Skip to content

chore(deps): update all non-major dependencies - #70

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#70
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@vitest/coverage-v8 (source) 5.0.3 → 5.1.0 age confidence
pnpm (source) 12.9.1 → 12.16.1 age confidence
vitest (source) 5.0.3 → 5.1.0 age confidence

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v5.1.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v5.0.5

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v5.0.4

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
pnpm/pnpm (pnpm)

v12.16.1: pnpm 12.16.1

Compare Source

This release fixes pnpm install hanging on a cold store in workspaces that install Cargo crates, and pnpm pack shipping a file that files excludes by name.

Patch Changes

  • pnpm install no longer hangs on a cold store in a workspace that also installs Cargo crates or a Rust toolchain.

  • pnpm pack and pnpm publish now apply a files entry that names a file after the glob and directory entries, as npm does. A file excluded by name, such as !dist/index.js, stays out even when a later dist/** matches it. A file named by its path, such as lib/secret.js, ships even when a later !lib/*.js matches it.

  • pnpm install no longer leaves a broken symlink in an injected workspace dependency when the package links to a file outside its published files and pnpm imports by hardlink. Installing a git dependency now skips internal directory symlinks when importing its files into the store.

  • pnpm install now relinks a command that a workspace project renames into the projects that depend on it when sharedWorkspaceLockfile is false pnpm/tasks#224.

  • pnpm install and pnpm rebuild now refresh privately hoisted .bin shims in node_modules/.pnpm/node_modules/.bin after a dependency build replaces a script target with a native executable #​17402.

  • pnpm install now reads a package's manifest to decide its peer dependencies when it updates an existing lockfile, as it does when it resolves from scratch.

  • Commands, pnpm --version, pnpm self-update, and invocations with unknown flags now apply the same packageManager and devEngines.packageManager settings when switching to the pinned pnpm version or recording it in pnpm-lock.yaml. --config.<key> flags and lockfileDir now reach the version switch and lockfile sync on every entry point. Unreadable settings in pnpm-workspace.yaml or the global config.yaml that do not affect the pin decision no longer block the version switch pnpm/tasks#222.

  • pnpm now accepts the --cache-dir <dir> flag, as in pnpm install --cache-dir /tmp/pnpm-cache #​17422.

  • When the version or range given to pnpm unpublish matches every published version, the error now says so and shows the same command with --force. Before, the error suggested running pnpm unpublish <pkg>@<version>, the command that had just failed.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.16.0: pnpm 12.16

Compare Source

This release adds a global --env-file flag, updates to a symlinked pnpm-lock.yaml, and pnpm setup --no-modify-path. It also fixes two security issues, in zstd decompression and in signing.

Minor Changes

  • Added a repeatable global --env-file <path> flag to load environment variables from dotenv-style files before running a command. Later files override earlier files, variables already in the environment are preserved, and loaded variables are visible to user-level .npmrc interpolation and lifecycle scripts #​7111.

  • pnpm can now update a pnpm-lock.yaml that is a symlink. List the directories the lockfile may link into in the symlinkedLockfileTargetDirs setting, in the global config or with PNPM_CONFIG_SYMLINKED_LOCKFILE_TARGET_DIRS. pnpm writes the update to the file the symlink points to if that file is inside one of these directories. The symlink stays in place. pnpm ignores this setting in pnpm-workspace.yaml #​17222.

  • Added a --no-modify-path option to pnpm setup. It installs pnpm without adding it to PATH, leaving the shell config file, the Windows registry, and the GitHub Actions environment files unchanged. pnpm setup then prints the lines to add yourself get.pnpm.io#37.

Patch Changes
Security

  • Fixed memory exposure and allocation handling vulnerabilities when processing zstd-compressed data #​17388.

  • Signing in pnpm and pnpr no longer uses arithmetic that may leak the private key through timing. This covers shared artifacts, OCI registry tokens, and OIDC login state advisory.

Installing packages

  • A dependency symlink that pnpm cannot point at the wanted target now fails the install with an error that names the link. This happens when the filesystem still serves the old link after pnpm removed it, as a node_modules served by a virtual filesystem does. pnpm used to remove the link again without end and crashed with a segmentation fault once the thread ran out of stack.

  • Concurrent workspace installs no longer lose store-index rows when initializing the shared SQLite index #​17388.

  • Agent skill links now keep the same target across installs when a package version is installed with several sets of peer dependencies. An install no longer fails with ERR_PNPM_AGENT_SKILL_PATH_OCCUPIED on a skill link that pnpm created for another of those copies #​17319.

  • pnpm now fails at once, without retrying, when a downloaded package archive contains a rejected entry path #​17205.

  • pnpm now builds a git-hosted dependency in every new location it links the dependency into, such as a new global virtual store slot or a fresh node_modules. When the side-effects cache holds the build output, pnpm restores it from there. Before, only the install that fetched the dependency built it. This also fixes dependencies that are already in the store #​17224.

  • Changes a preResolution hook makes to the lockfiles now take effect. The hook now also runs when pnpm installs from an up-to-date lockfile. An error thrown by the hook now fails the install.

  • A custom fetcher in the pnpmfile can now call fetchers.directory to fetch a package from a local directory. The call rejects with ERR_PNPM_TARBALL_INTEGRITY if the lockfile pins an archive integrity for the package. Previously, calling fetchers.directory failed with a TypeError.

  • packageImportMethod: copy now also applies to packages that have lifecycle scripts or patches. On a filesystem that supports block cloning, such as ReFS or a Dev Drive on Windows, these packages were cloned #​17195.

  • With nodeLinker: hoisted and autoInstallPeers: false, a package that workspa

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai

coderabbitai Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 06440daf-68c1-48d7-b0ad-3449cc06c9fb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@codecov

codecov Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.09%. Comparing base (3526f80) to head (9697585).

Additional details and impacted files 
@@             Coverage Diff             @@
##              main      #70      +/-   ##
===========================================
- Coverage   100.00%   99.09%   -0.91%     
===========================================
  Files            3        3              
  Lines          110      110              
  Branches        31       31              
===========================================
- Hits           110      109       -1     
- Misses           0        1       +1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 6a636be to 12dedda Compare October 10, 2026 16:39
@renovate renovate Bot changed the title chore(deps): update pnpm to v12.10.1 chore(deps): update pnpm to v12.11.2 Oct 10, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 12dedda to dc3c24f Compare October 12, 2026 09:57
@renovate renovate Bot changed the title chore(deps): update pnpm to v12.11.2 chore(deps): update all non-major dependencies Oct 12, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 7ff87f3 to 4211810 Compare October 22, 2026 12:47
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 4211810 to 9697585 Compare October 28, 2026 20:35
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 9697585 to 1a2f3ef Compare November 2, 2026 18:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants