9.json (26141B)
1 { 2 "number": 9, 3 "title": "Update pnpm to v10.17.1", 4 "state": "open", 5 "diff_file": "9.diff", 6 "author": "renovate[bot]", 7 "created_at": "2025-05-23T12:56:12Z", 8 "closed_at": null, 9 "merged_at": null, 10 "base_ref": "main", 11 "head_ref": "renovate/pnpm-10.x", 12 "labels": [], 13 "assignees": [], 14 "requested_reviewers": [], 15 "body": "> [!NOTE]\n> Mend has cancelled [the proposed renaming](https://redirect.github.com/renovatebot/renovate/discussions/37842) of the Renovate GitHub app being renamed to `mend[bot]`.\n> \n> This notice will be removed on 2025-10-07.\n\n<hr>\n\nThis PR contains the following updates:\n\n| Package | Change | Age | Confidence |\n|---|---|---|---|\n| [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`10.10.0+sha512.d615db246fe70f25dcfea6d8d73dee782ce23e2245e3c4f6f888249fb568149318637dca73c2c5c8ef2a4ca0d5657fb9567188bfab47f566d1ee6ce987815c39` -> `10.17.1`](https://renovatebot.com/diffs/npm/pnpm/10.10.0/10.17.1) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |\n\n---\n\n### Release Notes\n\n<details>\n<summary>pnpm/pnpm (pnpm)</summary>\n\n### [`v10.17.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10171)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.17.0...v10.17.1)\n\n##### Patch Changes\n\n- When a version specifier cannot be resolved because the versions don't satisfy the `minimumReleaseAge` setting, print this information out in the error message [#​9974](https://redirect.github.com/pnpm/pnpm/pull/9974).\n- Fix `state.json` creation path when executing `pnpm patch` in a workspace project [#​9733](https://redirect.github.com/pnpm/pnpm/pull/9733).\n- When `minimumReleaseAge` is set and the `latest` tag is not mature enough, prefer a non-deprecated version as the new `latest` [#​9987](https://redirect.github.com/pnpm/pnpm/issues/9987).\n\n### [`v10.17.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10170)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.16.1...v10.17.0)\n\n##### Minor Changes\n\n- The `minimumReleaseAgeExclude` setting now supports patterns. For instance:\n\n ```yaml\n minimumReleaseAge: 1440\n minimumReleaseAgeExclude:\n - \"@​eslint/*\"\n ```\n\n Related PR: [#​9984](https://redirect.github.com/pnpm/pnpm/pull/9984).\n\n##### Patch Changes\n\n- Don't ignore the `minimumReleaseAge` check, when the package is requested by exact version and the packument is loaded from cache [#​9978](https://redirect.github.com/pnpm/pnpm/issues/9978).\n- When `minimumReleaseAge` is set and the active version under a dist-tag is not mature enough, do not downgrade to a prerelease version in case the original version wasn't a prerelease one [#​9979](https://redirect.github.com/pnpm/pnpm/issues/9979).\n\n### [`v10.16.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10161)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.16.0...v10.16.1)\n\n##### Patch Changes\n\n- The full metadata cache should be stored not at the same location as the abbreviated metadata. This fixes a bug where pnpm was loading the abbreviated metadata from cache and couldn't find the \"time\" field as a result [#​9963](https://redirect.github.com/pnpm/pnpm/issues/9963).\n- Forcibly disable ANSI color codes when generating patch diff [#​9914](https://redirect.github.com/pnpm/pnpm/pull/9914).\n\n### [`v10.16.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10160)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.15.1...v10.16.0)\n\n##### Minor Changes\n\n- There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies. In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour.\n\n The new setting is called `minimumReleaseAge`. It specifies the number of minutes that must pass after a version is published before pnpm will install it. For example, setting `minimumReleaseAge: 1440` ensures that only packages released at least one day ago can be installed.