chore(deps): update pnpm to v8 #3
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
|
|
New dependency changes detected. Learn more about Socket for GitHub ↗︎ 🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again. Bot CommandsTo ignore an alert, reply with a comment starting with
📜 Install scriptsInstall scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts. Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
Pull request alert summary
📊 Modified Dependency Overview:
🚮 Removed packages: @sxzz/[email protected], @sxzz/[email protected], [email protected] |
This PR contains the following updates:
7.12.2->8.5.1Release Notes
pnpm/pnpm
v8.5.1Compare Source
Patch Changes
package.jsonfile(s), print out what are the differences #6536.Our Gold Sponsors
Our Silver Sponsors
v8.5.0Compare Source
Minor Changes
pnpm patch-removecommand added #6521.Patch Changes
pnpm link -g <pkg-name>should not modify thepackage.jsonfile #4341.node_modulesdirectory #6510.enginesfield should match prerelease versions #6509.Our Gold Sponsors
Our Silver Sponsors
v8.4.0Compare Source
Minor Changes
pnpm publishsupports the--provenanceCLI option #6435.Patch Changes
node-linkeris set tohoisted6486.node_modulesdirectory unless the--forceoption is passed.node_modulesfolder with a.modules.yamlfile if there are no dependencies insidenode_modules.Our Gold Sponsors
Our Silver Sponsors
v8.3.1Compare Source
Patch Changes
node-fetchto fix an error that happens on Node.js 20 #6424.Our Gold Sponsors
Our Silver Sponsors
v8.3.0Compare Source
Minor Changes
pnpm packcommand using thepack-gzip-levelsetting #6393.--checkflag topnpm dedupe. No changes will be made tonode_modulesor the lockfile. Exits with a non-zero status code if changes are possible.pnpm install --resolution-onlyre-runs resolution to print out any peer dependency issues #6411.Patch Changes
publishConfig.directoryof an injected workspace dependency does not exist #6396.Our Gold Sponsors
Our Silver Sponsors
v8.2.0Compare Source
Minor Changes
.npmrc. This is a convention used by Yarn too.Using
${NAME-fallback}will returnfallbackifNAMEisn't set.${NAME:-fallback}will returnfallbackifNAMEisn't set, or is an empty string #6018.Patch Changes
-gto mismatch registries error info when original command has-goption #6224.pnpm config get <key>should print boolean values #6360link:protocol inpackage.json#6372Our Gold Sponsors
Our Silver Sponsors
v8.1.1Compare Source
Patch Changes
@yarnpkg/shellto fix issues in the shell emulator #6320.@character #6332.preResolutionhook.Our Gold Sponsors
Our Silver Sponsors
v8.1.0Compare Source
Minor Changes
dedupe-direct-deps, which is disabled by default. When set totrue, dependencies that are already symlinked to the rootnode_modulesdirectory of the workspace will not be symlinked to subprojectnode_modulesdirectories. This feature was enabled by default in v8.0.0 but caused issues, so it's best to disable it by default #6299.ignore-workspace-cyclesto silence workspace cycle warning #6308.Patch Changes
Our Gold Sponsors
Our Silver Sponsors
v8.0.0Compare Source
We are excited to announce the latest release of pnpm! To install it, check the installation page.
Major Changes
Node.js 14 Support Discontinued
If you still require Node.js 14, don't worry. We ship pnpm bundled with Node.js. This means that regardless of which Node.js version you've installed, pnpm will operate using the necessary Node.js runtime. For this to work you need to install pnpm either using the standalone script or install the
@pnpm/exepackage.Configuration Updates
auto-install-peers: enabled by default.dedupe-peer-dependents: enabled by default.resolve-peers-from-workspace-root: enabled by default.save-workspace-protocol: set torollingby default.resolution-mode: set tolowest-directby default.publishConfig.linkDirectory: enabled by default.Most of the configuration changes are related to peer dependencies. Most of these settings were implemented long ago, and we recommended them to users encountering peer dependency issues. The recently added
dedupe-peer-dependentsresolved many such problems. With these new defaults, pnpm will face significantly fewer issues during migration from other package managers.Lockfile Modifications
importerssection. The newpnpm-lock.yamlfile is more resistant to git merge conflicts!resolutionobject inpnpm-lock.yaml.Other Changes
filesfield in thepackage.json, only the files that are listed in it will be deployed. The same logic is applied when injecting packages. This behaviour can be changed by setting thedeploy-all-filessetting totrue(Related issue #5911).Migration Instructions
Before updating pnpm to v8 in your CI, regenerate your
pnpm-lock.yaml. To upgrade your lockfile, runpnpm installand commit the changes. Existing dependencies will not be updated; however, due to configuration changes in pnpm v8, some missing peer dependencies may be added to the lockfile and some packages may get deduplicated.You can commit the new lockfile even before upgrading Node.js in the CI, as pnpm v7 already supports the new lockfile format.
pnpm v7 Support
pnpm v7 will likely not receive any new features, but it will continue to get bug fixes for a few months and vulnerability fixes for at least a year.
Our Gold Sponsors
Our Silver Sponsors
v7.32.4Compare Source
Patch Changes
pnpm link -g <pkg-name>should not modify thepackage.jsonfile #4341.enginesfield should match prerelease versions #6509.pnpm publish --otpshould work #6514.Our Gold Sponsors
Our Silver Sponsors
v7.32.3Compare Source
Patch Changes
node-linkeris set tohoisted6486.Our Gold Sponsors
Our Silver Sponsors
v7.32.2Compare Source
Patch Changes
Our Gold Sponsors
Our Silver Sponsors
v7.32.1Compare Source
Patch Changes
publishConfig.directoryof an injected workspace dependency does not exist #6396.Our Gold Sponsors
Our Silver Sponsors
v7.32.0Compare Source
Minor Changes
.npmrc. This is a convention used by Yarn too.Using
${NAME-fallback}will returnfallbackifNAMEisn't set.${NAME:-fallback}will returnfallbackifNAMEisn't set, or is an empty string #6018.Patch Changes
pnpm config get <key>returns empty when the value is a booleanlink:protocol inpackage.json.Our Gold Sponsors
Configuration
📅 Schedule: Branch creation - "before 3am on Monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.