Update all non-major dependencies #51
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/all-minor-patch"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
3.4.5→3.4.6v3.2.2→v3.2.4v3.2.2→v3.2.412.6.0→12.8.1Release Notes
immich-app/immich (ghcr.io/immich-app/immich-machine-learning)
v3.2.4Compare Source
It's been a while since we last had to sacrifice a release. Let's hope v3.2.3 was a good sacrifice for v3.3, which is right around the corner!
Just another small patch that primarily fixes the memory leak people have observed through a dependency update.
What's Changed
🐛 Bug fixes
Full Changelog: https://github.com/immich-app/immich/compare/v3.2.2...v3.2.4
pnpm/pnpm (pnpm)
v12.8.1: pnpm 12.8.1Compare Source
pnpm 12.8.1 fixes
pnpm install --frozen-lockfilerejecting lockfiles with injected workspace packages that have peers, restores the executable bit on files of local directory dependencies, makespnpm dedupeconverge, and uses less CPU on many-core machines.Patch Changes
pnpm install --frozen-lockfileno longer rejects a freshly generated lockfile when an injected workspace package has peer dependencies #16332.Executable files in a
file:directory dependency or an injected workspace package keep their executable bit again. Since 12.8.0, pnpm installed these files without the permissions they have in their project.pnpm dedupenow reaches a stable lockfile when a package's peer suffix is long enough to be hashed. Before, each run could switch that package's key between the hashed and the spelled-out suffix, sopnpm dedupe --checkalways failed #16331.pnpm install --frozen-lockfile, the default in CI, now uses less CPU on machines with more than 8 cores. Warm installs on many-core Windows machines got up to 10% faster. Frozen installs now link with at most 16 worker threads.verifyDepsBeforeRunno longer reports dependencies as outdated after a filtered install just becausepnpm-lock.yamlhas a newer modification time. It checks the lockfile against the packages that install put in place. Before,pnpm runreinstalled the whole workspace with lifecycle scripts on, for example after a DockerCOPYbrought in a lockfile with a newer mtime #16322.After a filtered install,
verifyDepsBeforeRunnow also checks that the install put the selected projects' dependencies in place. Anode_modulesdirectory alone no longer counts as proof.pnpm runandpnpm execno longer install a project that has never been installed and has nothing to install. Such a project declares no dependencies, no peer dependencies thatautoInstallPeerswould fetch, and no install lifecycle scripts. The command now runs without writingnode_modulesorpnpm-lock.yaml#16313.pnpm update -g --latestnow upgrades globally installed packages beyond their saved version ranges #16320.Platinum Sponsors
Gold Sponsors
v12.8.0: pnpm 12.8Compare Source
pnpm 12.8.0 warns when
pnpm packorpnpm publishwould ship a.envfile thatfilesdoes not list, installssharedWorkspaceLockfile: falseworkspaces concurrently, applies every setting passed as--config.<name>=<value>, and no longer leaves the Windows terminal stuck after Ctrl+C in a script.Minor Changes
pnpm packandpnpm publishnow warn when the tarball includes a.envor.env.*file that thefilesfield ofpackage.jsondoes not list. Templates such as.env.exampleare not reported. List the file infilesto publish it on purpose, or exclude it in.npmignoreor.gitignore#7826.pnpm packnow honors--silent,--reporter=silent, and--loglevel=silentto hide the tarball contents and summary. With--json, lifecycle script output and the final JSON output remain visible #10297.Patch Changes
Installing packages
Installing through a
pnprserver now records the pnpmfile checksum in the lockfile, so a laterpnpm install --frozen-lockfileaccepts that lockfile #14460. A frozen install through the pnpr server now fails if the pnpmfile changed. If the pnpmfile defines areadPackage,afterAllResolvedorpreResolutionhook or custom resolvers, pnpm resolves dependencies locally and prints a warning that the pnpr server was not used.Installing through a
pnprserver also links a workspace project at the directory itspublishConfig.directorynames. A server that does not forward the setting makes the install fail withERR_PNPM_PNPR_PUBLISH_DIRECTORY_MISMATCH, so pnpm never writes a lockfile that points at the wrong directory. The server rejects apublishConfig.directorythat points outside its project.Installing a git-hosted dependency that has to be built no longer fails when that dependency's own dependencies have build scripts nobody approved. pnpm skips those builds while preparing the dependency, as it does without
strictDepBuilds#9764.A git-hosted dependency that is a pnpm workspace with no committed lockfile is now detected as a pnpm project #14011.
pnpm install --devandpnpm fetch --devnow install the optional dependencies of devDependencies, such as the platform binaries of Biome and oxlint. The project's ownoptionalDependenciesare still skipped #9678.pnpm install --offlineandpnpm add --offlinenow resolve a version range to the newest matching version whose tarball is already in the store. They used to pick the newest version in the cached metadata and fail withERR_PNPM_NO_OFFLINE_TARBALLwhen its tarball was missing #10715.If an offline install fails because the registry metadata cache uses the layout from before pnpm 11.27 and 12.4, the error now names the older mirror on disk and explains that one online install repopulates the cache. The error also carries the
ERR_PNPM_NO_OFFLINE_METAcode.pnpm cache prune --helpnow says that pnpm 11.26 and earlier, and pnpm 12.3 and earlier, depend on the directories it removes #15656.Running
pnpm installnow refreshes dependencies when a package declared with a localfile:directory changes its dependencies #4623.A repeat
pnpm installnow keeps its fast up-to-date check when an override replaces a declared localfile:dependency #12892.pnpm installnow removes an optional dependency fromnode_modulesif its install script fails. Code that checks whether the package is installed no longer finds a package that cannot load #8756.With
nodeLinker: hoisted,pnpm installnow restores a workspace project'snode_modulesafter it was deleted. Before, the install printed "Already up to date" and left the project without the dependencies nested under it. On Windows, the install also no longer fails with "Access is denied" when another project's copy of a shared dependency links to the deleted directory.Under
nodeLinker: hoisted,pnpm installnow clears orphaned package directories that an interrupted or failed install leaves in a project'snode_modules. A directory recorded by the previous install is removed, while an unrecorded directory is moved tonode_modules/.ignored. A copy already in.ignoredis never overwritten #13676.Concurrent installs no longer fail when they replace the same stale hoisted dependency link. Virtual store cleanup now keeps the temporary lockfiles that concurrent installs write.
Resolving and linking dependencies
pnpm installno longer aborts on a failed allocation of many gigabytes when peer dependency ranges combine overlapping||alternatives #15867.pnpm installno longer fails when a package from the registry declares afile:dependency on a directory inside itself, such as"@types/css-tree": "file:./typings/css-tree". pnpm links that dependency to the directory inside the package, as npm and Yarn do. The lockfile records it aslink:<root>/typings/css-tree#9141.An
npm:alias written byoverridesnow stays in place when a change elsewhere makes pnpm re-resolve the aliased dependency. Before, pnpm could look up the alias name at the aliased version, which failed withERR_PNPM_NO_MATCHING_VERSIONor locked an unrelated package #16309.A peer dependency no longer resolves to two different versions for one package. This happened when the package peer-depends on another package and on one of that package's peers, and it is installed deeper than a direct dependency of the package that provides them #12098.
An optional peer dependency is no longer resolved from another workspace project's package when the project provides one of that package's own peers at a version it rejects. This avoids bogus unmet peer errors #13989.
pnpm dedupeno longer changes the lockfile on every run when a nested peer dependency is provided through an npm alias #15709.With
resolutionMode: time-basedandminimumReleaseAgeboth set,pnpm installno longer reports a subdependency as too new when only the time-based cutoff excludes it. Such subdependencies used to fail a strict install withERR_PNPM_NO_MATURE_MATCHING_VERSION, or were added tominimumReleaseAgeExclude#13569. A transitive dependency that has no matching version published before the time-based cutoff now resolves to the lowest matching version allowed byminimumReleaseAge. pnpm picks a version younger thanminimumReleaseAgeonly if no older version matches #16298.pnpm installretries registry metadata fetches that fail with a timeout, a dropped connection, or an interrupted response body before it appliestrustPolicyorminimumReleaseAge. A transient fetch failure is not reported asTRUST_DOWNGRADEorMINIMUM_RELEASE_AGE_VIOLATION#12031.pnpm's built-in package compatibility database no longer applies to a project's own manifest. A project named like a published package, such as
vue-loader, no longer gains dependencies onpnpm installorpnpm update. User-configuredpackageExtensionsstill apply to project manifests #11700.Packages in an external
virtualStoreDircan resolve the project's direct dependencies selected byhoistPattern. Runpnpm install --forceto repair an existing installation #5652.pnpm installnow links the executables of auto-installed peer dependencies into the workspace root'snode_modules/.bin, including after a frozen-lockfile reinstall #8511.Lockfiles and frozen installs
pnpm install --frozen-lockfilenow works on a detached HEAD whengitBranchLockfileis enabled. The install reads the lockfiles of the local and remote-tracking branches that contain the checked-out commit. It still writes the sharedpnpm-lock.yaml#7672.pnpm install --frozen-lockfilenow accepts a lockfile that has no importer entry for a workspace package without dependencies. Such a package added after the lockfile was written made the install fail withERR_PNPM_PACKAGE_MANAGER_NO_IMPORTER#15875.pnpm installnow fails withERR_PNPM_LOCKFILE_MISSING_DEPENDENCYwhen an importer references a dependency version that has no snapshot entry. Before, the install succeeded and left anode_modulessymlink pointing at a missing virtual-store directory #14764.pnpm installon CI now fails on an outdated lockfile whenpreferFrozenLockfileis explicitly set totrue. Setting it totrueused to let CI update the lockfile #9072.With
gitBranchLockfileenabled, each emoji or other character outside the Basic Multilingual Plane in a branch name now becomes!!in the lockfile name. Before, each such character became one!.Workspaces and filtering
pnpm installin a workspace withsharedWorkspaceLockfile: falsenow installs projects concurrently, up toworkspaceConcurrencyat a time #14480. A project is resolved, fetched, and written to its virtual store without waiting for the workspace projects it depends on. It waits for them only before it links its dependencies and runs its lifecycle scripts, so its scripts still run after theirs. A project with apreinstallorpnpm:devPreinstallscript, or with an injected orfile:workspace dependency, waits for its workspace dependencies before it starts.The installs of the projects also share their package metadata, lockfile verification, and store caches, so they use less CPU and memory when several projects depend on the same packages. An install with a pnpmfile no longer starts an extra Node.js process when the pnpmfile has no
preResolutionhook.With
enableGlobalVirtualStoreandsharedWorkspaceLockfile: false, each project now keeps its current lockfile and its hidden hoisted dependencies in its ownnode_modules/.pnpm. Before, every project wrote them to the workspace root'snode_modules/.pnpm, so each repeat install treated the other projects' packages as its own and relinked them #14480.pnpm rebuild,pnpm approve-builds, andpnpm ignored-buildsnow work on the current project'snode_moduleswhen they run inside a project of a workspace withsharedWorkspaceLockfile: false. They used to read the workspace root'snode_modules, sopnpm rebuilddid not rebuild the project's dependencies and created a second virtual store at the workspace root #9402.pnpm installno longer creates anode_modulessymlink inside thepublishConfig.directoryof a workspace package linked withlinkDirectory. A build tool that cleaned its output directory through that symlink deleted the files of the package's dependencies.pnpm installalso removes a symlink that an earlier install left there #16226. It also no longer fails withERR_PNPM_CMD_SHIM_RESOLVE_PATHwhen such a package has abinfield and itspublishConfig.directorydoes not exist yet.pnpm installno longer fails for an injected workspace dependency whose package publishes from apublishConfig.directorythat its ownpreparescript builds. The injected copy now picks up that directory oncepreparefinishes building it.pnpm install --frozen-lockfileno longer reports the dependency as outdated while the directory has not been built yet #7811.An in-place edit to the source of an injected workspace package now shows up in its injected copy, unless a build writes to that package or
packageImportMethodis set. pnpm hardlinks such packages under the default import method #4410. Scripts listed insyncInjectedDepsAfterScriptsnow update injected dependencies while they run, so a watcher on the injected package, such as a dev server, sees each change before the script exits.With
sharedWorkspaceLockfile: false, an injected workspace package that has lifecycle scripts is now hard linked into the projects that depend on it. Before, pnpm left a plain copy, so later edits to the package did not reach those projects #9828.injectWorkspacePackagesnow hard links a workspace dependency declared with a relative path, such asworkspace:../foo, the same way it already does forworkspace:*#10446.Workspace discovery prunes dot-prefixed directories, so a
packagespattern such as**no longer matches projects inside.cacheand other hidden directories #16250.pnpm importin a workspace now keeps the versions pinned by ayarn.lockinside a workspace project #4385.Store and caches
Files imported from the store now follow the umask of the install that writes them. Installing with a umask of
077no longer leaves imported files readable by the group and others #3807.pnpm installkeeps the owner, group, and mode of files already in a shared store, includingindex.db. New store files and directories inherit the store directory's group-write bit. When that directory is setgid, new files inherit its group. pnpm does not change a file's owner or group #12765.When
pnpm installrepairs a store file that was modified through a hard link innode_modules, the repair now keeps the file's inode on Linux and macOS, so hard-linked copies in other projects are healed at the same time. On Windows the repair still replaces the file, so other projects are healed on their next install #3445.pnpm installnow reports a full store at once when writing package files fails. It no longer retries the tarball #8581.pnpm now warns when it cannot hard link packages from an existing store in the pnpm home directory and falls back to a store on the project's filesystem. This can happen when the project is on another filesystem, such as a bind-mounted workspace in a container. The warning names both stores and suggests setting
storeDir#14505.The side-effects cache now restores the symlinks that a build script creates inside a package. A warm install used to replace each of them with a copy of its target #12859.
After upgrading, every package with a build script is built once more.
The global virtual store and the side-effects cache now key built packages by the Node.js version that the root project's
devEngines.runtimeorengines.runtimepins. That is the Node.js their build scripts run with. A dependency that declares its ownengines.runtimeno longer changes the key for every other package.With
enableGlobalVirtualStore, an install into a freshnode_modulesno longer runs the build scripts of a dependency whose global virtual store slot an earlier install already built.pnpm rebuildstill runs them #14480.Concurrent installs that share a global virtual store now run a package's build in its shared slot one at a time. A failed build leaves the slot in place and marks it for the next install to rebuild #15568.
A warm
pnpm installreuses on-disk package metadata for five minutes when the registry does not send an ETag. Registries that send an ETag, including the public npm registry, still revalidate with a conditional request.pnpm updatestill fetches current metadata #13976.pnpm no longer revalidates cached registry metadata when the registry sends
Cache-Control: max-age=0,no-cache, orno-store. It downloads the metadata again, so a version newly published to such a registry is visible on the next install #13487.pnpm installhonorsCache-Controlfor dependencies named with anhttp:orhttps:tarball URL. A fresh response is taken from the store with no request, and a stale one is revalidated withIf-None-Match#15648.Patched dependencies
pnpm installnow repairs apnpm-lock.yamlwhose(patch_hash=<hash>)dependency paths disagree with itspatchedDependenciesmap, including paths that lack the hash their patch calls for. Before, pnpm accepted such a lockfile as up to date and kept the old patched files.pnpm install --frozen-lockfilenow fails on such a lockfile withERR_PNPM_INCONSISTENT_PATCH_HASH. It fails withERR_PNPM_UNCHECKABLE_PATCH_HASHwhen a patch hash in the lockfile is malformed, or when the lockfile lacks the package version or patch entry that the check needs #15336.pnpm installwithnodeLinker: hoistednow applies a patch once to each copy of a patched dependency in a workspace. Before, a copy that several workspace projects shared could receive the patch twice and end up with the patched content duplicated #7565.pnpm installandpnpm fetchnow fail withERR_PNPM_PATCH_NOT_FOUNDwhen a patch file listed inpatchedDependenciesdoes not exist #5268.engineStrictnow checks the patchedpackage.jsonwhen apatchedDependenciesentry changesengines. A patch that relaxesengines.nodeno longer fails the install against the published range #9603.pnpm patchnow applies the existing patch file to the edit directory of a git-hosted dependency, as it already does for packages from the registry #9699.Adding, updating, and removing dependencies
pnpm add <dir>now warns when the added directory declares peer dependencies, aspnpm linkdoes. The directory is saved as alink:dependency, and its peers are not resolved from the project that adds it. Use thefile:protocol to have them resolved #5523.pnpm add --save-typesno longer adds a@types/*package whose resolved version is deprecated. DefinitelyTyped publishes such stubs for packages that ship their own types, such as@types/typescriptfortypescript#15636.pnpm version,pnpm add, andpnpm pkg setkeep JSON5 style when they updatepackage.json5. ASCII identifier keys stay unquoted, strings keep JSON5 quotes, and indented files keep trailing commas #15717.Running scripts and commands
pnpm runandpnpm execno longer install dependencies automatically when the rootpackage.jsonstill keepsoverrides,packageExtensions,patchedDependencies, orignoredOptionalDependenciesin itspnpmfield. pnpm no longer reads that field, so the install rewrote the lockfile without those settings. The command now fails and asks to move the settings topnpm-workspace.yaml#16278.When
verifyDepsBeforeRuntriggers an install before a filteredpnpm runorpnpm exec, pnpm now installs only the selected projects and their dependencies. A later filtered command also installs a selected project that an earlier filtered install skipped #11865.pnpm -r run /regexp/now honors thetasksdependsOndeclared for each script the selector matches, like running the script by name does. Matched scripts that depend on each other run in order. Each matched script runs once #15596.pnpm runexits with the code of a script that handles Ctrl+C and shuts down. A script that finished cleanly is not reported as a lifecycle failure. The commands after it in the same script still run #9945.pnpm no longer hangs after a lifecycle script exits while a process it started in the background keeps the script's output open. pnpm stops reading that output one second after the script exits #5730.
pnpm runand lifecycle scripts use the configuredscriptShell, including Git Bash on Windows, whenshellEmulatoris also enabled.shellEmulatorstill runs scripts whenscriptShellis not set. Extra arguments passed topnpm runare quoted for the shell that runs the script, so a Windows path stays intact #14719.With
enableGlobalVirtualStore, dependency build scripts now see the workspace root'snode_modules/.bin, as they do with a local virtual store. Apostinstallscript that runsnodefinds the Node.js installed bydevEngines.runtimeand no longer fails with "command not found" on machines without a system Node.js #15652. Dependency build scripts also see the bins of privately hoisted dependencies.Dependency install scripts now find the node-gyp bundled with pnpm when pnpm runs through a symlink, such as
node_modules/.bin/pnpmor thepnpmthatnpm install -g pnpmlinks. They used to fail withnode-gyp: command not foundon macOS #15694.pnpm runand lifecycle scripts now setnpm_config_node_gypto the bundlednode-gypentry point. Tools that read the variable resolve the samenode-gyppnpm builds with. Annpm_config_node_gypvalue the environment already sets is kept as is #16270.Scripts now see the
npm_commandenvironment variable that npm sets. It holdsrun-scriptwhen the command runs a script, and the command's own name otherwise #16265.Commands run from a POSIX shell through a dependency's own
node_modules/.bin, such asnode_modules/vite/node_modules/.bin/esbuild, no longer fail withMODULE_NOT_FOUND#10189.pnpx --versionandpnpm dlx --versionnow print the pnpm version. Other unknown options before the command are reported as errors. Before, pnpm tried to download a package named after the option #16259.pnpm dlxnow keeps the virtual store of its cached installs innode_modules/.pnpm, like every other install #13955.pnpm pack-appnow names the manifest of its runtime install directorypnpm-pack-app-<target>.Publishing, packing, and deploying
pnpm packandpnpm publishnow ship a file that thefilesfield names even when another entry excludes the directory holding it. For example,["**", "!dist", "dist/index.d.ts"]shipsdist/index.d.ts#16213.pnpm packprunes a directory that afilesfield exclusion names, such as!**/test, excluding the directory and its contents from the packed package #15738.pnpm publishnow waits at least 5 minutes for the registry to answer a publish request, like npm. This fixes "409 Conflict - Failed to save packument" errors when the registry is slow to answer #11454.pnpm deploy --prodno longer fails withERR_PNPM_OUTDATED_LOCKFILEwhen the deployed project declares adevEngines.runtimewithonFail: download. The runtime stays out of the deployednode_moduleswith the rest of the dev dependencies #15703.pnpm deploywith a shared lockfile now copies workspace dependencies into the deploy directory, even whenpackageImportMethodis set tohardlink. Before, their files were hard-linked to the workspace sources, so editing a source file also changed the deployed copy #12176.pnpm deploy --legacyno longer leaves broken links to nested local dependencies of workspace packages #9575.Configuration and pnpmfile hooks
Every setting pnpm supports can now be set with
--config.<name>=<value>on the command line, not only the ones whose command also carries a matching flag. Before,pnpm install --config.frozen-lockfile=truedropped the setting and rewrotepnpm-lock.yamlas though the install had not been frozen #16276.Settings given on the command line, such as
--registryand--store-dir, now take precedence over the values a pnpmfileupdateConfighook sets #14063.pnpm config set --location=projectandpnpm config delete --location=project, run from a package inside a workspace, now write settings that belong inpnpm-workspace.yamlto the workspace root'spnpm-workspace.yaml. Before, they created a newpnpm-workspace.yamlin the current package, which made that package the workspace root. Settings stored in.npmrcare still written to the current directory #13757.pnpm now reads the workspace directory override from
PNPM_CONFIG_WORKSPACE_DIR, like other settings.NPM_CONFIG_WORKSPACE_DIRstill works as a fallback #16275.pnpm now fails with
ERR_PNPM_AUTH_INVALID_BASE64when a registry's_passwordin.npmrcis not valid base64. Before, it sent the value as the raw password. Ausernameor_passwordleft empty, for example by an unset environment variable, now supplies no credential #16273.proxy=falsenow turns proxying off even whenHTTP_PROXY,HTTPS_PROXY, orALL_PROXYis set. pnpm no longer sends requests through a proxy named only inALL_PROXY.pnpm installnow runs the install hooks of a config dependency plugin's pnpmfile, includingreadPackage,afterAllResolved, and custom resolvers. Its pnpmfile is also counted inpnpmfileChecksum. Before, only the plugin'supdateConfighook ran, so a plugin could not change the resolved dependencies.A pnpmfile
fetchershook now runs once per package on a fresh install when it handles a resolution with a customtypeor delegates a git-hosted one to the same subdirectory #15584. These packages were fetched a second time for installation, so the installed files could come from a different archive than the one their dependencies were read from. The hook also no longer runs twice when aresolvershook returns a tarball resolution without a manifest #15025.pnpm installnow re-fetches a package from a custom resolver when theintegrityof its resolution changes, with or withoutenableGlobalVirtualStore. It used to update the lockfile but keep the old files innode_modules#15670.pnpm installnow rejects invalid results from areadPackagehook. A hook that returns a non-object value fails withERR_PNPM_BAD_READ_PACKAGE_HOOK_RESULT#15730. A hook that sets a dependency range to a value other than a string, such asundefined, fails with an error that names the dependency, the package and the pnpmfile. Delete the property to remove a dependency #15705.Global packages, pnpm versions, and runtimes
pnpm update --globalnow reinstalls the global packages that pnpm 10 installed into the previous global directory,<global-dir>/5, so their commands are linked into the pnpm homebindirectory again andpnpm list --globallists them. Once every package is migrated, pnpm deletes the previous directory and the commands pnpm 10 linked into the pnpm home #11528.A signal sent to pnpm, such as
SIGTERM, now reaches the pnpm that pnpm switches to because ofpackageManagerordevEngines.packageManager, and the one thatpnpm withruns. The signal used to be dropped, so scripts running under that pnpm never got to shut down #9948.On arm64 musl Linux, such as Alpine on ARM, switching to a pinned pnpm older than 12 now runs the JavaScript
pnpmpackage. The standalone executable of those versions crashed at startup on that platform #10443.Global shims such as
nodenow work when pnpm runs through a relative symlink, as with a Homebrew install. They were copies of that symlink and did not resolve from the global bin directory #15691.pnpm env remove --globaldeletes Node.js versions that pnpm installed into its own store, including when another tool installed pnpm #8357.pnpm self-updateno longer suggests a downgrade whenminimumReleaseAgeholds back the registry'slatestrelease. It now says that release is still within the cutoff #12006.Windows
Interrupting a script with Ctrl+C on Windows no longer leaves the terminal stuck #14860. A script that runs through a batch shim, as
vite devdoes throughvite.CMD, made cmd.exe wait forever on its "Terminate batch job (Y/N)?" answer, and every following keystroke went to that prompt. pnpm now ends a cmd.exe script shell once it has sat for a second after the interrupt with nothing running under it. A script that takes longer to shut down is still waited for. A second Ctrl+C ends the script's shell at once.On Windows,
pnpm runnow passes the arguments after the script name to the script as typed. Before,cmdexpanded%VAR%in them and backslashes arrived doubled. Line breaks still arrive as the two characters\n, becausecmdcannot pass them. The command line pnpm prints for the script quotes the arguments the same way on every platform #16257.The Windows
pnpm.exeruns on a clean Windows install that does not have the Visual C++ Redistributable. It used to exit immediately on startup because that runtime was missing #15723.On Windows, the
.cmdcommand shims innode_modules/.binnow keep a%in the project path. Before, cmd.exe expanded it as a variable reference, so the command received a mangledNODE_PATH#15716. Command shims also run tools whose paths contain non-ASCII characters #6999, including the PowerShell shims in Windows PowerShell 5.1 #16217.Bin shims in
node_modules/.binrun from Cygwin on Windows again. The shims passed a/cygdrive/c/...path to the Windowsnodefound onPATH, so Node.js failed withCannot find module 'C:\cygdrive\c\...'#12845.On Windows, installing pnpm with npm inside a project now writes
node_modules/.binshims that runpnpm.exe. A global install withnpm install --location=globalnow gets the same shims asnpm install -g#15688.pnpm installno longer fails withERR_PNPM_WORKSPACE_INVALID_GLOBon Windows for a wildcard pattern such asplugins/*/*inpnpm-workspace.yamlwhen the workspace is on a different drive than the pnpm cache or state directory #16239.On Windows,
pnpm installno longer skips a dependency's build script on a later install when the package ships an executable file and the script changes nothing inside the package directory #15667.pnpm setupno longer writes thepn.ps1,pnpx.ps1, andpnx.ps1PowerShell wrappers. It also removes the ones an earlier setup wrote. PowerShell now runspn,pnpx, andpnxthrough their.cmdwrappers, likepnpmitself. Before, these aliases failed with a "not digitally signed" error wherever the execution policy blocks unsigned scripts #8444.pnpm setupon Windows no longer panics when an unrelated environment variable has a name containing a non-ASCII character. It skips that variable #15684.On Windows,
pnpm setuprepairs thePNPM_HOMEregistry type left by older pnpm versions, even when the configured directory has not changed.On Windows, the
ERR_PNPM_BAD_ENV_FOUNDerror ofpnpm setupnow shows the valuePNPM_HOMEis currently set to. Before, it showed the directory pnpm wanted to set.On Windows, pnpm expands nested
%VAR%references inPNPM_HOMEand the other directory environment variables it uses for its home, store, cache, state, and config directories. pnpm fails with an error when a%VAR%reference remains after expansion #13236.On Windows, if the global bin directory is not in
PATHand aPATHentry still contains an unexpanded variable such as%PNPM_HOME%, the error now names that entry. A variable referenced from the userPathmust be set to a full path and stored as a plain string (REG_SZ) for the entry to expand #5283.Inspecting dependencies
pnpm auditandpnpm audit signaturesnow fail with an error when the lockfile contains unresolvable dependency references #13638.pnpm licenses listnow reports the actual on-disk package locations when usingnodeLinker: hoistedorshamefully-hoist: true#8589. With--json, itspathsarray now includes every installed copy of a package, including hoisted copies and isolated installations with different peer dependencies.pnpm rootnow prints the configuredmodulesDir. It used to printnode_modulesregardless of the setting. A project's ownmodulesDirfrompackageConfigsis printed too #9113.Output and messages
With the default and append-only reporters, installs with
--loglevel warnor--loglevel errornow print the full output of a failed install script. The output of successful scripts, including the root project's own install hooks, stays hidden. With--loglevel warn, pnpm also prints ignored build script warnings.When a dependency fails to resolve, the error now shows the cause. For example, a Node.js runtime download behind a proxy that re-signs TLS now reports
invalid peer certificate: UnknownIssuer#9556.When installing a git dependency over SSH fails with
Permission denied (publickey), pnpm suggests checking the loaded keys withssh-add -l. Resolving an SSH URL that refuses the key also shows a local HTTPS rewrite that leaves the recorded URL alone #13743.Lockfile verification now fails with
ERR_PNPM_TARBALL_URL_MISMATCH,ERR_PNPM_TARBALL_REVISION_MISMATCH, orERR_PNPM_MISSING_NAMED_REGISTRYwhen every rejected entry failed that check. These failures were reported as the genericERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION.The lockfile verification error now suggests relaxing the policy that flagged an entry only if a fresh resolution still fails and you trust the affected packages. Errors from checks that no policy controls, such as a missing tarball integrity, no longer suggest relaxing a policy #14411.
pnpm installno longer prints an extraProgress:line after the progress line is markeddone#16184.Platinum Sponsors
Gold Sponsors
v12.7.0: pnpm 12.7Compare Source
pnpm 12.7.0 ships with
.nvmrcand.node-versionsupport in the globalnodeshim,pnpm install --allow-build,pnpm publish --publish-wait-timeout, andpnpm-workspace.yamlcreated from theworkspacesfield.pnpm install --forceno longer installs optional dependencies built for other platforms. This release also carries security fixes for bin shims on Nix, for lifecycle scripts of packages in astoreDirinside the workspace, and foruserAgentplaceholders inpnpm-workspace.yaml.Minor Changes
pnpm install --forcenow keeps skipping optional dependencies whoseos,cpuorlibcdo not match the host. It still refetches every package and liftsengineStrict. The newforceIgnoresPlatformsetting restores the previous behaviour, installing optional dependencies of every platform under--force#6133.The global
nodeshim created by pnpm now uses the Node.js version from the nearest.nvmrcor.node-versionfile when the project does not declare a Node.js runtime indevEngines.runtimeorengines.runtime#4471. The nearest directory with a Node.js runtime declaration decides the version. Within one directory,package.jsontakes precedence over.node-version, which takes precedence over.nvmrc. An.nvmrcvalue that only nvm can act on, such assystemor a custom alias, is ignored.pnpm installnow supports the--allow-buildoption to selectively allow or deny package lifecycle scripts and record them inpnpm-workspace.yaml#15388.Added
pnpm publish --publish-wait-timeout <milliseconds>to wait for published versions and their tarballs to become available from the registry. SetpublishWaitTimeoutinpnpm-workspace.yamlto configure a default. A value of0disables the check.Recursive publishing confirms availability before publishing dependent packages. If confirmation times out, the command fails.
When
pnpm publish -r --report-summaryfails after some uploads were accepted, the summary file now lists those packages.pnpm installnow createspnpm-workspace.yamlfrom theworkspacesfield of the rootpackage.jsonwhen the repository has nopnpm-workspace.yaml. The projects the field lists are linked on that same install. An existingpnpm-workspace.yamlis never changed. With--ignore-workspace, no file is created. If theworkspacesfield later differs frompackagesinpnpm-workspace.yaml, pnpm prints a warning #2255.When a project pins a pnpm version or a runtime that another pnpm process is installing at that moment, pnpm now waits a few seconds and then installs and runs a private copy of its own. It used to wait up to five minutes and then use the shared install directory without the lock. The private copy is removed once the command has run.
pnpm store pruneremoves any private copy that a killed process left behind #15413.pnpm now keeps the blank lines between entries of
package.jsonwhen it updates the file, for example onpnpm add#5602.Patch Changes
Security
pnpm no longer expands environment variables in a
userAgentset in a project'spnpm-workspace.yaml. AuserAgentwith a placeholder in that file is now ignored. Before this fix, pnpm sent the variable's value to the configured registry #15415.On Nix, a dependency's bin named like a system utility such as
sedcan no longer redirect a POSIX bin shim or thepnpm,pn,pnpx, andpnxlaunchers. The shims and launchers now ignorenode_modulesand relativePATHentries while they locate their own files. Installing again replaces the shims already innode_modules#14883.pnpm no longer treats manifests inside its store, cache, state, or modules directories as workspace projects. Before, a
storeDirinside the workspace could let lifecycle scripts of packages in the store run withoutallowBuildsapproval #15033.Packages that run a lifecycle script are no longer hard-linked into the virtual store, so a build script can no longer rewrite the workspace source of an injected package or the store copy it was imported from #15483.
Installing packages
Fixed
pnpm install,pnpm add,pnpm remove, andpnpm peers checkrunning out of memory when many packages share a missing peer dependency. This mostly affected projects withautoInstallPeers: false#15362.pnpm no longer hangs for up to 5 minutes after a pnpm process was killed while setting up the pnpm version pinned in
packageManagerordevEngines#15360, #15393. The killed process left behind a lock that every later pnpm command in the project waited on. pnpm now detects that the process holding a lock is gone and takes the lock over at once. The same applies to the locks pnpm takes while installing a managed runtime or writing the global bin directory. Two pnpm processes that are both still running keep waiting for each other as before.Requests to a registry or tarball server whose TLS certificate fails verification now fail at once. Such requests were retried for more than a minute without any output #9134.
On macOS, pnpm now falls back to its bundled CA roots when system trust evaluation is unavailable, such as in a sandbox or when macOS cannot create an SSL policy for a registry connection. Installs failed or crashed on the first registry request in that case. Custom
cacertificates are now honored directly #15329, #14461.pnpm installnow caps concurrent connections to a proxy at 50 sockets by default #15280. It also immediately retries transient connection resets when downloading package archives.pnpm installnow reuses a package already present in the store when an existing lockfile entry satisfies the dependency, avoiding registry requests that fail without authorization #2522.Installing or adding dependencies no longer fails when a previously installed local tarball file was deleted from disk #8367.
pnpm installnow installs the new version of a local tarball dependency whose file was replaced at the same path #2437.pnpm install --frozen-lockfilerejects such a changed tarball, even when the previous archive contents are in the store #1889.pnpm installnow fetches committed submodules of git dependencies #1470.pnpm installnow applies patches produced bypnpm patch-commitwhen an edit removes the trailing lines of a file along with its newline. The install no longer fails withERR_PNPM_INVALID_PATCH("expected end of hunk") #12451.pnpm installnow preserves existingnode_modulesdirectories when a cross-device move reportsEXDEV#14504.pnpm installno longer fails when writing the workspace state file encounters an error. Failures to update the state file now emit a warning instead of aborting the install #14550.Interrupting
pnpm installwith Ctrl+C or SIGTERM no longer leaves a temporary lockfile (.pnpm-lock.yaml.*.tmp) behind in the project #1418.pnpm installnow relinks a direct dependency whose link innode_modulespoints to a missing target. Before, it reported "Already up to date" and left the broken link #9758.pnpm installuses less CPU when it links packages from a warm store. On Windows, a warm install could take several times longer than with pnpm 11 #15439.pnpm installnow runsnode --versiononce per run. A workspace whose projects keep their own lockfiles (sharedWorkspaceLockfile: false) previously ran the probe once or twice for every project, and on macOS the concurrent launches waited on each other, so a project could wait several seconds before its linking started.A repeat
pnpm install --frozen-lockfilewithnodeLinker: hoistedin a workspace no longer re-linksnode_moduleswhen nothing changed.Custom fetcher hooks no longer run a second time during installation when an archive was already fetched during dependency resolution #15025.
Fixed a package resolved by a
resolverspnpmfile hook installing without its own dependencies. This happened when the hook returned nomanifestand afetchershook handled the resolution #15552.pnpm install --prodand other installs that skipdevDependenciesno longer run thepnpm:devPreinstallscript #7065. They skippreparelifecycle scripts too, as do installs given package arguments.pnpm prune --prodand production installs now remove devDependencies whenlockfile: falseis configured #2677.pnpm install --prod,pnpm fetch --prodandpnpm deploy --prodno longer install a devDependency that is only there to satisfy an optional peer dependency of a production dependency.pnpm list,pnpm why,pnpm licenses,pnpm sbomandpnpm auditleave it out of--prodresults too. The same applies to--dev. A peer that is not optional is still installed and audited #15344.pnpm installno longer skips optional dependencies that the Node.js version locked for adevEngines.runtimerange supports, when the range usesonFail: download. An explicitly setnodeVersionstill takes priority #14628.pnpm fetchnow also installs the pnpm version thatpnpm-lock.yamlpins, when it differs from the running pnpm. A laterpnpm install --offlinethat switches to the pinned version no longer fails because that version is missing from the store #11808.A dependency that ships a
binding.gypand setsgypfile: falseno longer gets thenode-gyp rebuildinstall script pnpm synthesizes for it. Such a dependency needs noallowBuildsentry and is no longer listed under "Ignored build scripts".pnpm installno longer addsallowBuildsplaceholder entries topnpm-workspace.yamlwhen it runs in CI or without a terminal. Interactive installs still add them #11574.pnpm now detects the same CI environments as pnpm 11, including AWS CodeBuild, which does not set
CI. On these servicespnpm installuses a frozen lockfile by default and fails withERR_PNPM_OUTDATED_LOCKFILEwhen the lockfile is outdated.Resolving and linking dependencies
Installing through a pnpr server now installs a project's peer dependencies when
autoInstallPeersis enabled. A project that declared only peer dependencies failed withERR_PNPM_OUTDATED_LOCKFILEor skipped its peers #14833.pnpm now installs a dependency that a package also declares as an optional peer dependency, for example
lightningcssin some vite builds. The dependency was missing fromnode_modules, so the package failed to import it #8912.Removal overrides such as
"parent>peer": "-"now prevent optional peers from being installed from another workspace package #15008.Removing an entry from
overridesnow re-resolves the packages it targeted. A version the override had locked is no longer kept just because the declared range still accepts it #4587.packageExtensionsandoverridesentries with a ranged selector (such as@<Xor@*) no longer match a dependency that has nopackage.json, such as a local directory dependency #15007.Trim leading and trailing whitespace from dependency override selectors in
pnpm.overrides#6356.With
trustPolicy: no-downgrade, pnpm now resolves the newest matching version that is not a trust downgrade. Previously a dependency failed withERR_PNPM_TRUST_DOWNGRADEeven when an older version satisfied its range.pnpm self-updatepicks its target version the same way. A request for an exact version still fails #14176.pnpm installnow re-resolves a dependency when its manifest range is updated from a prerelease to a stable version. The lockfile previously retained the prerelease version and caused--frozen-lockfileto fail #15528.pnpm install --ignore-pnpmfileno longer removespnpmfileChecksumfrom an up-to-datepnpm-lock.yaml.pnpm install --frozen-lockfile --ignore-pnpmfileno longer fails withERR_PNPM_LOCKFILE_CONFIG_MISMATCHwhen the lockfile records apnpmfileChecksum. A command that resolves dependencies with the pnpmfile ignored still writes the lockfile without it #10944.pnpm installandpnpm peers checknow use local tarball packages' actual versions when checking peer dependencies. Compatible packages no longer fail withstrictPeerDependenciesenabled.pnpm peers checkand the install-time peer dependency check now resolve peer dependencies from the workspace root whenresolvePeersFromWorkspaceRootis enabled #14982.autoDedupeandpnpm dedupenow move transitive dependencies to the version acatalog:dependency pins, as they already did for versions written directly inpackage.json. Previously they could move those dependencies to a higher version and keep both versions in the lockfile.pnpm dedupenow produces a stable lockfile when a dependency's range matches both a direct dependency and annpm:alias of the same package. The dependency resolves to the version of the direct dependency. Repeated runs previously alternated between two lockfiles #15588.Merging lockfiles now preserves recorded configuration fields such as
overrides,neverBuiltDependencies,patchedDependencies,packageExtensionsChecksum,settings, andcatalogs#8366.A lockfile entry whose resolution is unchanged now keeps its recorded
deprecatedmessage #5772.pnpm no longer writes a package's legacy array-form
engines, such as["node >= 0.8"], to the lockfile. It was recorded as an object keyed by index, such as{'0': node >= 0.8}#4518.Tarball URLs recorded in the lockfile now strip default HTTP and HTTPS ports (
:80and:443) #15539.node_modules/.package-map.jsonno longer contains entries that point at directories that do not exist. Such entries appeared for packages installed only with peer dependencies, most visibly withenableGlobalVirtualStore#14938.With
nodeLinker: hoisted,hoistWorkspacePackagesnow links each workspace project thathoistPatternorpublicHoistPatternselects into the rootnode_modules, unless a hoisted package or a root dependency already uses its name. The project's bins are linked into the rootnode_modules/.bin#7553.With
nodeLinker: hoisted,pnpm installnow removes the commands of the packages it removes fromnode_modules/.bin, such as a nested copy deduped into the rootnode_modules#7568.pnpm installno longer puts a dependency's bin onPATHfor that dependency's own lifecycle scripts before the bin's file exists. pnpm links such a bin after the dependency's build has run. It also removes such a bin left by an earlier install. This fixes installing thenodepackage on Windows #15501.Dependencies and executable binaries are now correctly linked and accessible for workspace packages using
publishConfig.directoryandpublishConfig.linkDirectory#8338.Bin linking leaves workspace and linked dependency files outside node_modules unchanged. Already executable bin files no longer receive redundant permission changes.
Workspaces and filtering
pnpm installnow finds workspace projects reached through a symlink, such as apackagesdirectory that links to a folder outside the workspace. It installs their dependencies, and the links in theirnode_modulesresolve #1044.A dependency declared with
catalog:now counts as a workspace dependency when its catalog entry points at a workspace project, for exampleworkspace:*#15587. WithlinkWorkspacePackagesenabled, so does annpm:alias of a workspace project, such as"math-alias": "npm:math@^1.0.0".pnpm -r runruns that project first.--filter <pkg>...selects it.A
workspace:dependency now resolves to a workspace project whose version is not valid semver, such as1or1.0.workspace:*,workspace:^, andworkspace:~match it. A range identical to the version also matches it #4567.A
workspace:dependency with an exact version now resolves to a workspace project whose version carries SemVer build metadata. For example,workspace:0.5.6-next.3matches a project at0.5.6-next.3+f60facc#6483.Secondary dependencies now prefer the version resolved by the local project's direct dependencies over versions from sibling workspace projects #7191.
pnpm installnow re-resolves a workspace project's auto-installed peer dependency when another workspace project changes its specifier for that package to one that excludes the locked version but still overlaps the peer range. The peer then resolves to the version a fresh install would pick #11800.pnpm install --frozen-lockfilenow fails withERR_PNPM_OUTDATED_LOCKFILEwhenpnpm-lock.yamllists a workspace project whose directory or manifest file is missing. The install used to report success without installing that project's dependencies #7667.pnpm install -rnow installs every workspace project whenrecursiveInstallis set tofalseinpnpm-workspace.yaml#7504.pnpm installwith--filternow installs only the dependencies of the selected projects when usingnodeLinker: hoisted#8882.pnpm installnow updates an injected workspace dependency after that package's own dependencies change, whenshared-workspace-lockfileisfalse#7209.pnpm installnow copies the output of a workspace package's ownprepare,install, orpostinstallscript into the injected copies of that package. Before, the injected copies kept only the files that existed before the script ran.syncInjectedDepsAfterScriptsnow also works whenmodulesDiris set #9464.syncInjectedDepsAfterScriptsnow copies files into injected dependencies whennode_modulesis on another filesystem than the package sources. The sync previously failed with a cross-device link error and made the script run exit with an error #14703.A
modulesDirwith several path segments, such aswww/modules, now puts each workspace project's dependencies in<project>/www/moduleson both fresh and frozen installs, andpnpm binprints<project>/www/modules/.bin#15484.With
nodeLinker: hoisted, pnpm now installs the root project's dependencies into a custommodulesDirinstead ofnode_modules. With a custommodulesDir, the virtual store and itslock.yamlnow default to<modulesDir>/.pnpm.A repeat
pnpm installin a workspace with a custommodulesDirnow takes the up-to-date fast path. Before, pnpm looked for each workspace project's dependencies innode_modulesand ran a full install every time.pnpm now warns when a workspace install covers a project that has its own
pnpm-workspace.yaml. The nested file's settings, such aspatchedDependencies, do not apply when the outer workspace installs that project. pnpm reads settings only from thepnpm-workspace.yamlat the workspace root #11724.The
[<since>]filter selector now compares against the commit where the current branch forked from<since>. Projects changed only by newer commits on<since>are no longer selected. Uncommitted changes are still included. In a shallow clone without that commit, pnpm compares against<since>directly, as before #9907.--filter "[<since>]"now selects workspace packages when dependency versions change in a catalog inpnpm-workspace.yaml#8718. It also selects projects that files were moved out of when git detects the move as a rename #15481.--filternow evaluates selectors in order, so later inclusion filters can re-include packages that an earlier exclusion filter excluded #9354.Adding, updating, and removing dependencies
pnpm addnow saves changes topackage.jsonbefore running lifecycle scripts, so a postinstall script failure leaves the added dependency inpackage.json#8627.pnpm addnow saves the requested exact version when adding a dependency, even when the manifest already contains a version range #6040.pnpm add <pkg>@<version>andpnpm update <pkg>@<version>now move the catalog entry onto the named version when the entry's range already covers it. For example,^7.22.17becomes^7.29.6, the same waypnpm update <pkg>moves an entry to the version it resolves #13715.pnpm addandpnpm installkeep an emptypeerDependencies,dependencies,devDependencies, oroptionalDependenciesfield that was already inpackage.json. pnpm still drops such a field when it removes the last entry itself, aspnpm removedoes #5096.pnpm updatenow keeps a version range whose shape has no save prefix, such as<= 3.0.0or>=1.0.0 <2.0.0, when the updated version still satisfies it. Before,<= 3.0.0became^3.0.0#6714.pnpm update <pkg>now moves a package off a locked version the registry no longer serves, such as an unpublished release. The lockfile check for supply-chain policies such asminimumReleaseAgeused to reject that version before the update could replace it #9953.pnpm update --prodno longer installs devDependencies when run in a project installed with--prod#8038.pnpm update --interactive --workspacenow allows external dependencies to be updated.pnpm outdatedandpnpm updatenow applyminimumReleaseAgeto GitHub Actions.minimumReleaseAgeExcludeentries match action names such asactions/checkout#13923.pnpm removenow accepts--trust-lockfileand--no-trust-lockfileto control supply-chain policy checks while removing a package #14406.pnpm unlinknow removes thelink:dependency thatpnpm link <dir>added topackage.json. The linked package is removed fromnode_modulesand the lockfile. Alink:dependency to another directory is kept #4219.pnpm installnow prunes unreferenced catalog entries frompnpm-workspace.yamlwhencatalogPrune: trueis configured #15273.minimumReleaseAgeExcludePruneandtrustPolicyExcludePrunenow work in workspaces withshared-workspace-lockfile=false. Once every project has been installed, pnpm drops an entry only if no project lockfile records it. UndecidedallowBuildsentries are pruned the same way #14612.Exclude entries that pnpm writes to
pnpm-workspace.yamlnow match the file's list indentation and dominant quote style #15571, #15079.pnpm importnow converts dependencies that use Yarn'spatch:protocol. The dependency keeps the version it patches, and the patch file is added topatchedDependenciesinpnpm-workspace.yaml. If the patch file is missing, pnpm prints a warning and imports the dependency without the patch #10278.pnpm importin a workspace now keeps the versions pinned by the rootyarn.lock,package-lock.json, ornpm-shrinkwrap.jsonwhen another workspace project's range allows a newer version. Before, the root project got the newest version in its range #4385.pnpm patch,pnpm patch-commit, andpnpm patch-removenow work in a project of a workspace withsharedWorkspaceLockfile: false.pnpm patchfailed there withERR_PNPM_PATCH_NO_LOCKFILEafter a successful install. The reinstall after committing or removing a patch left the project's ownnode_modulesunchanged #9926.pnpm patch-commitnow resolves default patch directory locations when passed a package name or package specifier (such aspnpm patch-commit <pkg>orpnpm patch-commit <pkg>@<version>).pnpm patch-commitnow updates the lockfile snapshot and prunes removed dependencies when the patch modifiespackage.json#6866.pnpm patch-commitnow falls back to copying package files when hard linking fails.Running scripts and commands
A script that pnpm runs without a terminal now ends when pnpm itself is killed. Killing pnpm's process group, as Playwright's
webServerdoes to stop the command it started, used to leave the script running and holding the caller's output pipes open #15555.pnpm --filter <project> <command>andpnpm -r <command>now run a command installed in the selected projects' dependencies when none of them has a script by that name. This matchespnpm <command>in a single project.pnpm runwith--filteror-rstill reports the missing script #10151.pnpm execandpnpm dlxnow setnpm_execpath,INIT_CWD,npm_node_execpath, andNODEin child environments when Node.js is available. Stale inheritedNODEandnpm_node_execpathvariables are cleared when Node.js cannot be found on PATH #7037. Scripts thatpnpxandpnxrun now get pnpm itself asnpm_execpath. A script that ran$npm_execpath installthere ranpnpm dlx install.pnpm execnow sets thePWDenvironment variable to the directory the command runs in. Shells and tools that readPWDnow report the logical path of a workspace package reached through a symlink #1550.A script that runs
pnpm runno longer adds duplicatenode_modules/.binandnode-gyp-binentries toPATH#5352.Concurrent
pnpm runandpnpm execcommands now serialize their dependency installs #14551.pnpm runandpnpm execwithverifyDepsBeforeRunnow accept a moved project whose store is on the project's volume. Before, the check reported that the workspace structure had changed whenever the default store was not on the home volume.verifyDepsBeforeRunchecks now account for project-specificpackageConfigsoverrides in workspaces withsharedWorkspaceLockfile: false#15545.pnpm restartnow runs the "stop" and "start" scripts when the package has no "restart" script. Previously it ran "stop" and then failed with "Missing script: restart" #4750.pnpm dlxnow keeps a separate cache entry for each Node.js major version. A package built under one Node.js major version, such as a native addon, is no longer reused under another #8611.pnpm pipelineno longer fails when run in a project outside a Git work tree or on a system withoutgit. Tasks in those projects run without caching, and pnpm prints a warning explaining why #15601.A
runtime:version range that contains||or a space, such as adevEngines.runtimeversion of^22.18.0 || ^24.0.0, now installs the requested runtime. pnpm used to install the npm package with the same name, such asnode#14817.When the configured
scriptShelldoes not exist, running a script now fails with an error that names the shell. Previously pnpm printed only an exit code or the package directory #7562.A script killed by a signal now fails with an error that names the signal, such as
Command failed with signal SIGKILL.#9821.Publishing, packing, and deploying
pnpm publishnow resolvesworkspace:dependencies from workspace manifests whennode_modulesis not installed. Previously, publishing withoutnode_modulesfailed withERR_PNPM_CANNOT_RESOLVE_WORKSPACE_PROTOCOL#6567.pnpm publishnow honorspublishConfig["@scope:registry"]for a package in that scope. It takes precedence over the registry set for the same scope in.npmrcand overpublishConfig.registry#12071.pnpm packandpnpm publishnow include bundled dependencies when using the isolated linker. This covers workspace packages and the dependencies of each bundled package. Bundled dependencies are also included whenpublishConfig.directoryselects a build directory #1643.pnpm pack,pnpm deploy, and installs of local directory dependencies now keep symlinks that point to files or directories included in the package.pnpm packleaves out symlinks that point outside the package #8208.pnpm packnow preserves file executable permissions in the packed tarball when source files are executable on disk.pnpm publishandpnpm packnow report a missingversionornamefield on a workspace dependency. Previously, pnpm reported that the dependency was not installed #4164.pnpm publishandpnpm packnow report an error when a bin script has a shebang line ending with CRLF #7311.pnpm deploynow copies thepackageManageranddevEngines.packageManagerfields of the workspace rootpackage.jsoninto the deployedpackage.json, unless the deployed project pins a package manager itself #9079.pnpm deploynow puts the virtual store atvirtualStoreDir, resolved against the deploy directory. A shared-lockfile deploy recordsvirtualStoreDirin the deployedpnpm-workspace.yaml. With the global virtual store enabled or an absolutevirtualStoreDir, the deploy still usesnode_modules/.pnpm#8787.pnpm deploynow respects--package-import-methodpassed on the command line and reports the package import method correctly #7593.pnpm deploydoes not run thepreparescripts of the deployed project #7282.pnpm deploy --legacyno longer rewrites the source workspace'snode_modules/.pnpm-workspace-state-v1.jsonto describe only the deployed project #15352.Manifests and configuration files
pnpm now reads and updates
package.json5project manifests. Manifest updates retain comments, and workspace discovery preferspackage.json, thenpackage.json5, thenpackage.yaml#15129.pnpm packincludes exactly onepackage.jsonin the archive when the project uses an alternative manifest format, even when.npmignoreorfilesexcludes the source file.Git-hosted dependencies that use a
package.yamlorpackage.json5manifest now honor itsfilesfield #7906.Fixed
pnpm versionfailing on projects using apackage.yamlmanifest.Fixed
pnpm initcreating an extrapackage.jsonwhenpackage.yamlis already present.pnpm versionnow applies pending bumps to private workspace packages. A private package's changelog is written to its committedCHANGELOG.md, also whenversioning.changelog.storageisregistry#13736, #13519.pnpm initnow supports the--bareoption. It creates apackage.jsonfile with only the required fields #15538.The
reportersetting is now honored when it is configured inpnpm-workspace.yaml, the global configuration, or thePNPM_CONFIG_REPORTERenvironment variable. Configuredreporter: silentmakes silent output the default. An explicit--reportertakes precedence #4879..npmrcandpnpm-workspace.yamlfiles now support npm's${VAR?}placeholder. It expands to the value ofVAR, or to an empty string without a warning whenVARis unset #14404.pnpm now expands environment variables in
_auth.authTokenvalues loaded from globalconfig.yamlandpnpm_config__auth.pnpm now keeps the configured default registry when
_authholds credentials for several registries and some of those registries serve package scopes.Lockfile verification checks a tarball hosted on a scoped registry against that registry's metadata, unless the package's own scope has a registry assigned #15530.
pnpm now parses the first setting in a
.npmrcthat starts with a UTF-8 byte order mark. Previously, the leading byte order mark caused the first line's key to be ignored #15353.pnpm now prints a warning when a
.npmrc,auth.ini, or the file set bynpmrcAuthFileexists but cannot be read. The settings in such a file were ignored without any message. A.npmrcthat contains invalid UTF-8 is now read #5065.pnpm config setandpnpm config deletenow preserve comments and repeated keys such asca=in.npmrc#14851.pnpm loginnow logs back in to an existing user on registries without web login, such as verdaccio. The classic login request sends the username and password as basic auth, asnpm logindoes #12055.Commands that do not use the store no longer create a temporary file in the project directory when they load their settings. These include
pnpm view,pnpm config,pnpm root,pnpm bin,pnpm exec,pnpm run, the script shortcuts such aspnpm test, and the registry commands such aspnpm whoami,pnpm dist-tag, andpnpm search.pnpm exec,pnpm run, and the script shortcuts still create one in projects that declareconfigDependencies.Global packages, pnpm versions, and runtimes
Global commands such as
pnpm add --global,pnpm list --global, andpnpm bin --globalnow run with the pnpm you invoked, even in a project that pins another pnpm version. Previously, a pin withonFail: "download"switched them to the pinned pnpm, and a pinned pnpm 10 or older failed because its global bin directory was not inPATH#14531.pnpm add -g,pnpm update -g, andpnpm remove -gno longer fail withERR_PNPM_PACKAGE_MANIFEST_IO_ERRORwhen another global package's link into the store dangles, for example after the store was pruned. The pnpm install script failed the same way on such a machine.pnpm update --globalnow skips a global package installed from afile:path that no longer exists, prints a warning, and updates the remaining global packages. Previously the whole update failed withERR_PNPM_LINKED_PKG_DIR_NOT_FOUND#12533.pnpm self-updaterun in a project that pins pnpm throughpackageManagerordevEngines.packageManagernow also updates the global pnpm, as it does outside a project #14747.pnpm self-updateno longer leaves the previous pnpm in the global packages when it was installed as@pnpm/exe.pnpm ls -gnow lists a single pnpm #14709.pnpm setupnow installs pnpm under the package namepnpmtoo, so both commands leave the same shims in the global bin directory. After a self-update on Windows, PowerShell ran pnpm throughpnpm.cmdand asked "Terminate batch job (Y/N)?" on Ctrl+C #15567.pnpm setupfailed withText file busy (os error 26)when$PNPM_HOME/binalready heldpn,pnpx, orpnxas links to the running pnpm executable. It now replaces those files and completes #15494.pnpm setupno longer deletes aliases and other lines that sit between a# pnpmcomment and the pnpm block in a shell startup file #7067.When pnpm switches to the version a project pins, the
minimumReleaseAgeapprovals for that version are now added tominimumReleaseAgeExcludein the project'spnpm-workspace.yaml. A project without that file gets one. Global commands leave the project's settings unchanged #15396.pnpm env removenow cleans up dangling Node.js executables and shims. Surviving global commands remain intact.Node.js runtime resolution now supports Windows ARM64. Node.js 20 and newer resolve native
win-arm64builds, and older versions fall back towin-x64under emulation #7123.Windows and WSL
On Windows,
pnpm cleanand installs no longer fail immediately when another process uses a package innode_modules. pnpm waits up to a minute for an open file. It waits up to 5 seconds for a running program #15081.pnpm installin WSL now waits out Windows file locks on a Windows drive such as/mnt/c, as it already does on Windows. Before, an antivirus or indexer scan holding a file open could fail the install withEACCES#6155.On Windows, pnpm now retries saving
pnpm-lock.yamlfor up to a minute while another process holds the file open. The save used to fail at once withEPERM,EBUSY, or "Access is denied" #9461.pnpm now escapes trailing dots and spaces in
node_modules/.pnpmdirectory names. Windows strips these characters, so a dependency such as"parent-pkg": "file:../"created a directory that could not be deleted or failed to install #8101.On Windows, bin shims run from Git Bash, MSYS2, or Cygwin now pass
NODE_PATHto Node.js as Windows paths. A project installed from cmd or PowerShell gave its bins aNODE_PATHunder the Git install directory when they ran from Git Bash. Installing again replaces the shims already innode_modules#3360.Fixed scripts failing with errors such as
'an-compile' is not recognizedwhenscriptShellis set tocmd.exeon Windows #7181.On Windows, the error for a
node_modulesdirectory that pnpm cannot move out of the way now names the directory and says that a file in it is probably in use by another process #7505.Inspecting dependencies
pnpm auditandpnpm audit signaturesnow check only the dependencies of the projects selected by--filter,--filter-prod, or--workspace-root. The filter used to be ignored, so a filtered audit reported the whole workspace #10982.pnpm auditnow lists at least one dependency path from every workspace project that depends on a vulnerable package. Before, a project whose dependency was reached through more than 100 paths filled the path list, and other projects that depend on the same package were left out #12200.pnpm audit --fixnow prunes redundant overrides when one vulnerable range is a subset of another for the same package #8577.Running
pnpm listinside a workspace package without--recursiveor a filter now lists only the current package #14494.pnpm licenses listdoes the same. Use--recursiveor--filterto list the licenses of other workspace projects #5689.pnpm list --only-projectsnow prints every project selected with--filteror--recursive, including a project that has no workspace dependencies #9770. It also lists the workspace projects whensharedWorkspaceLockfileisfalse#7151, and a project that setspublishConfig.directory#10635. It no longer reports packages innode_modulesthat are missing from the lockfile #9528.pnpm licenses listfailed or reported nothing in a workspace withsharedWorkspaceLockfile: false. It now reads the lockfile of each selected project #10140.With
nodeLinker: hoisted,pnpm licenses listreported every license asUnknownand listed paths undernode_modules/.pnpmthat do not exist. It now reads each package from the directory where the hoisted linker placed it #8589.pnpm outdatedandpnpm -r outdatednow fail withERR_PNPM_NO_PACKAGE_IN_DEPENDENCIESwhen a requested package selector does not match any dependency in the inspected projects #2319.pnpm -r outdated --jsonnow includes every outdated workspace dependency when multiple projects depend on different versions or dependency types of the same package. Such a package is keyed by its current version and dependency type, for examplevue@2.7.14 (dev)#7693.pnpm sbomfiltered to a single workspace project now takes theauthor,description,license,repository, andbugsfields from the workspace rootpackage.jsonwhen the project does not declare them. A field the project declares is never taken from the root, even when it is blank ornull#14882.pnpm store statusno longer reports a package as modified when it has build or postinstall scripts, peer dependencies, or skipped optional dependencies #15383. When packages were mutated, it now lists only those packages and no longer suggests runningpnpm install --force#919.pnpm peers checkand theERR_PNPM_PEER_DEP_ISSUESerror now group peer dependency issues under the workspace project they were found in #15351.Output and messages
The error for an incompatible pnpm-lock.yaml now reports the lockfileVersion the file was generated with and the lockfileVersion the current pnpm supports #848.
When the registry stops sending data for longer than
fetchTimeout, pnpm now reports that the metadata or tarball request timed out. Previously the error did not mention the timeout #3646.Fatal peer dependency errors and their hints are now written to stderr #5419.
pnpm runwith--loglevelset towarn,error, orsilent(or the sameloglevelsetting) no longer prints the$ <command>line before a script, nor the summary of the install thatverifyDepsBeforeRunruns first. Both are info-level output #8944.pnpm runandpnpm execnow printNo projects matched the filters in "<workspace>"when--filterselects no project #8408.pnpm dedupenow counts each package reused from the store once in its progress output #15303.pnpm addnow warns when replacing an existing dependency with a specifier pointing to a different source #14869.pnpm linknow warns when linking a package that declares one or more peer dependencies, explaining that the linked dependency will not resolve peer dependencies from the targetnode_modulesand suggesting thefile:protocol instead.pnpm importnow warns when package.json lists projects in a "workspaces" array and there is no "pnpm-workspace.yaml". Without that file, the import writes a lockfile for the root project only #5240.Bash completion now completes script names that contain a colon, such as
pnpm run test:utopnpm run test:unit#5482.Platinum Sponsors
Gold Sponsors
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
920b422a1dto4b4f316207Update ghcr.io/immich-app/immich-machine-learning Docker tag to v3.2.4to Update all non-major dependencies to v3.2.44b4f316207to95234fb7fcUpdate all non-major dependencies to v3.2.4to Update all non-major dependencies95234fb7fcto8c65423f978c65423f97to37dd3bd0c037dd3bd0c0toc771d6b836View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.