\n\n If you set `minimumReleaseAge` but need to disable this restriction for certain dependencies, you can list them under the `minimumReleaseAgeExclude` setting. For instance, with the following configuration pnpm will always install the latest version of webpack, regardless of its release time:\n\n ```yaml\n minimumReleaseAgeExclude:\n - webpack\n ```\n\n Related issue: [#​9921](https://redirect.github.com/pnpm/pnpm/issues/9921).\n\n- Added support for `finders` [#​9946](https://redirect.github.com/pnpm/pnpm/pull/9946).\n\n In the past, `pnpm list` and `pnpm why` could only search for dependencies by **name** (and optionally version). For example:\n\n ```\n pnpm why minimist\n ```\n\n prints the chain of dependencies to any installed instance of `minimist`:\n\n ```\n verdaccio 5.20.1\n \u251c\u2500\u252c handlebars 4.7.7\n \u2502 \u2514\u2500\u2500 minimist 1.2.8\n \u2514\u2500\u252c mv 2.1.1\n \u2514\u2500\u252c mkdirp 0.5.6\n \u2514\u2500\u2500 minimist 1.2.8\n ```\n\n What if we want to search by **other properties** of a dependency, not just its name? For instance, find all packages that have `react@17` in their peer dependencies?\n\n This is now possible with \"finder functions\". Finder functions can be declared in `.pnpmfile.cjs` and invoked with the `--find-by=<function name>` flag when running `pnpm list` or `pnpm why`.\n\n Let's say we want to find any dependencies that have React 17 in peer dependencies. We can add this finder to our `.pnpmfile.cjs`:\n\n ```js\n module.exports = {\n finders: {\n react17: (ctx) => {\n return ctx.readManifest().peerDependencies?.react === \"^17.0.0\";\n },\n },\n };\n ```\n\n Now we can use this finder function by running:\n\n ```\n pnpm why --find-by=react17\n ```\n\n pnpm will find all dependencies that have this React in peer dependencies and print their exact locations in the dependency graph.\n\n ```\n @​apollo/client 4.0.4\n \u251c\u2500\u2500 @​graphql-typed-document-node/core 3.2.0\n \u2514\u2500\u2500 graphql-tag 2.12.6\n ```\n\n It is also possible to print out some additional information in the output by returning a string from the finder. For example, with the following finder:\n\n ```js\n module.exports = {\n finders: {\n react17: (ctx) => {\n const manifest = ctx.readManifest();\n if (manifest.peerDependencies?.react === \"^17.0.0\") {\n return `license: ${manifest.license}`;\n }\n return false;\n },\n },\n };\n ```\n\n Every matched package will also print out the license from its `package.json`:\n\n ```\n @​apollo/client 4.0.4\n \u251c\u2500\u2500 @​graphql-typed-document-node/core 3.2.0\n \u2502 license: MIT\n \u2514\u2500\u2500 graphql-tag 2.12.6\n license: MIT\n ```\n\n##### Patch Changes\n\n- Fix deprecation warning printed when executing pnpm with Node.js 24 [#​9529](https://redirect.github.com/pnpm/pnpm/issues/9529).\n- Throw an error if `nodeVersion` is not set to an exact semver version [#​9934](https://redirect.github.com/pnpm/pnpm/issues/9934).\n- `pnpm publish` should be able to publish a `.tar.gz` file [#​9927](https://redirect.github.com/pnpm/pnpm/pull/9927).\n- Canceling a running process with Ctrl-C should make `pnpm run` return a non-zero exit code [#​9626](https://redirect.github.com/pnpm/pnpm/issues/9626).\n\n### [`v10.15.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10151)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.15.0...v10.15.1)\n\n##### Patch Changes\n\n- Fix `.pnp.cjs` crash when importing subpath [#​9904](https://redirect.github.com/pnpm/pnpm/issues/9904).\n- When resolving peer dependencies, pnpm looks whether the peer dependency is present in the root workspace project's dependencies. This change makes it so that the peer dependency is correctly resolved even from aliased npm-hosted dependencies or other types of dependencies [#​9913](https://redirect.github.com/pnpm/pnpm/issues/9913).\n\n### [`v10.15.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10150)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.14.0...v10.15.0)\n\n##### Minor Changes\n\n- Added the `cleanupUnusedCatalogs` configuration. When set to `true`, pnpm will remove unused catalog entries during installation [#​9793](https://redirect.github.com/pnpm/pnpm/pull/9793).\n- Automatically load pnpmfiles from config dependencies that are named `@*/pnpm-plugin-*` [#​9780](https://redirect.github.com/pnpm/pnpm/issues/9780).\n- `pnpm config get` now prints an INI string for an object value [#​9797](https://redirect.github.com/pnpm/pnpm/issues/9797).\n- `pnpm config get` now accepts property paths (e.g. `pnpm config get catalog.react`, `pnpm config get .catalog.react`, `pnpm config get 'packageExtensions[\"@​babel/parser\"].peerDependencies[\"@​babel/types\"]'`), and `pnpm config set` now accepts dot-leading or subscripted keys (e.g. `pnpm config set .ignoreScripts true`).\n- `pnpm config get --json` now prints a JSON serialization of config value, and `pnpm config set --json` now parses the input value as JSON.\n\n##### Patch Changes\n\n- **Semi-breaking.** When automatically installing missing peer dependencies, prefer versions that are already present in the direct dependencies of the root workspace package [#​9835](https://redirect.github.com/pnpm/pnpm/pull/9835).\n- When executing the `pnpm create` command, must verify whether the node version is supported even if a cache already exists [#​9775](https://redirect.github.com/pnpm/pnpm/pull/9775).\n- When making requests for the non-abbreviated packument, add `*/*` to the `Accept` header to avoid getting a 406 error on AWS CodeArtifact [#​9862](https://redirect.github.com/pnpm/pnpm/issues/9862).\n- The standalone exe version of pnpm works with glibc 2.26 again [#​9734](https://redirect.github.com/pnpm/pnpm/issues/9734).\n- Fix a regression in which `pnpm dlx pkg --help` doesn't pass `--help` to `pkg` [#​9823](https://redirect.github.com/pnpm/pnpm/issues/9823).\n\n### [`v10.14.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10140)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.13.1...v10.14.0)\n\n##### Minor Changes\n\n- **Added support for JavaScript runtime resolution**\n\n Declare Node.js, Deno, or Bun in [`devEngines.runtime`](https://redirect.github.com/openjs-foundation/package-metadata-interoperability-collab-space/issues/15) (inside `package.json`) and let pnpm download and pin it automatically.\n\n Usage example:\n\n ```json\n {\n \"devEngines\": {\n \"runtime\": {\n \"name\": \"node\",\n \"version\": \"^24.4.0\",\n \"onFail\": \"download\" (we only support the \"download\" value for now)\n }\n }\n }\n ```\n\n How it works:\n\n 1. `pnpm install` resolves your specified range to the latest matching runtime version.\n 2. The exact version (and checksum) is saved in the lockfile.\n 3. Scripts use the local runtime, ensuring consistency across environments.\n\n Why this is better:\n\n 1. This new setting supports also Deno and Bun (vs. our Node-only settings `useNodeVersion` and `executionEnv.nodeVersion`)\n 2. Supports version ranges (not just a fixed version).\n 3. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity.\n 4. It can be used on any workspace project (like `executionEnv.nodeVersion`). So, different projects in a workspace can use different runtimes.\n 5. For now `devEngines.runtime` setting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.\n\n Related PR: [#​9755](https://redirect.github.com/pnpm/pnpm/pull/9755).\n\n- Add `--cpu`, `--libc`, and `--os` to `pnpm install`, `pnpm add`, and `pnpm dlx` to customize `supportedArchitectures` via the CLI [#​7510](https://redirect.github.com/pnpm/pnpm/issues/7510).\n\n##### Patch Changes\n\n- Fix a bug in which `pnpm add` downloads packages whose `libc` differ from `pnpm.supportedArchitectures.libc`.\n- The integrities of the downloaded Node.js artifacts are verified [#​9750](https://redirect.github.com/pnpm/pnpm/pull/9750).\n- Allow `dlx` to parse CLI flags and options between the `dlx` command and the command to run or between the `dlx` command and `--` [#​9719](https://redirect.github.com/pnpm/pnpm/issues/9719).\n- `pnpm install --prod` should removing hoisted dev dependencies [#​9782](https://redirect.github.com/pnpm/pnpm/issues/9782).\n- Fix an edge case bug causing local tarballs to not re-link into the virtual store. This bug would happen when changing the contents of the tarball without renaming the file and running a filtered install.\n- Fix a bug causing `pnpm install` to incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.\n\n### [`v10.13.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10131)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.13.0...v10.13.1)\n\n##### Patch Changes\n\n- Run user defined pnpmfiles after pnpmfiles of plugins.\n\n### [`v10.13.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10130)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.12.4...v10.13.0)\n\n##### Minor Changes\n\n- Added the possibility to load multiple pnpmfiles. The `pnpmfile` setting can now accept a list of pnpmfile locations [#​9702](https://redirect.github.com/pnpm/pnpm/pull/9702).\n- pnpm will now automatically load the `pnpmfile.cjs` file from any [config dependency](https://pnpm.io/config-dependencies) named `@pnpm/plugin-*` or `pnpm-plugin-*` [#​9729](https://redirect.github.com/pnpm/pnpm/pull/9729).\n\n The order in which config dependencies are initialized should not matter \u2014 they are initialized in alphabetical order. If a specific order is needed, the paths to the `pnpmfile.cjs` files in the config dependencies can be explicitly listed using the `pnpmfile` setting in `pnpm-workspace.yaml`.\n\n##### Patch Changes\n\n- When patching dependencies installed via `pkg.pr.new`, treat them as Git tarball URLs [#​9694](https://redirect.github.com/pnpm/pnpm/pull/9694).\n- Prevent conflicts between local projects' config and the global config in `dangerouslyAllowAllBuilds`, `onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, and `neverBuiltDependencies` [#​9628](https://redirect.github.com/pnpm/pnpm/issues/9628).\n- Sort keys in `pnpm-workspace.yaml` with deep [#​9701](https://redirect.github.com/pnpm/pnpm/pull/9701).\n- The `pnpm rebuild` command should not add pkgs included in `ignoredBuiltDependencies` to `ignoredBuilds` in `node_modules/.modules.yaml` [#​9338](https://redirect.github.com/pnpm/pnpm/issues/9338).\n- Replaced `shell-quote` with `shlex` for quoting command arguments [#​9381](https://redirect.github.com/pnpm/pnpm/issues/9381).\n\n### [`v10.12.4`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10124)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.12.3...v10.12.4)\n\n##### Patch Changes\n\n- Fix `pnpm licenses` command for local dependencies [#​9583](https://redirect.github.com/pnpm/pnpm/pull/9583).\n- Fix a bug in which `pnpm ls --filter=not-exist --json` prints nothing instead of an empty array [#​9672](https://redirect.github.com/pnpm/pnpm/issues/9672).\n- Fix a deadlock that sometimes happens during peer dependency resolution [#​9673](https://redirect.github.com/pnpm/pnpm/issues/9673).\n- Running `pnpm install` after `pnpm fetch` should hoist all dependencies that need to be hoisted.\n Fixes a regression introduced in \\[v10.12.2] by \\[[#​9648](https://redirect.github.com/pnpm/pnpm/issues/9648)]; resolves \\[[#​9689](https://redirect.github.com/pnpm/pnpm/issues/9689)].\n\n \\[v10.12.2]: https://redirect.github.com/pnpm/pnpm/releases/tag/v10.12.2Add commentMore actions\n \\[[#​9648](https://redirect.github.com/pnpm/pnpm/issues/9648)]: [https://github.com/pnpm/pnpm/pull/9648](https://redirect.github.com/pnpm/pnpm/pull/9648)\n \\[[#​9689](https://redirect.github.com/pnpm/pnpm/issues/9689)]: [https://github.com/pnpm/pnpm/issues/9689](https://redirect.github.com/pnpm/pnpm/issues/9689)\n\n### [`v10.12.3`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10123)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.12.2...v10.12.3)\n\n##### Patch Changes\n\n- Restore hoisting of optional peer dependencies when installing with an outdated lockfile.\n Regression introduced in [v10.12.2] by [#​9648]; resolves [#​9685].\n\n [v10.12.2]: https://redirect.github.com/pnpm/pnpm/releases/tag/v10.12.2\n\n [#​9648]: https://redirect.github.com/pnpm/pnpm/pull/9648\n\n [#​9685]: https://redirect.github.com/pnpm/pnpm/issues/9685\n\n### [`v10.12.2`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10122)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.12.1...v10.12.2)\n\n##### Patch Changes\n\n- Fixed hoisting with `enableGlobalVirtualStore` set to `true` [#​9648](https://redirect.github.com/pnpm/pnpm/pull/9648).\n- Fix the `--help` and `-h` flags not working as expected for the `pnpm create` command.\n- The dependency package path output by the `pnpm licenses list --json` command is incorrect.\n- Fix a bug in which `pnpm deploy` fails due to overridden dependencies having peer dependencies causing `ERR_PNPM_OUTDATED_LOCKFILE` [#​9595](https://redirect.github.com/pnpm/pnpm/issues/9595).\n\n### [`v10.12.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10121)\n\n##### Minor Changes\n\n- **Experimental.** Added support for global virtual stores. When enabled, `node_modules` contains only symlinks to a central virtual store, rather to `node_modules/.pnpm`. By default, this central store is located at `<store-path>/links` (you can find the store path by running `pnpm store path`).\n\n In the central virtual store, each package is hard linked into a directory whose name is the hash of its dependency graph. This allows multiple projects on the system to symlink shared dependencies from this central location, significantly improving installation speed when a warm cache is available.\n\n > This is conceptually similar to how [NixOS manages packages](https://nixos.org/guides/how-nix-works/), using dependency graph hashes to create isolated and reusable package directories.\n\n To enable the global virtual store, set `enableGlobalVirtualStore: true` in your root `pnpm-workspace.yaml`, or globally via:\n\n ```sh\n pnpm config -g set enable-global-virtual-store true\n ```\n\n NOTE: In CI environments, where caches are typically cold, this setting may slow down installation. pnpm automatically disables the global virtual store when running in CI.\n\n Related PR: [#​8190](https://redirect.github.com/pnpm/pnpm/pull/8190)\n\n<!---->\n\n- The `pnpm update` command now supports updating `catalog:` protocol dependencies and writes new specifiers to `pnpm-workspace.yaml`.\n- Added two new CLI options (`--save-catalog` and `--save-catalog-name=<name>`) to `pnpm add` to save new dependencies as catalog entries. `catalog:` or `catalog:<name>` will be added to `package.json` and the package specifier will be added to the `catalogs` or `catalog[<name>]` object in `pnpm-workspace.yaml` [#​9425](https://redirect.github.com/pnpm/pnpm/issues/9425).\n- **Semi-breaking.** The keys used for side-effects caches have changed. If you have a side-effects cache generated by a previous version of pnpm, the new version will not use it and will create a new cache instead [#​9605](https://redirect.github.com/pnpm/pnpm/pull/9605).\n- Added a new setting called `ci` for explicitly telling pnpm if the current environment is a CI or not.\n\n##### Patch Changes\n\n- Sort versions printed by `pnpm patch` using semantic versioning rules.\n- Improve the way the error message displays mismatched specifiers. Show differences instead of 2 whole objects [#​9598](https://redirect.github.com/pnpm/pnpm/pull/9598).\n- Revert [#​9574](https://redirect.github.com/pnpm/pnpm/pull/9574) to fix a regression [#​9596](https://redirect.github.com/pnpm/pnpm/issues/9596).\n\n### [`v10.11.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10111)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.11.0...v10.11.1)\n\n##### Patch Changes\n\n- Fix an issue in which `pnpm deploy --legacy` creates unexpected directories when the root `package.json` has a workspace package as a peer dependency [#​9550](https://redirect.github.com/pnpm/pnpm/issues/9550).\n- Dependencies specified via a URL that redirects will only be locked to the target if it is immutable, fixing a regression when installing from GitHub releases. ([#​9531](https://redirect.github.com/pnpm/pnpm/issues/9531))\n- Installation should not exit with an error if `strictPeerDependencies` is `true` but all issues are ignored by `peerDependencyRules` [#​9505](https://redirect.github.com/pnpm/pnpm/pull/9505).\n- Use `pnpm_config_` env variables instead of `npm_config_` [#​9571](https://redirect.github.com/pnpm/pnpm/pull/9571).\n- Fix a regression (in v10.9.0) causing the `--lockfile-only` flag on `pnpm update` to produce a different `pnpm-lock.yaml` than an update without the flag.\n- Let `pnpm deploy` work in repos with `overrides` when `inject-workspace-packages=true` [#​9283](https://redirect.github.com/pnpm/pnpm/issues/9283).\n- Fixed the problem of path loss caused by parsing URL address. Fixes a regression shipped in pnpm v10.11 via [#​9502](https://redirect.github.com/pnpm/pnpm/pull/9502).\n- `pnpm -r --silent run` should not print out section [#​9563](https://redirect.github.com/pnpm/pnpm/issues/9563).\n\n### [`v10.11.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10110)\n\n[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.10.0...v10.11.0)\n\n##### Minor Changes\n\n- A new setting added for `pnpm init` to create a `package.json` with `type=module`, when `init-type` is `module`. Works as a flag for the init command too [#​9463](https://redirect.github.com/pnpm/pnpm/pull/9463).\n\n- Added support for Nushell to `pnpm setup` [#​6476](https://redirect.github.com/pnpm/pnpm/issues/6476).\n\n- Added two new flags to the `pnpm audit` command, `--ignore` and `--ignore-unfixable` [#​8474](https://redirect.github.com/pnpm/pnpm/pull/8474).\n\n Ignore all vulnerabilities that have no solution:\n\n ```shell\n > pnpm audit --ignore-unfixable\n ```\n\n Provide a list of CVE's to ignore those specifically, even if they have a resolution.\n\n ```shell\n > pnpm audit --ignore=CVE-2021-1234 --ignore=CVE-2021-5678\n ```\n\n- Added support for recursively running pack in every project of a workspace [#​4351](https://redirect.github.com/pnpm/pnpm/issues/4351).\n\n Now you can run `pnpm -r pack` to pack all packages in the workspace.\n\n##### Patch Changes\n\n- pnpm version management should work, when `dangerouslyAllowAllBuilds` is set to `true` [#​9472](https://redirect.github.com/pnpm/pnpm/issues/9472).\n- `pnpm link` should work from inside a workspace [#​9506](https://redirect.github.com/pnpm/pnpm/issues/9506).\n- Set the default `workspaceConcurrency` to `Math.min(os.availableParallelism(), 4)` [#​9493](https://redirect.github.com/pnpm/pnpm/pull/9493).\n- Installation should not exit with an error if `strictPeerDependencies` is `true` but all issues are ignored by `peerDependencyRules` [#​9505](https://redirect.github.com/pnpm/pnpm/pull/9505).\n- Read `updateConfig` from `pnpm-workspace.yaml` [#​9500](https://redirect.github.com/pnpm/pnpm/issues/9500).\n- Add support for `recursive pack`\n- Remove `url.parse` usage to fix warning on Node.js 24 [#​9492](https://redirect.github.com/pnpm/pnpm/issues/9492).\n- `pnpm run` should be able to run commands from the workspace root, if `ignoreScripts` is set tot `true` [#​4858](https://redirect.github.com/pnpm/pnpm/issues/4858).\n\n</details>\n\n---\n\n### Configuration\n\n\ud83d\udcc5 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).\n\n\ud83d\udea6 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n\u267b **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\ud83d\udd15 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/MTRNord/draupnir4all-web).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4xNi4wIiwidXBkYXRlZEluVmVyIjoiNDEuMTMxLjkiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->\n", 16 "comments": [], 17 "review_comments": [] 18 }