Skip to content

chore(deps): lock file maintenance npm packages #98

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): lock file maintenance npm packages #98

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 9, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change Age Adoption Passing Confidence
lockFileMaintenance All locks refreshed
pnpm (source) packageManager minor 10.12.1 -> 10.14.0 age adoption passing confidence
rolldown (source) dependencies patch 1.0.0-beta.27 -> 1.0.0-beta.32 age adoption passing confidence

🔧 This Pull Request updates lock files to use the latest dependency versions.

Release Notes

pnpm/pnpm (pnpm)

v10.14.0

Compare Source

Minor Changes

  • Added support for JavaScript runtime resolution

    Declare Node.js, Deno, or Bun in devEngines.runtime (inside package.json) and let pnpm download and pin it automatically.

    Usage example:

    {
  "devEngines": {
    "runtime": {
      "name": "node",
      "version": "^24.4.0",
      "onFail": "download" (we only support the "download" value for now)
    }
  }
}

    How it works:

    1. pnpm install resolves your specified range to the latest matching runtime version.
    2. The exact version (and checksum) is saved in the lockfile.
    3. Scripts use the local runtime, ensuring consistency across environments.

    Why this is better:

    1. This new setting supports also Deno and Bun (vs. our Node-only settings useNodeVersion and executionEnv.nodeVersion)
    2. Supports version ranges (not just a fixed version).
    3. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity.
    4. It can be used on any workspace project (like executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.
    5. For now devEngines.runtime setting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.

    Related PR: #​9755.

  • Add --cpu, --libc, and --os to pnpm install, pnpm add, and pnpm dlx to customize supportedArchitectures via the CLI #​7510.

Patch Changes
  • Fix a bug in which pnpm add downloads packages whose libc differ from pnpm.supportedArchitectures.libc.
  • The integrities of the downloaded Node.js artifacts are verified #​9750.
  • Allow dlx to parse CLI flags and options between the dlx command and the command to run or between the dlx command and -- #​9719.
  • pnpm install --prod should removing hoisted dev dependencies #​9782.
  • Fix an edge case bug causing local tarballs to not re-link into the virtual store. This bug would happen when changing the contents of the tarball without renaming the file and running a filtered install.
  • Fix a bug causing pnpm install to incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.

v10.13.1

Compare Source

Patch Changes
  • Run user defined pnpmfiles after pnpmfiles of plugins.

v10.13.0

Compare Source

Minor Changes

  • Added the possibility to load multiple pnpmfiles. The pnpmfile setting can now accept a list of pnpmfile locations #​9702.

  • pnpm will now automatically load the pnpmfile.cjs file from any config dependency named @pnpm/plugin-* or pnpm-plugin-* #​9729.

    The order in which config dependencies are initialized should not matter — they are initialized in alphabetical order. If a specific order is needed, the paths to the pnpmfile.cjs files in the config dependencies can be explicitly listed using the pnpmfile setting in pnpm-workspace.yaml.

Patch Changes
  • When patching dependencies installed via pkg.pr.new, treat them as Git tarball URLs #​9694.
  • Prevent conflicts between local projects' config and the global config in dangerouslyAllowAllBuilds, onlyBuiltDependencies, onlyBuiltDependenciesFile, and neverBuiltDependencies #​9628.
  • Sort keys in pnpm-workspace.yaml with deep #​9701.
  • The pnpm rebuild command should not add pkgs included in ignoredBuiltDependencies to ignoredBuilds in node_modules/.modules.yaml #​9338.
  • Replaced shell-quote with shlex for quoting command arguments #​9381.

v10.12.4

Compare Source

Patch Changes

v10.12.3

Compare Source

Patch Changes
  • Restore hoisting of optional peer dependencies when installing with an outdated lockfile.
    Regression introduced in v10.12.2 by #​9648; resolves #​9685.

v10.12.2

Compare Source

Patch Changes
  • Fixed hoisting with enableGlobalVirtualStore set to true #​9648.
  • Fix the --help and -h flags not working as expected for the pnpm create command.
  • The dependency package path output by the pnpm licenses list --json command is incorrect.
  • Fix a bug in which pnpm deploy fails due to overridden dependencies having peer dependencies causing ERR_PNPM_OUTDATED_LOCKFILE #​9595.
rolldown/rolldown (rolldown)

v1.0.0-beta.32

Compare Source

💥 BREAKING CHANGES
🚀 Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
⚡ Performance
🧪 Testing
⚙️ Miscellaneous Tasks

v1.0.0-beta.31

Compare Source

🚀 Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
🧪 Testing
⚙️ Miscellaneous Tasks
❤️ New Contributors

v1.0.0-beta.30

Compare Source

💥 BREAKING CHANGES
🚀 Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
⚡ Performance
🧪 Testing
⚙️ Miscellaneous Tasks

v1.0.0-beta.29

Compare Source

🚀 Features
🐛 Bug Fixes

Configuration

📅 Schedule: Branch creation - "before 10am" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-packages branch from be75965 to df3df6a Compare June 10, 2025 11:50
@renovate renovate bot changed the title chore(deps): lock file maintenance chore(deps): lock file maintenance npm packages Jun 10, 2025
@renovate renovate bot force-pushed the renovate/npm-packages branch 3 times, most recently from d48fdf6 to a031094 Compare June 17, 2025 16:58
@renovate renovate bot force-pushed the renovate/npm-packages branch 7 times, most recently from ff3fdcb to b83b58a Compare June 25, 2025 18:02
@renovate renovate bot force-pushed the renovate/npm-packages branch 5 times, most recently from 6814583 to 301d40d Compare July 1, 2025 13:31
@renovate renovate bot force-pushed the renovate/npm-packages branch 6 times, most recently from 1af01b2 to 67f52e9 Compare July 12, 2025 06:17
@renovate renovate bot force-pushed the renovate/npm-packages branch 4 times, most recently from 35f3d34 to 1f59a32 Compare July 17, 2025 20:33
@renovate renovate bot force-pushed the renovate/npm-packages branch 3 times, most recently from 5893bd6 to 91cceb9 Compare July 22, 2025 08:40
@renovate renovate bot force-pushed the renovate/npm-packages branch 7 times, most recently from 35645d7 to 0a206b6 Compare August 11, 2025 10:32
@renovate renovate bot force-pushed the renovate/npm-packages branch from 0a206b6 to 277e327 Compare August 13, 2025 16:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants