This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`12.16.1` → `12.18.0`](https://renovatebot.com/diffs/npm/pnpm/12.16.1/12.18.0) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v12.18.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.18.0): pnpm 12.18 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.17.0...v12.18.0) pnpm 12.18.0 packs, publishes, and installs packages with platform variants on pnpr registries. It also adds per-skill approval of agent skills and `pnpm store add` for offline installs from downloaded tarballs. Repeat installs and `verifyDepsBeforeRun` no longer read the `package.json` of unchanged workspace projects. The release fixes several peer dependency resolution bugs too. ##### Minor Changes ##### Agent skills - pnpm now names the link to a dependency's agent skill after the skill alone. A skill that the `@acme/kit` package ships in `skills/auth/` is linked as `.claude/skills/auth`, not `.claude/skills/pnpm-@acme+kit-auth`. The next install replaces links with the old names. pnpm lists the linked skills in a `# pnpm` block of each agent skill directory's `.gitignore` [#&#8203;17455](https://redirect.github.com/pnpm/pnpm/discussions/17455). When two approved packages ship a skill of the same name, or the name is already taken in an agent skill directory, pnpm links the skill as `pnpm-<package>-<skill>`. Before, the install failed. - `pnpm approve` now asks which agent skills to link when a package ships more than one. pnpm records the chosen skills as a list, such as `permissions.<pkg>.skills: [guide, migrate]`, and does not offer the other skills for approval again. The first time a project approves a skill, `pnpm approve` also asks which agent directories to link skills into, and records the answer under `skills.dirs`. - pnpm links agent skills nested in category directories, such as `skills/engineering/implement/SKILL.md`, up to three levels below `skills/`. Before, it linked only the skills directly under `skills/`. ##### Platform variants These features need a registry declared with `serverType: pnpr`. - `pnpm pack` packs one archive per entry of `publishConfig.variants`, each platform variant as `<name>-<version>~<tag>.tgz`. `pnpm pack --variant <target>` packs only the archive whose entry lists that target. `pnpm pack --json` prints the `integrity` and `size` of every archive it writes. - `pnpm publish` publishes a package's `publishConfig.variants`. pnpm uploads every archive before the publish request that references them. Publishing variants to any other registry is refused unless `--no-variants` is given, which publishes only the archive that targets `any`. - `pnpm publish --upload-variant <target>` uploads the archive of one `publishConfig.variants` entry to the registry's staging area and prints `<target>=<integrity>`. `pnpm publish --variant-integrity <target>=<integrity>` then publishes the version from archives that other jobs uploaded. With `--recursive`, each value names its package as `<name>~<target>=<integrity>`. - `pnpm publish -r --batch` now uploads each package archive on its own request and skips archives the registry already holds, so the batch request no longer grows with the archives it publishes. A batch of more than 256 packages still carries every archive inline. Packages with `publishConfig.variants` can be published in a batch. A batch with variants that would reference more than 256 archives on one registry fails with `ERR_PNPM_BATCH_PUBLISH_TOO_MANY_ARCHIVES` [pnpm/tasks#244](https://redirect.github.com/pnpm/tasks/issues/244). - `pnpm publish --provenance` signs one statement that names every archive of a version with `publishConfig.variants`. A platform variant's archive is named by the version's package URL with a `variant` qualifier. - Rerunning `pnpm publish` after the version was already published now succeeds when the published version is the same release. pnpm compares the archives, the provenance statement when the rerun signs one, and the dist-tag. When the published version differs, the publish fails with `ERR_PNPM_PUBLISHED_RELEASE_DIFFERS`, which names what differs. - pnpm installs the platform variant of a package that fits the host, or the package's own archive when none does. The lockfile records every variant. A version published with variants only, and no archive for other hosts, installs on a host one of the variants fits. On any other host, an optional dependency is skipped, and any other dependency fails with an error that lists the platforms the version is published for. - `supportedArchitectures` platform lists accept platform tags, the same tags `publishConfig.variants` entries name. An entry can state floors and an ABI, such as `linux-x64-manylinux_2_28`, `darwin-arm64-macos_14_0`, `linux-x64-napi8` or `linux-x64-node127`, and any Node.js OS and CPU, such as `freebsd-x64`. The spellings accepted before still work. - With `supportedArchitectures` set, pnpm also fetches into the store the variants that the other listed platforms need, when it downloads a package with platform variants. ##### pnpr registries - pnpm downloads less metadata from a registry declared with `serverType: pnpr`. A large package document leaves out the manifests of rarely picked versions, and pnpm fetches one only when it picks that version. In a benchmark that resolves 787 packages, the package documents shrank from 30.3 MB to 2.5 MB gzipped. pnpm caches these documents in `v12/metadata-pnpr`, and the `pnpm cache` commands cover them. pnpm warns when a registry that is not declared `serverType: pnpr` turns out to be pnpr. For a registry declared `serverType: pnpr`, a `minimumReleaseAge` longer than 30 days fails with `ERR_PNPM_UNSUPPORTED_MINIMUM_RELEASE_AGE`. - `pnpm publish` sends release notes to registries declared with `serverType: pnpr`. A package's notes are the section for its version in `CHANGELOG.md`, or the notes that `pnpm version -r` composed from change intents. `--release-notes <file>` gives the notes from a file, and `--no-release-notes` sends none. `--publication-name` names a release published with `--batch`. In a workspace that uses pnpm's versioning, `pnpm version -r --release-notes <file>` puts a summary above the composed notes of the release. `pnpm view <pkg>@<version> releaseNotes`, `pnpm outdated --notes`, and `pnpm update --interactive` show the release notes from these registries. ##### Store and hooks - `pnpm store add` now prepares the store for offline installs from package tarballs downloaded some other way. After `pnpm store add ./tarballs/*.tgz`, `pnpm install --offline --frozen-lockfile` installs each registry package whose lockfile entry pins one of those tarballs [#&#8203;2978](https://redirect.github.com/pnpm/pnpm/issues/2978). - Custom pnpmfile fetchers can use `fetchers.gitHostedTarball`, `fetchers.git`, and `fetchers.binary` [pnpm/tasks#191](https://redirect.github.com/pnpm/tasks/issues/191). ##### Patch Changes ##### Installing packages - Running `node` or `pnpm install` in a project that pins a Node.js version pnpm has not downloaded yet no longer hangs when a `globalPnpmfile` is configured [#&#8203;17530](https://redirect.github.com/pnpm/pnpm/issues/17530). - `pnpm install` with `enableGlobalVirtualStore` no longer fails on Windows for a dependency from a named registry, such as `gh:` or `npmjs:` [#&#8203;17665](https://redirect.github.com/pnpm/pnpm/issues/17665). - Concurrent installs that share a global virtual store no longer fail with `ERR_PNPM_CMD_SHIM_SYMLINK_BIN` when they link the same executable at the same time [#&#8203;17587](https://redirect.github.com/pnpm/pnpm/issues/17587). - `pnpm install` and `pnpm ci` now succeed when dependency skills are approved but no agent skill directory exists. The skills stay unlinked until a directory exists [#&#8203;17574](https://redirect.github.com/pnpm/pnpm/issues/17574). - Commands run from a workspace package now use the same default store as the workspace root. Before, `pnpm add` in a package could fail with `ERR_PNPM_UNEXPECTED_STORE` when the workspace root was its own mount point and the home store was on another volume, as in a sandbox or a container. A workspace installed with the old behavior may need one `pnpm install --force` from the workspace root. - `pnpm deploy` now keeps a symlink in the project whose target is missing from the source, such as a link into a `node_modules` directory that was removed after the build. Deploy used to drop such a link silently [#&#8203;17571](https://redirect.github.com/pnpm/pnpm/issues/17571). - `pnpm install` now links the runtime that an earlier `pnpm install --no-runtime` skipped, and `pnpm install --no-runtime` removes a runtime that an earlier install linked [#&#8203;17542](https://redirect.github.com/pnpm/pnpm/issues/17542). - With `enableGlobalVirtualStore`, `pnpm install` again runs a dependency's build scripts in a project whose global virtual store slot another project already built, unless the side-effects cache has build output to restore for it. A build that writes only outside its own package, such as a git hook installer, now takes effect in every project [#&#8203;17526](https://redirect.github.com/pnpm/pnpm/issues/17526). - Commands of a package whose `bin` paths contain excess parent directory segments, such as `../dist/cli.js`, are no longer missing. Such paths now resolve inside the package [#&#8203;17586](https://redirect.github.com/pnpm/pnpm/issues/17586). - Generated POSIX shell shims now quote their paths, so shell special characters in a path stay literal. ##### Lockfile and local paths - Packages from the default registry keep plain lockfile keys, even when a prefix such as `npmjs` points at the registry set as `registry`. A dependency written with such a prefix shares the plain entry of the same package. The next install rewrites keys that earlier versions qualified this way [#&#8203;17575](https://redirect.github.com/pnpm/pnpm/issues/17575). - `pnpm install --frozen-lockfile`, `pnpm approve-builds`, and `pnpm rebuild` now accept a lockfile that resolves a `*` dependency to a prerelease `latest` version. pnpm wrote such a lockfile and then reported it as outdated [#&#8203;17594](https://redirect.github.com/pnpm/pnpm/issues/17594). - `pnpm install --frozen-lockfile` now accepts a lockfile written with `excludeLinksFromLockfile` and `linkWorkspacePackages` on, when a project depends on a workspace package through a `catalog:` entry. It used to fail with `ERR_PNPM_OUTDATED_LOCKFILE`. - `pnpm install --frozen-lockfile` no longer rejects a freshly generated lockfile when `addMissingPeerTypes` is enabled and an injected workspace package has peer dependencies [#&#8203;17668](https://redirect.github.com/pnpm/pnpm/issues/17668). - Relative local paths in root `overrides` now resolve from the workspace root when each project has its own lockfile [#&#8203;17691](https://redirect.github.com/pnpm/pnpm/issues/17691). Installing a local directory dependency no longer fails when another project's install is writing a lockfile in that directory. - Relative local paths in root catalogs now resolve for dependencies and peers [#&#8203;17690](https://redirect.github.com/pnpm/pnpm/issues/17690). - `pnpm install` now resolves auto-installed relative `workspace:` and `file:` peers from the directory of the package that declares them [#&#8203;17676](https://redirect.github.com/pnpm/pnpm/issues/17676), [#&#8203;17689](https://redirect.github.com/pnpm/pnpm/issues/17689). - `pnpm dedupe --check` leaves `pnpm-lock.yaml` untouched while it looks for deduplication changes. If `configDependencies` changed since the last install, the check keeps the lockfile they sync, as `pnpm install` does [#&#8203;17628](https://redirect.github.com/pnpm/pnpm/issues/17628). - `pnpm dedupe --check` no longer fails when the only difference is the integrity of a locked version that the registry now reports with a stronger algorithm, such as a `sha512` integrity replacing the `sha1` shasum it reported when the lockfile was written [#&#8203;17692](https://redirect.github.com/pnpm/pnpm/issues/17692). ##### Peer dependencies - Peer deduplication no longer gives a project different copies of a dependency across direct and transitive paths when an optional peer has no provider [#&#8203;17666](https://redirect.github.com/pnpm/pnpm/issues/17666). - Dependencies no longer bind to another project's peer variant when the provider has nested peers, including providers that finish resolving later [#&#8203;17593](https://redirect.github.com/pnpm/pnpm/issues/17593). - Re-resolving a lockfile no longer preserves optional peer bindings from other projects when no provider is in scope [#&#8203;17592](https://redirect.github.com/pnpm/pnpm/issues/17592). - `pnpm peers check` warns when a required peer is resolved without a provider declared by the project or its dependency ancestors, with `autoInstallPeers: false` and `dedupePeerDependents: true`. These warnings do not change the command's exit code or cause `strictPeerDependencies` failures. ##### Speed and memory - `pnpm install`, and `pnpm run` and `pnpm exec` with `verifyDepsBeforeRun`, no longer read the `package.json` of workspace projects whose files did not change since the last install. This also holds with a pnpmfile, `configDependencies`, or `sharedWorkspaceLockfile: false`. In an up-to-date workspace with `sharedWorkspaceLockfile: false`, `pnpm install` no longer runs the install of each project [pnpm/tasks#256](https://redirect.github.com/pnpm/tasks/issues/256). - A recursive `pnpm run` or `pnpm exec` with `verifyDepsBeforeRun` set no longer reads every `package.json` in the workspace once per project when `sharedWorkspaceLockfile` is `false`. In a 300-project workspace, `pnpm -r exec true` went from 490 ms to 42 ms [pnpm/tasks#256](https://redirect.github.com/pnpm/tasks/issues/256). - `pnpm install` makes fewer `stat` calls when it hardlinks files from the store, as few as 12.7.0 made [#&#8203;17543](https://redirect.github.com/pnpm/pnpm/issues/17543). - Picking versions from registry metadata uses less temporary memory. ##### verifyDepsBeforeRun and repeat installs - With `verifyDepsBeforeRun`, `pnpm run` and `pnpm exec` now report dependencies as out of date after a dependency is added to the `package.json` of a local directory dependency, such as `"lib": "file:../lib"`. Before, the command ran without the new dependency installed. - `verifyDepsBeforeRun` no longer reports a `file:` directory dependency as out of date after an edit to `package.json` that leaves its dependencies unchanged [#&#8203;17697](https://redirect.github.com/pnpm/pnpm/issues/17697). - `verifyDepsBeforeRun` no longer reports dependencies as out of sync when only the `version` field of a single-project repository changed [#&#8203;17560](https://redirect.github.com/pnpm/pnpm/issues/17560). The same holds for a workspace project that no dependency can resolve to. A script run after such a change no longer starts an install first. - A repeat `pnpm install` now rewrites the bin shims after `extendNodePath` changes. Before, it reported "Already up to date" and the shims kept the `NODE_PATH` of the previous setting. ##### Adding and updating dependencies - `pnpm add <pkg>` without a version now saves the range that the other workspace projects declare for the package, or the one a matching override sets. A `catalog:` reference still comes first, and the `tag` setting is used only when none of these exists [pnpm/tasks#191](https://redirect.github.com/pnpm/tasks/issues/191). - `pnpm update` with only negated selectors, such as `pnpm update '!foo'`, now leaves the dependencies listed in `update.ignoreDeps` unchanged. Negated `crate:` and `pypi:` selectors, such as `!crate:sha2`, now exclude that dependency and update the rest [pnpm/tasks#243](https://redirect.github.com/pnpm/tasks/issues/243). - `pnpm update --latest` keeps three kinds of Cargo dependencies where they are, unless the crate is named on the command line. Before, it moved each one to the newest release and left a workspace that did not build. - A renamed dependency, such as `tower-0-4 = { package = "tower", version = "0.4" }`, stays within its requirement if the workspace also declares the crate under its own name. - A crate replaced through `[patch.crates-io]` keeps its version, with a warning. - A crate whose newest release is older than its current version, such as a prerelease newer than the latest stable release, keeps its version, with a warning. Only an explicit version, such as `pnpm update crate:foo@1`, moves it back. Other new major versions are still selected and may need code changes. - `pnpm update` now keeps a Cargo dependency at its current version, with a warning, if the new version lacks a feature the workspace enables on it. If the crate is named on the command line, as in `pnpm update --latest crate:sha2`, the update fails with an error that names the missing features. - `pnpm update` now keeps the operator of every existing Cargo requirement, so `~1.0.0` is updated to `~1.1.0`, and an exact `=` requirement stays exact unless the selector gives a range, such as `crate:foo@^2`. The `savePrefix` and `saveExact` settings apply only to new Cargo dependencies. Saved Cargo requirements omit build metadata. - `pnpm update` now updates a Cargo dependency whose inline table spans several lines, such as one with a multi-line `features` array. It failed with "its Cargo.toml dependency declaration is not a string or single-line inline table". - `pnpm update` no longer applies the `savePrefix` and `saveExact` settings to Python requirements. A `savePrefix` such as `^` made `pnpm update` fail in a project with Python dependencies. `pnpm update` now keeps the precision of a `~=` requirement, so `~=1.0` is updated to `~=1.5` and still allows any 1.x release. With `--latest`, a `==1.*` requirement is updated to `==2.*`. ##### Store - `pnpm store prune` now keeps packages linked from a configured modules directory [pnpm/tasks#230](https://redirect.github.com/pnpm/tasks/issues/230). - `pnpm store prune` now removes aliases of pruned packages. - `pnpm store status` no longer reports untouched packages as modified when the global virtual store is enabled. If the installed global-store layout cannot be verified, the command reports `ERR_PNPM_STORE_STATUS_UNVERIFIABLE` and asks for a reinstall [#&#8203;17631](https://redirect.github.com/pnpm/pnpm/issues/17631). - `pnpm store add` now fails with `ERR_PNPM_FROZEN_STORE_WRITE` when `frozenStore` is enabled. It used to write package files into the read-only store without recording them, so no install could use them. - `pnpm cat-index <name>@<version>` no longer shows the index of a package whose name differs only in letter case. ##### Other commands and settings - `pnpm link` now fails without changing `package.json` or `pnpm-workspace.yaml` when the linked package's name is not a valid npm package name. It used to write that name to both files, which made every later install fail [#&#8203;17475](https://redirect.github.com/pnpm/pnpm/issues/17475). - `pnpm link <dir>` now resolves a relative `<dir>` against the current directory. In a directory without a `package.json`, such as a workspace's `packages` folder, `pnpm link .` used to link the nearest project above it into itself [#&#8203;17475](https://redirect.github.com/pnpm/pnpm/issues/17475). - A Node.js version range such as `>=26.13`, for example in `devEngines.runtime`, now resolves to the newest stable release that satisfies it. pnpm picks a prerelease only when no stable release matches [#&#8203;17516](https://redirect.github.com/pnpm/pnpm/issues/17516). - Switching to the pnpm version a project pins no longer writes a temporary `_tmp_*` file into the project directory, which file watchers reported on every command [#&#8203;17681](https://redirect.github.com/pnpm/pnpm/issues/17681). - pnpm now reads the `linkWorkspacePackages`, `injectWorkspacePackages`, `extendNodePath`, `frozenStore`, and `optimisticRepeatInstall` settings from `PNPM_CONFIG_*` environment variables, such as `PNPM_CONFIG_LINK_WORKSPACE_PACKAGES=true`. `--config.extend-node-path` now applies too. - Recursive scripts run with `--sequential` or `--workspace-concurrency=1` print GitHub Actions log groups again [#&#8203;17629](https://redirect.github.com/pnpm/pnpm/issues/17629). - When `pnpm docs` cannot open a browser, the URL it prints no longer includes the query string or the fragment. <!-- sponsors --> ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://www.cloudflare.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/cloudflare.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/cloudflare_light.svg" /> <img src="https://pnpm.io/img/users/cloudflare.svg" width="160" alt="Cloudflare" /> </picture> </a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> <td align="center" valign="middle"> <a href="https://syntax.fm/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/syntaxfm.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/syntaxfm_light.svg" /> <img src="https://pnpm.io/img/users/syntaxfm.svg" width="90" alt="Syntax" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.17.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.17.0): pnpm 12.17 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v12.16.1...v12.17.0) pnpm 12.17.0 adds `pnpm peers check --global`, dependency-group selectors and wildcards in `overrides`, and runtime, package manager, Cargo, and Python updates in `pnpm outdated` and `pnpm update`. It also fixes files that other users could not read in Docker images, and repeat installs that missed changes to local dependencies. ##### Minor Changes - `pnpm peers check` now accepts `--global` (`-g`) to check globally installed packages. After a global install or update, the peer dependency warning now suggests `pnpm peers check -g` [#&#8203;17504](https://redirect.github.com/pnpm/pnpm/issues/17504). - `pnpm outdated` and `pnpm update` now inspect and update package manager and runtime versions in `devEngines.packageManager`, `packageManager`, `devEngines.runtime`, `engines.runtime`, and `runtime:` dependencies. With `cargo.enabled` or `python.enabled`, `pnpm outdated` and `pnpm update` also inspect and update Cargo dependencies in `Cargo.toml` and `Cargo.lock` and Python dependencies in `pyproject.toml` and `pylock.toml`. - `overrides` selectors now support `:prod`, `:optional`, and `:peer` pseudo-selectors that target a single dependency group. They also support `*` wildcard patterns on parent and target package names. An override with a non-range value, such as `npm:` or `file:`, no longer adds a peer dependency to `dependencies`. Removing an optional dependency with `"-"` now also removes the duplicate entry from `dependencies` [#&#8203;5391](https://redirect.github.com/pnpm/pnpm/issues/5391). ##### Patch Changes ##### Installing packages - Files that pnpm creates in a project now get the permissions the umask gives any new file, such as `0644`. Before, several of them were readable only by the user who ran pnpm, which broke Docker images that run as a different user [#&#8203;17435](https://redirect.github.com/orgs/pnpm/discussions/17435). The fix applies to: - `node_modules/.pnpm-workspace-state-v1.json`. A different user running `pnpm run` reinstalled the dependencies because it could not read this file. - `pnpm-workspace.yaml` - the files written by `pnpm deploy` - patch files from `pnpm patch-commit` - the lockfile restored by `pnpm dedupe --check` - the Cargo and Python files that pnpm writes When pnpm edits an existing file, the file keeps its permissions. - `pnpm install` no longer writes broken dependency links when the project's `node_modules` is a symlink to another directory, such as another project's `node_modules`. The install reported success, but the links it wrote did not resolve [#&#8203;17448](https://redirect.github.com/pnpm/pnpm/issues/17448). - Commands installed with `pnpm add --global` now find the dependencies that pnpm hoists for their package. A package that loads a dependency it does not declare, such as a native addon's platform-specific package, failed with "Cannot find module". Reinstall such a package with `pnpm add --global` to update its existing command [#&#8203;17503](https://redirect.github.com/pnpm/pnpm/issues/17503). - When pnpm switches to the version a project pins, it now installs that version's native binary for the current host, even if the project's `supportedArchitectures` excludes the host. Before, pnpm could not use the pinned version and kept running the installed one. pnpm also repairs a pinned version that an earlier install left without the host's binary. - With the global virtual store, a change to a dependency of one package in a dependency cycle now gives every package in that cycle a new directory. Before, the other packages kept their directories and still linked the old copy of the changed package, so the project could load two copies of it [#&#8203;17466](https://redirect.github.com/pnpm/pnpm/issues/17466). Packages in a dependency cycle, and packages that depend on one, move to new global virtual store directories once after this update. Those that run a build miss the side-effects cache once. - With `nodeLinker: hoisted`, when two workspace projects need the same package version and it cannot be hoisted to the root, each project now keeps the copy installed in its own `node_modules`. Build scripts run in each of these copies. Before, the second project's copy was replaced with a symlink to the first project's, so every repeat install imported it again [#&#8203;17498](https://redirect.github.com/pnpm/pnpm/issues/17498). - The Node.js `latest` selector now chooses the newest stable release [#&#8203;17490](https://redirect.github.com/pnpm/pnpm/issues/17490). - Hardlinking from the store now stats each store file once per install. Since pnpm 12.8.0, a store file was stat'ed again for every package that links it. On an offline install of a large workspace, that added up to 15% system CPU [#&#8203;17500](https://redirect.github.com/pnpm/pnpm/issues/17500). ##### Repeat installs and local dependencies - `pnpm install --frozen-lockfile` no longer reports an outdated lockfile right after the install that wrote it. This happened when a pnpmfile `readPackage` hook or `packageExtensions` changed the dependencies or peer dependencies of a local directory dependency outside the workspace projects. It affected a `file:` dependency, an injected `workspace:../dir` dependency outside the workspace patterns, and an injected workspace package left out by `--filter` [#&#8203;17447](https://redirect.github.com/pnpm/pnpm/issues/17447) [#&#8203;17473](https://redirect.github.com/pnpm/pnpm/issues/17473). A repeat `pnpm install` now takes the fast path when `ignoredOptionalDependencies` removes an optional dependency of a `file:` directory dependency. It used to resolve again on every run. - `pnpm install` now resolves again after an edit to an injected `workspace:../dir` dependency outside the workspace patterns under a shared lockfile. It used to keep the lockfile unchanged. The next `pnpm install --frozen-lockfile` then failed [#&#8203;17476](https://redirect.github.com/pnpm/pnpm/issues/17476). - `pnpm install` now resolves a local directory again after its `package.json` changes when an override or a package extension adds it to the dependencies of a registry package. `pnpm install --frozen-lockfile` fails on a lockfile that still records the old dependencies of such a directory [#&#8203;17486](https://redirect.github.com/pnpm/pnpm/issues/17486). - With `injectWorkspacePackages` and per-project lockfiles, `pnpm install` now updates a project's lockfile when a local tarball that an injected workspace project depends on is replaced. The project's lockfile kept the old version and integrity before. - `pnpm install` now detects a change to a local tarball or directory that only a pnpmfile `readPackage` hook depends on. A repeat install reported "Already up to date" and kept the old contents before [pnpm/tasks#227](https://redirect.github.com/pnpm/tasks/issues/227). - `pnpm install` now relinks a `workspace:` or `link:` dependency whose link was deleted from `node_modules`. It used to report "Already up to date" and leave the link missing [#&#8203;17485](https://redirect.github.com/pnpm/pnpm/issues/17485). - A repeat `pnpm install` reports "Already up to date" again when a pnpmfile `readPackage` hook changes the dependencies of a workspace project. Since 12.15.0, every such install ran in full [#&#8203;17468](https://redirect.github.com/pnpm/pnpm/issues/17468). After an edit to a project's `package.json`, `pnpm install` and `verifyDepsBeforeRun` now run the pnpmfile's `readPackage` hook on the edited manifest before comparing it with the lockfile. They could report the project up to date when the hook rewrote the edited dependency to a specifier the lockfile did not record. ##### Adding and updating dependencies - `pnpm update --latest` with package selectors now updates the dependencies of the selected packages within their declared ranges. Excluded packages and their dependencies keep their locked versions [#&#8203;17444](https://redirect.github.com/pnpm/pnpm/issues/17444). - `pnpm add <pkg>@<tag>` now uses a catalog entry set to that same dist-tag. The dependency is saved as `catalog:` and the entry stays as written [pnpm/tasks#225](https://redirect.github.com/pnpm/tasks/issues/225). When `pnpm add` adds a new dist-tag such as `vue@legacy` to a catalog, the catalog entry records the exact version the tag points to. The same applies to a dependency added without a version when the `tag` setting names a dist-tag other than `latest`. - `pnpm add` now saves the resolved version range of an npm alias. For example, `pnpm add v2@npm:vue` and `pnpm add v2@npm:vue@^3.0.0` both save `npm:vue@^3.5.13`. ##### Running scripts and commands - Programs that a script or `pnpm exec` command leaves running, such as a browser opened by the `open` package, now outlive pnpm exactly when they would outlive the command run without pnpm. Before, on Windows, a failed command, `Ctrl+C`, or a closed terminal ended all of them. pnpm still ends them when it is killed or crashes. When a recursive or parallel run bails, the scripts still running now receive `SIGTERM` on Unix and are killed only if they are still running two seconds later. On Windows, everything those scripts started is ended, including detached processes whose parent has already exited. Before, a bail killed them at once [#&#8203;17465](https://redirect.github.com/pnpm/pnpm/issues/17465). - On Windows, the shell shim of a `.cmd` or `.bat` bin now runs it under Git Bash when MSYS argument conversion is off, such as with `MSYS_NO_PATHCONV=1` or `MSYS2_ARG_CONV_EXCL='*'`. The shim used to start an interactive cmd.exe prompt [#&#8203;17480](https://redirect.github.com/pnpm/pnpm/issues/17480). - `pnx` and `pnpm create` now run the command in the directory selected by `--dir` or `--workspace-root`. Without either flag, the command still runs in the directory pnpm was started in. - `pnpm --env-file` now reads files the way `node --env-file` does. Values are taken as written, so `$VAR` is no longer expanded and Windows paths such as `C:\Users\me` load unchanged. A file is no longer rejected for its contents. ##### Settings and messages - `pnpm version` no longer creates a git commit and tag when `gitTagVersion` is set to `false` [#&#8203;17460](https://redirect.github.com/pnpm/pnpm/issues/17460). - `pnpm publish` now reads the `publishBranch` setting from `pnpm-workspace.yaml` and from `PNPM_CONFIG_PUBLISH_BRANCH`. The `--publish-branch` flag overrides it. - `pnpm` now accepts `--strict-ssl` and `--local-address <ip>` on the command line. - `pnpm doctor` uses a 15-second timeout when checking registry connectivity. - `pnpm-workspace.yaml` parse errors now report `ERR_PNPM_INVALID_SETTING`. - The error for a dependency with an invalid name in a project's manifest now names the project's directory. It used to say only "The current package", which did not tell which workspace project to fix [#&#8203;17475](https://redirect.github.com/pnpm/pnpm/issues/17475). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://www.cloudflare.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/cloudflare.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/cloudflare_light.svg" /> <img src="https://pnpm.io/img/users/cloudflare.svg" width="160" alt="Cloudflare" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> <td align="center" valign="middle"> <a href="https://syntax.fm/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/syntaxfm.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/syntaxfm_light.svg" /> <img src="https://pnpm.io/img/users/syntaxfm.svg" width="90" alt="Syntax" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - "every weekend" - Automerge - "after 1 am and before 7 am" 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-actions). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJQUjogRGVwZW5kZW5jaWVzIl19-->