Update dependency pnpm to v6.35.1 #664
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
6.17.2->6.35.1Release Notes
pnpm/pnpm (pnpm)
v6.35.1Compare Source
Patch Changes
.npmrcfiles in subdirectories inside a workspace #2570.v6.35.0Compare Source
Patch Changes
Installing a package with
binthat points to an.exefile on Windows #5159.Ignore the
always-authsetting.pnpm will never reuse the registry auth token for requesting the package tarball, if the package tarball is hosted on a different domain.
So, for example, if your registry is at
https://company.registry.com/but the tarballs are hosted athttps://tarballs.com/, then you will have to configure the auth token for both domains in your.npmrc:When an error happens during installation of a subdependency, print some context information in order to be able to locate that subdependency. Print the exact chain of packages that led to the problematic dependency.
v6.34.0Compare Source
Minor Changes
ignore-compatibility-dbis set totrue, the compatibility database will not be used to patch dependencies #5132.Full Changelog: pnpm/pnpm@v6.33.1...v6.34.0
v6.33.1Compare Source
Patch Changes
v6.33.0Compare Source
v6.32.25Compare Source
Patch Changes
pnpm audit --fixshould not add an override for a vulnerable package that has no fixes released.pnpm env useshould throw an error on a system that use the MUSL libc.v6.32.24Compare Source
Patch Changes
Don't crash when
pnpm update --interactiveis cancelled with Ctrl+c.The
use-node-versionsetting should work with prerelease Node.js versions. For instance:v6.32.23Compare Source
Patch Changes
v6.32.22Compare Source
Patch Changes
v6.32.21Compare Source
Patch Changes
v6.32.20Compare Source
Patch Changes
package.jsonfile #4822.v6.32.19Compare Source
Patch Changes
v6.32.18Compare Source
Patch Changes
auto-install-peersis set totrue#4796.NODE_ENV=production pnpm install --devshould only install dev deps #4745.Full Changelog: pnpm/pnpm@v6.32.17...v6.32.18
v6.32.17Compare Source
Patch Changes
v6.32.16Compare Source
Patch Changes
auto-install-peersis set totrue, automatically install missing peer dependencies without writing them topackage.jsonas dependencies. This makes pnpm handle peer dependencies the same way as npm v7 #4776.v6.32.15Compare Source
Patch Changes
pnpm setupshould not fail on Windows ifPNPM_HOMEis not yet in the system registry #4757pnpm dlxshouldn't modify the lockfile in the current working directory #4743.v6.32.14Compare Source
Patch Changes
node_modules/.pnpmand inside the global store #4716Full Changelog: pnpm/pnpm@v6.32.13...v6.32.14
v6.32.13Compare Source
Patch Changes
pnpm setupshould update the config of the current shell, not the preferred shell.pnpm dlxshould work with git-hosted packages. For example:pnpm dlx gengjiawen/envinfo#4714.pnpm setupshould not override the PNPM_HOME env variable on Windows, unless--forceis used.pnpm create <pkg>should be passed to the executed create app package. Sopnpm create next-app --typescriptshould work`.pnpm run --streamshould prefix the output with directory #4702Full Changelog: pnpm/pnpm@v6.32.12...v6.32.13
v6.32.12Compare Source
Patch Changes
pnpm dlxshould work when the bin name of the executed package isn't the same as the package name #4672.pnpm pruneworks in a workspace #4647.pnpm prunedoes not remove hoisted dependencies.pnpm dlxshould print messages about installation to stderr #1698.v6.32.11Compare Source
Patch Changes
pnpm publishshould work correctly in a workspace, when the latest npm CLI is installed #4348.node_modules/.ignoredsubfolder and a package with that name is already present in `node_modules/.ignored' #4626.v6.32.10Compare Source
Patch Changes
v6.32.9Compare Source
Patch Changes
Fix an error with peer resolutions, which was happening when there was a circular dependency and another dependency that had the name of the circular dependency as a substring.
When
pnpm execis running a command in a workspace project, the commands that are in the dependencies of that workspace project should be in the PATH #4481.Hide "WARN deprecated" messages on loglevel error #4507
Don't show the progress bar when loglevel is set to warn or error.
v6.32.8Compare Source
Patch Changes
v6.32.7Compare Source
Patch Changes
auto-install-peerstotrueshould work.v6.32.6Compare Source
Patch Changes
v6.32.5Compare Source
Patch Changes
dependenciesMetashould be saved into the lockfile, when it is added to the package manifest by a hook.v6.32.4Compare Source
Patch Changes
dependenciesMetafield in the manifest should be satisfied by a not set field in the lockfile #4463.package.json#4487.v6.32.3Compare Source
Patch Changes
4941f31: The location of an injected directory dependency should be correctly located, when there is a chain of local dependencies (declared via thefile:protocol`).The next scenario was not working prior to the fix. There are 3 projects in the same folder: foo, bar, qar.
foo/package.json:{ "name": "foo", "dependencies": { "bar": "file:../bar" }, "dependenciesMeta": { "bar": { "injected": true } } }bar/package.json:{ "name": "bar", "dependencies": { "qar": "file:../qar" }, "dependenciesMeta": { "qar": { "injected": true } } }qar/package.json:{ "name": "qar" }Related PR: #4415.
v6.32.2Compare Source
Patch Changes
pnpm installwhen the lockfile is broken andnode-linkeris set tohoisted#4387.v6.32.1Compare Source
Patch Changes
pnpm publishshould work correctly in a workspace, when the latest npm CLI is installed #4348.node_modules/.ignoredsubfolder and a package with that name is already present in `node_modules/.ignored' #4626.v6.32.0Compare Source
Minor Changes
A new setting is supported in the
pnpmsection of thepackage.jsonfile #4001.onlyBuiltDependenciesis an array of package names that are allowed to be executed during installation. If this field exists, only mentioned packages will be able to run install scripts.{ "pnpm": { "onlyBuiltDependencies": ["fsevents"] } }-Fis a short alias of--filter#3467.When adding a new dependency, use the version specifier from the overrides, when present #4313.
Normally, if the latest version of
foois2.0.0, thenpnpm add fooinstallsfoo@^2.0.0. This behavior changes iffoois specified in an override:{ "pnpm": { "overrides": { "foo": "1.0.0" } } }In this case,
pnpm add foowill addfoo@1.0.0to the dependency. However, if a version is explicitly specifying, then the specified version will be used and the override will be ignored. Sopnpm add foo@0will install v0 and it doesn't matter what is in the overrides.Patch Changes
*, just replace any range with*.v6.31.0Compare Source
Minor Changes
Added
--shell-mode/-coption support topnpm exec#4328--shell-mode: shell interpreter. See: https://github.com/sindresorhus/execa/tree/484f28de7c35da5150155e7a523cbb20de161a4f#shellUsage example:
{ "scripts": { "check": " pnpm -r --shell-mode exec -- echo \"\\$PNPM_PACKAGE_NAME\"" } }Patch Changes
publishConfigwhen thepackorpublishcommands are used #4311pnpx,pnpm dlx,pnpm create, andpnpm execcommands should set thenpm_config_user_agentenv variable #3985.v6.30.1Compare Source
Patch Changes
This fixes an issue introduced in pnpm v6.30.0.
When a package is not linked to
node_modules, no info message should be printed about it being "relinked" from the store #4314.v6.30.0Compare Source
Minor Changes
v6.29.2Compare Source
Patch Changes
node_modulesdirectories inside injected dependencies should not be overwritten #4299.v6.29.1Compare Source
Patch Changes
node_modules.v6.29.0Compare Source
Minor Changes
update-notifierconfiguration option #4158.Patch Changes
v6.28.0Compare Source
Minor Changes
embed-readme. Whenfalse,pnpm publishdoesn't save the readme file's content topackage.jsonbefore publish #4265.Patch Changes
pnpm execshould look for the executed command in thenode_modules/.bindirectory that is relative to the current working directory. Only after that should it look for the executable in the workspace root.v6.27.2Compare Source
Patch Changes
v6.27.1Compare Source
Patch Changes
peerDependencyRulesshould work when bothoverridesandpackageExtensionsare present as well #4255.pnpm listshould show information whether a package is private or not #4246.v6.27.0Compare Source
Minor Changes
Side effects cache is not an experimental feature anymore.
Side effects cache is saved separately for packages with different dependencies. So if
foohasbarin the dependencies, then a separate cache will be created each timefoois installed with a different version ofbar#4238.Patch Changes
devDependencies#4196.v6.26.1Compare Source
Patch Changes
node_modules. This was an issue only withnode-linker=hoisted#4229.v6.26.0Compare Source
Minor Changes
In order to mute some types of peer dependency warnings, a new section in
package.jsonmay be used for declaring peer dependency warning rules. For example, the next configuration will turn off any warnings about missingbabel-loaderpeer dependency and about@angular/common, when the wanted version of@angular/commonis not v13.{ "name": "foo", "version": "0.0.0", "pnpm": { "peerDependencyRules": { "ignoreMissing": ["babel-loader"], "allowedVersions": { "@​angular/common": "13" } } } }New setting supported:
auto-install-peers. When it is set totrue,pnpm add <pkg>automatically installs any missing peer dependencies asdevDependencies#4213.v6.25.1Compare Source
Patch Changes
v6.25.0Compare Source
Minor Changes
New installation mode added that creates a flat
node_modulesdirectory without the usage of symlinks. This is similar to the one created by npm and Yarn Classic.To use this new installation mode, set the
node-linkersetting tohoisted. These are the supported values ofnode-linker:isolated- the default value.hoisted- flatnode_moduleswithout symlinks.pnp- nonode_modules. Yarn's Plug'n'Play managed by pnpm.Related issue: #4073
Add support for token helper, a command line tool to obtain a token.
A token helper is an executable, set in the user's
.npmrcwhich outputs an auth token. This can be used in situations where the authToken is not a constant value, but is something that refreshes regularly, where a script or other tool can use an existing refresh token to obtain a new access token.The configuration for the path to the helper must be an absolute path, with no arguments. In order to be secure, it is only permitted to set this value in the user
.npmrc, otherwise a project could place a value in a project local.npmrcand run arbitrary executables.Usage example:
Related PRs:
New CLI option:
--ignore-workspace. When used, pnpm ignores any workspace configuration found in the current or parent directories.If
use-beta-cliistrue, then don't setnpm_config_argvenv variable for scripts #4175.v6.24.4Compare Source
Patch Changes
Don't throw an error during install when the bin of a dependency points to a path that doesn't exist #3763.
When reporting unmet peer dependency issues, if the peer dependency is resolved not from a dependency installed by the user, then print the name of the parent package that has the bad peer dependency installed as a dependency.
Injected subdependencies should be hard linked as well. So if
buttonis injected intocardandcardis injected intopage, then bothbuttonandcardshould be injected intopage#4167.v6.24.3Compare Source
Patch Changes
--frozen-lockfileshould not fail when the project has injected dependencies and a dedicated lockfile #4098.v6.24.2Compare Source
Patch Changes
If pnpm previously failed to install node when the
use-node-versionoption is set, that download and install will now be re-attempted when pnpm is ran again #4104.Don't warn about unmet peer dependency when the peer is resolved from a prerelease version #4144.
For instance, if a project has
react@*as a peer dependency, then react16.0.0-rc.0should not cause a warning.pnpm update pkgshould not fail ifpkgnot found as a direct dependency, unless--depth=0is passed as a CLI option #4122.When printing peer dependency issues, print the "*" range in double quotes. This will make it easier to copy the package resolutions and put them to the end of a
pnpm addcommand for execution.v6.24.1Compare Source
Patch Changes
pnpm publishshould add the content of theREADME.mdfile to thereadmefield of the published package'spackage.jsonfiles #4117.pnpm publishshould work with the--otpoption #4115.v6.24.0Compare Source
Minor Changes
Peer dependency issues are grouped and rendered in a nice hierarchy view.
This is how the peer dependency issues were printed in previous versions:
This is how they are displayed in pnpm v6.24:
New option added for:
node-mirror:<releaseDir>#4083. The string value of this dynamic option is used as the base URL for downloading node whenuse-node-versionis specified. The<releaseDir>portion of this argument can be any dir inhttps://nodejs.org/download. Which<releaseDir>dynamic config option gets selected depends on the value ofuse-node-version. If 'use-node-version' is a simplex.x.xversion string,<releaseDir>becomesreleaseandnode-mirror:releaseis read. Defaults tohttps://nodejs.org/download/<releaseDir>/.927c4a0: A new option--aggregate-outputforappend-onlyreporter is added. It aggregates lifecycle logs output for each command that is run in parallel, and only prints command logs when command is finished.Related discussion: #4070.
Patch Changes
Don't fail when the version of a package in the store is not a semver version #4077.
pnpm store pruneshould not fail if there are unexpected subdirectories in the content-addressable store #4072.Don't make unnecessary retries when fetching Git-hosted packages #2731.
pnpm should read the auth token of a github-registry-hosted package, when the registry path contains the owner #4034.
So this should work:
When
strict-peer-dependenciesis used, don't fail on the first peer dependency issue. Print all the peer dependency issues and then stop the installation process #4082.When sorting workspace projects, don't ignore the manifests of those that don't have a version field #3933.
v6.23.6Compare Source
Patch Changes
Fixes a regression introduced in pnpm v6.23.3 via #4044.
The temporary directory to which the Git-hosted package is downloaded should not be removed prematurely #4064.
v6.23.5Compare Source
Patch Changes
pnpm auditshould work when a proxy is configured for the registry #3755.v6.23.4Compare Source
Patch Changes
v6.23.3Compare Source
Patch Changes
pnpm importshould work with a lockfile generated by Yarn Berry #3993.v6.23.2Compare Source
Patch Changes
pnpm should read the auth token of a github-registry-hosted package, when the registry path contains the owner #4034.
So this should work:
When checking the correctness of the package data in the lockfile, don't use exact version comparison.
v1.0.0should be considered to be the same as1.0.0. This fixes some edge cases when a package is published with a non-normalized version specifier in itspackage.json#4036.v6.23.1Compare Source
Patch Changes
pnpm setupshould create shell rc files for pnpm path configuration if no such file exists prior #4027.pnpm dlxwill now support version specifiers for packages. E.g.pnpm dlx create-svelte@next#4023.v6.23.0Compare Source
Minor Changes
New setting added:
scripts-prepend-node-path. This setting can betrue,false, orwarn-only.When
true, the path to thenodeexecutable with which pnpm executed is prepended to thePATHof the scripts.When
warn-only, pnpm will print a warning if the scripts run with anodebinary that differs from thenodebinary executing the pnpm CLI.Patch Changes
nodeexecutable that executes pnpm should not be added to thePATH, when running scripts.pnpm env useshould download the right Node.js tarball on Raspberry Pi #4007.v6.22.2Compare Source
Patch Changes
pnpm execshould exit with the exit code of the child process. This fixes a regression introduced in pnpm v6.20.4 via #3951.node-gypfrom the dependencies should be preferred over thenode-gypthat is bundled with pnpm, when running scripts #2135.pnpm dlx pnpmshould not break the globally installed pnpm CLI.v6.22.1Compare Source
Patch Changes
Downgrading
p-memoizeto v4.0.1. pnpm v6.22.0 started to print the next warning #3989:v6.22.0Compare Source
Minor Changes
Added
--reverseoption support topnpm exec#3984.Usage example:
Patch Changes
peerDependenciesranges should be compared loosely #3753.v6.21.1Compare Source
Patch Changes
v6.21.0Compare Source
Minor Changes
pnpm:devPreinstall. This script works only in the rootpackage.jsonfile, only during local development, and runs before installation happens #3968.Patch Changes
v6.20.4Compare Source
Patch Changes
v6.20.3Compare Source
Patch Changes
dependenciesMetafields should be duplicated to the lockfile.v6.20.2Compare Source
Patch Changes
pnpm importshould be able to import a workspace lockfile #3908.pnpm env useshould use the network/proxy settings to make HTTP requests #3942.pnpm createandpnpm dlxshould work with scoped packages #3916.v6.20.1Compare Source
Patch Changes
Fix broken artifacts of
@pnpm/exe. This doesn't affect thepnpmpackage.Related issue: #3937. This was a bug introduced by #3896.
v6.20.0Compare Source
Minor Changes
New property supported via the
dependenciesMetafield ofpackage.json:injected. Wheninjectedis set totrue, the package will be hard linked tonode_modules, not symlinked #3915.For instance, the following
package.jsonin a workspace will create a symlink tobarin thenode_modulesdirectory offoo:{ "name": "foo", "dependencies": { "bar": "workspace:1.0.0" } }But what if
barhasreactin its peer dependencies? If all projects in the monorepo use the same version ofreact, then no problem. But what ifbaris required byfoothat usesreact16 andqarwithreact17? In the past, you'd have to choose a single version of react and install it as dev dependency ofbar. But now with theinjectedfield you can injectbarto a package, andbarwill be installed with thereactversion of that package.So this will be the
package.jsonoffoo:{ "name": "foo", "dependencies": { "bar": "workspace:1.0.0", "react": "16" }, "dependenciesMeta": { "bar": { "injected": true } } }barwill be hard linked into the dependencies offoo, andreact16 will be linked to the dependencies offoo/node_modules/bar.And this will be the
package.jsonofqar:{ "name": "qar", "dependencies": { "bar": "workspace:1.0.0", "react": "17" }, "dependenciesMeta": { "bar": { "injected": true } } }barwill be hard linked into the dependencies ofqar, andreact17 will be linked to the dependencies ofqar/node_modules/bar.Patch Changes
v6.19.1Compare Source
Patch Changes
v6.19.0Compare Source
Minor Changes
Package scope is optional when filtering by package name #3485.
So the next two commands will both find
@pnpm/core:However, if the workspace contains
@types/coreand@pnpm/core,--filter=corewill not work.Allow a system's package manager to override pnpm's default settings
Patch Changes
pnpm install --globalshould link global packages to specific Node.js versions only if Node.js was installed by pnpm #3910.pnpm store pathadded to the output ofpnpm store.v6.18.0Compare Source
Minor Changes
pnpm env use:pnpm env use -g latest
pnpm env use -g 16.0.0-rc.0
pnpm env use -g nightly
pnpm env use -g nightly/16
maxsockets: a new setting to configure the maximum number of connections to use per origin (protocol/host/post combination) #3889.Patch Changes
pnpm add ssh://git@example.com:foo/bar.git#3882.Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.