feat: add Windsurf support by aviel-lanzman · Pull Request #117 · vitejs/launch-editor

aviel-lanzman · 2026-04-27T05:57:06Z

This PR adds support for the Windsurf editor. Like VS Code, it supports the --goto flag for opening files at specific lines and columns.

Relates to vuejs/devtools#873

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://redirect.github.com/actions/checkout) | action | pinDigest | → `de0fac2` | | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | pinDigest | → `48b55a0` | | [pnpm/action-setup](https://redirect.github.com/pnpm/action-setup) | action | pinDigest | → `fc06bc1` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

1. Add types for `launch-editor-middleware` 2. Improve types for `launch-editor`: use overloads for stricter typings. Note: I didn't export the `ErrorCallback` or `Middleware` types because it's a bit finicky to do so with CJS-style dts code (`export =`). Ideally these dts should be written in modern ESM-style (which works in CJS), but probably these could be used with very old TS versions, so I didn't change it.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pnpm/action-setup](https://redirect.github.com/pnpm/action-setup) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>pnpm/action-setup (pnpm/action-setup)</summary> ### [`v6.0.8`](https://redirect.github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8) ### [`v6.0.7`](https://redirect.github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7) ### [`v6.0.6`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.6) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.5...v6.0.6) ##### What's Changed - fix: bin\_dest output points to self-updated pnpm, not bootstrap by [@zkochan](https://redirect.github.com/zkochan) in [#249](https://redirect.github.com/pnpm/action-setup/pull/249) **Full Changelog**: <pnpm/action-setup@v6.0.5...v6.0.6> ### [`v6.0.5`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.5) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.4...v6.0.5) ##### What's Changed - fix: append (not prepend) action node dir to PATH for npm bootstrap by [@zkochan](https://redirect.github.com/zkochan) in [#241](https://redirect.github.com/pnpm/action-setup/pull/241) **Full Changelog**: <pnpm/action-setup@v6.0.4...v6.0.5> ### [`v6.0.4`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.4) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.3...v6.0.4) ##### What's Changed - fix: use npm co-located with the action node binary by [@benquarmby](https://redirect.github.com/benquarmby) in [#239](https://redirect.github.com/pnpm/action-setup/pull/239) ##### New Contributors - [@benquarmby](https://redirect.github.com/benquarmby) made their first contribution in [#239](https://redirect.github.com/pnpm/action-setup/pull/239) **Full Changelog**: <pnpm/action-setup@v6.0.3...v6.0.4> ### [`v6.0.3`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.3) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.2...v6.0.3) Updated pnpm to v11.0.0-rc.5 **Full Changelog**: <pnpm/action-setup@v6.0.2...v6.0.3> ### [`v6.0.2`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.2) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.1...v6.0.2) ##### What's Changed - fix: pnpm self-update binary shadowed by bootstrap on PATH by [@oniani1](https://redirect.github.com/oniani1) in [#230](https://redirect.github.com/pnpm/action-setup/pull/230) ##### New Contributors - [@oniani1](https://redirect.github.com/oniani1) made their first contribution in [#230](https://redirect.github.com/pnpm/action-setup/pull/230) **Full Changelog**: <pnpm/action-setup@v6.0.1...v6.0.2> ### [`v6.0.1`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.1) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6...v6.0.1) Update pnpm to v11.0.0-rc.2. `pnpm-lock.yaml` will not be saved with two documents unless the `packageManager` is set via `devEngines.packageManager`. Related issue: [#228](https://redirect.github.com/pnpm/action-setup/issues/228) ### [`v6.0.0`]() [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6...v6) ### [`v6`](https://redirect.github.com/pnpm/action-setup/compare/v5...v6) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v5.0.0...v6) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [yorkie](https://redirect.github.com/yyx990803/yorkie) | [`^1.0.3` → `^2.0.0`](https://renovatebot.com/diffs/npm/yorkie/1.0.3/2.0.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/yorkie/2.0.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/yorkie/1.0.3/2.0.0?slim=true) | --- ### Release Notes <details> <summary>yyx990803/yorkie (yorkie)</summary> ### [`v2.0.0`](https://redirect.github.com/yyx990803/yorkie/compare/37321cd1340d70d4f8959b60d8553be2fc958774...a4cf01d789da2633a33a888b496fa35395e72109) [Compare Source](https://redirect.github.com/yyx990803/yorkie/compare/37321cd1340d70d4f8959b60d8553be2fc958774...a4cf01d789da2633a33a888b496fa35395e72109) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [lint-staged](https://redirect.github.com/lint-staged/lint-staged) | [`^6.1.1` → `^17.0.5`](https://renovatebot.com/diffs/npm/lint-staged/6.1.1/17.0.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/lint-staged/17.0.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lint-staged/6.1.1/17.0.5?slim=true) | --- ### Release Notes <details> <summary>lint-staged/lint-staged (lint-staged)</summary> ### [`v17.0.5`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1705) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v17.0.4...v17.0.5) ##### Patch Changes - [#1792](https://redirect.github.com/lint-staged/lint-staged/pull/1792) [`1f67271`](https://redirect.github.com/lint-staged/lint-staged/commit/1f672718b6fa67e0f00aafe107cb9f084f4d9102) - Correctly set the `--max-arg-length` default value based on the running platform. This controls how very long lists of staged files are split into multiple chunks. ### [`v17.0.4`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1704) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v17.0.3...v17.0.4) ##### Patch Changes - [#1788](https://redirect.github.com/lint-staged/lint-staged/pull/1788) [`f95c1f8`](https://redirect.github.com/lint-staged/lint-staged/commit/f95c1f8df3368758c44c2052e568aac1b3d4c767) - Another fix for making sure *lint-staged* adds task modifications correctly to the commit in the following cases: - after editing `<file>` it is staged with `git add <file>`, and then committed with `git commit` - after editing `<file>` it is committed with `git commit --all` without explicit `git add` - after editing `<file>` it is committed with `git commit <pathspec>` without explicit `git add` There's new test cases which actually setup the Git `pre_commit` hook to run *lint-staged* and verify them. These issues started in **v17.0.0** when trying to improve support for committig without having explicitly staged files. ### [`v17.0.3`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1703) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v17.0.2...v17.0.3) ##### Patch Changes - [#1782](https://redirect.github.com/lint-staged/lint-staged/pull/1782) [`06813f9`](https://redirect.github.com/lint-staged/lint-staged/commit/06813f9ab661db987e7720086ef9ec3f552ee097) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Fix *lint-staged* behavior when implicitly committing files without using `git add` by either: - `git commit -am "my commit message"` where `-a` (`--all`) means to automatically stage all tracked modified and deleted files - `git commit -m "my commit message" .` where `.` is an example of a [*pathspec*](https://git-scm.com/docs/git-commit#Documentation/git-commit.txt-pathspec) where matching files will be staged ### [`v17.0.2`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1702) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v17.0.1...v17.0.2) ##### Patch Changes - [#1779](https://redirect.github.com/lint-staged/lint-staged/pull/1779) [`88670ca`](https://redirect.github.com/lint-staged/lint-staged/commit/88670ca2278200f6348ed663358895ddc4bfff3c) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Enable immutable GitHub releases ### [`v17.0.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1701) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v17.0.0...v17.0.1) ##### Patch Changes - [#1776](https://redirect.github.com/lint-staged/lint-staged/pull/1776) [`4a5664b`](https://redirect.github.com/lint-staged/lint-staged/commit/4a5664be63af19590ec37940f705dad870ac5cfb) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Adjust GitHub Actions workflow so that automatic publishing works with signed commits. ### [`v17.0.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1700) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.4.0...v17.0.0) ##### Major Changes - [#1745](https://redirect.github.com/lint-staged/lint-staged/pull/1745) [`e244adf`](https://redirect.github.com/lint-staged/lint-staged/commit/e244adfab430be95803e74b20acf518517054c9f) Thanks [@iiroj](https://redirect.github.com/iiroj)! - **Node.js v20 is no longer supported, and the oldest supported version is now `22.22.1`**, which is an active LTS version at the time of this release. Node.js 20 will be EOL after April 2026. Please upgrade your Node.js version! - [#1676](https://redirect.github.com/lint-staged/lint-staged/pull/1676) [`0584e0b`](https://redirect.github.com/lint-staged/lint-staged/commit/0584e0b8824a07ea4d0151f2c17fc37c4905a421) Thanks [@outslept](https://redirect.github.com/outslept)! - *Lint-staged* now tries to verify the installed Git version is at least `2.32.0`, released in 2021. If you're using an even older Git version, you need to [upgrade](https://git-scm.com/install/mac) it before running *lint-staged*! - [#1745](https://redirect.github.com/lint-staged/lint-staged/pull/1745) [`2dcc40a`](https://redirect.github.com/lint-staged/lint-staged/commit/2dcc40a1a98aea20d38f76031ac30b278f81682a) Thanks [@iiroj](https://redirect.github.com/iiroj)! - The dependency `yaml` is now marked as optional and probably won't be installed by default. If you're using a YAML configuration file you should install the package separately: ```shell npm install --development yaml ``` If you're using `.lintstagedrc` as the config file name (without a file extension), it will be treated as a YAML file. If the content is JSON, consider renaming it to `.lintstagedrc.json` to avoid needing to install `yaml`. ##### Minor Changes - [#1748](https://redirect.github.com/lint-staged/lint-staged/pull/1748) [`809d5ef`](https://redirect.github.com/lint-staged/lint-staged/commit/809d5ef0a66edb2b26b233d33ce8e14af6c978e7) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Add new option `--hide-all` for hiding all unstaged changes and untracked files, before running tasks. This makes it easier to run tools like [Knip](https://knip.dev) which check for unused code. Untracked files are included in the backup stash and restored automatically after running. - [#1759](https://redirect.github.com/lint-staged/lint-staged/pull/1759) [`f13045a`](https://redirect.github.com/lint-staged/lint-staged/commit/f13045a5eae28c3233fc37146b0e1f51739c254b) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Update dependencies, including [`tinyexec@1.1.1`](https://redirect.github.com/tinylibs/tinyexec/releases/tag/1.1.1) to fix the following issues: - When using a Node.js version manager with multiple versions installed ([nvm](https://redirect.github.com/nvm-sh/nvm), [n](https://redirect.github.com/tj/n), for example), scripts with the `#!/usr/bin/env node` shebang ([Prettier](https://redirect.github.com/prettier/prettier), [ESLint](https://redirect.github.com/eslint/eslint), for example) were previously spawned using the default Node.js version configured by the version manager (the one `which node` points to) on POSIX systems. Now, they will be spawned with the same version that *lint-staged* itself was started with. - For example, if your default Node.js version is 24.14.1 but *lint-staged* is run with the latest version 25.9.0, the tasks spawned by *lint-staged* will now also use version 25.9.0. Previously they were spawned using 24.14.1. - When installing Node.js from the Ubuntu App Center ([Snap store](https://snapcraft.io/store)), the `node` executable available in `PATH` is a symlink pointing to Snap itself. The sandboxing features of Snap prevented *lint-staged* from spawning scripts with the `#!/usr/bin/env node` shebang, because it meant *lint-staged* tried to spawn Snap via the symlink. This resulted in an `ENOENT` error when trying to run `prettier`, for example. Now, since the real `node` executable's directory is available in the `PATH`, *lint-staged* will instead spawn the script with the real `node` binary succesfully. - [#1761](https://redirect.github.com/lint-staged/lint-staged/pull/1761) [`d3251b1`](https://redirect.github.com/lint-staged/lint-staged/commit/d3251b192d7116f059e7cabeffa3bfd7788dedeb) Thanks [@iiroj](https://redirect.github.com/iiroj)! - *Lint-staged* now runs `git update-index --again` after running tasks, instead of `git add <originally staged files>`. This should improve compatibility when using non-default indexes, for example when committing with a pathspec `git commit -m "message" .` instead of adding files to the index. - [#1745](https://redirect.github.com/lint-staged/lint-staged/pull/1745) [`a9585ac`](https://redirect.github.com/lint-staged/lint-staged/commit/a9585ac7ce0162c5c6c9aa88a28c11c812abedaf) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Remove `commander` as a dependency and use the built-in `parseArgs` from `node:util` to parse CLI flags. ##### Patch Changes - [#1755](https://redirect.github.com/lint-staged/lint-staged/pull/1755) [`c82d30b`](https://redirect.github.com/lint-staged/lint-staged/commit/c82d30bda8c80f886bdfead2e7aa123f7337aa76) Thanks [@iiroj](https://redirect.github.com/iiroj)! - All tests now pass on the [Bun](https://bun.com) runtime (latest). - [#1750](https://redirect.github.com/lint-staged/lint-staged/pull/1750) [`a401818`](https://redirect.github.com/lint-staged/lint-staged/commit/a4018185016617b02e4473d14e036a5f1a9b3f85) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Remove manual handling for `git stash --keep-index` resurrecting deleted files, because the issue was fixed in Git `2.23.0` and *lint-staged* requires at least Git `2.32.0`. - [#1771](https://redirect.github.com/lint-staged/lint-staged/pull/1771) [`c4b8936`](https://redirect.github.com/lint-staged/lint-staged/commit/c4b893665bf39670650ae71b4ec2073025e9984e) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Fix documentation about multiple config files and the `--cwd` option. When using it, all tasks will be run in the specified directory. For example, to run everything in the actual `process.cwd()`, use `lint-staged --cwd="."`. ### [`v16.4.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1640) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.3.4...v16.4.0) ##### Minor Changes - [#1739](https://redirect.github.com/lint-staged/lint-staged/pull/1739) [`687fc90`](https://redirect.github.com/lint-staged/lint-staged/commit/687fc9069a312ac83ca48f035a1bbf453db91814) Thanks [@hyperz111](https://redirect.github.com/hyperz111)! - Replace `micromatch` with `picomatch` to reduce dependencies. ### [`v16.3.4`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1634) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.3.3...v16.3.4) ##### Patch Changes - [#1742](https://redirect.github.com/lint-staged/lint-staged/pull/1742) [`9d6e827`](https://redirect.github.com/lint-staged/lint-staged/commit/9d6e827b0c55da5b091c989111f6c55dd76539d9) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Update dependencies, including [`tinyexec@1.0.4`](https://redirect.github.com/tinylibs/tinyexec/releases/tag/1.0.4) to make sure local `node_modules/.bin` are preferred to global locations (released in [`tinyexec@1.0.3`](https://redirect.github.com/tinylibs/tinyexec/releases/tag/1.0.3)). ### [`v16.3.3`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1633) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.3.2...v16.3.3) ##### Patch Changes - [#1740](https://redirect.github.com/lint-staged/lint-staged/pull/1740) [`0109e8d`](https://redirect.github.com/lint-staged/lint-staged/commit/0109e8d1507409d950dab0d65ce27bd40b1137c7) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Make sure Git's warning about CRLF line-endings doesn't interfere with creating initial backup stash. ### [`v16.3.2`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1632) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.3.1...v16.3.2) ##### Patch Changes - [#1735](https://redirect.github.com/lint-staged/lint-staged/pull/1735) [`2adaf6c`](https://redirect.github.com/lint-staged/lint-staged/commit/2adaf6c3a76152abddbf23b749dfa5d62982f3cf) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Hide the extra `cmd` window on Windows by spawning tasks without the `detached` option. ### [`v16.3.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1631) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.3.0...v16.3.1) ##### Patch Changes - [#1729](https://redirect.github.com/lint-staged/lint-staged/pull/1729) [`cd5d762`](https://redirect.github.com/lint-staged/lint-staged/commit/cd5d762c288bcfe36274c32f018cea97dfe11280) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Remove `nano-spawn` as a dependency from `package.json` as it was replaced with `tinyexec` and is no longer used. ### [`v16.3.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1630) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.7...v16.3.0) ##### Minor Changes - [#1698](https://redirect.github.com/lint-staged/lint-staged/pull/1698) [`feda37a`](https://redirect.github.com/lint-staged/lint-staged/commit/feda37aa590789e847f32a4aabc346af1d79c547) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Run external processes with [`tinyexec`](https://redirect.github.com/tinylibs/tinyexec) instead of [`nano-spawn`](https://redirect.github.com/sindresorhus/nano-spawn). `nano-spawn` replaced [`execa`](https://redirect.github.com/sindresorhus/execa) in *lint-staged* version 16 to limit the amount of npm dependencies required, but caused some unknown issues related to spawning tasks. Let's hope `tinyexec` improves the situation. - [#1699](https://redirect.github.com/lint-staged/lint-staged/pull/1699) [`1346d16`](https://redirect.github.com/lint-staged/lint-staged/commit/1346d16387e188911ef64e8bad6b8a6252cb6d71) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Remove `pidtree` as a dependency. When a task fails, its sub-processes are killed more efficiently via the process group on Unix systems, and the `taskkill` command on Windows. ##### Patch Changes - [#1726](https://redirect.github.com/lint-staged/lint-staged/pull/1726) [`87467aa`](https://redirect.github.com/lint-staged/lint-staged/commit/87467aaa76e1edc2547f3f3d462a4495afa5337d) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Incorrect brace expansions like `*.