[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending	OpenSSF
@aws-sdk/client-s3 (source)	devDependencies	minor	^3.1117.0 → ^3.1124.0	3.1161.0
@testing-library/dom	devDependencies	patch	^10.4.1 → ^10.4.1
@testing-library/react	devDependencies	patch	^16.3.2 → ^16.3.2
@testing-library/user-event	devDependencies	patch	^14.6.6 → ^14.6.7
@types/node (source)	devDependencies	minor	^24.0.0 → ^24.19.2
@types/react (source)	devDependencies	minor	^19.2.18 → ^19.3.0
@types/react-dom (source)	devDependencies	minor	^19.1.6 → ^19.3.0
@vitest/coverage-v8 (source)	pnpm.catalog.default	patch	4.1.11 → 4.1.12
jsdom	devDependencies	minor	^30.0.1 → ^30.0.1
pnpm (source)	packageManager	minor	11.24.0 → 11.28.9	11.28.10
publint (source)	devDependencies	patch	^0.3.24 → ^0.3.24
react (source)	devDependencies	minor	^19.2.8 → ^19.3.1
react-aria-components	dependencies	minor	1.20.0 → 1.22.1
react-dom (source)	devDependencies	minor	^19.2.8 → ^19.3.1
vite (source)	pnpm.catalog.default	patch	0.3.0 → 0.3.3
vite-plus (source)	pnpm.catalog.default	patch	0.3.0 → 0.3.3
vitest (source)	pnpm.catalog.default	patch	4.1.11 → 4.1.12
voidzero-dev/setup-vp	action	minor	v1.18.0 → v1.22.0
zustand	dependencies	patch	5.0.15 → 5.0.16

---

Release Notes

aws/aws-sdk-js-v3 (@​aws-sdk/client-s3)

v3.1160.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1159.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1158.0

Compare Source

Bug Fixes

• client-s3: isolate special character e2e test keys (#​8382) (d9c091f)

v3.1157.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1156.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1155.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1154.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1153.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1152.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1151.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1150.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1149.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1148.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1147.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1146.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1145.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1144.0

Compare Source

Features

• client-s3: Amazon S3 adds a new optional S3 Inventory field, IntelligentTieringReferenceDate, reporting the reference date S3 Intelligent-Tiering uses to evaluate an object's tier-transition eligibility. The value is populated for objects in the Intelligent-Tiering storage class and left blank for others. (82bbbdc)

v3.1143.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1142.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1141.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1140.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1139.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1138.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1137.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1136.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1135.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1134.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1133.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1132.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1131.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1130.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1129.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1128.0

Compare Source

Features

• client-s3: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (8b58987)

v3.1127.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1126.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1125.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

testing-library/dom-testing-library (@​testing-library/dom)

v10.4.2

Compare Source

Bug Fixes

• deps: pin @​types/node to a TypeScript 4-compatible version (#​1386) (6049cc0)

testing-library/react-testing-library (@​testing-library/react)

v16.3.3

Compare Source

Bug Fixes

• Avoid act() re-entrant when dispatching events (#​1468) (20ce75f)

testing-library/user-event (@​testing-library/user-event)

v14.6.8

Compare Source

Bug Fixes

• treat programmatic null input values as empty string (#​1329) (1951eb7)

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.12

Compare Source

   🐞 Bug Fixes

• mocker: Harden manual and redirect mocks [backport to v4]  -  by @​sheremet-va in #​11580 (b8253)

    View changes on GitHub

jsdom/jsdom (jsdom)

v30.1.3

Compare Source

• Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
• Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
• Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
• Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
• Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
• Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
• Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
• Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
• Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
• Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
• Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
• Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
• Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
• Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)

v30.1.2

Compare Source

• Updated URLs to support Unicode v18.0.0 in internationalized domain names.
• Reduced package size and memory use for CSS property definitions. (@​scttcper)
• Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
• Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
• Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
• Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
• Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
• Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.
• Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().
• Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)
• Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.
• Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.
• Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)

v30.1.1

Compare Source

• Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
• Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)
• Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)
• Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)
• Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)
• Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.
• Fixed the storageQuota option being ignored by frames.
• Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.
• Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)
• Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.
• Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.
• Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

v30.1.0

Compare Source

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

• Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
• Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
• Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
• Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
• Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
• Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
• Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
• Changed window.close() to preserve access to the document and its DOM through retained references.
• Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
• Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
• Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
• Fixed :focus matching in shadow trees. (@​asamuzaK)
• Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during element.replaceWith().
• Fixed the ordering of script execution, custom element callbacks, iframe loading, and mutation observer notifications during DOM insertion, including in shadow trees.
• Fixed queued events and navigation continuing after window.close() or iframe removal, and prevented new scripts, resource loads, timers, and animation frames from starting in destroyed documents. (@​scttcper)
• Fixed parent documents waiting indefinitely for loading to finish when a child iframe removes itself during loading.
• Fixed request cancellation across redirects, during pending requestInterceptor() callbacks, and when reusing an XMLHttpRequest after aborting it.
• Fixed resource loading and JSDOM.fromURL() potentially hanging when response handling throws and response stream cleanup does not finish.
• Fixed successful cached resource loads being treated as aborted.
• Fixed getComputedStyle() and document.styleSheets using the wrong stylesheet order after inserting or updating <style> elements.
• Fixed getComputedStyle() ignoring nested @import and @media rules in imported stylesheets, and returning stale results after imports finish loading.
• Fixed style invalidation, stylesheet removal, and frame source updates in shadow trees.
• Fixed repeated getComputedStyle() calls changing case-sensitive background URLs, and inconsistent resolution of border shorthands containing system colors. (@​scttcper)
• Fixed computed border widths, including borderless elements incorrectly reporting 16px, which regressed in v30.0.0. (@​Alberto-BaseNet)
• Fixed getComputedStyle() to resolve 'font-weight' keywords to numeric values. (@​tianrking)
• Fixed getComputedStyle() to convert lengths to pixels inside CSS math functions containing percentages, and to resolve percentages in 'font-size' math functions. (@​soroushm)
• Fixed serialization of min() and max() containing nested calc(), which regressed in v30.0.0. (@​asamuzaK)
• Fixed CSS values mixing lengths or percentages with math functions, such as 'grid-template-columns' values containing both 100px and calc(). (@​rome-xi)
• Fixed parsing of 'background' and 'border' shorthands with adjacent components, such as url(a.png)no-repeat, including a crash when parsing inline styles. Also fixed handling of invalid shorthand assignments and escaped or unusual characters in CSS declarations. (@​asamuzaK)
• Fixed parsing of unitless zero values in 'flex' shorthands, such as 35 1 0, and rejection of negative 'flex-basis' lengths and percentages. (@​asamuzaK)
• Fixed shorthand style assignments producing extra mutation records and custom element callbacks for intermediate values. (@​scttcper)
• Fixed Range and Selection handling of CDATA sections, including boundary offsets and range cloning, extraction, deletion, insertion, and stringification. (@​scttcper)
• Fixed text.normalize() incorrectly removing the text node or merging its siblings. (@​scttcper)
• Fixed cloning and importing CDATA sections and processing instructions whose contents have been modified, and serialization of CDATA sections adopted into HTML documents.
• Fixed stale named-property collections on window, and incorrect named access from empty or namespaced id="" and name="" values. (@​scttcper)
• Fixed elements in documents created with DOMParser or document.implementation.createHTMLDocument() appearing as named properties on window and being retained in memory. (@​Iaotle)
• Fixed memory leaks from mutation observers retaining observed nodes, abort signals retaining removed event listeners, and storage event tracking retaining closed windows. (@​scttcper)
• Fixed storage events being sent to windows created after the storage change, and ensured surviving recipients still receive events when the source document is destroyed.
• Fixed attribute lookups after namespace prefix changes, and namespaced attributes incorrectly affecting ID lookups and element behavior. (@​scttcper)
• Fixed input.list in detached element trees. (@​scttcper)
• Fixed attr.ownerDocument after setting an attribute node on an element in another document or adopting its element. (@​Kjubikstronk)
• Fixed fresh element.getElementsByTagName() calls using the previous document's case-sensitivity rules after adoption between HTML and XML documents. (@​Kjubikstronk)
• Fixed element.tagName returning stale casing after adoption between HTML and XML documents.
• Fixed radio button grouping and checkedness updates for controls with different form owners, controls outside their form, unnamed controls, and canceled clicks.
• Fixed <select> selection updates when moving options, and unintended selection resets when moving a whole <select> or changing unrelated descendants.
• Fixed cloning <input> elements to preserve input.indeterminate.
• Fixed focus state after removing a focused element or its ancestor, including inside shadow trees.
• Fixed script execution when inserting children into a connected, empty <script>. (@​Kjubikstronk)
• Fixed incorrect script execution after changes to src="", and handling of type="", for="", and event="".
• Fixed document.currentScript during nested script execution and scripts in shadow trees.
• Fixed event dispatch, window.event, and default passive listener handling for non-node event targets, and event dispatch when user code modifies window.constructor.
• Fixed volumechange and ratechange events to fire asynchronously. (@​christianaurichzm)
• Fixed DOM APIs accepting user-created proxies around DOM objects where genuine DOM objects are required.
• Fixed XPath iterator invalidation after DOM mutations and errors for invalid result types.
• Fixed NodeIterator traversal when its filter removes nodes.
• Fixed fileReader.readAsText() to honor the blob's MIME type charset when no supported explicit encoding is supplied.
• Fixed fractional seconds in time input parsing and serialization. (@​Jaybhade)
• Fixed large input.valueAsNumber assignments for time and local date/time inputs.
• Fixed hard wrapping of <textarea> values to use the numeric textarea.cols value.
• Fixed document.readyState to be "complete" for documents created with document.implementation.createDocument() and document.implementation.createHTMLDocument().
• Fixed element.translate for empty translate="" values and elements without a parent.
• Fixed XML parsing of lone surrogates to replace them with the Unicode replacement character.
• Fixed node.lookupNamespaceURI() for the xml and xmlns prefixes. (@​vojtisprime11)
• Fixed <base> elements to ignore data: and javascript: URLs. (@​vojtisprime11)
• Fixed svgElement.viewportElement inside <symbol> elements.
• Fixed the default blobEvent.timecode to be NaN.
• Fixed the object shape and property descriptors of CSS.

pnpm/pnpm (pnpm)

v11.28.9: pnpm 11.28.9

Compare Source

This release fixes a crash on registry responses with too many content encodings (GHSA-xjj6-f33q-929c) and sizes the install worker pool by the container's CPU quota. A repeat pnpm install now acts on more setting changes.

Patch Changes

Crashes and security

• A registry response with too many content encodings can no longer crash pnpm. pnpm now uses undici 7.30.1, which fixes GHSA-xjj6-f33q-929c.

• pnpm install now sizes its worker pool by the CPU quota of the container it runs in, such as a Kubernetes CPU limit, when that quota is smaller than the number of CPUs the container may run on. The default workspaceConcurrency respects the quota the same way. On a CI runner with a 4-CPU quota and hundreds of host CPUs, pnpm started hundreds of workers and ran out of memory #​17382.

Repeat installs and changed settings

• A repeat pnpm install now acts on a change to these settings. Before, it reported "Already up to date".

  • storeDir or virtualStoreDir: it recreates node_modules.
  • virtualStoreDirMaxLength: it renames the virtual store directories.
  • dangerouslyAllowAllBuilds turned on: it runs the builds it skipped.
  • trustLockfile turned off: it verifies the lockfile.

• pnpm add, pnpm remove, and pnpm update now fail when the node-linker setting differs from the one recorded in node_modules. A pnpm install of the whole workspace recreates node_modules with the new node-linker, and an install filtered to some projects fails pnpm/tasks#203.

• An install filtered to some workspace projects now fails if node_modules was installed with a different nodeLinker, hoistPattern, publicHoistPattern, store, or virtual store. Before, it recreated node_modules and left the projects it skipped without their dependencies. A pnpm install of the whole workspace still recreates node_modules pnpm/tasks#217.

• pnpm install now takes its fast path in a workspace with patchedDependencies when the previous install ran with another major version of pnpm.

• pnpm install now relinks the bins of a workspace package when its bin field changes, including with --frozen-lockfile and an unchanged lockfile. A filtered install relinks them in the selected projects, and the next install that covers the remaining projects relinks them there #​17324.

• pnpm install now removes command shims from node_modules/.bin when a workspace dependency renames or removes an entry from its bin field pnpm/tasks#211.

• With nodeLinker: hoisted, an install that stops partway no longer leaves the next install trusting the packages it was replacing. Before, reverting the change that started the stopped install, such as a patch edit, kept the half-replaced package in node_modules.

• pnpm run and pnpm exec no longer report the dependencies as out of date after a lockfile change when dedupePeers is true #​17322.

Resolving dependencies and the lockfile

• A package that a plain range and a <prefix>: specifier both resolve from one registry is now recorded once in pnpm-lock.yaml and installed once. The lockfile key names the registry a package resolved from. When that registry declares a prefix, through prefix in registries or through namedRegistries, the package is keyed <name>@<prefix>:<version> however its dependency was written: with the prefix, as a plain range its scope routes to that registry, or through the default registry. Before, the plain range was keyed <name>@<version>, so one tarball was installed twice and instanceof checks and module singletons broke between the two copies. The same name and version served by two registries still get separate entries. When several prefixes declare one registry, its packages are keyed by the lexicographically smallest prefix.

  If a scope you route reaches a registry that also declares a prefix, your next pnpm install re-keys those entries, which shows up as a lockfile diff. Commit it. pnpm install --frozen-lockfile installs the lockfile as recorded.

• pnpm install now resolves a scope's packages again when the scope is routed to another registry in registries. Before, the lockfile kept the versions and integrity resolved from the old registry, so the install failed when the new registry did not serve a locked version or served different content. pnpm records in the workspace state which registry each scope routed to, so a fresh clone without that record installs the lockfile as recorded. Changing the default registry resolves nothing again, and pnpm install --frozen-lockfile is unchanged.

• An optional dependency written with a named-registry prefix, such as work:^1.0.0, now fails the install when it cannot be resolved but the lockfile already has a matching entry from that registry. Such a dependency was skipped, which removed its entries from the lockfile.

• With injectWorkspacePackages: true, a workspace: dependency written as a relative path, such as workspace:../lib-a, in a workspace package now resolves from that package's directory #​17284.

• Fixed pnpm install failing with ERR_PNPM_UNSUPPORTED_PROTOCOL when a workspace package injected through a relative path, such as workspace:../lib, has catalog: dependencies. Their catalog entries now resolve the way they do for a package injected by name #​17280.

• pnpm install now applies the serverType registry setting when it updates the lockfile for an override or catalog change without a full resolution. pnpm wrote the tarball URLs of a declared registry into the lockfile in that case.

• Added the pnpr value to the serverType registry setting. pnpm leaves the tarball URLs of a pnpr registry out of pnpm-lock.yaml.

• A registries entry whose prefix is __proto__ is no longer ignored.

• Installs delegated to a pnpr server now resolve every prefix declared for a registry URL. A dependency or lockfile entry that used the second of two prefixes for the same registry, such as zeta: next to work: in namedRegistries, failed on the server pnpm/tasks#204.

Registries, proxies, and downloading pnpm

• The proxy settings httpProxy, httpsProxy, noProxy, proxy, and noproxy set in the global config.yaml, through PNPM_CONFIG_HTTPS_PROXY and the matching variables, or as --config.httpsProxy on the command line now apply to pnpm self-update and to the download of the pnpm version pinned in packageManager. Previously, these requests read the proxy only from .npmrc and the HTTPS_PROXY family of variables pnpm/tasks#215.

• When https-proxy is false, pnpm now downloads the pnpm version pinned by packageManager through the legacy proxy setting, as installs already do. Setting proxy to false now also stops that download from using the HTTP_PROXY environment variable. The signature check of the pinned pnpm now uses the same proxy and TLS settings as its download pnpm/tasks#193.

• strictSsl and localAddress set in the global config.yaml, through PNPM_CONFIG_STRICT_SSL and PNPM_CONFIG_LOCAL_ADDRESS, or on the command line now apply to pnpm self-update and to the download of the pnpm version pinned in packageManager. These requests read them from .npmrc only before. --config.localAddress now reaches them in the camelCase spelling too pnpm/tasks#201.

Commands

• pnpm audit --ignore and pnpm audit --ignore-unfixable now exit with a non-zero code when vulnerabilities at or above the audit level remain after ignoring. Before, these commands always exited with code 0.

• pnpm audit --fix and pnpm audit --interactive now fail with ERR_PNPM_AUDIT_FIX_WITH_IGNORE when combined with --ignore or --ignore-unfixable. Before, the fix ran and the ignore flags had no effect.

• pnpm ci --lockfile and pnpm ci --config.lockfile=true no longer delete pnpm-lock.yaml. pnpm ci now always keeps the lockfile and runs a frozen install from it.

• pnpm deploy now keeps a deployed symlink to a directory inside the project even if the directory is not among the deployed files, such as a link into node_modules #​17288.

• pnpm pack and pnpm publish again include the files of a publishConfig.directory that is reached through a symlink, together with its bundled dependencies #​17390.

• pnpm -r publish --batch now sends PUT /-/pnpr/v0/publish, the batch publish endpoint that pnpr serves.

• pnpm store prune now keeps the packages that a project still uses when pnpm copied or cloned them into node_modules. These include patched packages, built packages, and every package installed with packageImportMethod: copy. Before, the prune removed them, and the next install downloaded them again #​7192.

• pnpm store prune now keeps the packages of a project that was installed with a different symlinked spelling of the store path. Previously, prune dropped such a project from its list and removed the packages only that project used from the global virtual store.

Speed and output

• Sped up installs of projects whose local directory dependencies share transitive local directory dependencies. pnpm no longer checks a shared directory again for each direct dependency that reaches it #​17374.

• Output that fills the terminal, such as pnpm run --stream script output, is now written once. Before, every new line also rewrote all the lines already on screen #​17387.

• The warning about unrecognized settings now marks symlinkedLockfileTargetDirs as a setting of a newer pnpm version.

Platinum Sponsors

Gold Sponsors

	config help if that's undesired. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

✓ Lockfile passes supply-chain policies (verified 972ms ago)
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 203, reused 0, downloaded 0, added 0
[ERR_PNPM_STRICT_MIN_RELEASE_AGE_REQUIRES_SAVE] minimumReleaseAgeStrict cannot be combined with --no-save: approval would require writing to minimumReleaseAgeExclude in pnpm-workspace.yaml, which --no-save prevents.

Drop --no-save so the exclude list can be persisted, or set minimumReleaseAgeStrict: false to let the install proceed without prompting (the lockfile would still trigger the auto-collect on the next normal install).