Update pnpm to v10 #1363
Open
Update pnpm to v10 #1363
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
|
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
9.14.4->10.2.0Release Notes
pnpm/pnpm (pnpm)
v10.2.0Compare Source
Minor Changes
Packages executed via
pnpm dlxandpnpm createare allowed to be built (run postinstall scripts) by default.If the packages executed by
dlxorcreatehave dependencies that have to be built, they should be listed via the--allow-buildflag. For instance, if you want to run a package calledbundlethat hasesbuildin dependencies and want to allowesbuildto run postinstall scripts, run:Related PR: #9026.
Patch Changes
pnpm deployfails to read the correctprojectIdwhen the deploy source is the same as the workspace directory #9001.overridesfrom adding invalid version ranges topeerDependenciesby keeping thepeerDependenciesand overriding them with proddependencies#8978.pnpm approve-builds.v10.1.0Compare Source
Minor Changes
pnpm ignored-builds#8963.pnpm approve-builds#8963.optimistic-repeat-install. When enabled, a fast check will be performed before proceeding to installation. This way a repeat install or an install on a project with everything up-to-date becomes a lot faster. But some edge cases might arise, so we keep it disabled by default for now #8977.Patch Changes
pnpm install, thepreprepareandpostpreparescripts of the project should be executed #8989.workspace:andcatalog:to be part of wider version range inpeerDependencies.pnpm deployshould inherit thepnpmobject from the rootpackage.json#8991.node_modulesin a sub-project of a monorepo is detected as out-of-date #8959.pnpmto execute other scripts duringpnpm installwithverify-deps-before-run=install#8954.strip-ansiwith the built-inutil.stripVTControlCharacters#9009.v10.0.0Compare Source
Major Changes
Lifecycle scripts of dependencies are not executed during installation by default! This is a breaking change aimed at increasing security. In order to allow lifecycle scripts of specific dependencies, they should be listed in the
pnpm.onlyBuiltDependenciesfield ofpackage.json#8897. For example:{ "pnpm": { "onlyBuiltDependencies": ["fsevents"] } }pnpm linkbehavior updated:The
pnpm linkcommand now adds overrides to the rootpackage.json.pnpm linkfrom the package’s directory. Previously, you needed to usepnpm link -g.Related PR: #8653
Secure hashing with SHA256:
Various hashing algorithms have been updated to SHA256 for enhanced security and consistency:
node_modules/.pnpmare now hashed with SHA256.packageExtensionsChecksumfield ofpnpm-lock.yamlis now SHA256.Configuration updates:
manage-package-manager-versions: enabled by default. pnpm now manages its own version based on thepackageManagerfield inpackage.jsonby default.public-hoist-pattern: nothing is hoisted by default. Packages containingeslintorprettierin their name are no longer hoisted to the root ofnode_modules. Related Issue: #8378Upgraded
@yarnpkg/extensionsto v2.0.3. This may alter your lockfile.virtual-store-dir-max-length: the default value on Windows has been reduced to 60 characters.Reduced environment variables for scripts:
During script execution, fewer
npm_package_*environment variables are set. Onlyname,version,bin,engines, andconfigremain.Related Issue: #8552
All dependencies are now installed even if
NODE_ENV=production. Related Issue: #8827Changes to the global store:
Store version bumped to v10.
Some registries allow identical content to be published under different package names or versions. To accommodate this, index files in the store are now stored using both the content hash and package identifier.
This approach ensures that we can:
Related PR: #8510
Related Issue: #8204
More efficient side effects indexing. The structure of index files in the store has changed. Side effects are now tracked more efficiently by listing only file differences rather than all files.
Related PR: #8636
A new
indexdirectory stores package content mappings. Previously, these files were infiles.Other breaking changes:
#character is now escaped in directory names withinnode_modules/.pnpm.Related PR: #8557
pnpm add --global pnpmorpnpm add --global @​pnpm/exenow fails with an error message, directing you to usepnpm self-updateinstead.Related PR: #8728
Related Issue: #8833
pnpm deploycommand now only works in workspaces that haveinject-workspace-packages=true. This limitation is introduced to allow us to create a proper lockfile for the deployed project using the workspace lockfile.pnpm testnow passes all parameters after thetestkeyword directly to the underlying script. This matches the behavior ofpnpm run test. Previously you needed to use the--prefix.Related PR: #8619
node-gypupdated to version 11.pnpm deploynow tries creating a dedicated lockfile from a shared lockfile for deployment. It will fallback to deployment without a lockfile if there is no shared lockfile orforce-legacy-deployis set totrue.Minor Changes
Added support for a new type of dependencies called "configurational dependencies". These dependencies are installed before all the other types of dependencies (before "dependencies", "devDependencies", "optionalDependencies").
Configurational dependencies cannot have dependencies of their own or lifecycle scripts. They should be added using exact version and the integrity checksum. Example:
{ "pnpm": { "configDependencies": { "my-configs": "1.0.0+sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==" } } }Related RFC: #8.
Related PR: #8915.
New settings:
New
verify-deps-before-runsetting. This setting controls howpnpmchecksnode_modulesbefore running scripts:install: Automatically runpnpm installifnode_modulesis outdated.warn: Print a warning ifnode_modulesis outdated.prompt: Prompt the user to confirm runningpnpm installifnode_modulesis outdated.error: Throw an error ifnode_modulesis outdated.false: Disable dependency checks.Related Issue: #8585
New
inject-workspace-packagessetting enables hard-linking all local workspace dependencies instead of symlinking them. Previously, this could be achieved usingdependenciesMeta[].injected, which remains supported.Related PR: #8836
Faster repeat installs:
On repeated installs,
pnpmperforms a quick check to ensurenode_modulesis up to date.Related PR: #8838
pnpm addintegrates with default workspace catalog:When adding a dependency,
pnpm addchecks the default workspace catalog. If the dependency and version requirement match the catalog,pnpm adduses thecatalog:protocol. Without a specified version, it matches the catalog’s version. If it doesn’t match, it falls back to standard behavior.Related Issue: #8640
pnpm dlxnow resolves packages to their exact versions and uses these exact versions for cache keys. This ensurespnpm dlxalways installs the latest requested packages.Related PR: #8811
No
node_modulesvalidation on certain commands. Commands that should not modifynode_modules(e.g.,pnpm install --lockfile-only) no longer validate or purgenode_modules.Related PR: #8657
v9.15.5: pnpm 9.15.5Compare Source
Patch Changes
pnpm install, thepreprepareandpostpreparescripts of the project should be executed #8989.strip-ansiwith the built-inutil.stripVTControlCharacters#9009.Platinum Sponsors
Gold Sponsors
v9.15.4: pnpm 9.15.4Compare Source
Patch Changes
pnpm update --latest <pkg>updates only the specified package, withdedupe-peer-dependents=true.Platinum Sponsors
Gold Sponsors
v9.15.3Compare Source
v9.15.2: pnpm 9.15.2Compare Source
Patch Changes
publish/packerror with workspace dependencies with relative paths #8904. It was broken inv9.4.0(398472c).pnpm patchon Windows #7546.git ls-remoteworks via HTTPS #8906.Platinum Sponsors
Gold Sponsors
v9.15.1Compare Source
v9.15.0Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.