Skip to content

Update npm dependencies - #128

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-dependencies
Open

Update npm dependencies#128
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-dependencies

Conversation

@renovate

@renovate renovate Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@iconify/react (source) 6.0.3 → 6.0.4 age confidence dependencies patch
eslint (source) 10.13.0 → 10.14.0 age confidence devDependencies minor
eslint-plugin-oxlint 1.89.0 → 1.90.0 age confidence devDependencies minor
globals 17.13.0 → 17.14.0 age confidence devDependencies minor
node (source) 26.12.1 → 26.13.0 age confidence tools minor
oxfmt (source) ^0.74.0 → ^0.75.0 age confidence devDependencies minor
oxlint (source) 1.89.0 → 1.90.0 age confidence devDependencies minor
oxlint-plugin-react-doctor (source) 0.9.18 → 0.9.22 age confidence devDependencies patch
pnpm (source) 12.15.0 → 12.16.1 age confidence tools minor
typescript-eslint (source) 8.72.0 → 8.72.1 age confidence devDependencies patch

Release Notes

eslint/eslint (eslint)

v10.14.0

Compare Source

Features

  • d23a7f9 feat: fix property descriptor handling in func-name-matching (#​21400) (xbinaryx)

Bug Fixes

Documentation

  • 0f94f47 docs: remove zh-hans from docs language switcher (#​21437) (lumir)
  • dab466e docs: Update README (GitHub Actions Bot)
  • 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#​21452) (Pixel)
  • 7697550 docs: Update README (GitHub Actions Bot)
  • 0c699d5 docs: Remove Tidelift commercial support (#​21416) (Milos Djermanovic)
  • 0880666 docs: update loadESLint() documentation for v10 (#​21374) (Minseon Kim)
  • e06fe87 docs: Revise AI acknowledgment options in PR template (#​21414) (Nicholas C. Zakas)

Chores

  • 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#​21462) (Francesco Trotta)
  • 6e3f988 chore: update github/codeql-action action to v4.39.1 (#​21450) (renovate[bot])
  • a031c40 chore: update ecosystem plugins (#​21445) (ESLint Bot)
  • 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#​21429) (Milos Djermanovic)
  • 276021d chore: update github/codeql-action action to v4.39.0 (#​21432) (renovate[bot])
  • 449724e chore: update ecosystem plugins (#​21420) (ESLint Bot)
  • 8ffeb8c chore: update dependency prettier to v3.9.10 (#​21417) (renovate[bot])
oxc-project/eslint-plugin-oxlint (eslint-plugin-oxlint)

v1.90.0

Compare Source

What's Changed

Full Changelog: oxc-project/eslint-plugin-oxlint@v1.89.0...v1.90.0

sindresorhus/globals (globals)

v17.14.0

Compare Source

nodejs/node (node)

v26.13.0: 2026-10-28, Version 26.13.0 'Lithium' (LTS), @​richardlau

Compare Source

Notable Changes

This release marks the transition of Node.js 26.x into Long Term Support (LTS)
with the codename 'Lithium'. It will continue to receive updates through to
the end of April 2029.

Other than updating metadata, such as the process.release object, to reflect
that the release is LTS, no further changes from Node.js 26.12.1 are included.

If you are updating from an earlier Long Term Support release (e.g. Node.js 24
or 22 or earlier) please note that since Node.js 25 the official binaries for
Linux are linked against libatomic, which may need to be installed separately
depending on your Linux distribution.

oxc-project/oxc (oxfmt)

v0.75.0: oxfmt v0.75.0

Compare Source

🐛 Bug Fixes
  • 5042019 formatter: Keep fill layout for array with comment after [ (#​28170) (leaysgur)
  • 9d37ff6 formatter: Use position-based comment checks for concise arrays (#​28169) (leaysgur)
  • 016c4a2 formatter: Keep a comment before } inside a JSX spread child (#​28103) (vidigoat)
  • 190bb1e formatter: Keep parens around an instantiation expression ending an operand through any tight parent (#​28168) (leaysgur)
  • a5314a1 formatter: Keep ; before in and instanceof class members (#​28166) (leaysgur)
  • 3a56e7c formatter: Keep closing HTML comments at the start of a line (#​28064) (Cameron)
  • 23d23d6 formatter_markdown: Honor range ignore inside directives (#​28164) (leaysgur)
  • 5f1fd3d formatter: Measure width heuristics by display width (#​28098) (leaysgur)
  • a5a52cf formatter: Keep parens around private in expressions (#​28096) (leaysgur)
  • 999496e formatter: Measure a short key by its display width (#​28026) (vidigoat)
  • 7e9aa44 formatter: Keep parens around a looser operand of an instantiation expression (#​28025) (vidigoat)
  • 6912d1f formatter: Keep an arrow signature that exactly fills the line for any body (#​27989) (leaysgur)
  • eb1d9f9 formatter_core: Count a flat line space in fits only when text follows (#​27987) (leaysgur)
⚡ Performance
  • 1ed93af data_structures: Copy short strings without a memcpy call (#​27953) (leaysgur)
  • 7948f0b formatter_core: Shrink FormatElement to 16B (#​28012) (leaysgur)
  • 788af22 formatter: Keep AstNodes on the stack, and only chain links in the arena (#​27963) (leaysgur)
📚 Documentation
oxc-project/oxc (oxlint)

v1.90.0

Compare Source

🚀 Features
  • 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#​28118) (camc314)
  • d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#​28117) (camc314)
  • 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#​28116) (camc314)
millionco/react-doctor (oxlint-plugin-react-doctor)

v0.9.22

Compare Source

Patch Changes
  • #​2326 ad51b5a Thanks @​aidenybai! - Treat an effect cleanup that only reads a proven local runtime binding as empty. Preserve cleanup exemptions for global identifiers and member reads that can run getters, and keep no-op filtering conservative in other rules. no-mirror-prop-effect, no-event-trigger-state, no-effect-event-handler, no-effect-chain and rendering-hydration-no-flicker also stop skipping effects with proven empty or read-only inline cleanups. Unknown cleanup factories and other effectful returns remain conservative.

v0.9.21

Compare Source

Patch Changes

  • #​2320 5a2c6f5 Thanks @​aidenybai! - Report an unguarded useReducer dispatch after await or inside a microtask or Promise callback when it goes through a transparent local setter helper, such as queueMicrotask(() => assign(dispatch, action)), exactly where the direct dispatch is reported. Only no-set-state-after-await-in-effect accepts the forwarded dispatch, because it already counts a direct dispatch. The prop-change rules, which compare writes against useState initializers, stay unchanged. Imported, reassigned, asynchronous, deferred and conditional helpers, and reassigned dispatch bindings, stay outside the proof.

  • #​2319 39152dc Thanks @​aidenybai! - Report react-hooks-js/set-state-in-effect when an effect updates state synchronously through a transparent local setter helper, such as useEffect(() => assign(setValue, next)), which React Compiler does not follow. A new forwarded-set-state-in-effect rule finds the write with the forwarded setter proof, runs only when the compiler rule is enabled, and React Doctor reports its finding under the compiler's rule key, message and docs link, so react-hooks/set-state-in-effect disable comments, ignores and scoring treat it like the compiler finding. Compiler-visible synchronous setter calls retain duplicate suppression. Ref-derived measurements and guarded ref writes remain allowed. Imported, reassigned, asynchronous, deferred, conditional and multi-statement forwarding helpers stay outside the proof.

v0.9.20

Compare Source

Patch Changes

  • #​2317 2c5d72c Thanks @​aidenybai! - Report an unguarded state update after await or inside a microtask or Promise callback when it goes through a transparent local setter helper, such as queueMicrotask(() => assign(setValue, next)), exactly where the direct setter call is reported. Cleanup guards still protect the forwarded write. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof. Preserve transparent TypeScript setter arguments and implicit undefined writes, and exclude bound/call/apply argument shifts from the forwarding proof.

    Keep resource lifecycle exemptions when the same setter is forwarded through immutable aliases, and register the deferred-write rule in cross-file cache metadata.

  • #​2315 8a7c60a Thanks @​aidenybai! - Report state adjusted after a prop change through a transparent local setter helper, such as assign(setValue, ""), exactly where the direct setter call is reported, including functional updaters and layout effects. Evaluate the forwarded write at its call site for the released object URL, portal mount, request map, resource lifecycle, and external work checks. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof.

    Preserve resource lifecycle and asynchronous loading exemptions when related event or completion writers also use transparent setter helpers.

  • #​2316 b713862 Thanks @​aidenybai! - Report an effect that resets all state after a prop change through a transparent local setter helper, such as assign(setKey, ""), exactly where the direct reset is reported, including layout effects. A reload forwarded through the same helper from an asynchronous callback now counts as a loading lifecycle, and a handler that writes through the helper keeps the hidden-until-reset exemption. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof.

    Keep setter identity stable across immutable aliases when counting reset state and recognizing asynchronous reloads. Resource lifecycle handlers retain their exemptions when their writes are forwarded through the same proven helper.

v0.9.19

Compare Source

Patch Changes

  • #​2000 9a79847 Thanks @​aidenybai! - Let rules declare the code that owns a finding separately from its diagnostic location. With --scope contextual, exhaustive-deps now reports existing dependency findings when their hook call or resolved local callback changes. Ownership survives lint-cache replay and stays out of public JSON reports and score requests.

    Add JSX element scope for alt-text and click-events-have-key-events, and function scope for rules-of-hooks. Existing scan defaults and other scopes are unchanged.

  • #​2311 813bd63 Thanks @​aidenybai! - Recognize synchronous derived-state writes through transparent local helpers that receive a React state setter. Preserve external, deferred, mutable, and independently editable state, including event writes through readonly setter aliases for direct and forwarded effect writes. Compare forwarded values with their existing state initializer. Withhold the forwarding proof for reassigned helpers and parameters whose defaults or destructuring can perform additional work.

  • #​2313 be55f78 Thanks @​aidenybai! - Detect unguarded state updates in inline microtask and proven native Promise callbacks started by effects with changing dependencies. Preserve cleanup guards, stable dependencies, and opaque or shadowed thenables.

    Exclude inert generator callbacks and mutated or escaped Promise receivers, and cache immutable provenance checks for shared Promise bindings.

  • #​2312 e5c7c99 Thanks @​aidenybai! - Detect redundant state derivation, initialization, adjustment, and resets in React useLayoutEffect, including imported aliases. Preserve layout measurement and resource lifecycle exemptions, and describe avoidable renders without implying stale content must be painted.

  • #​2308 a4bcd7f Thanks @​NisargIO! - Stop treating an empty effect cleanup as a real one. return () => {}, return () => undefined, a direct const function binding, or flag ? () => {} : undefined no longer silences no-adjust-state-on-prop-change, no-chain-state-updates, no-effect-event-handler, no-event-handler, no-pass-data-to-parent, or the derived-state rules' cleanup-managed state check. Cleanups that do work during parameter evaluation and disposer calls opposite inline or named empty functions still exempt the effect. Mutable bindings and unproven callback factories retain the existing conservative exemption.

  • #​2011 84ad0c8 Thanks @​skoshx! - Fix unsafe-json-in-html false positive for JSON.stringify().replaceAll("<", "\\u003c")

    The unsafe-json-in-html rule now recognizes .replaceAll("<", "\\u003c") as a safe escape pattern, equivalent to the already-recognized .replace(/</g, "\\u003c") form. This resolves false positives when developers use the more explicit .replaceAll method to escape less-than characters in JSON-LD or other JSON embedded in HTML/script tags.

  • #​2309 95cd1d4 Thanks @​aidenybai! - Detect missing cleanup for native timers called through globalThis, window, self, global, and proven constant aliases. Recognize matching qualified clearInterval and clearTimeout calls while preserving shadowed receiver and timer handle checks. Exclude qualified timer methods that have been overwritten, deleted, or updated, and never count an overridden clear method as cleanup.

  • #​2310 3fd747e Thanks @​aidenybai! - Detect render-time ref.current writes made through Object.assign while preserving predictable guarded initialization and deferred effect or event writes. Keep semantic analysis lazy for unrelated calls. Exclude calls to an overridden Object.assign.

  • #​1983 a1df4e5 Thanks @​skoshx! - Skip .open-next build output in security scan

    The security scan now skips .open-next/ directories (OpenNext build output) the same way it skips .next/ and .vercel/, preventing false positive security findings from bundled library code.

pnpm/pnpm (pnpm)

v12.16.1: pnpm 12.16.1

Compare Source

This release fixes pnpm install hanging on a cold store in workspaces that install Cargo crates, and pnpm pack shipping a file that files excludes by name.

Patch Changes

  • pnpm install no longer hangs on a cold store in a workspace that also installs Cargo crates or a Rust toolchain.

  • pnpm pack and pnpm publish now apply a files entry that names a file after the glob and directory entries, as npm does. A file excluded by name, such as !dist/index.js, stays out even when a later dist/** matches it. A file named by its path, such as lib/secret.js, ships even when a later !lib/*.js matches it.

  • pnpm install no longer leaves a broken symlink in an injected workspace dependency when the package links to a file outside its published files and pnpm imports by hardlink. Installing a git dependency now skips internal directory symlinks when importing its files into the store.

  • pnpm install now relinks a command that a workspace project renames into the projects that depend on it when sharedWorkspaceLockfile is false pnpm/tasks#224.

  • pnpm install and pnpm rebuild now refresh privately hoisted .bin shims in node_modules/.pnpm/node_modules/.bin after a dependency build replaces a script target with a native executable #​17402.

  • pnpm install now reads a package's manifest to decide its peer dependencies when it updates an existing lockfile, as it does when it resolves from scratch.

  • Commands, pnpm --version, pnpm self-update, and invocations with unknown flags now apply the same packageManager and devEngines.packageManager settings when switching to the pinned pnpm version or recording it in pnpm-lock.yaml. --config.<key> flags and lockfileDir now reach the version switch and lockfile sync on every entry point. Unreadable settings in pnpm-workspace.yaml or the global config.yaml that do not affect the pin decision no longer block the version switch pnpm/tasks#222.

  • pnpm now accepts the --cache-dir <dir> flag, as in pnpm install --cache-dir /tmp/pnpm-cache #​17422.

  • When the version or range given to pnpm unpublish matches every published version, the error now says so and shows the same command with --force. Before, the error suggested running pnpm unpublish <pkg>@<version>, the command that had just failed.

Platinum Sponsors
Bit OpenAI Notion
CodeRabbit
Gold Sponsors
Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.16.0: pnpm 12.16

Compare Source

This release adds a global --env-file flag, updates to a symlinked pnpm-lock.yaml, and pnpm setup --no-modify-path. It also fixes two security issues, in zstd decompression and in signing.

Minor Changes

  • Added a repeatable global --env-file <path> flag to load environment variables from dotenv-style files before running a command. Later files override earlier files, variables already in the environment are preserved, and loaded variables are visible to user-level .npmrc interpolation and lifecycle scripts #​7111.

  • pnpm can now update a pnpm-lock.yaml that is a symlink. List the directories the lockfile may link into in the symlinkedLockfileTargetDirs setting, in the global config or with PNPM_CONFIG_SYMLINKED_LOCKFILE_TARGET_DIRS. pnpm writes the update to the file the symlink points to if that file is inside one of these directories. The symlink stays in place. pnpm ignores this setting in pnpm-workspace.yaml #​17222.

  • Added a --no-modify-path option to pnpm setup. It installs pnpm without adding it to PATH, leaving the shell config file, the Windows registry, and the GitHub Actions environment files unchanged. pnpm setup then prints the lines to add yourself get.pnpm.io#37.

Patch Changes
Security

  • Fixed memory exposure and allocation handling vulnerabilities when processing zstd-compressed data #​17388.

  • Signing in pnpm and pnpr no longer uses arithmetic that may leak the private key through timing. This covers shared artifacts, OCI registry tokens, and OIDC login state advisory.

Installing packages

  • A dependency symlink that pnpm cannot point at the wanted target now fails the install with an error that names the link. This happens when the filesystem still serves the old link after pnpm removed it, as a node_modules served by a virtual filesystem does. pnpm used to remove the link again without end and crashed with a segmentation fault once the thread ran out of stack.

  • Concurrent workspace installs no longer lose store-index rows when initializing the shared SQLite index #​17388.

  • Agent skill links now keep the same target across installs when a package version is installed with several sets of peer dependencies. An install no longer fails with ERR_PNPM_AGENT_SKILL_PATH_OCCUPIED on a skill link that pnpm created for another of those copies #​17319.

  • pnpm now fails at once, without retrying, when a downloaded package archive contains a rejected entry path #​17205.

  • pnpm now builds a git-hosted dependency in every new location it links the dependency into, such as a new global virtual store slot or a fresh node_modules. When the side-effects cache holds the build output, pnpm restores it from there. Before, only the install that fetched the dependency built it. This also fixes dependencies that are already in the store #​17224.

  • Changes a preResolution hook makes to the lockfiles now take effect. The hook now also runs when pnpm installs from an up-to-date lockfile. An error thrown by the hook now fails the install.

  • A custom fetcher in the pnpmfile can now call fetchers.directory to fetch a package from a local directory. The call rejects with ERR_PNPM_TARBALL_INTEGRITY if the lockfile pins an archive integrity for the package. Previously, calling fetchers.directory failed with a TypeError.

  • packageImportMethod: copy now also applies to packages that have lifecycle scripts or patches. On a filesystem that supports block cloning, such as ReFS or a Dev Drive on Windows, these packages were cloned #​17195.

  • With nodeLinker: hoisted and autoInstallPeers: false, a package that workspace projects use with different peer versions is now installed once per peer variant, so each project's copy resolves that project's peer #​17395.

  • Under nodeLinker: hoisted, pnpm install now leaves a patched package that is already in place alone. The same holds for a package whose peers include a patched package, such as every package peering on a patched react-native #​17188.

  • With nodeLinker: hoisted, an install that stops partway no longer leaves the next install trusting the packages it was replacing. Before, reverting the change that started the stopped install, such as a patch edit, kept the half-replaced package in node_modules.

Repeat installs and changed settings

  • A repeat pnpm install now acts on a change to these settings. Before, it reported "Already up to date".

    • storeDir or virtualStoreDir: it recreates node_modules.
    • globalVirtualStoreDir: it links the packages from the new directory.
    • virtualStoreDirMaxLength: it renames the virtual store directories.
    • dangerouslyAllowAllBuilds turned on: it runs the builds it skipped.
    • trustLockfile turned off: it verifies the lockfile.

  • pnpm add, pnpm remove, and pnpm update now fail if node_modules does not match the current settings. Run pnpm install to recreate it. Previously, these commands removed and reinstalled node_modules without asking. They report:

    • ERR_PNPM_UNEXPECTED_STORE if node_modules was linked from a different store.
    • ERR_PNPM_UNEXPECTED_VIRTUAL_STORE if it was linked from a different virtual store directory.
    • ERR_PNPM_MODULES_BREAKING_CHANGE if it was installed by an incompatible pnpm version, or if node_modules/.modules.yaml cannot be read.
    • ERR_PNPM_NODE_LINKER_DIFF if it was installed with a different nodeLinker.

    pnpm update now also fails with ERR_PNPM_HOIST_PATTERN_DIFF and the other errors pnpm add reports for a changed hoist pattern or virtualStoreDirMaxLength.

  • An install filtered to some workspace projects now fails if node_modules was installed with a different nodeLinker, hoistPattern, publicHoistPattern, store, or virtual store. Before, it recreated node_modules and left the projects it skipped without their dependencies. A pnpm install of the whole workspace still recreates node_modules pnpm/tasks#217.

  • pnpm install and the verifyDepsBeforeRun check now notice an edited patch file when sharedWorkspaceLockfile is false.

  • pnpm install now takes its fast path in a workspace with patchedDependencies when the previous install ran with another major version of pnpm.

  • pnpm install now relinks the bins of a workspace package when its bin field changes, including with --frozen-lockfile and an unchanged lockfile. A filtered install relinks them in the selected projects, and the next install that covers the remaining projects relinks them there #​17324.

  • pnpm install now removes command shims from node_modules/.bin when a workspace dependency renames or removes an entry from its bin field pnpm/tasks#211.

Resolving dependencies and the lockfile

  • A package that a plain range and a <prefix>: specifier both resolve from one registry is now recorded once in pnpm-lock.yaml and installed once. The lockfile key names the registry a package resolved from. When that registry declares a prefix, through prefix in registries or through namedRegistries, the package is keyed <name>@<prefix>:<version> however its dependency was written: with the prefix, as a plain range its scope routes to that registry, or through the default registry. Before, the plain range was keyed <name>@<version>, so one tarball was installed twice and instanceof checks and module singletons broke between the two copies. The same name and version served by two registries still get separate entries. When several prefixes declare one registry, its packages are keyed by the lexicographically smallest prefix.

    If a scope you route reaches a registry that also declares a prefix, your next pnpm install re-keys those entries, which shows up as a lockfile diff. Commit it. pnpm install --frozen-lockfile installs the lockfile as recorded.

  • pnpm install now resolves a scope's packages again when the scope is routed to another registry in registries. Before, the lockfile kept the versions and integrity resolved from the old registry, so the install failed when the new registry did not serve a locked version or served different content. pnpm records in the workspace state which registry each scope routed to, so a fresh clone without that record installs the lockfile as recorded. Changing the default registry resolves nothing again, and pnpm install --frozen-lockfile is unchanged.

  • When autoDedupe is off, a workspace project's dependencies now resolve from its own ranges, like they do with sharedWorkspaceLockfile: false. Previously, another project's narrower range could hold them back. For example, ajv: "*" now resolves to the latest Ajv even if another project depends on ajv@^6. Packages that a project lists in peerDependencies still follow the versions other projects use. pnpm dedupe and installs with autoDedupe: true still pick one version that satisfies every range. Set autoDedupe: true if CI runs pnpm dedupe --check #​17235.

  • An optional dependency written with a named-registry prefix, such as work:^1.0.0, now fails the install when it cannot be resolved but the lockfile already has a matching entry from that registry. Such a dependency was skipped, which removed its entries from the lockfile.

  • With injectWorkspacePackages: true, a workspace: dependency written as a relative path, such as workspace:../lib-a, in a workspace package now resolves from that package's directory #​17284.

  • Fixed pnpm install failing with ERR_PNPM_UNSUPPORTED_PROTOCOL when a workspace package injected through a relative path, such as workspace:../lib, has catalog: dependencies. Their catalog entries now resolve the way they do for a package injected by name #​17280.

  • pnpm dedupe now refreshes cached registry metadata while re-resolving locked versions #​17208.

  • pnpm dedupe --check no longer fails when the only difference is a deprecated notice that the registry added or removed after the lockfile was written #​17198.

  • Installs delegated to a pnpr server now resolve every prefix declared for a registry URL. A dependency or lockfile entry that used the second of two prefixes for the same registry, such as zeta: next to work: in namedRegistries, failed on the server pnpm/tasks#204.

  • Registry revisions are now addressed at <registry>/<name>@<version>+r<revision> pnpm/tasks#208.

Adding packages and global packages

  • pnpm add <pkg>@<tag> and pnpm add <pkg>@<range> now install the version the tag or range resolves to, even when the saved range allows a newer one #​17234.

  • pnpm add <pkg> without a version now installs the version under the dist-tag set by the tag setting. An npm: alias or a jsr: dependency without a version resolves that tag too. The setting is read from pnpm-workspace.yaml, the global config, PNPM_CONFIG_TAG, and --config.tag, and defaults to latest.

  • pnpm add now accepts the lowercase short options -p, -d, -o, and -e as aliases of --save-prod, --save-dev, --save-optional, and --save-exact.

  • pnpm -D install <pkg> now saves the package to devDependencies. An add option such as -D or -E written before install <pkg> was rejected as an unexpected argument.

  • pnpm add -T now reports that the short option is ambiguous and points to --save-types and --tilde.

  • Global packages installed with pnpm add -g are now linked from the global virtual store, so global packages that share dependencies share one copy. Set virtualStoreType: project to give each global install its own virtual store.

  • pnpm add -g and the other --global commands now fail with ERR_PNPM_CONFIG_CONFLICT_VIRTUAL_STORE_DIR_WITH_GLOBAL when --virtual-store-dir is passed. A custom --hoist-pattern fails with ERR_PNPM_CONFIG_CONFLICT_HOIST_PATTERN_WITH_GLOBAL. Passing --link-workspace-packages, --shared-workspace-lockfile, or --config.lockfile-dir with --global also fails, with the matching ERR_PNPM_CONFIG_CONFLICT_*_WITH_GLOBAL code.

Registries, proxies, and login

  • pnpm now reads the strictSsl and localAddress settings from pnpm-workspace.yaml, the global config.yaml, PNPM_CONFIG_* environment variables, and --config.* options. This includes pnpm self-update and the download of the pnpm version pinned in packageManager. Before, pnpm read them only from .npmrc as strict-ssl and local-address and ignored the other sources pnpm/tasks#201.

  • When Corepack runs pnpm and the native binary has to be downloaded, the download now uses the proxy from pnpm's config. That proxy comes from PNPM_CONFIG_HTTPS_PROXY and the matching variables, the global config.yaml, and the user .npmrc. Previously, the download read the proxy only from HTTPS_PROXY, HTTP_PROXY, and NO_PROXY pnpm/tasks#215.

  • When the pnpm package downloads its native binary on first run, as it does under Corepack, it now trusts the CA certificates from the ca, ca[], and cafile settings of .npmrc, including the ones scoped to the registry. A registry behind a private CA failed with fetch failed before, unless NODE_EXTRA_CA_CERTS named the CA. A project .npmrc is used only while the download is checked against npm's signature. Node.js versions that cannot add CA certificates after startup still need NODE_EXTRA_CA_CERTS.

  • pnpm login saves the token in <pnpm config>/auth.ini again. Since v12.1.0, an unscoped login had made its registry the default for every project that did not name a registry. A login now also removes the token an earlier login saved for that registry or scope under _auth in the global config.yaml. pnpm login --scope still routes the scope through the global registries setting.

  • pnpm no longer warns that a registries entry routed through the @ scope matches no configured registry. pnpm applied such an entry and its options such as serverType while reporting it as ignored pnpm/tasks#184.

Running scripts and other commands

  • pnpm ci --lockfile and pnpm ci --config.lockfile=true no longer delete pnpm-lock.yaml. pnpm ci now always keeps the lockfile and runs a frozen install from it.

  • pnpm deploy --legacy now checks the workspace lockfile against minimumReleaseAge and the other resolution policies, as pnpm install does, and fails with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION when a locked version is too new. It used to deploy an older version that is not in the lockfile without a warning #​17209.

  • pnpm deploy now keeps a deployed symlink to a directory inside the project even if the directory is not among the deployed files, such as a link into node_modules #​17288.

  • pnpm pack and pnpm publish now keep pnpm.config in the published package.json. They also always include the file pnpm.config points to in the tarball #​17210.

  • pnpm -r publish --batch now sends PUT /-/pnpr/v0/publish, the batch publish endpoint that pnpr serves.

  • pnpm audit --ignore and pnpm audit --ignore-unfixable now exit with a non-zero code when vulnerabilities at or above the audit level remain after ignoring. Before, these commands always exited with code 0.

  • pnpm audit --fix and pnpm audit --interactive now fail with ERR_PNPM_AUDIT_FIX_WITH_IGNORE when combined with --ignore or --ignore-unfixable. Before, the fix ran and the ignore flags had no effect.

  • pnpm -r run <script> now honors the requiredScripts setting from pnpm-workspace.yaml. If the script is listed there and a selected project does not define it, the run fails with ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT and names the projects that lack it.

  • pnpm run and pnpm exec no longer report the dependencies as out of date after a lockfile change when dedupePeers is true [#​17322](https://redirec

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) November 2, 2026 02:06
@renovate
renovate Bot requested a review from No767 as a code owner November 2, 2026 02:06
renovate-approve[bot]
renovate-approve Bot previously approved these changes Nov 2, 2026
View reviewed changes
@renovate
renovate Bot force-pushed the renovate/npm-dependencies branch from fb23911 to 13a203f Compare November 2, 2026 05:54
renovate-approve[bot]
renovate-approve Bot previously approved these changes Nov 2, 2026
View reviewed changes
@renovate
renovate Bot force-pushed the renovate/npm-dependencies branch from 13a203f to 0852d35 Compare November 2, 2026 17:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes
@No767 No767 Awaiting requested review from No767 No767 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants