ci(deps): update ci dependencies #354
No reviewers
Labels
No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
projects/events-cash-register!354
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate-ci"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v2026.10.14.1→v2026.10.16.1v2026.10.14.1→v2026.10.16.1v1.11.13→v1.11.1412.11.2→12.13.012.14.02.11.7→2.11.82.11.92.11.7→2.11.82.11.9Release Notes
projects/forgejo-agent (https://git.zarantonello.dev/projects/forgejo-agent)
v1.11.14Compare Source
Bug Fixes
pnpm/pnpm (pnpm)
v12.13.0: pnpm 12.13.0Compare Source
This release adds the
pnpm profileandpnpm tokencommands, thestoreIndexFormat: filessetting for stores shared over a network filesystem, and faster Python dependency resolution.Minor Changes
Added the
pnpm profilecommand to view and update registry user profile settings.Added
pnpm tokento list, create, and revoke authentication tokens on the registry.Added the
storeIndexFormatsetting. Set it tofilesto keep a store's package index as one file per package instead of the SQLiteindex.db, for a store on a network filesystem that several machines use at once. SQLite's locking does not work across machines, so concurrent installs on such a store could corruptindex.db.Added the
nodePackageMapsetting, which groups the package-map settings.nodePackageMap.mode: write-onlywritesnode_modules/.package-map.jsonfor other tools without making Node.js load it.mode: loadalso makes Node.js load the map, likenodeExperimentalPackageMap: true.nodePackageMap.typereplacesnodePackageMapType. The old settings still work #14937.Patch Changes
Setting up pnpm
pnpm setupnow works when pnpm was installed with npm on macOS. It installed pnpm from npm'sbindirectory and left a$PNPM_HOME/bin/pnpmthat could not run #16855.pnpm runs again after
pnpm setupwhenglobalShimsenables pnpm. Every command failed with "the global target of the pnpm shim points back at the shim" #16874.A pnpm built for the MinGW target on Windows, such as the MSYS2 package, now installs the MinGW Rust toolchain that
rust-toolchain.tomlnames. It used to install the MSVC toolchain.Installing packages
On macOS,
pnpm installno longer fails withERR_PNPM_LOCKFILE_WRITE_FILEwhen the project is on a virtiofs or SMB share. pnpm now falls back to a regularfsyncwhen the file system rejects a full sync #16846.On macOS,
pnpm install,pnpm patch-commit, and other commands that load a pnpmfile no longer hang at random.pnpm installnow puts the executables of a Python build backend's requirements on thePATHwhile the backend runs. Projects built withuv_buildnow install. Before, they failed with "uv-build was not properly installed".Removing a
link:dependency now also removes its symlink fromnode_moduleswhennodeLinkerishoisted#16884.pnpm-lock.yamlno longer records the tarball URL of a package installed from a scoped registry, such as one set by@types:registry=, when pnpm can rebuild the URL from that registry #16866.Packing, auditing, and pipelines
pnpm packandpnpm publishnow pack onlypackage.json, the README, the license, and the files named inmainandbinwhenfilesis an empty array. They used to pack every file in the package #16889.pnpm auditandpnpm audit signaturesno longer check runtimes installed throughdevEngines.runtime, such asnode@runtime:24.21.0, against the npm package of the same name.pnpm audit signaturesreported these runtimes as having an invalid registry signature #16869.pnpm pipelinenow runs the root's tasks whenpnpm-workspace.yamllists only the root inpackagesor omitspackages, aspnpm -r rundoes. A change to a root file in such a workspace no longer triggers a full-run warning. When a full run has no projects to run,pnpm pipelinenow reports that no projects are selected #16849.Performance
pnpm installresolves Python dependencies faster. With--lockfile-only, a project with 10 dependencies now resolves in about 4 seconds, down from about 40. When the index publishes a metadata file beside each wheel (PEP 658), as PyPI does, pnpm downloads only the wheels of the releases it selects.A repeat install against an existing lockfile no longer reads registry metadata for the dependencies it takes from that lockfile. On a warm store this removes thousands of metadata lookups from a repeat install of a large workspace.
pnpm installwithenableModulesDir: falsenow verifies the packages already in the store while the dependencies resolve, and checks a package's files in parallel. On a 5,100-package install with the store on a network filesystem, this removed a 19-second pause between resolution and fetching.Platinum Sponsors
Gold Sponsors
v12.12.1: pnpm 12.12.1Compare Source
This release adds OIDC authentication to
pnpm dist-tagand thetool:protocol.pnpm publishnow checks which registry anNPM_ID_TOKENwas issued for before using it.Patch Changes
pnpm publishnow uses anNPM_ID_TOKENonly if itsaudclaim matches the selected registry, such asnpm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.pnpm dist-tag add,rm, andlsnow support OIDC authentication in CI. Enable "Allow npm dist-tag" in the package's trusted publishing settings to manage tags without a stored npm token.Added the
tool:protocol for the tools pnpm downloads itself: Node.js, Bun, Deno, and Yarn.pnpm add bun@tool:1.3.0,pnx node@tool:22, andpnx yarn@tool:4work like theruntime:spelling, which stays supported as an alias. A lockfile written forruntime:stays up to date whenpackage.jsonswitches totool:, and the other way around.A named registry can no longer be called
tool.Platinum Sponsors
Gold Sponsors
v12.12.0: pnpm 12.12.0Compare Source
This release shares task results and dependency builds through a remote cache, adds the
addMissingPeerTypessetting, and letspnpm add --configandpnpm updatemanage configuration dependencies. It also fixesdangerouslyAllowAllBuildsrunning the build scripts of packages thatallowBuildsdenies.Minor Changes
pnpm pipelinecan share task results between machines. A result is a signed artifact stored on a pnpr server or on a server that speaks the Turborepo Remote Cache API, such as Vercel Remote Cache.The remote side-effects cache can also store dependency builds on a Turborepo Remote Cache server. Both caches read the new
remoteCachesetting, which names the server and holds the signing keys.pnpm pipeline --reportrecords the run under the organizationremoteCache.orgnames.Added the
addMissingPeerTypessetting, which links the@typespackage of a peer dependency next to every package that peer-depends on it. For example, a package that peer-depends onreactgets the project's@types/reactlinked next to it. This lets TypeScript find the types of a peer dependency when the global virtual store is on #15689.pnpm add --configandpnpm updatenow handle configuration dependencies the way they handle other dependencies #16814.pnpm add --configsaves a version range inpnpm-workspace.yamlby the same rules aspnpm add, sopnpm add --config my-config@latestsaves a range such as^1.2.0. It also resolves the package again whenpnpm-lock.yamlalready locks an older version.pnpm updateupdates configuration dependencies within their ranges, andpnpm update --latestmoves them to their latest version. A selector such aspnpm update my-configupdates only the configuration dependencies it names.Patch Changes
A package set to
falseinallowBuildsno longer runs its build scripts whendangerouslyAllowAllBuildsistrue. The two settings together now allow every build except the denied ones. Previously,dangerouslyAllowAllBuildsignored the denials.pnpm now switches to the pnpm version a project pins even when it cannot read its configuration. Previously, a setting it rejected in the global config file, an
.npmrcfile, or_auth, or apnpm-workspace.yamlit could not parse, stopped every command,pnpm --versionincluded.pnpm updateandpnpm whyaccept--depth Infinityagain. They failed withinvalid value 'Infinity' for '--depth <DEPTH>'#16817.pnpm deploywithoutinjectWorkspacePackagesnow binds a peer dependency of a linked workspace package to the version its parent provides, as an injected install does. Previously the deploy failed withERR_PNPM_DEPLOY_AMBIGUOUS_PEERwhenever other packages in the deployed graph depended on different versions of that peer #16807.pnpm deploy --legacyno longer fails withERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVERwhen a workspace dependency of the deployed project declares aworkspace:peer dependency that the project does not depend on itself. pnpm now copies that peer from the workspace into the deploy directory.An auto-installed peer declared with
workspace:now always resolves to the workspace project. Previously,workspace:*andworkspace:^1.0.0peers could be installed from the registry #16806.Repeat installs no longer resolve again when an injected workspace package lists a dependency also as a peer dependency.
Sped up frozen installs of unchanged injected workspace packages that use hardlinks.
Sped up workspace discovery with subtree exclusions such as
!generated/**.A key under a registry URL in the
_authsetting that does not start with@is now skipped with a warning, so a field a later pnpm version adds there no longer breaks this one. A key that holds anauthTokenobject but lacks its@, such asorgfor@org, is still an error.Platinum Sponsors
Gold Sponsors
vercel/turborepo (turbo)
v2.11.8: Turborepo v2.11.8Compare Source
What's Changed
Changelog
add-package-namescodemod from generating duplicate names by @irontaek in #14433New Contributors
Full Changelog: https://github.com/vercel/turborepo/compare/v2.11.7...v2.11.8
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.