9.md (25375B)
1 # PR #9 Update pnpm to v10.17.1 2 3 - **Status:** open 4 - **Author:** @renovate[bot] 5 - **Created:** 2025-05-23T12:56:12Z 6 - **Branch:** renovate/pnpm-10.x → main 7 - **Diff:** [9.diff](./9.diff) 8 9 --- 10 11 > [!NOTE] 12 > Mend has cancelled [the proposed renaming](https://redirect.github.com/renovatebot/renovate/discussions/37842) of the Renovate GitHub app being renamed to `mend[bot]`. 13 > 14 > This notice will be removed on 2025-10-07. 15 16 <hr> 17 18 This PR contains the following updates: 19 20 | Package | Change | Age | Confidence | 21 |---|---|---|---| 22 | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`10.10.0+sha512.d615db246fe70f25dcfea6d8d73dee782ce23e2245e3c4f6f888249fb568149318637dca73c2c5c8ef2a4ca0d5657fb9567188bfab47f566d1ee6ce987815c39` -> `10.17.1`](https://renovatebot.com/diffs/npm/pnpm/10.10.0/10.17.1) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | 23 24 --- 25 26 ### Release Notes 27 28 <details> 29 <summary>pnpm/pnpm (pnpm)</summary> 30 31 ### [`v10.17.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10171) 32 33 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.17.0...v10.17.1) 34 35 ##### Patch Changes 36 37 - When a version specifier cannot be resolved because the versions don't satisfy the `minimumReleaseAge` setting, print this information out in the error message [#​9974](https://redirect.github.com/pnpm/pnpm/pull/9974). 38 - Fix `state.json` creation path when executing `pnpm patch` in a workspace project [#​9733](https://redirect.github.com/pnpm/pnpm/pull/9733). 39 - When `minimumReleaseAge` is set and the `latest` tag is not mature enough, prefer a non-deprecated version as the new `latest` [#​9987](https://redirect.github.com/pnpm/pnpm/issues/9987). 40 41 ### [`v10.17.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10170) 42 43 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.16.1...v10.17.0) 44 45 ##### Minor Changes 46 47 - The `minimumReleaseAgeExclude` setting now supports patterns. For instance: 48 49 ```yaml 50 minimumReleaseAge: 1440 51 minimumReleaseAgeExclude: 52 - "@​eslint/*" 53 ``` 54 55 Related PR: [#​9984](https://redirect.github.com/pnpm/pnpm/pull/9984). 56 57 ##### Patch Changes 58 59 - Don't ignore the `minimumReleaseAge` check, when the package is requested by exact version and the packument is loaded from cache [#​9978](https://redirect.github.com/pnpm/pnpm/issues/9978). 60 - When `minimumReleaseAge` is set and the active version under a dist-tag is not mature enough, do not downgrade to a prerelease version in case the original version wasn't a prerelease one [#​9979](https://redirect.github.com/pnpm/pnpm/issues/9979). 61 62 ### [`v10.16.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10161) 63 64 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.16.0...v10.16.1) 65 66 ##### Patch Changes 67 68 - The full metadata cache should be stored not at the same location as the abbreviated metadata. This fixes a bug where pnpm was loading the abbreviated metadata from cache and couldn't find the "time" field as a result [#​9963](https://redirect.github.com/pnpm/pnpm/issues/9963). 69 - Forcibly disable ANSI color codes when generating patch diff [#​9914](https://redirect.github.com/pnpm/pnpm/pull/9914). 70 71 ### [`v10.16.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10160) 72 73 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.15.1...v10.16.0) 74 75 ##### Minor Changes 76 77 - There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies. In most cases, such attacks are discovered quickly and the malicious versions are removed from the registry within an hour. 78 79 The new setting is called `minimumReleaseAge`. It specifies the number of minutes that must pass after a version is published before pnpm will install it. For example, setting `minimumReleaseAge: 1440` ensures that only packages released at least one day ago can be installed. 80 81 If you set `minimumReleaseAge` but need to disable this restriction for certain dependencies, you can list them under the `minimumReleaseAgeExclude` setting. For instance, with the following configuration pnpm will always install the latest version of webpack, regardless of its release time: 82 83 ```yaml 84 minimumReleaseAgeExclude: 85 - webpack 86 ``` 87 88 Related issue: [#​9921](https://redirect.github.com/pnpm/pnpm/issues/9921). 89 90 - Added support for `finders` [#​9946](https://redirect.github.com/pnpm/pnpm/pull/9946). 91 92 In the past, `pnpm list` and `pnpm why` could only search for dependencies by **name** (and optionally version). For example: 93 94 ``` 95 pnpm why minimist 96 ``` 97 98 prints the chain of dependencies to any installed instance of `minimist`: 99 100 ``` 101 verdaccio 5.20.1 102 ├─┬ handlebars 4.7.7 103 │ └── minimist 1.2.8 104 └─┬ mv 2.1.1 105 └─┬ mkdirp 0.5.6 106 └── minimist 1.2.8 107 ``` 108 109 What if we want to search by **other properties** of a dependency, not just its name? For instance, find all packages that have `react@17` in their peer dependencies? 110 111 This is now possible with "finder functions". Finder functions can be declared in `.pnpmfile.cjs` and invoked with the `--find-by=<function name>` flag when running `pnpm list` or `pnpm why`. 112 113 Let's say we want to find any dependencies that have React 17 in peer dependencies. We can add this finder to our `.pnpmfile.cjs`: 114 115 ```js 116 module.exports = { 117 finders: { 118 react17: (ctx) => { 119 return ctx.readManifest().peerDependencies?.react === "^17.0.0"; 120 }, 121 }, 122 }; 123 ``` 124 125 Now we can use this finder function by running: 126 127 ``` 128 pnpm why --find-by=react17 129 ``` 130 131 pnpm will find all dependencies that have this React in peer dependencies and print their exact locations in the dependency graph. 132 133 ``` 134 @​apollo/client 4.0.4 135 ├── @​graphql-typed-document-node/core 3.2.0 136 └── graphql-tag 2.12.6 137 ``` 138 139 It is also possible to print out some additional information in the output by returning a string from the finder. For example, with the following finder: 140 141 ```js 142 module.exports = { 143 finders: { 144 react17: (ctx) => { 145 const manifest = ctx.readManifest(); 146 if (manifest.peerDependencies?.react === "^17.0.0") { 147 return `license: ${manifest.license}`; 148 } 149 return false; 150 }, 151 }, 152 }; 153 ``` 154 155 Every matched package will also print out the license from its `package.json`: 156 157 ``` 158 @​apollo/client 4.0.4 159 ├── @​graphql-typed-document-node/core 3.2.0 160 │ license: MIT 161 └── graphql-tag 2.12.6 162 license: MIT 163 ``` 164 165 ##### Patch Changes 166 167 - Fix deprecation warning printed when executing pnpm with Node.js 24 [#​9529](https://redirect.github.com/pnpm/pnpm/issues/9529). 168 - Throw an error if `nodeVersion` is not set to an exact semver version [#​9934](https://redirect.github.com/pnpm/pnpm/issues/9934). 169 - `pnpm publish` should be able to publish a `.tar.gz` file [#​9927](https://redirect.github.com/pnpm/pnpm/pull/9927). 170 - Canceling a running process with Ctrl-C should make `pnpm run` return a non-zero exit code [#​9626](https://redirect.github.com/pnpm/pnpm/issues/9626). 171 172 ### [`v10.15.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10151) 173 174 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.15.0...v10.15.1) 175 176 ##### Patch Changes 177 178 - Fix `.pnp.cjs` crash when importing subpath [#​9904](https://redirect.github.com/pnpm/pnpm/issues/9904). 179 - When resolving peer dependencies, pnpm looks whether the peer dependency is present in the root workspace project's dependencies. This change makes it so that the peer dependency is correctly resolved even from aliased npm-hosted dependencies or other types of dependencies [#​9913](https://redirect.github.com/pnpm/pnpm/issues/9913). 180 181 ### [`v10.15.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10150) 182 183 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.14.0...v10.15.0) 184 185 ##### Minor Changes 186 187 - Added the `cleanupUnusedCatalogs` configuration. When set to `true`, pnpm will remove unused catalog entries during installation [#​9793](https://redirect.github.com/pnpm/pnpm/pull/9793). 188 - Automatically load pnpmfiles from config dependencies that are named `@*/pnpm-plugin-*` [#​9780](https://redirect.github.com/pnpm/pnpm/issues/9780). 189 - `pnpm config get` now prints an INI string for an object value [#​9797](https://redirect.github.com/pnpm/pnpm/issues/9797). 190 - `pnpm config get` now accepts property paths (e.g. `pnpm config get catalog.react`, `pnpm config get .catalog.react`, `pnpm config get 'packageExtensions["@​babel/parser"].peerDependencies["@​babel/types"]'`), and `pnpm config set` now accepts dot-leading or subscripted keys (e.g. `pnpm config set .ignoreScripts true`). 191 - `pnpm config get --json` now prints a JSON serialization of config value, and `pnpm config set --json` now parses the input value as JSON. 192 193 ##### Patch Changes 194 195 - **Semi-breaking.** When automatically installing missing peer dependencies, prefer versions that are already present in the direct dependencies of the root workspace package [#​9835](https://redirect.github.com/pnpm/pnpm/pull/9835). 196 - When executing the `pnpm create` command, must verify whether the node version is supported even if a cache already exists [#​9775](https://redirect.github.com/pnpm/pnpm/pull/9775). 197 - When making requests for the non-abbreviated packument, add `*/*` to the `Accept` header to avoid getting a 406 error on AWS CodeArtifact [#​9862](https://redirect.github.com/pnpm/pnpm/issues/9862). 198 - The standalone exe version of pnpm works with glibc 2.26 again [#​9734](https://redirect.github.com/pnpm/pnpm/issues/9734). 199 - Fix a regression in which `pnpm dlx pkg --help` doesn't pass `--help` to `pkg` [#​9823](https://redirect.github.com/pnpm/pnpm/issues/9823). 200 201 ### [`v10.14.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10140) 202 203 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.13.1...v10.14.0) 204 205 ##### Minor Changes 206 207 - **Added support for JavaScript runtime resolution** 208 209 Declare Node.js, Deno, or Bun in [`devEngines.runtime`](https://redirect.github.com/openjs-foundation/package-metadata-interoperability-collab-space/issues/15) (inside `package.json`) and let pnpm download and pin it automatically. 210 211 Usage example: 212 213 ```json 214 { 215 "devEngines": { 216 "runtime": { 217 "name": "node", 218 "version": "^24.4.0", 219 "onFail": "download" (we only support the "download" value for now) 220 } 221 } 222 } 223 ``` 224 225 How it works: 226 227 1. `pnpm install` resolves your specified range to the latest matching runtime version. 228 2. The exact version (and checksum) is saved in the lockfile. 229 3. Scripts use the local runtime, ensuring consistency across environments. 230 231 Why this is better: 232 233 1. This new setting supports also Deno and Bun (vs. our Node-only settings `useNodeVersion` and `executionEnv.nodeVersion`) 234 2. Supports version ranges (not just a fixed version). 235 3. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity. 236 4. It can be used on any workspace project (like `executionEnv.nodeVersion`). So, different projects in a workspace can use different runtimes. 237 5. For now `devEngines.runtime` setting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer. 238 239 Related PR: [#​9755](https://redirect.github.com/pnpm/pnpm/pull/9755). 240 241 - Add `--cpu`, `--libc`, and `--os` to `pnpm install`, `pnpm add`, and `pnpm dlx` to customize `supportedArchitectures` via the CLI [#​7510](https://redirect.github.com/pnpm/pnpm/issues/7510). 242 243 ##### Patch Changes 244 245 - Fix a bug in which `pnpm add` downloads packages whose `libc` differ from `pnpm.supportedArchitectures.libc`. 246 - The integrities of the downloaded Node.js artifacts are verified [#​9750](https://redirect.github.com/pnpm/pnpm/pull/9750). 247 - Allow `dlx` to parse CLI flags and options between the `dlx` command and the command to run or between the `dlx` command and `--` [#​9719](https://redirect.github.com/pnpm/pnpm/issues/9719). 248 - `pnpm install --prod` should removing hoisted dev dependencies [#​9782](https://redirect.github.com/pnpm/pnpm/issues/9782). 249 - Fix an edge case bug causing local tarballs to not re-link into the virtual store. This bug would happen when changing the contents of the tarball without renaming the file and running a filtered install. 250 - Fix a bug causing `pnpm install` to incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies. 251 252 ### [`v10.13.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10131) 253 254 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.13.0...v10.13.1) 255 256 ##### Patch Changes 257 258 - Run user defined pnpmfiles after pnpmfiles of plugins. 259 260 ### [`v10.13.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10130) 261 262 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.12.4...v10.13.0) 263 264 ##### Minor Changes 265 266 - Added the possibility to load multiple pnpmfiles. The `pnpmfile` setting can now accept a list of pnpmfile locations [#​9702](https://redirect.github.com/pnpm/pnpm/pull/9702). 267 - pnpm will now automatically load the `pnpmfile.cjs` file from any [config dependency](https://pnpm.io/config-dependencies) named `@pnpm/plugin-*` or `pnpm-plugin-*` [#​9729](https://redirect.github.com/pnpm/pnpm/pull/9729). 268 269 The order in which config dependencies are initialized should not matter — they are initialized in alphabetical order. If a specific order is needed, the paths to the `pnpmfile.cjs` files in the config dependencies can be explicitly listed using the `pnpmfile` setting in `pnpm-workspace.yaml`. 270 271 ##### Patch Changes 272 273 - When patching dependencies installed via `pkg.pr.new`, treat them as Git tarball URLs [#​9694](https://redirect.github.com/pnpm/pnpm/pull/9694). 274 - Prevent conflicts between local projects' config and the global config in `dangerouslyAllowAllBuilds`, `onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, and `neverBuiltDependencies` [#​9628](https://redirect.github.com/pnpm/pnpm/issues/9628). 275 - Sort keys in `pnpm-workspace.yaml` with deep [#​9701](https://redirect.github.com/pnpm/pnpm/pull/9701). 276 - The `pnpm rebuild` command should not add pkgs included in `ignoredBuiltDependencies` to `ignoredBuilds` in `node_modules/.modules.yaml` [#​9338](https://redirect.github.com/pnpm/pnpm/issues/9338). 277 - Replaced `shell-quote` with `shlex` for quoting command arguments [#​9381](https://redirect.github.com/pnpm/pnpm/issues/9381). 278 279 ### [`v10.12.4`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10124) 280 281 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.12.3...v10.12.4) 282 283 ##### Patch Changes 284 285 - Fix `pnpm licenses` command for local dependencies [#​9583](https://redirect.github.com/pnpm/pnpm/pull/9583). 286 - Fix a bug in which `pnpm ls --filter=not-exist --json` prints nothing instead of an empty array [#​9672](https://redirect.github.com/pnpm/pnpm/issues/9672). 287 - Fix a deadlock that sometimes happens during peer dependency resolution [#​9673](https://redirect.github.com/pnpm/pnpm/issues/9673). 288 - Running `pnpm install` after `pnpm fetch` should hoist all dependencies that need to be hoisted. 289 Fixes a regression introduced in \[v10.12.2] by \[[#​9648](https://redirect.github.com/pnpm/pnpm/issues/9648)]; resolves \[[#​9689](https://redirect.github.com/pnpm/pnpm/issues/9689)]. 290 291 \[v10.12.2]: https://redirect.github.com/pnpm/pnpm/releases/tag/v10.12.2Add commentMore actions 292 \[[#​9648](https://redirect.github.com/pnpm/pnpm/issues/9648)]: [https://github.com/pnpm/pnpm/pull/9648](https://redirect.github.com/pnpm/pnpm/pull/9648) 293 \[[#​9689](https://redirect.github.com/pnpm/pnpm/issues/9689)]: [https://github.com/pnpm/pnpm/issues/9689](https://redirect.github.com/pnpm/pnpm/issues/9689) 294 295 ### [`v10.12.3`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10123) 296 297 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.12.2...v10.12.3) 298 299 ##### Patch Changes 300 301 - Restore hoisting of optional peer dependencies when installing with an outdated lockfile. 302 Regression introduced in [v10.12.2] by [#​9648]; resolves [#​9685]. 303 304 [v10.12.2]: https://redirect.github.com/pnpm/pnpm/releases/tag/v10.12.2 305 306 [#​9648]: https://redirect.github.com/pnpm/pnpm/pull/9648 307 308 [#​9685]: https://redirect.github.com/pnpm/pnpm/issues/9685 309 310 ### [`v10.12.2`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10122) 311 312 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.12.1...v10.12.2) 313 314 ##### Patch Changes 315 316 - Fixed hoisting with `enableGlobalVirtualStore` set to `true` [#​9648](https://redirect.github.com/pnpm/pnpm/pull/9648). 317 - Fix the `--help` and `-h` flags not working as expected for the `pnpm create` command. 318 - The dependency package path output by the `pnpm licenses list --json` command is incorrect. 319 - Fix a bug in which `pnpm deploy` fails due to overridden dependencies having peer dependencies causing `ERR_PNPM_OUTDATED_LOCKFILE` [#​9595](https://redirect.github.com/pnpm/pnpm/issues/9595). 320 321 ### [`v10.12.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10121) 322 323 ##### Minor Changes 324 325 - **Experimental.** Added support for global virtual stores. When enabled, `node_modules` contains only symlinks to a central virtual store, rather to `node_modules/.pnpm`. By default, this central store is located at `<store-path>/links` (you can find the store path by running `pnpm store path`). 326 327 In the central virtual store, each package is hard linked into a directory whose name is the hash of its dependency graph. This allows multiple projects on the system to symlink shared dependencies from this central location, significantly improving installation speed when a warm cache is available. 328 329 > This is conceptually similar to how [NixOS manages packages](https://nixos.org/guides/how-nix-works/), using dependency graph hashes to create isolated and reusable package directories. 330 331 To enable the global virtual store, set `enableGlobalVirtualStore: true` in your root `pnpm-workspace.yaml`, or globally via: 332 333 ```sh 334 pnpm config -g set enable-global-virtual-store true 335 ``` 336 337 NOTE: In CI environments, where caches are typically cold, this setting may slow down installation. pnpm automatically disables the global virtual store when running in CI. 338 339 Related PR: [#​8190](https://redirect.github.com/pnpm/pnpm/pull/8190) 340 341 <!----> 342 343 - The `pnpm update` command now supports updating `catalog:` protocol dependencies and writes new specifiers to `pnpm-workspace.yaml`. 344 - Added two new CLI options (`--save-catalog` and `--save-catalog-name=<name>`) to `pnpm add` to save new dependencies as catalog entries. `catalog:` or `catalog:<name>` will be added to `package.json` and the package specifier will be added to the `catalogs` or `catalog[<name>]` object in `pnpm-workspace.yaml` [#​9425](https://redirect.github.com/pnpm/pnpm/issues/9425). 345 - **Semi-breaking.** The keys used for side-effects caches have changed. If you have a side-effects cache generated by a previous version of pnpm, the new version will not use it and will create a new cache instead [#​9605](https://redirect.github.com/pnpm/pnpm/pull/9605). 346 - Added a new setting called `ci` for explicitly telling pnpm if the current environment is a CI or not. 347 348 ##### Patch Changes 349 350 - Sort versions printed by `pnpm patch` using semantic versioning rules. 351 - Improve the way the error message displays mismatched specifiers. Show differences instead of 2 whole objects [#​9598](https://redirect.github.com/pnpm/pnpm/pull/9598). 352 - Revert [#​9574](https://redirect.github.com/pnpm/pnpm/pull/9574) to fix a regression [#​9596](https://redirect.github.com/pnpm/pnpm/issues/9596). 353 354 ### [`v10.11.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10111) 355 356 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.11.0...v10.11.1) 357 358 ##### Patch Changes 359 360 - Fix an issue in which `pnpm deploy --legacy` creates unexpected directories when the root `package.json` has a workspace package as a peer dependency [#​9550](https://redirect.github.com/pnpm/pnpm/issues/9550). 361 - Dependencies specified via a URL that redirects will only be locked to the target if it is immutable, fixing a regression when installing from GitHub releases. ([#​9531](https://redirect.github.com/pnpm/pnpm/issues/9531)) 362 - Installation should not exit with an error if `strictPeerDependencies` is `true` but all issues are ignored by `peerDependencyRules` [#​9505](https://redirect.github.com/pnpm/pnpm/pull/9505). 363 - Use `pnpm_config_` env variables instead of `npm_config_` [#​9571](https://redirect.github.com/pnpm/pnpm/pull/9571). 364 - Fix a regression (in v10.9.0) causing the `--lockfile-only` flag on `pnpm update` to produce a different `pnpm-lock.yaml` than an update without the flag. 365 - Let `pnpm deploy` work in repos with `overrides` when `inject-workspace-packages=true` [#​9283](https://redirect.github.com/pnpm/pnpm/issues/9283). 366 - Fixed the problem of path loss caused by parsing URL address. Fixes a regression shipped in pnpm v10.11 via [#​9502](https://redirect.github.com/pnpm/pnpm/pull/9502). 367 - `pnpm -r --silent run` should not print out section [#​9563](https://redirect.github.com/pnpm/pnpm/issues/9563). 368 369 ### [`v10.11.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10110) 370 371 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.10.0...v10.11.0) 372 373 ##### Minor Changes 374 375 - A new setting added for `pnpm init` to create a `package.json` with `type=module`, when `init-type` is `module`. Works as a flag for the init command too [#​9463](https://redirect.github.com/pnpm/pnpm/pull/9463). 376 377 - Added support for Nushell to `pnpm setup` [#​6476](https://redirect.github.com/pnpm/pnpm/issues/6476). 378 379 - Added two new flags to the `pnpm audit` command, `--ignore` and `--ignore-unfixable` [#​8474](https://redirect.github.com/pnpm/pnpm/pull/8474). 380 381 Ignore all vulnerabilities that have no solution: 382 383 ```shell 384 > pnpm audit --ignore-unfixable 385 ``` 386 387 Provide a list of CVE's to ignore those specifically, even if they have a resolution. 388 389 ```shell 390 > pnpm audit --ignore=CVE-2021-1234 --ignore=CVE-2021-5678 391 ``` 392 393 - Added support for recursively running pack in every project of a workspace [#​4351](https://redirect.github.com/pnpm/pnpm/issues/4351). 394 395 Now you can run `pnpm -r pack` to pack all packages in the workspace. 396 397 ##### Patch Changes 398 399 - pnpm version management should work, when `dangerouslyAllowAllBuilds` is set to `true` [#​9472](https://redirect.github.com/pnpm/pnpm/issues/9472). 400 - `pnpm link` should work from inside a workspace [#​9506](https://redirect.github.com/pnpm/pnpm/issues/9506). 401 - Set the default `workspaceConcurrency` to `Math.min(os.availableParallelism(), 4)` [#​9493](https://redirect.github.com/pnpm/pnpm/pull/9493). 402 - Installation should not exit with an error if `strictPeerDependencies` is `true` but all issues are ignored by `peerDependencyRules` [#​9505](https://redirect.github.com/pnpm/pnpm/pull/9505). 403 - Read `updateConfig` from `pnpm-workspace.yaml` [#​9500](https://redirect.github.com/pnpm/pnpm/issues/9500). 404 - Add support for `recursive pack` 405 - Remove `url.parse` usage to fix warning on Node.js 24 [#​9492](https://redirect.github.com/pnpm/pnpm/issues/9492). 406 - `pnpm run` should be able to run commands from the workspace root, if `ignoreScripts` is set tot `true` [#​4858](https://redirect.github.com/pnpm/pnpm/issues/4858). 407 408 </details> 409 410 --- 411 412 ### Configuration 413 414 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 415 416 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. 417 418 ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 419 420 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. 421 422 --- 423 424 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box 425 426 --- 427 428 This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/MTRNord/draupnir4all-web). 429 <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4xNi4wIiwidXBkYXRlZEluVmVyIjoiNDEuMTMxLjkiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> 430 431