{js}` (*nothing to expand*) are detected exhaustively, instead of just a single pass. ### [`v16.2.7`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1627) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.6...v16.2.7) ##### Patch Changes - [#1711](https://redirect.github.com/lint-staged/lint-staged/pull/1711) [`ef74c8d`](https://redirect.github.com/lint-staged/lint-staged/commit/ef74c8d165d5acd3ce88567e02b891e0e9af8e0e) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Do not display a "*failed to spawn*" error message when a task fails normally. This message is reserved for when the task didn't run because spawning it failed. ### [`v16.2.6`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1626) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.5...v16.2.6) ##### Patch Changes - [#1693](https://redirect.github.com/lint-staged/lint-staged/pull/1693) [`33d4502`](https://redirect.github.com/lint-staged/lint-staged/commit/33d4502ef9c939a9c6f41fc630a34e0985220f8e) Thanks [@Adrian-Baran-GY](https://redirect.github.com/Adrian-Baran-GY)! - Fix problems with `--continue-on-error` option, where tasks might have still been killed (`SIGINT`) when one of them failed. ### [`v16.2.5`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1625) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.4...v16.2.5) ##### Patch Changes - [#1687](https://redirect.github.com/lint-staged/lint-staged/pull/1687) [`9e02d9d`](https://redirect.github.com/lint-staged/lint-staged/commit/9e02d9dc8a84bfeb7995520f00f7080b07a2e839) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Fix unhandled promise rejection when spawning tasks (*instead of the tasks themselves failing*). Previously when a task failed to spawn, *lint-staged* also failed and the backup stash might not have been automatically restored. ### [`v16.2.4`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1624) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.3...v16.2.4) ##### Patch Changes - [#1682](https://redirect.github.com/lint-staged/lint-staged/pull/1682) [`0176038`](https://redirect.github.com/lint-staged/lint-staged/commit/01760380e57080d136cc396455346c36aef5770e) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Update dependencies, including [`nano-spawn@2.0.0`](https://redirect.github.com/sindresorhus/nano-spawn/releases/tag/v2.0.0) with bug fixes. - [#1671](https://redirect.github.com/lint-staged/lint-staged/pull/1671) [`581a54e`](https://redirect.github.com/lint-staged/lint-staged/commit/581a54eea6ba3a3a1b715407c895f63a961903f3) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Speed up execution by only importing the `yaml` depedency if using YAML configuration files. ### [`v16.2.3`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1623) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.2...v16.2.3) ##### Patch Changes - [#1669](https://redirect.github.com/lint-staged/lint-staged/pull/1669) [`27cd541`](https://redirect.github.com/lint-staged/lint-staged/commit/27cd5413d973baea6b4f3da704fb3bee8298e751) Thanks [@iiroj](https://redirect.github.com/iiroj)! - When using `--fail-on-changes`, automatically hidden (partially) unstaged changes are no longer counted to make *lint-staged* fail. ### [`v16.2.2`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1622) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.1...v16.2.2) ##### Patch Changes - [#1667](https://redirect.github.com/lint-staged/lint-staged/pull/1667) [`699f95d`](https://redirect.github.com/lint-staged/lint-staged/commit/699f95df8f89ac7f7d360bbf93740d19d5899ac5) Thanks [@iiroj](https://redirect.github.com/iiroj)! - The backup stash will not be dropped when using `--fail-on-changes` and there are errors. When reverting to original state is disabled (via `--no-revert` or `--fail-on-changes`), hidden (partially) unstaged changes are still restored automatically so that it's easier to resolve the situation manually. Additionally, the example for using the backup stash manually now uses the correct backup hash, if available: ```shell % npx lint-staged --fail-on-changes ✔ Backed up original state in git stash (c18d55a3) ✔ Running tasks for staged files... ✖ Tasks modified files and --fail-on-changes was used! ↓ Cleaning up temporary files... ✖ lint-staged failed because `--fail-on-changes` was used. Any lost modifications can be restored from a git stash: > git stash list --format="%h %s" c18d55a3 On main: lint-staged automatic backup > git apply --index c18d55a3 ``` ### [`v16.2.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1621) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.0...v16.2.1) ##### Patch Changes - [#1664](https://redirect.github.com/lint-staged/lint-staged/pull/1664) [`8277b3b`](https://redirect.github.com/lint-staged/lint-staged/commit/8277b3b298421ebbb39c43d7e3538481e15c4659) Thanks [@iiroj](https://redirect.github.com/iiroj)! - The built-in TypeScript types have been updated to more closely match the implementation. Notably, the list of staged files supplied to task functions is `readonly string[]` and can't be mutated. Thanks [@outslept](https://redirect.github.com/outslept)! ```diff export default { --- "*": (files: string[]) => void console.log('staged files', files) +++ "*": (files: readonly string[]) => void console.log('staged files', files) } ``` - [#1654](https://redirect.github.com/lint-staged/lint-staged/pull/1654) [`70b9af3`](https://redirect.github.com/lint-staged/lint-staged/commit/70b9af3ac3fd66af94936e55bb3e91381937b41f) Thanks [@iiroj](https://redirect.github.com/iiroj)! - This version has been published from GitHub Actions using [Trusted Publishing for npm packages](https://docs.npmjs.com/trusted-publishers). - [#1659](https://redirect.github.com/lint-staged/lint-staged/pull/1659) [`4996817`](https://redirect.github.com/lint-staged/lint-staged/commit/49968170abb3bab7ac8dc0a6bc5ea92850337baa) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Fix searching configuration files when the working directory is a subdirectory of a git repository, and there are `package.json` files in the working directory. This situation might happen when running *lint-staged* for a single package in a monorepo. - [#1654](https://redirect.github.com/lint-staged/lint-staged/pull/1654) [`7021f0a`](https://redirect.github.com/lint-staged/lint-staged/commit/7021f0af40ac1d5787501894c0f2222980023703) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Return the caret semver range (`^`) to direct dependencies so that future patch and minor versions are allowed. This enables projects to better maintain and deduplicate their own transitive dependencies while not requiring direct updates to *lint-staged*. This was changed in [16.2.0](https://redirect.github.com/lint-staged/lint-staged/releases/tag/v16.2.0) after the vulnerability issues with `chalk` and `debug`, which were also removed in the same version. Given the recent vulnerabilities in the *npm* ecosystem, it's best to be very careful when updating dependencies. ### [`v16.2.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1620) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.6...v16.2.0) ##### Minor Changes - [#1615](https://redirect.github.com/lint-staged/lint-staged/pull/1615) [`99eb742`](https://redirect.github.com/lint-staged/lint-staged/commit/99eb74200e8db69e72dba45314025953b8b0794e) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Added a new option `--fail-on-changes` to make *lint-staged* exit with code 1 when tasks modify any files, making the `precommit` hook fail. This is similar to the `git diff --exit-code` option. Using this flag also implies the `--no-revert` flag which means any changes made by tasks will be left in the working tree after failing, so that they can be manually staged and the commit tried again. - [#1611](https://redirect.github.com/lint-staged/lint-staged/pull/1611) [`cd05fd3`](https://redirect.github.com/lint-staged/lint-staged/commit/cd05fd349594baf586fbafb05588ff07d86060b7) Thanks [@rlorenzo](https://redirect.github.com/rlorenzo)! - Added a new option `--continue-on-error` so that *lint-staged* will run all tasks to completion even if some of them fail. By default, *lint-staded* will exit early on the first failure. - [#1637](https://redirect.github.com/lint-staged/lint-staged/pull/1637) [`82fcc07`](https://redirect.github.com/lint-staged/lint-staged/commit/82fcc0789c17bf6b2ea2649147abec77fa619375) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Internal *lint-staged* errors are now thrown and visible in the console output. Previously they were caught with the process exit code set to 1, but not logged. This happens when, for example, there's a syntax error in the *lint-staged* configuration file. - [#1647](https://redirect.github.com/lint-staged/lint-staged/pull/1647) [`a5ecc06`](https://redirect.github.com/lint-staged/lint-staged/commit/a5ecc0605d52756167417c84cb0007ea7bceaaa3) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Remove [debug](https://redirect.github.com/debug-js/debug) as a dependency due to recent malware issue; read more at [debug-js/debug#1005](https://redirect.github.com/debug-js/debug/issues/1005). Because of this, the `DEBUG` environment variable is no longer supported — use the `--debug` to enable debugging - [#1636](https://redirect.github.com/lint-staged/lint-staged/pull/1636) [`8db2717`](https://redirect.github.com/lint-staged/lint-staged/commit/8db2717574ebfa2b80e0fc4eb0b24d705fd264fc) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Added a new option `--hide-unstaged` so that *lint-staged* will hide all unstaged changes to tracked files before running tasks. The changes will be applied back after running the tasks. Note that the combination of flags `--hide-unstaged --no-hide-partially-staged` isn't meaningful and behaves the same as just `--hide-unstaged`. Thanks to [@ItsNickBarry](https://redirect.github.com/ItsNickBarry) for the idea and initial implementation in [#1552](https://redirect.github.com/lint-staged/lint-staged/pull/1552). - [#1648](https://redirect.github.com/lint-staged/lint-staged/pull/1648) [`7900b3b`](https://redirect.github.com/lint-staged/lint-staged/commit/7900b3b79c5e2e69662cb8b1bcbcae79c3549421) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Remove [lilconfig](https://redirect.github.com/antonk52/lilconfig) to reduce reliance on third-party dependencies. It was used to find possible config files outside of those tracked in Git, including from the parent directories. This behavior has been moved directly into *lint-staged* and should work about the same. ##### Patch Changes - [#1633](https://redirect.github.com/lint-staged/lint-staged/pull/1633) [`7f9e485`](https://redirect.github.com/lint-staged/lint-staged/commit/7f9e485a981707897e0d417f6a62008f0c098e00) Thanks [@dependabot](https://redirect.github.com/apps/dependabot)! - Bumps [listr2](https://redirect.github.com/listr2/listr2) from 9.0.3 to 9.0.4. - [#1626](https://redirect.github.com/lint-staged/lint-staged/pull/1626) [`99d5a9b`](https://redirect.github.com/lint-staged/lint-staged/commit/99d5a9b0ddcba7d471d39ff3969d37988f1e2705) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Due to recent phishing attacks, for example [chalk@5.6.1](https://redirect.github.com/chalk/chalk/issues/656) was released with malware. To avoid *lint-staged*'s users being at risk the **direct dependencies are pinned to exact versions**, instead of allowing future patch versions with the [caret (`^`) range](https://docs.npmjs.com/cli/v6/using-npm/semver#caret-ranges-123-025-004). - [#1588](https://redirect.github.com/lint-staged/lint-staged/pull/1588) [`035bbf2`](https://redirect.github.com/lint-staged/lint-staged/commit/035bbf268ac47bbaf2cfa737c3b2240d38feb22e) Thanks [@outslept](https://redirect.github.com/outslept)! - Increase performance by listing staged files and searching for configuration concurrently. - [#1645](https://redirect.github.com/lint-staged/lint-staged/pull/1645) [`deba3ad`](https://redirect.github.com/lint-staged/lint-staged/commit/deba3ad83581938dd71b86b563e62827b5fc2a0a) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Remove [chalk](https://redirect.github.com/chalk/chalk) as a dependency due to recent malware issue; read more at [chalk/chalk#656](https://redirect.github.com/chalk/chalk/issues/656). If you are having trouble with ANSI color codes when using *lint-staged*, you can try setting either `FORCE_COLOR=true` or `NO_COLOR=true` env variables. ### [`v16.1.6`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1616) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.5...v16.1.6) ##### Patch Changes - [#1610](https://redirect.github.com/lint-staged/lint-staged/pull/1610) [`e93578e`](https://redirect.github.com/lint-staged/lint-staged/commit/e93578e265a69ed6b02fcaa11486078c1bdbdaaa) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Try to improve terminating of subprocess of tasks by using `SIGKILL`, and only calling `pidtree` when the the main task process has a known pid. ### [`v16.1.5`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1615) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.4...v16.1.5) ##### Patch Changes - [#1608](https://redirect.github.com/lint-staged/lint-staged/pull/1608) [`4e3ce22`](https://redirect.github.com/lint-staged/lint-staged/commit/4e3ce225b33f759f78a84d156189dc38e536cdc6) Thanks [@srsatt](https://redirect.github.com/srsatt)! - Detect the git repo's top-level directory correctly when in a worktree. ### [`v16.1.4`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1614) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.3...v16.1.4) ##### Patch Changes - [#1604](https://redirect.github.com/lint-staged/lint-staged/pull/1604) [`90b37b0`](https://redirect.github.com/lint-staged/lint-staged/commit/90b37b00c2c30b9cacf6c080f6a0885e1151eb7a) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Add another `types` field to `package.json` to make even more sure NPM detects that *lint-staged* includes built-in TypeScript type definitions. ### [`v16.1.3`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1613) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.2...v16.1.3) ##### Patch Changes - [#1602](https://redirect.github.com/lint-staged/lint-staged/pull/1602) [`7ea700b`](https://redirect.github.com/lint-staged/lint-staged/commit/7ea700bcf3d0078a01720a9c8dc13a271387afbd) Thanks [@dword-design](https://redirect.github.com/dword-design)! - Add the `types` field to `package.json` to make sure NPM detects *lint-staged* includes built-in TypeScript type definitions. ### [`v16.1.2`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1612) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.1...v16.1.2) ##### Patch Changes - [#1570](https://redirect.github.com/lint-staged/lint-staged/pull/1570) [`a7c0c88`](https://redirect.github.com/lint-staged/lint-staged/commit/a7c0c88bcfe94e695528cb33e69fea58586691fc) Thanks [@ItsNickBarry](https://redirect.github.com/ItsNickBarry)! - When using `--diff-filter` with the `D` option to include deleted staged files, *lint-staged* no longer tries to stage the deleted files, unless they're no longer deleted. Previously this caused an error from `git add` like `fatal: pathspec 'deleted-file' did not match any files`. - [`38f942e`](https://redirect.github.com/lint-staged/lint-staged/commit/38f942ecc456355d5f12af68db1696f3411f65c2) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Removed an extraneous log entry that printed `shouldHidePArtiallyStagedFiles` to console output. ### [`v16.1.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1611) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.0...v16.1.1) ##### Patch Changes - [#1565](https://redirect.github.com/lint-staged/lint-staged/pull/1565) [`3686977`](https://redirect.github.com/lint-staged/lint-staged/commit/3686977ccdadf70b709c16c0346ef6c2b18e2376) Thanks [@iiroj](https://redirect.github.com/iiroj)! - *Lint-staged* now explicitly warns about potential data loss when using `--no-stash`. - [#1571](https://redirect.github.com/lint-staged/lint-staged/pull/1571) [`02299a9`](https://redirect.github.com/lint-staged/lint-staged/commit/02299a9e4f98a05c13beb27f3596af73aaa8c150) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Function tasks (introduced in v16.0.0) only receive the staged files matching the configured glob, instead of all staged files. - [#1563](https://redirect.github.com/lint-staged/lint-staged/pull/1563) [`bc61c74`](https://redirect.github.com/lint-staged/lint-staged/commit/bc61c74383b6d100c55b8d275b979d583ffbe5a1) Thanks [@iiroj](https://redirect.github.com/iiroj)! - This version fixes incorrect behavior where unstaged changes were committed when using the `--no-stash` option. This happened because `--no-stash` implied `--no-hide-partially-staged`, meaning unstaged changes to files which also had other staged changes were added to the commit by *lint-staged*; this is no longer the case. The previous (incorrect) behavior can still be achieved by using both options `--no-stash --no-hide-partially-staged` at the same time. ### [`v16.1.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1610) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.0.0...v16.1.0) ##### Minor Changes - [#1536](https://redirect.github.com/lint-staged/lint-staged/pull/1536) [`e729daa`](https://redirect.github.com/lint-staged/lint-staged/commit/e729daa3b3ae28e613f63e730652dbfad5d1c594) Thanks [@iiroj](https://redirect.github.com/iiroj)! - A new flag `--no-revert` has been introduced for when task modifications should be applied to the index before aborting the commit in case of errors. By default, *lint-staged* will clear all task modifications and revert to the original state. - [#1550](https://redirect.github.com/lint-staged/lint-staged/pull/1550) [`b27fa3f`](https://redirect.github.com/lint-staged/lint-staged/commit/b27fa3fecb75bcdcaa4bcd483c9d5c0755a22607) Thanks [@iiroj](https://redirect.github.com/iiroj)! - *Lint-staged* now ignores symlinks and leaves them out from the list of staged files. ##### Patch Changes - [#1558](https://redirect.github.com/lint-staged/lint-staged/pull/1558) [`c37dc38`](https://redirect.github.com/lint-staged/lint-staged/commit/c37dc38dddbdebc41df4dbd909d79c98c3f69eb3) Thanks [@iiroj](https://redirect.github.com/iiroj)! - The minimum required Node.js version is lowered to `20.17` following [nano-spawn@1.0.2](https://redirect.github.com/sindresorhus/nano-spawn/releases/tag/v1.0.2). ### [`v16.0.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1600) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.5.2...v16.0.0) ##### Major Changes - [#1546](https://redirect.github.com/lint-staged/lint-staged/pull/1546) [`158d15c`](https://redirect.github.com/lint-staged/lint-staged/commit/158d15c9aea0a3a87790ec3766442763cf387dba) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Processes are spawned using [nano-spawn](https://redirect.github.com/sindresorhus/nano-spawn) instead of [execa](https://redirect.github.com/sindresorhus/execa). If you are using Node.js scripts as tasks, you might need to explicitly run them with `node`, especially when using Windows: ```json { "*.js": "node my-js-linter.js" } ``` - [#1546](https://redirect.github.com/lint-staged/lint-staged/pull/1546) [`158d15c`](https://redirect.github.com/lint-staged/lint-staged/commit/158d15c9aea0a3a87790ec3766442763cf387dba) Thanks [@iiroj](https://redirect.github.com/iiroj)! - The `--shell` flag has been removed and *lint-staged* no longer supports evaluating commands directly via a shell. To migrate existing commands, you can create a shell script and invoke it instead. Lint-staged will pass matched staged files as a list of arguments, accessible via `"$@"`: ```shell ``` ### [`v15.5.2`]() [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.5.1...v15.5.2) ### [`v15.5.1`]() [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.5.0...v15.5.1) ### [`v15.5.0`]() [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.4.3...v15.5.0) ### [`v15.4.3`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1543) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.4.2...v15.4.3) ##### Patch Changes - [#1512](https://redirect.github.com/lint-staged/lint-staged/pull/1512) [`cbfed1d`](https://redirect.github.com/lint-staged/lint-staged/commit/cbfed1dfd2465c4198c692955281f0836600bea1) Thanks [@tarik02](https://redirect.github.com/tarik02)! - Adjust TypeScript types for the default export so that it can be used as a value without error TS2693. ### [`v15.4.2`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1542) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.4.1...v15.4.2) ##### Patch Changes - [#1509](https://redirect.github.com/lint-staged/lint-staged/pull/1509) [`8827ebf`](https://redirect.github.com/lint-staged/lint-staged/commit/8827ebf29dc8f25149a36450b4a0023425202e18) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Change *lint-staged*'s dependencies to use [caret (`^`) ranges](https://docs.npmjs.com/cli/v6/using-npm/semver#caret-ranges-123-025-004) instead of [tilde (`~`)](https://docs.npmjs.com/cli/v6/using-npm/semver#tilde-ranges-123-12-1). This makes it easier for package managers to perform dependency management when minor-level updates are also permitted instead of just patch-level. ### [`v15.4.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1541) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.4.0...v15.4.1) ##### Patch Changes - [#1504](https://redirect.github.com/lint-staged/lint-staged/pull/1504) [`1c7a45e`](https://redirect.github.com/lint-staged/lint-staged/commit/1c7a45ed2c7fee9d5f55337be16a51e4c9b240e1) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Default TypeScript config filenames match JS equivalents. - [#1504](https://redirect.github.com/lint-staged/lint-staged/pull/1504) [`9cc18c9`](https://redirect.github.com/lint-staged/lint-staged/commit/9cc18c9debb185490f9ae4f9c1d21ec8c2587393) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Add missing conditional exports syntax for TypeScript types. ### [`v15.4.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1540) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.3.0...v15.4.0) ##### Minor Changes - [#1500](https://redirect.github.com/lint-staged/lint-staged/pull/1500) [`a8ec1dd`](https://redirect.github.com/lint-staged/lint-staged/commit/a8ec1ddb587d2c1c2420dbb4baff8160f0ac46c9) Thanks [@iiroj](https://redirect.github.com/iiroj)! - *Lint-staged* now provides TypeScript types for the configuration and main Node.js API. You can use the JSDoc syntax in your JS configuration files: ```js /** * @filename: lint-staged.config.js * @type {import('lint-staged').Configuration} */ export default { '*': 'prettier --write', } ``` It's also possible to use the `.ts` file extension for the configuration if your Node.js version supports it. The `--experimental-strip-types` flag was introduced in [Node.js v22.6.0](https://redirect.github.com/nodejs/node/releases/tag/v22.6.0) and unflagged in [v23.6.0](https://redirect.github.com/nodejs/node/releases/tag/v23.6.0), enabling Node.js to execute TypeScript files without additional configuration. ```shell export NODE_OPTIONS="--experimental-strip-types" npx lint-staged --config lint-staged.config.ts ``` ##### Patch Changes - [#1501](https://redirect.github.com/lint-staged/lint-staged/pull/1501) [`9b79364`](https://redirect.github.com/lint-staged/lint-staged/commit/9b793640e1f87b46e4f40fcfc1ecf9d6f6013ac9) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Handle possible failures when logging user shell for debug info. ### [`v15.3.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1530) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.2.11...v15.3.0) ##### Minor Changes - [#1495](https://redirect.github.com/lint-staged/lint-staged/pull/1495) [`e69da9e`](https://redirect.github.com/lint-staged/lint-staged/commit/e69da9e614db2d45f56e113d45d5ec0157813423) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Added more info to the debug logs so that "environment" info doesn't need to be added separately to GitHub issues. - [#1493](https://redirect.github.com/lint-staged/lint-staged/pull/1493) [`fa0fe98`](https://redirect.github.com/lint-staged/lint-staged/commit/fa0fe98104f8885f673b98b8b49ae586de699c5e) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Added more help messages around the automatic `git stash` that *lint-staged* creates as a backup (by default). The console output also displays the short git *hash* of the stash so that it's easier to recover lost files in case some fatal errors are encountered, or the process is killed before completing. For example: ``` % npx lint-staged ✔ Backed up original state in git stash (20addf8) ✔ Running tasks for staged files... ✔ Applying modifications from tasks... ✔ Cleaning up temporary files... ``` where the backup can be seen with `git show 20addf8`, or `git stash list`: ``` % git stash list stash@{0}: lint-staged automatic backup (20addf8) ``` ### [`v15.2.11`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#15211) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.2.10...v15.2.11) ##### Patch Changes - [#1484](https://redirect.github.com/lint-staged/lint-staged/pull/1484) [`bcfe309`](https://redirect.github.com/lint-staged/lint-staged/commit/bcfe309fca88aedf42b6a321383de49eb361c5a0) Thanks [@wormsik](https://redirect.github.com/wormsik)! - Escape paths containing spaces when using the "shell" option. - [#1487](https://redirect.github.com/lint-staged/lint-staged/pull/1487) [`7dd8caa`](https://redirect.github.com/lint-staged/lint-staged/commit/7dd8caa8f80fe1a6ce40939c1224b6774000775a) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Do not treat submodule root paths as "staged files". This caused *lint-staged* to fail to a Git error when only updating the revision of a submodule. ### [`v15.2.10`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#15210) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.2.9...v15.2.10) ##### Patch Changes - [#1471](https://redirect.github.com/lint-staged/lint-staged/pull/1471) [`e3f283b`](https://redirect.github.com/lint-staged/lint-staged/commit/e3f283b250868b7c15ceb54d2a51b2e5fb3a18a9) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Update minor dependencies, including `micromatch@~4.0.8`. ### [`v15.2.9`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1529) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.2.8...v15.2.9) ##### Patch Changes - [#1463](https://redirect.github.com/lint-staged/lint-staged/pull/1463) [`b69ce2d`](https://redirect.github.com/lint-staged/lint-staged/commit/b69ce2ddfd5a7ae576f4fef4afc60b8a81f3c945) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Set the maximum number of event listeners to the number of tasks. This should silence the console warning `MaxListenersExceededWarning: Possible EventEmitter memory leak detected`. ### [`v15.2.8`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1528) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.2.7...v15.2.8) ##### Patch Changes - [`f0480f0`](https://redirect.github.com/lint-staged/lint-staged/commit/f0480f01b24b9f6443a12515d413a7ba4dda3981) Thanks [@iiroj](https://redirect.github.com/iiroj)! - In the previous version the native `git rev-parse --show-toplevel` command was taken into use for resolving the current git repo root. This version switched the `--show-toplevel` flag with `--show-cdup`, because on Git installed via MSYS2 the former was returning absolute paths that do not work with Node.js `child_process`. The new flag returns a path relative to the working directory, avoiding the issue. The GitHub Actions workflow has been updated to install Git via MSYS2, to ensure better future compatibility; using the default Git binary in the GitHub Actions runner was working correctly even with MSYS2. ### [`v15.2.7`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1527) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.2.6...v15.2.7) ##### Patch Changes - [#1440](https://redirect.github.com/lint-staged/lint-staged/pull/1440) [`a51be80`](https://redirect.github.com/lint-staged/lint-staged/commit/a51be804b63307ac7af3c82f4cb2d43dbe92daac) Thanks [@iiroj](https://redirect.github.com/iiroj)! - In the previous version the native `git rev-parse --show-toplevel` command was taken into use for resolving the current git repo root. This version drops the `--path-format=absolute` option to support earlier git versions since it's also the default behavior. If you are still having trouble, please try upgrading `git` to the latest version. ### [`v15.2.6`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1526) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.2.5...v15.2.6) ##### Patch Changes - [#1433](https://redirect.github.com/lint-staged/lint-staged/pull/1433) [`119adb2`](https://redirect.github.com/lint-staged/lint-staged/commit/119adb29854cabddbfcf0469d7c8a0126184a5d4) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Use native "git rev-parse" commands to determine git repo root directory and the .git config directory, instead of using custom logic. This hopefully makes path resolution more robust on non-POSIX systems. ### [`v15.2.5`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1525) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.2.4...v15.2.5) ##### Patch Changes - [#1424](https://redirect.github.com/lint-staged/lint-staged/pull/1424) [`31a1f95`](https://redirect.github.com/lint-staged/lint-staged/commit/31a1f9548ea8202bc5bd718076711f747396e3ca) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Allow approximately equivalent versions of direct dependencies by using the "\~" character in the version ranges. This means a more recent patch version of a dependency is allowed if available. - [#1423](https://redirect.github.com/lint-staged/lint-staged/pull/1423) [`91abea0`](https://redirect.github.com/lint-staged/lint-staged/commit/91abea0d298154d92113ba34bae4020704e22918) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Improve error logging when failing to read or parse a configuration file - [#1424](https://redirect.github.com/lint-staged/lint-staged/pull/1424) [`ee43f15`](https://redirect.github.com/lint-staged/lint-staged/commit/ee43f154097753dd5448766f792387e60e0ea453) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Upgrade micromatch\@4.0.7 ### [`v15.2.4`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1524) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.2.2...v15.2.4) ##### Patch Changes - [`4f4537a`](https://redirect.github.com/lint-staged/lint-staged/commit/4f4537a75ebfba816826f6f67a325dbc7f25908a) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Fix release issue with previous version; update dependencies ### [`v15.2.2`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1522) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.2.1...v15.2.2) ##### Patch Changes - [#1391](https://redirect.github.com/lint-staged/lint-staged/pull/1391) [`fdcdad4`](https://redirect.github.com/lint-staged/lint-staged/commit/fdcdad42ff96fea3c05598e378d3c44ad4a51bde) Thanks [@iiroj](https://redirect.github.com/iiroj)! - *Lint-staged* no longer tries to load configuration from files that are not checked out. This might happen when using sparse-checkout. ### [`v15.2.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#15211) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.2.0...v15.2.1) ##### Patch Changes - [#1484](https://redirect.github.com/lint-staged/lint-staged/pull/1484) [`bcfe309`](https://redirect.github.com/lint-staged/lint-staged/commit/bcfe309fca88aedf42b6a321383de49eb361c5a0) Thanks [@wormsik](https://redirect.github.com/wormsik)! - Escape paths containing spaces when using the "shell" option. - [#1487](https://redirect.github.com/lint-staged/lint-staged/pull/1487) [`7dd8caa`](https://redirect.github.com/lint-staged/lint-staged/commit/7dd8caa8f80fe1a6ce40939c1224b6774000775a) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Do not treat submodule root paths as "staged files". This caused *lint-staged* to fail to a Git error when only updating the revision of a submodule. ### [`v15.2.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1520) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.1.0...v15.2.0) ##### Minor Changes - [#1371](https://redirect.github.com/lint-staged/lint-staged/pull/1371) [`f3378be`](https://redirect.github.com/lint-staged/lint-staged/commit/f3378be894fb84800341800b1e4f6f8bc8dfd904) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Using the `--no-stash` flag no longer discards all unstaged changes to partially staged files, which resulted in inadvertent data loss. This fix is available with a new flag `--no-hide-partially-staged` that is automatically enabled when `--no-stash` is used. ##### Patch Changes - [#1362](https://redirect.github.com/lint-staged/lint-staged/pull/1362) [`17bc480`](https://redirect.github.com/lint-staged/lint-staged/commit/17bc480c0f8767407a87527931558de8d1d1551d) Thanks [@antonk52](https://redirect.github.com/antonk52)! - update lilconfig\@3.0.0 - [#1368](https://redirect.github.com/lint-staged/lint-staged/pull/1368) [`7c55ca9`](https://redirect.github.com/lint-staged/lint-staged/commit/7c55ca9f410043016e8b33b3b523b9b7e764acf4) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Update most dependencies - [#1368](https://redirect.github.com/lint-staged/lint-staged/pull/1368) [`777d4e9`](https://redirect.github.com/lint-staged/lint-staged/commit/777d4e976852af4c181ffbe055f3531343349695) Thanks [@iiroj](https://redirect.github.com/iiroj)! - To improve performance, only use `lilconfig` when searching for config files outside the git repo. In the regular case, *lint-staged* finds the config files from the Git index and loads them directly. - [#1373](https://redirect.github.com/lint-staged/lint-staged/pull/1373) [`85eb0dd`](https://redirect.github.com/lint-staged/lint-staged/commit/85eb0ddab1eba0c0bcc8cc109e17dc2bbb3d044e) Thanks [@iiroj](https://redirect.github.com/iiroj)! - When determining git directory, use `fs.realpath()` only for symlinks. It looks like `fs.realpath()` changes some Windows mapped network filepaths unexpectedly, causing issues. ### [`v15.1.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1510) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.0.2...v15.1.0) ##### Minor Changes - [#1344](https://redirect.github.com/lint-staged/lint-staged/pull/1344) [`0423311`](https://redirect.github.com/lint-staged/lint-staged/commit/04233115a5e25d6fa7d357cbe9d42173ae8a1acf) Thanks [@danielbayley](https://redirect.github.com/danielbayley)! - Add support for loading configuration from `package.yaml` and `package.yml` files, supported by `pnpm`. ##### Patch Changes - [#1355](https://redirect.github.com/lint-staged/lint-staged/pull/1355) [`105d901`](https://redirect.github.com/lint-staged/lint-staged/commit/105d9012fc92fca549987816406450075cf255f3) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Suppress some warnings when using the "--quiet" flag ### [`v15.0.2`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1502) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.0.1...v15.0.2) ##### Patch Changes - [#1339](https://redirect.github.com/lint-staged/lint-staged/pull/1339) [`8e82364`](https://redirect.github.com/lint-staged/lint-staged/commit/8e82364dd89155e96de574cfb38a94d28b8635af) Thanks [@iiroj](https://redirect.github.com/iiroj)! - Update dependencies, including listr2\@7.0.2 to fix an upstream issue affecting lint-staged. ### [`v15.0.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1501) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.0.0...v15.0.1) ##### Patch Changes - [#1217](https://redirect.github.com/lint-staged/lint-staged/pull/1217) [`d2e6f8b`](https://redirect.github.com/lint-staged/lint-staged/commit/d2e6f8b1e1cd84ba6eb2f3f6a7f650c882987041) Thanks [@louneskmt](https://redirect.github.com/louneskmt)! - Previously it was possible for a function task to mutate the list of staged files passed to the function, and accidentally affect the generation of other tasks. This is now fixed by passing a copy of the original file list instead. ### [`v15.0.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1500) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v14.0.1...v15.0.0) ##### Major Changes - [#1322](https://redirect.github.com/okonet/lint-staged/pull/1322) [`66b93aa`](https://redirect.github.com/okonet/lint-staged/commit/66b93aac870d155ca81302b2574617da99409ca7) Thanks [@iiroj](https://redirect.github.com/iiroj)! - **Require at least Node.js 18.12.0** This release drops support for Node.js 16, which is EOL after 2023-09-11. Please upgrade your Node.js to the latest version. Additionally, all dependencies have been updated to their latest versions. ### [`v14.0.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#v1401---21-Aug-2023) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v14.0.0...v14.0.1) ##### Bug Fixes - fix reading config from stdin, introduced in v14.0.0 ([#1317](https://redirect.github.com/okonet/lint-staged/issues/1317)) ([fc3bfea](https://redirect.github.com/okonet/lint-staged/commit/fc3bfeabae29b65f99b6911a989b0b41d3d1128e)) ### [`v14.0.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#v1400---13-Aug-2023) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v13.3.0...v14.0.0) ##### Features - drop support for Node.js 14 ([#1312](https://redirect.github.com/okonet/lint-staged/issues/1312)) ([9da8777](https://redirect.github.com/okonet/lint-staged/commit/9da877711a7547b9122c6af91683fb2a2f398184)) ##### BREAKING CHANGES - Please upgrade your Node.js version to at least `16.14.0`. ### [`v13.3.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#v1330---13-Aug-2023) [Compare Source](https://redirect.github.com/lint-staged/lint-staged/compare/v13.2.3...v13.3.0) ##### Bug Fixes - **dependencies:** update most dependencies ([7443870](https://redirect.github.com/okonet/lint-staged/commit/7443870b2c24ead8613295cbfa1fe80f96167e1c)) - detect duplicate redundant braces in pattern ([d895aa8](https://redirect.github.com/okonet/lint-staged/commit/d895aa8382b769f8 > ✂ **Note** > > PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: sapphi-red <49056869+sapphi-red@users.noreply.github.com>

> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [bumpp](https://redirect.github.com/antfu-collective/bumpp) | [`^11.0.1` → `^11.1.0`](https://renovatebot.com/diffs/npm/bumpp/11.0.1/11.1.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/bumpp/11.1.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/bumpp/11.0.1/11.1.0?slim=true) | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`10.4.1` → `10.34.1`](https://renovatebot.com/diffs/npm/pnpm/10.4.1/10.34.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/10.34.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/10.4.1/10.34.1?slim=true) | | [shell-quote](https://redirect.github.com/ljharb/shell-quote) | [`^1.8.3` → `^1.8.4`](https://renovatebot.com/diffs/npm/shell-quote/1.8.3/1.8.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/shell-quote/1.8.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/shell-quote/1.8.3/1.8.4?slim=true) | --- ### Release Notes <details> <summary>antfu-collective/bumpp (bumpp)</summary> ### [`v11.1.0`](https://redirect.github.com/antfu-collective/bumpp/releases/tag/v11.1.0) [Compare Source](https://redirect.github.com/antfu-collective/bumpp/compare/v11.0.1...v11.1.0) ##### 🐞 Bug Fixes - Inherit stdio for git push to support windows SSH passphrase - by [@awdr74100](https://redirect.github.com/awdr74100) in [#122](https://redirect.github.com/antfu-collective/bumpp/issues/122) [<samp>(a30af)</samp>](https://redirect.github.com/antfu-collective/bumpp/commit/a30afd0) - **cli**: Prevent empty CLI files from overriding config-file `files` - by [@benny123tw](https://redirect.github.com/benny123tw) in [#120](https://redirect.github.com/antfu-collective/bumpp/issues/120) [<samp>(4e42e)</samp>](https://redirect.github.com/antfu-collective/bumpp/commit/4e42e32) ##### [View changes on GitHub](https://redirect.github.com/antfu-collective/bumpp/compare/v11.0.1...v11.1.0) </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v10.34.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.34.1): pnpm 10.34.1 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.34.0...v10.34.1) #### Patch Changes - Reject `pnpm-lock.yaml` entries whose remote tarball `resolution:` block is missing the `integrity` field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips `integrity:`) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under `--frozen-lockfile`. pnpm now fails closed at lockfile-read time with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`. Git-hosted tarballs (`gitHosted: true` or a URL on codeload.github.com / bitbucket.org / gitlab.com) and `file:` tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.  #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.34.0`](https://redirect.github.com/pnpm/pnpm/compare/v10.33.4...v10.34.0) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.33.4...v10.34.0) ### [`v10.33.4`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.33.4): pnpm 10.33.4 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.33.3...v10.33.4) #### Patch Changes - Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes. A new `gitHosted: true` field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase. - Fix a regression where `pnpm --recursive --filter '!<pkg>' run/exec/test/add` would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative `--filter` arguments are provided, matching the [documented behavior](https://pnpm.io/cli/recursive). To include the root, pass `--include-workspace-root` [#11341](https://redirect.github.com/pnpm/pnpm/issues/11341).  #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.33.3`](https://redirect.github.com/pnpm/pnpm/compare/v10.33.2...v10.33.3) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.33.2...v10.33.3) ### [`v10.33.2`](https://redirect.github.com/pnpm/pnpm/compare/v10.33.1...v10.33.2) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.33.1...v10.33.2) ### [`v10.33.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.33.1): pnpm 10.33.1 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.33.0...v10.33.1) ##### Patch Changes - When a project's `packageManager` field selects pnpm v11 or newer, commands that v10 would have passed through to npm (`version`, `login`, `logout`, `publish`, `unpublish`, `deprecate`, `dist-tag`, `docs`, `ping`, `search`, `star`, `stars`, `unstar`, `whoami`, etc.) are now handed over to the wanted pnpm, which implements them natively. Previously they silently shelled out to npm — making, for example, `pnpm version --help` print npm's help on a project with `packageManager: pnpm@11.0.0-rc.3` [#11328](https://redirect.github.com/pnpm/pnpm/issues/11328).  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.33.0`](https://redirect.github.com/pnpm/pnpm/compare/v10.32.1...v10.33.0) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.32.1...v10.33.0) ### [`v10.32.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.32.1): pnpm 10.32.1 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.32.0...v10.32.1) #### Patch Changes - Fix a regression where `pnpm-workspace.yaml` without a `packages` field caused all directories to be treated as workspace projects. This broke projects that use `pnpm-workspace.yaml` only for settings (e.g. `minimumReleaseAge`) without defining workspace packages [#10909](https://redirect.github.com/pnpm/pnpm/issues/10909).  #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.32.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.32.0): pnpm 10.32 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.31.0...v10.32.0) #### Minor Changes - Added `--all` flag to `pnpm approve-builds` that approves all pending builds without interactive prompts [#10136](https://redirect.github.com/pnpm/pnpm/issues/10136). #### Patch Changes - Reverted change related to setting explicitly the npm config file path, which caused regressions. - Reverted fix related to `lockfile-include-tarball-url`. Fixes [#10915](https://redirect.github.com/pnpm/pnpm/issues/10915).  #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.31.0`](https://redirect.github.com/pnpm/pnpm/compare/v10.30.3...v10.31.0) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.30.3...v10.31.0) ### [`v10.30.3`](https://redirect.github.com/pnpm/pnpm/compare/v10.30.2...v10.30.3) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.30.2...v10.30.3) ### [`v10.30.2`](https://redirect.github.com/pnpm/pnpm/compare/v10.30.1...v10.30.2) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.30.1...v10.30.2) ### [`v10.30.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.30.1): pnpm 10.30.1 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.30.0...v10.30.1) #### Patch Changes - Use the `/-/npm/v1/security/audits/quick` endpoint as the primary audit endpoint, falling back to `/-/npm/v1/security/audits` when it fails [#10649](https://redirect.github.com/pnpm/pnpm/issues/10649). #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> ### [`v10.30.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.30.0): pnpm 10.30 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.29.3...v10.30.0) #### Minor Changes - `pnpm why` now shows a reverse dependency tree. The searched package appears at the root with its dependents as branches, walking back to workspace roots. This replaces the previous forward-tree output which was noisy and hard to read for deeply nested dependencies. #### Patch Changes - Revert `pnpm why` dependency pruning to prefer correctness over memory consumption. Reverted PR: [#7122](https://redirect.github.com/pnpm/pnpm/pull/7122). - Optimize `pnpm why` and `pnpm list` performance in workspaces with many importers by sharing the dependency graph and materialization cache across all importers instead of rebuilding them independently for each one [#10596](https://redirect.github.com/pnpm/pnpm/pull/10596/changes). #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> ### [`v10.29.3`](https://redirect.github.com/pnpm/pnpm/compare/v10.29.2...v10.29.3) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.29.2...v10.29.3) ### [`v10.29.2`](https://redirect.github.com/pnpm/pnpm/compare/v10.29.1...v10.29.2) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.29.1...v10.29.2) ### [`v10.29.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.29.1): pnpm 10.29.1 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.28.2...v10.29.1) #### Minor Changes - The `pnpm dlx` / `pnpx` command now supports the `catalog:` protocol. Example: `pnpm dlx shx@catalog:`. - Support configuring `auditLevel` in the `pnpm-workspace.yaml` file [#10540](https://redirect.github.com/pnpm/pnpm/issues/10540). - Support bare `workspace:` protocol without version specifier. It is now treated as `workspace:*` and resolves to the concrete version during publish [#10436](https://redirect.github.com/pnpm/pnpm/pull/10436). #### Patch Changes - Fixed `pnpm list --json` returning incorrect paths when using global virtual store [#10187](https://redirect.github.com/pnpm/pnpm/issues/10187). - Fix `pnpm store path` and `pnpm store status` using workspace root for path resolution when `storeDir` is relative [#10290](https://redirect.github.com/pnpm/pnpm/issues/10290). - Fixed `pnpm run -r` failing with "No projects matched the filters" when an empty `pnpm-workspace.yaml` exists [#10497](https://redirect.github.com/pnpm/pnpm/issues/10497). - Fixed a bug where `catalogMode: strict` would write the literal string `"catalog:"` to `pnpm-workspace.yaml` instead of the resolved version specifier when re-adding an existing catalog dependency [#10176](https://redirect.github.com/pnpm/pnpm/issues/10176). - Fixed the documentation URL shown in `pnpm completion --help` to point to the correct page at <https://pnpm.io/completion> [#10281](https://redirect.github.com/pnpm/pnpm/issues/10281). - Skip local `file:` protocol dependencies during `pnpm fetch`. This fixes an issue where `pnpm fetch` would fail in Docker builds when local directory dependencies were not available [#10460](https://redirect.github.com/pnpm/pnpm/issues/10460). - Fixed `pnpm audit --json` to respect the `--audit-level` setting for both exit code and output filtering [#10540](https://redirect.github.com/pnpm/pnpm/issues/10540). - update tar to version 7.5.7 to fix security issue Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: <a href="https://redirect.github.com/advisories/GHSA-34x7-hfp2-rc4v">CVE-2026-24842</a> - Fix `pnpm audit --fix` replacing reference overrides (e.g. `$foo`) with concrete versions [#10325](https://redirect.github.com/pnpm/pnpm/issues/10325). - Fix `shamefullyHoist` set via `updateConfig` in `.pnpmfile.cjs` not being converted to `publicHoistPattern` [#10271](https://redirect.github.com/pnpm/pnpm/issues/10271). - `pnpm help` should correctly report if the currently running pnpm CLI is bundled with Node.js [#10561](https://redirect.github.com/pnpm/pnpm/issues/10561). - Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for `node_modules/.bin`, causing binaries to not be found when running commands like `pnpm exec` [#10457](https://redirect.github.com/pnpm/pnpm/issues/10457). #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> </tbody> </table> ### [`v10.28.2`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.28.2): pnpm 10.28.2 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.28.1...v10.28.2) #### Patch Changes - Security fix: prevent path traversal in `directories.bin` field. - When pnpm installs a `file:` or `git:` dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into `node_modules`. This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) and have their contents copied when the package is installed. Note: This only affects `file:` and `git:` dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected. - Fixed optional dependencies to request full metadata from the registry to get the `libc` field, which is required for proper platform compatibility checks [#9950](https://redirect.github.com/pnpm/pnpm/issues/9950). #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> </tbody> </table> ### [`v10.28.1`](https://redirect.github.com/pnpm/pnpm/compare/v10.28.0...v10.28.1) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.28.0...v10.28.1) ### [`v10.28.0`](https://redirect.github.com/pnpm/pnpm/compare/v10.27.0...v10.28.0) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.27.0...v10.28.0) ### [`v10.27.0`](https://redirect.github.com/pnpm/pnpm/compare/v10.26.2...v10.27.0) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.26.2...v10.27.0) ### [`v10.26.2`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.26.2): pnpm 10.26.2 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.26.1...v10.26.2) #### Patch Changes - Improve error message when a package version exists but does not meet the `minimumReleaseAge` constraint. The error now clearly states that the version exists and shows a human-readable time since release (e.g., "released 6 hours ago") [#10307](https://redirect.github.com/pnpm/pnpm/issues/10307). - Fix installation of Git dependencies using annotated tags [#10335](https://redirect.github.com/pnpm/pnpm/issues/10335). Previously, pnpm would store the annotated tag object's SHA in the lockfile instead of the actual commit SHA. This caused `ERR_PNPM_GIT_CHECKOUT_FAILED` errors because the checked-out commit hash didn't match the stored tag object hash. - Binaries of runtime engines (Node.js, Deno, Bun) are written to `node_modules/.bin` before lifecycle scripts (install, postinstall, prepare) are executed [#10244](https://redirect.github.com/pnpm/pnpm/issues/10244). - Try to avoid making network calls with preferOffline [#10334](https://redirect.github.com/pnpm/pnpm/pull/10334). #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> </tbody> </table> ### [`v10.26.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v10.26.1): pnpm 10.26.1 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v10.26.0...v10.26.1) #### Patch Changes - Don't fail on `pnpm add`, when `blockExoticSubdeps` is set to `true` [#10324](https://redirect.github.com/pnpm/pnpm/issues/10324). - Always resolve git references to full commits and ensure `HEAD` points to the commit after checkout [#10310](https://redirect.github.com/pnpm/pnpm/pull/10310). #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="c > ✂ **Note** > > PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month (`* 0-3 1 * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vitejs/launch-editor).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Fixes GHSA-v6wh-96g9-6wx3

aviel-lanzman and others added 22 commits April 27, 2026 08:42

feat: add Windsurf support

2fcc74a

ci: add renovate (vitejs#120)

f1829bf

chore: add oxfmt (vitejs#123)

68c70f9

ci: add zizmor (vitejs#125)

58ab6e0

chore: add oxlint (vitejs#126)

61fd2e6

ci: run test ci (vitejs#127)

1fc7052

chore: update repo link (vitejs#128)

b4992fa

chore: remove unused deps

ae007bb

ci: harden publish settings

7c0bfdd

v2.14.0

e2ebf0d

chore: add README (vitejs#134)

be88ef7

test: add some tests for launch-editor package (vitejs#135)

88ef433

ci: run tests on mac and windows (vitejs#136)

6dc60d7

fix: reject UNC paths (vitejs#138)

f586ed1

Fixes GHSA-v6wh-96g9-6wx3

v2.14.1

d293c4d

Merge branch 'main' into feat/add-windsurf-support

e0e2011

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add Windsurf support#117

feat: add Windsurf support#117
aviel-lanzman wants to merge 22 commits into
vitejs:mainfrom
aviel-lanzman:feat/add-windsurf-support

aviel-lanzman commented Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

aviel-lanzman commented Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants