.0) |  |  | dependencies | minor | | | [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`7.4.2` → `7.4.5`](https://renovatebot.com/diffs/npm/astro/7.4.2/7.4.5) |  |  | dependencies | patch | `7.4.7` (+1) | | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`12.16.1` → `12.17.0`](https://renovatebot.com/diffs/npm/pnpm/12.16.1/12.17.0) |  |  | packageManager | minor | `12.18.0` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) ([changelog](https://github.com/pnpm/action-setup/compare/0977fd99725f1db4007ccb2928dbb4e90d06cc86..73e46992e05b19abd31f2f3c20e0e7370d762115)) | `0977fd9` → `73e4699` | | | action | digest | | --- ### Release Notes <details> <summary>withastro/starlight (@​astrojs/starlight)</summary> ### [`v0.42.8`](https://github.com/withastro/starlight/blob/HEAD/packages/starlight/CHANGELOG.md#0428) [Compare Source](https://github.com/withastro/starlight/compare/@astrojs/[email protected]...@astrojs/[email protected]) ##### Patch Changes - [#​4309](https://github.com/withastro/starlight/pull/4309) [`3490c80`](https://github.com/withastro/starlight/commit/3490c803a5fd02019fd3c9357982e9e3753e335d) Thanks [@​athulsreekumar](https://github.com/athulsreekumar)! - Fixes autogenerated sidebar groups omitting directories whose names match `Object.prototype` properties, such as `constructor` or `toString` - [#​4290](https://github.com/withastro/starlight/pull/4290) [`bf93823`](https://github.com/withastro/starlight/commit/bf938239f5f9775318baeaea1adc1ef93768628c) Thanks [@​RaphaelFakhri](https://github.com/RaphaelFakhri)! - Fixes missing last-updated dates in production builds for pages whose file path contains special characters - [#​4295](https://github.com/withastro/starlight/pull/4295) [`af9557e`](https://github.com/withastro/starlight/commit/af9557ea8c957173ea9174e19a87d80fce22a983) Thanks [@​delucis](https://github.com/delucis)! - Fixes a formatting issue in some error messages impacting projects with Zod ≥4.5 installed - [#​4299](https://github.com/withastro/starlight/pull/4299) [`a103f38`](https://github.com/withastro/starlight/commit/a103f383bcd99a7bd0b9c62a678c41ec5202497b) Thanks [@​clean99](https://github.com/clean99)! - Fixes empty sidebars when autogenerating entries from the docs root directory using `directory: ''` </details> <details> <summary>Pagefind/pagefind (@​pagefind/default-ui)</summary> ### [`v1.6.0`](https://github.com/Pagefind/pagefind/blob/HEAD/CHANGELOG.md#v160-November-1-2026) [Compare Source](https://github.com/Pagefind/pagefind/compare/v1.5.2...v1.6.0) 👋 A little overdue, but this release knocks out a healthy selection of bug reports, and includes a lot of work from the community. Thanks to everyone who contributed ❤️ - [@​bglw](https://github.com/bglw) ##### Multilingual Segmentation Pagefind's extended build now segments Chinese, Japanese, and Thai pages with ICU4X, replacing the previous dependency (PR [#​1383](https://github.com/Pagefind/pagefind/issues/1383)). Alongside producing a smaller binary, ICU4X segments a lot closer to the `Intl.Segmenter` used in the browser on the search query (which is ICU4C). This closes out a mixture of latent and reported issues where the different segmentation between indexing and searching makes for iffy results. It's not perfect yet, but it's a darn sight closer. Bonuses: - Segmentation is smarter in languages such as Thai, and doesn't break inside a grapheme cluster - Japanese katakana has special handling, but should still be improved over 1.5.2 - Japanese voiced and semi-voiced sound marks are no longer normalized into each other ##### Fewer Fragment Files Pagefind now has an option to limit the total number of fragment files produced, for hosting providers that cap the number of uploaded files. Contributed in PR [#​1020](https://github.com/Pagefind/pagefind/issues/1020) — thanks [@​yakovsh](https://github.com/yakovsh) ! This limit is set with `--max-fragments` / `max_fragments`, and applies per language. When applied, multiple fragments are bundled together and loaded as a set when required. See [📘 Max fragments](https://pagefind.app/docs/config-options/#max-fragments). ##### Explicit Sub-Result Titles Added support for explicit sub-result titles. Any element with both an `id` and a `data-pagefind-title` attribute can be used as a sub-result (PR [#​1282](https://github.com/Pagefind/pagefind/issues/1282) — thanks [@​samuel-williams-shopify](https://github.com/samuel-williams-shopify) !) See [📘 Defining a sub result explicitly](https://pagefind.app/docs/sub-results/#defining-a-sub-result-explicitly). ##### Component UI - Added a `sort` attribute to `<pagefind-config>`, to order results by a [sort key](https://pagefind.app/docs/js-api-sorting/) (PR [#​1326](https://github.com/Pagefind/pagefind/issues/1326)) - Added a `max-sub-results` attribute to `<pagefind-searchbox>` (PR [#​1324](https://github.com/Pagefind/pagefind/issues/1324)) - Added a `placeholder` setter to `<pagefind-searchbox>` and `<pagefind-modal-trigger>` (PR [#​1321](https://github.com/Pagefind/pagefind/issues/1321)) - `configureInstance` now applies to an instance that already exists but has not loaded yet (PR [#​1323](https://github.com/Pagefind/pagefind/issues/1323)) - Fixed the UI language being resolved after the first render, which could flash the wrong translations (PR [#​1332](https://github.com/Pagefind/pagefind/issues/1332)) - Fixed component cleanup after being disconnected (PR [#​1322](https://github.com/Pagefind/pagefind/issues/1322)) - Fixed IME composition keystrokes support (PR [#​1284](https://github.com/Pagefind/pagefind/issues/1284) — thanks [@​oharu121](https://github.com/oharu121) !) - Fixed the modal staying open when clicking a result for the current page (PR [#​1327](https://github.com/Pagefind/pagefind/issues/1327)) - Fixed the filter panel checkbox shrinking when its label wraps (PR [#​1166](https://github.com/Pagefind/pagefind/issues/1166) — thanks [@​mbrambilla](https://github.com/mbrambilla) !) - Hid the keyboard shortcut badge on touch-only devices (PR [#​1325](https://github.com/Pagefind/pagefind/issues/1325)) ##### Search Results & Options - Added an `excerptEllipsis` option to mark the truncated ends of excerpts (PR [#​1320](https://github.com/Pagefind/pagefind/issues/1320)) - See [📘 Excerpt ellipsis](https://pagefind.app/docs/search-config/#excerpt-ellipsis) - Fixed phrase search across diacritic variants, so searching `"cafe latte"` can match a page containing `café latte` (PR [#​1386](https://github.com/Pagefind/pagefind/issues/1386) — thanks [@​sean0407](https://github.com/sean0407) !) - Fixed filters not matching values containing escaped characters such as quotes or backslashes (PR [#​1392](https://github.com/Pagefind/pagefind/issues/1392)) - Fixed compound words being counted twice in metadata coverage, which could overvalue a metadata match (PR [#​1319](https://github.com/Pagefind/pagefind/issues/1319)) - Fixed a bug which could build excerpts from the wrong words (PR [#​1318](https://github.com/Pagefind/pagefind/issues/1318)) - Fixed decoding for HTML entities in the automatic `image` and `image_alt` metadata (PR [#​1393](https://github.com/Pagefind/pagefind/issues/1393) — thanks [@​digilist](https://github.com/digilist) !) ##### Indexing & Performance - More work making the index deterministic between builds (PR [#​1124](https://github.com/Pagefind/pagefind/issues/1124) — thanks [@​gissimo](https://github.com/gissimo) !) - Improved search performance on a bunch of broad queries (PR [#​1334](https://github.com/Pagefind/pagefind/issues/1334)) - Fixed a bug where a word with many variants could produce an oversized index chunk (PR [#​1316](https://github.com/Pagefind/pagefind/issues/1316)) - Searches no longer request index chunks for empty terms (PR [#​1317](https://github.com/Pagefind/pagefind/issues/1317)) - More minor search performance work (PR [#​1238](https://github.com/Pagefind/pagefind/issues/1238) — thanks [@​sanjaiyan-dev](https://github.com/sanjaiyan-dev) !) ##### Fixes & Tweaks - Search terms that normalize to nothing are now dropped, rather than searching for an empty term (PR [#​1382](https://github.com/Pagefind/pagefind/issues/1382)) - Improved some compound indexing, so `sysconfig.is_python_build` can be found by searching `is_python_build` - Fixed a way that output files could be truncated in service-mode (PR [#​1272](https://github.com/Pagefind/pagefind/issues/1272) — thanks [@​zelinskyy](https://github.com/zelinskyy) !) - Fixed `--exclude-selectors` hard-erroring when a single selector could not be parsed (PR [#​1312](https://github.com/Pagefind/pagefind/issues/1312) — thanks [@​dualfroz](https://github.com/dualfroz) !) - Improved handling of percent-encoded page URLs (PR [#​1315](https://github.com/Pagefind/pagefind/issues/1315), PR [#​1335](https://github.com/Pagefind/pagefind/issues/1335) — thanks [@​dualfroz](https://github.com/dualfroz) !) - Failed index fetches are now evicted from the cache correctly and are retried (PR [#​1329](https://github.com/Pagefind/pagefind/issues/1329)) - Per-page warnings are now only logged with `--verbose` (PR [#​1314](https://github.com/Pagefind/pagefind/issues/1314)) ##### UI Translations - Added Macedonian (mk) translations (PR [#​1353](https://github.com/Pagefind/pagefind/issues/1353) — thanks [@​I90rche](https://github.com/I90rche) !) - Added Bulgarian (bg) translations (PR [#​1341](https://github.com/Pagefind/pagefind/issues/1341) — thanks [@​salif](https://github.com/salif) !) - Improved French (fr) translations (PR [#​1145](https://github.com/Pagefind/pagefind/issues/1145) — thanks [@​maxonss](https://github.com/maxonss) !) - Improved German (de) translations (PR [#​1096](https://github.com/Pagefind/pagefind/issues/1096) — thanks [@​randomguy-2650](https://github.com/randomguy-2650) !) - Improved Persian (fa) translations (PR [#​1204](https://github.com/Pagefind/pagefind/issues/1204) — thanks [@​Goudarz](https://github.com/Goudarz) !) - Improved Swahili (sw) translations (PR [#​1185](https://github.com/Pagefind/pagefind/issues/1185) — thanks [@​gully223](https://github.com/gully223) !) </details> <details> <summary>withastro/astro (astro)</summary> ### [`v7.4.5`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#745) [Compare Source](https://github.com/withastro/astro/compare/[email protected]@7.4.5) ##### Patch Changes - [#​18558](https://github.com/withastro/astro/pull/18558) [`fac3c50`](https://github.com/withastro/astro/commit/fac3c50463ce9c290bdccb1d6dba30dc7ca4d779) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `astro dev status` and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process - [#​18559](https://github.com/withastro/astro/pull/18559) [`10dae2f`](https://github.com/withastro/astro/commit/10dae2f31486cc0a6a04d1f3d7f5ab7fa8889b30) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `import.meta.env` values containing `$` sequences (such as `$$` or `$&`) being corrupted in `astro build` when server code reads the `import.meta.env` object directly, for example with `const { MY_SECRET } = import.meta.env` - [#​18544](https://github.com/withastro/astro/pull/18544) [`e3bec3d`](https://github.com/withastro/astro/commit/e3bec3d2c770cb53771dad723db57a2ebf931b42) Thanks [@​skezo](https://github.com/skezo)! - Fixes request paths with invalid percent-encoding (e.g. `/%C0%AF` or a bare `%`) being logged as an `Invalid URL encoding` error and routed with the undecoded path. These requests now return a `400`, the same as a path that is encoded too many times. - [#​18520](https://github.com/withastro/astro/pull/18520) [`e023aba`](https://github.com/withastro/astro/commit/e023abac912d7cb6af2b9fb5107ef5dabc667096) Thanks [@​matthewp](https://github.com/matthewp)! - Makes rendering of string tag names stricter and consistent across `.astro` dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as `/` or `=` can no longer change the generated markup. A string that does not start with a valid element name (for example `'!--'` or `''`) now throws an error instead of producing invalid HTML. ### [`v7.4.4`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#744) [Compare Source](https://github.com/withastro/astro/compare/[email protected]@7.4.4) ##### Patch Changes - [#​18344](https://github.com/withastro/astro/pull/18344) [`df838da`](https://github.com/withastro/astro/commit/df838da6c6d965504fae0d89e12d3e67bdd0f4c6) Thanks [@​edmundhung](https://github.com/edmundhung)! - Allows `astro add` to configure tagged versions of official adapters ### [`v7.4.3`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#743) [Compare Source](https://github.com/withastro/astro/compare/[email protected]@7.4.3) ##### Patch Changes - [#​18488](https://github.com/withastro/astro/pull/18488) [`e4e25fa`](https://github.com/withastro/astro/commit/e4e25fa7d47e702985cbb1ee633d4ffb92f8dad6) Thanks [@​umeraamir69](https://github.com/umeraamir69)! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into `script-src` and `style-src`. - [#​18500](https://github.com/withastro/astro/pull/18500) [`e5a3a1b`](https://github.com/withastro/astro/commit/e5a3a1bdec268933f01a0da3fbeb4e38bdf455c9) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `<Image>` and `<Picture>` emitting duplicate `srcset` candidates when `densities` contains equivalent values such as `1` and `'1x'` - [#​18517](https://github.com/withastro/astro/pull/18517) [`c3185b7`](https://github.com/withastro/astro/commit/c3185b764e14f50664b0e63ec665804fdecf685e) Thanks [@​okxint](https://github.com/okxint)! - Fix unhandled `AbortError` rejection when `ClientRouter` skips a pending view transition - [#​18497](https://github.com/withastro/astro/pull/18497) [`c712113`](https://github.com/withastro/astro/commit/c7121132acc25ee3a7f3dc6dd36240f031537878) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes an uncaught `TypeError` in the browser when a `server:defer` island request fails due to a network error. The fallback content is kept, as it is for non-200 responses. - [#​18525](https://github.com/withastro/astro/pull/18525) [`d0240b9`](https://github.com/withastro/astro/commit/d0240b9d5738a97f0b8ad100b76bce8b7527e4cd) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes a `DEP0190` deprecation warning printed by `astro info` on Node.js 24 and later - [#​18522](https://github.com/withastro/astro/pull/18522) [`776b9a6`](https://github.com/withastro/astro/commit/776b9a6124a8d5aef8e280a8af4f8ba68c80e65b) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `memoryCache()` serving an empty body for cached pages that return an empty `404` or `500` response. These responses now render the `404` or `500` error page on every request. - [#​18511](https://github.com/withastro/astro/pull/18511) [`d060ff9`](https://github.com/withastro/astro/commit/d060ff9b68f737af2788e521635afb6f6a84b029) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `transition:name` styles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts - [#​18494](https://github.com/withastro/astro/pull/18494) [`5fe699c`](https://github.com/withastro/astro/commit/5fe699c888d0423db75cac3f0939409d7eb28e37) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes the `astro` CLI refusing to run on StackBlitz by allowing Node.js `>=22.22.0` inside WebContainers, whose Node.js version users cannot change - [#​18506](https://github.com/withastro/astro/pull/18506) [`bf43a60`](https://github.com/withastro/astro/commit/bf43a6042f8a9e87c2cef1b4c36700d4e941c35f) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `<ClientRouter />` animating scroll restoration on back/forward navigation when `scroll-behavior: smooth` is set. Saved scroll positions are now restored instantly, matching the browser's native behavior. - [#​18476](https://github.com/withastro/astro/pull/18476) [`8ea79a2`](https://github.com/withastro/astro/commit/8ea79a282e53b83c65f69c9013f5eeb5d97aadb1) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes a `DataCloneError` crash when building pages that render SVG imports with `<Image />` or `getImage()` while `experimental.parallelPrerender` is enabled. - [#​18504](https://github.com/withastro/astro/pull/18504) [`6dbd737`](https://github.com/withastro/astro/commit/6dbd73764f8a0f16d696f276b634e32631982aab) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `<Picture>` emitting a duplicate `1x` candidate in `<source>` `srcset` when `densities` includes `1` - [#​18524](https://github.com/withastro/astro/pull/18524) [`7524889`](https://github.com/withastro/astro/commit/75248890363ce7de03e5d9b56605958323752dc4) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes type errors reported in Astro's built-in `<Image />`, `<Picture />`, `<Code />`, `<Debug />` and `<ClientRouter />` components when type-checking a project that extends `astro/tsconfigs/strictest` with `tsc` and `@astrojs/ts-content-mapper` - [#​18493](https://github.com/withastro/astro/pull/18493) [`3773941`](https://github.com/withastro/astro/commit/377394179293d1f898c49d38a5b28cf9b21641a9) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file - [#​18512](https://github.com/withastro/astro/pull/18512) [`1151b9e`](https://github.com/withastro/astro/commit/1151b9e0d05e850fa3638a927ac9f66179010e00) Thanks [@​jp-knj](https://github.com/jp-knj)! - Fixes CSP hashes added with `Astro.csp` from components rendered inside `<body>` being left out of the CSP `<meta>` element in static builds, including MDX pages - Updated dependencies \[[`6cf3423`](https://github.com/withastro/astro/commit/6cf3423e4c62af5e54a2676c8304a209ab1e064d), [`edfbf4a`](https://github.com/withastro/astro/commit/edfbf4ab34ff007ae8f7188af76a023a15c9443d)]: - [@​astrojs/telemetry](https://github.com/astrojs/telemetry)@3.4.2 - [@​astrojs/markdown-satteri](https://github.com/astrojs/markdown-satteri)@0.4.6 </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v12.17.0`](https://github.com/pnpm/pnpm/releases/tag/v12.17.0): pnpm 12.17 [Compare Source](https://github.com/pnpm/pnpm/compare/v12.16.1...v12.17.0) pnpm 12.17.0 adds `pnpm peers check --global`, dependency-group selectors and wildcards in `overrides`, and runtime, package manager, Cargo, and Python updates in `pnpm outdated` and `pnpm update`. It also fixes files that other users could not read in Docker images, and repeat installs that missed changes to local dependencies. ##### Minor Changes - `pnpm peers check` now accepts `--global` (`-g`) to check globally installed packages. After a global install or update, the peer dependency warning now suggests `pnpm peers check -g` [#​17504](https://github.com/pnpm/pnpm/issues/17504). - `pnpm outdated` and `pnpm update` now inspect and update package manager and runtime versions in `devEngines.packageManager`, `packageManager`, `devEngines.runtime`, `engines.runtime`, and `runtime:` dependencies. With `cargo.enabled` or `python.enabled`, `pnpm outdated` and `pnpm update` also inspect and update Cargo dependencies in `Cargo.toml` and `Cargo.lock` and Python dependencies in `pyproject.toml` and `pylock.toml`. - `overrides` selectors now support `:prod`, `:optional`, and `:peer` pseudo-selectors that target a single dependency group. They also support `*` wildcard patterns on parent and target package names. An override with a non-range value, such as `npm:` or `file:`, no longer adds a peer dependency to `dependencies`. Removing an optional dependency with `"-"` now also removes the duplicate entry from `dependencies` [#​5391](https://github.com/pnpm/pnpm/issues/5391). ##### Patch Changes ##### Installing packages - Files that pnpm creates in a project now get the permissions the umask gives any new file, such as `0644`. Before, several of them were readable only by the user who ran pnpm, which broke Docker images that run as a different user [#​17435](https://github.com/orgs/pnpm/discussions/17435). The fix applies to: - `node_modules/.pnpm-workspace-state-v1.json`. A different user running `pnpm run` reinstalled the dependencies because it could not read this file. - `pnpm-workspace.yaml` - the files written by `pnpm deploy` - patch files from `pnpm patch-commit` - the lockfile restored by `pnpm dedupe --check` - the Cargo and Python files that pnpm writes When pnpm edits an existing file, the file keeps its permissions. - `pnpm install` no longer writes broken dependency links when the project's `node_modules` is a symlink to another directory, such as another project's `node_modules`. The install reported success, but the links it wrote did not resolve [#​17448](https://github.com/pnpm/pnpm/issues/17448). - Commands installed with `pnpm add --global` now find the dependencies that pnpm hoists for their package. A package that loads a dependency it does not declare, such as a native addon's platform-specific package, failed with "Cannot find module". Reinstall such a package with `pnpm add --global` to update its existing command [#​17503](https://github.com/pnpm/pnpm/issues/17503). - When pnpm switches to the version a project pins, it now installs that version's native binary for the current host, even if the project's `supportedArchitectures` excludes the host. Before, pnpm could not use the pinned version and kept running the installed one. pnpm also repairs a pinned version that an earlier install left without the host's binary. - With the global virtual store, a change to a dependency of one package in a dependency cycle now gives every package in that cycle a new directory. Before, the other packages kept their directories and still linked the old copy of the changed package, so the project could load two copies of it [#​17466](https://github.com/pnpm/pnpm/issues/17466). Packages in a dependency cycle, and packages that depend on one, move to new global virtual store directories once after this update. Those that run a build miss the side-effects cache once. - With `nodeLinker: hoisted`, when two workspace projects need the same package version and it cannot be hoisted to the root, each project now keeps the copy installed in its own `node_modules`. Build scripts run in each of these copies. Before, the second project's copy was replaced with a symlink to the first project's, so every repeat install imported it again [#​17498](https://github.com/pnpm/pnpm/issues/17498). - The Node.js `latest` selector now chooses the newest stable release [#​17490](https://github.com/pnpm/pnpm/issues/17490). - Hardlinking from the store now stats each store file once per install. Since pnpm 12.8.0, a store file was stat'ed again for every package that links it. On an offline install of a large workspace, that added up to 15% system CPU [#​17500](https://github.com/pnpm/pnpm/issues/17500). ##### Repeat installs and local dependencies - `pnpm install --frozen-lockfile` no longer reports an outdated lockfile right after the install that wrote it. This happened when a pnpmfile `readPackage` hook or `packageExtensions` changed the dependencies or peer dependencies of a local directory dependency outside the workspace projects. It affected a `file:` dependency, an injected `workspace:../dir` dependency outside the workspace patterns, and an injected workspace package left out by `--filter` [#​17447](https://github.com/pnpm/pnpm/issues/17447) [#​17473](https://github.com/pnpm/pnpm/issues/17473). A repeat `pnpm install` now takes the fast path when `ignoredOptionalDependencies` removes an optional dependency of a `file:` directory dependency. It used to resolve again on every run. - `pnpm install` now resolves again after an edit to an injected `workspace:../dir` dependency outside the workspace patterns under a shared lockfile. It used to keep the lockfile unchanged. The next `pnpm install --frozen-lockfile` then failed [#​17476](https://github.com/pnpm/pnpm/issues/17476). - `pnpm install` now resolves a local directory again after its `package.json` changes when an override or a package extension adds it to the dependencies of a registry package. `pnpm install --frozen-lockfile` fails on a lockfile that still records the old dependencies of such a directory [#​17486](https://github.com/pnpm/pnpm/issues/17486). - With `injectWorkspacePackages` and per-project lockfiles, `pnpm install` now updates a project's lockfile when a local tarball that an injected workspace project depends on is replaced. The project's lockfile kept the old version and integrity before. - `pnpm install` now detects a change to a local tarball or directory that only a pnpmfile `readPackage` hook depends on. A repeat install reported "Already up to date" and kept the old contents before [pnpm/tasks#227](https://github.com/pnpm/tasks/issues/227). - `pnpm install` now relinks a `workspace:` or `link:` dependency whose link was deleted from `node_modules`. It used to report "Already up to date" and leave the link missing [#​17485](https://github.com/pnpm/pnpm/issues/17485). - A repeat `pnpm install` reports "Already up to date" again when a pnpmfile `readPackage` hook changes the dependencies of a workspace project. Since 12.15.0, every such install ran in full [#​17468](https://github.com/pnpm/pnpm/issues/17468). After an edit to a project's `package.json`, `pnpm install` and `verifyDepsBeforeRun` now run the pnpmfile's `readPackage` hook on the edited manifest before comparing it with the lockfile. They could report the project up to date when the hook rewrote the edited dependency to a specifier the lockfile did not record. ##### Adding and updating dependencies - `pnpm update --latest` with package selectors now updates the dependencies of the selected packages within their declared ranges. Excluded packages and their dependencies keep their locked versions [#​17444](https://github.com/pnpm/pnpm/issues/17444). - `pnpm add <pkg>@<tag>` now uses a catalog entry set to that same dist-tag. The dependency is saved as `catalog:` and the entry stays as written [pnpm/tasks#225](https://github.com/pnpm/tasks/issues/225). When `pnpm add` adds a new dist-tag such as `vue@legacy` to a catalog, the catalog entry records the exact version the tag points to. The same applies to a dependency added without a version when the `tag` setting names a dist-tag other than `latest`. - `pnpm add` now saves the resolved version range of an npm alias. For example, `pnpm add v2@npm:vue` and `pnpm add v2@npm:vue@^3.0.0` both save `npm:vue@^3.5.13`. ##### Running scripts and commands - Programs that a script or `pnpm exec` command leaves running, such as a browser opened by the `open` package, now outlive pnpm exactly when they would outlive the command run without pnpm. Before, on Windows, a failed command, `Ctrl+C`, or a closed terminal ended all of them. pnpm still ends them when it is killed or crashes. When a recursive or parallel run bails, the scripts still running now receive `SIGTERM` on Unix and are killed only if they are still running two seconds later. On Windows, everything those scripts started is ended, including detached processes whose parent has already exited. Before, a bail killed them at once [#​17465](https://github.com/pnpm/pnpm/issues/17465). - On Windows, the shell shim of a `.cmd` or `.bat` bin now runs it under Git Bash when MSYS argument conversion is off, such as with `MSYS_NO_PATHCONV=1` or `MSYS2_ARG_CONV_EXCL='*'`. The shim used to start an interactive cmd.exe prompt [#​17480](https://github.com/pnpm/pnpm/issues/17480). - `pnx` and `pnpm create` now run the command in the directory selected by `--dir` or `--workspace-root`. Without either flag, the command still runs in the directory pnpm was started in. - `pnpm --env-file` now reads files the way `node --env-file` does. Values are taken as written, so `$VAR` is no longer expanded and Windows paths such as `C:\Users\me` load unchanged. A file is no longer rejected for its contents. ##### Settings and messages - `pnpm version` no longer creates a git commit and tag when `gitTagVersion` is set to `false` [#​17460](https://github.com/pnpm/pnpm/issues/17460). - `pnpm publish` now reads the `publishBranch` setting from `pnpm-workspace.yaml` and from `PNPM_CONFIG_PUBLISH_BRANCH`. The `--publish-branch` flag overrides it. - `pnpm` now accepts `--strict-ssl` and `--local-address <ip>` on the command line. - `pnpm doctor` uses a 15-second timeout when checking registry connectivity. - `pnpm-workspace.yaml` parse errors now report `ERR_PNPM_INVALID_SETTING`. - The error for a dependency with an invalid name in a project's manifest now names the project's directory. It used to say only "The current package", which did not tell which workspace project to fix [#​17475](https://github.com/pnpm/pnpm/issues/17475). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://www.cloudflare.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/cloudflare.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/cloudflare_light.svg" /> <img src="https://pnpm.io/img/users/cloudflare.svg" width="160" alt="Cloudflare" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> <td align="center" valign="middle"> <a href="https://syntax.fm/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/syntaxfm.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/syntaxfm_light.svg" /> <img src="https://pnpm.io/img/users/syntaxfm.svg" width="90" alt="Syntax" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xOTkuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMi41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> <!-- cloudflare-preview --> Preview: https://pr-640.docs-gitea-com.pages.dev --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/640 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]>
Gitea Docs 
The sources of docs.gitea.com, built with Astro and Starlight.
The site covers four products, all served from this repository:
| Product | Content | Versions | Languages |
|---|---|---|---|
| Docs | docs/, versioned_docs/, i18n/ |
next, 28, 1.27 … 1.22 | English, 简体中文, 繁體中文 |
| API | static/swagger-*.json, static/openapi3-*.json |
next, 28, 1.27 … 1.22 | English |
| Runner | runner-docs/, runner-docs_versioned_docs/ |
develop, 5 … 0 | English |
| CLI | cli-docs/, cli-docs_versioned_docs/ |
develop | English |
The enterprise documentation is built and deployed from its own repository and
reached through /enterprise/, which a Cloudflare worker maintained elsewhere
routes to that deployment.
Development
make install # pnpm install
make serve-fast # english, the version served at the root, starts in seconds
make serve # the whole matrix, every version and language
make build # production build into sites/docs/dist
make check # type checks the site and its components
Search is built by Pagefind while the site is built, so it only answers on the
built site: use make serve-built to try it. With the Algolia credentials
(PUBLIC_DOCSEARCH_APP_ID, PUBLIC_DOCSEARCH_API_KEY) set, DocSearch is used
instead and works in make serve too.
GITEA_DOCS_PRODUCTS, GITEA_DOCS_VERSIONS and GITEA_DOCS_LOCALES (comma
separated) restrict what is built, which is what make serve-fast uses.
GITEA_DOCS_STRICT_LINKS=true turns the warnings about unresolved relative
markdown links into a build error.
sites/docs/README.md documents how the sources are mapped onto the site.
Writing
Pages are plain markdown with the same frontmatter and admonitions as before:
frontmatter slug, sidebar_position and sidebar_label keep working, and so
do the :::note style admonitions and the @version@ style release variables.
Relative *.md links are rewritten to urls while the site is built.
The order of the top level sidebar groups comes from sidebars.js (and
versioned_sidebars/ for released versions), the label and order of every other
group from the _category_.json of its directory.
Cutting a version
make cut-version PRODUCT=docs VERSION=1.28
make cut-version PRODUCT=runner VERSION=6
make cut-version PRODUCT=cli VERSION=0.1
This freezes the current tree, its translations and its sidebar. The label of
the version, its release variables (@version@, @dockerVersion@, ...) and
which version is served at the root live in
packages/content-loader/src/products.ts and are edited by hand afterwards.
That file is the single source of truth for the product, version and language
matrix.
API docs
The definitions rendered under /api/ live in static/:
swagger-latest.json (gitea main) and swagger-<minor>.json (released
versions) hold the swagger 2.0 document every gitea version ships,
openapi3-latest.json and openapi3-<minor>.json the openapi 3.0 document
gitea generates since 1.27. The openapi 3.0 document is what gets rendered
where it exists, and both are offered for download on the overview page of the
version, since code generators cannot read the rendered pages (and several of
them reject swagger 2.0).
make update-api-docs # refresh latest + every released version
make update-api-docs-latest # refresh only the documents of gitea main
The documents of gitea main are refreshed automatically: the update api spec files workflow runs weekly and opens a pull request whenever gitea main
changed. Released versions are updated by hand when a new gitea version is
documented.
Runner docs
| Version | Content | URL |
|---|---|---|
| develop | runner-docs/ |
/runner/develop/ |
| current series | runner-docs_versioned_docs/version-5/ |
/runner/ |
| older series | runner-docs_versioned_docs/version-4/ |
/runner/4/ |
A version directory covers a whole release series (version-3 documents every
3.x release), so a patch release only needs a content update, not a new
folder. Use floating image tags (gitea/runner:3) and links to the runner's
main branch in those pages to keep them valid across patch releases.
Its sidebar is written by hand: runner-sidebars.js for develop, and
runner-docs_versioned_sidebars/version-<version>-sidebars.json per documented
version.
The pages under reference/ are generated from the runner sources — the command
line reference from --help, the example configuration from config generate
(generate-config before 3.1):
make update-runner-docs # develop docs, from the main branch of gitea/runner
make update-runner-docs-released # every series, from its newest stable tag
./update_runner_docs.sh v3.0.2 runner-docs_versioned_docs/version-3/reference
These are refreshed automatically as well: the update runner reference
workflow runs weekly and opens a pull request whenever the runner's CLI or
example configuration changed. Generating them needs Go, since the script builds
the runner binary.
CLI docs
The documentation of gt, the Gitea CLI from
gitea/cli, is laid out like the runner docs, with
its sidebar in cli-sidebars.js. No series is documented yet, so cli-docs/ is
served at /cli/. Once a release exists, cut its series and list it in
cliSeries in packages/content-loader/src/products.ts, which moves the develop
docs to /cli/develop/. The guides leave the flags of each command to
gt <command> --help.
Deployment
main is built and published by the Build and Publish Docs site workflow, to
S3/CloudFront and to Cloudflare Pages. cloudflare/_headers sets the cache
policy and cloudflare/_redirects keeps the urls the site used to serve; both
are copied next to the build output by that workflow.
cloudflare/docsearch-crawler.json is the Algolia crawler configuration.
/enterprise/ is served by another deployment and routed to it by a Cloudflare
worker that lives outside this repository.