You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#7535ea1c48f Thanks @ragelink! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available as cynefin-beta). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design.
#7721f45cc2c Thanks @notionparallax! - feat(treeView): add box-drawing character input support for treeView diagrams
#7527b4d0442 Thanks @notionparallax! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures.
#7793a6f097d Thanks @SSDWGG! - feat(er): support optional ER attribute types with a ? suffix
#777237f2e36 Thanks @devareddy05! - feat(gantt): support multiple excludes / includes lines so long exclusion lists can be split into commented groups (#6270)
#77084e63e9d Thanks @txmxthy! - feat(architecture): add align row|column {ids…} directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly.
#776005223be Thanks @ngdaniels! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice
#7251216e4e9 Thanks @ydah! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta).
#7284c1f116d Thanks @darshanr0107! - fix(gantt): Render gantt vertical markers without affecting row layout or chart height
#778672fbab1 Thanks @knsv-bot! - fix(er): allow special characters (e.g. dots) in ER diagram attribute names and types by escaping them with backticks
c112b61: Added a --dry-run option to pnpm install. It runs a full dependency resolution and reports what an install would change, but writes nothing to disk (no lockfile, no node_modules) and always exits with code 0. This mirrors the preview semantics of npm install --dry-run#7340.
179ebc4: pnpm run --no-bail now exits with a non-zero exit code when any of the executed scripts fail, while still running every matched script to completion. This makes the exit-code behavior of --no-bail consistent between recursive and non-recursive runs (recursive runs already failed at the end). Previously, a non-recursive pnpm run --no-bail always exited with code 0, even when a script failed #8013.
0474a9c: Added support for generating Node.js package maps at node_modules/.package-map.json during isolated and hoisted installs. Added the node-experimental-package-map setting to inject the generated map into pnpm-managed Node.js script environments, and the node-package-map-type setting to choose between standard and loose package maps.
dcededc: pnpm sbom now marks components reachable only through devDependencies with CycloneDX scope: "excluded" and the cdx:npm:package:development property. The excluded scope documents "component usage for test and other non-runtime purposes", which matches the semantics of a devDependency; the property is the CycloneDX npm-taxonomy marker emitted by @cyclonedx/cyclonedx-npm, so both modern (scope) and existing (property) consumers are covered. Components reachable at runtime (including installed optionalDependencies) omit scope and default to required.
1495cb0: Added per-package SBOM generation with --out and --split flags. Use --out out/%s.cdx.json to write one SBOM per workspace package to individual files, or --split for NDJSON output to stdout. When --filter selects a single package, the SBOM root component now uses that package's metadata. Workspace inter-dependencies (workspace: protocol) and their transitive dependencies are included. Author, repository, and license fall back to the root manifest when the package doesn't define them.
293921a: feat(view): support searching project manifest upward when package name is omitted
When running pnpm view without a package name, the command now searches
upward for the nearest project manifest (package.json, package.yaml, or package.json5) and uses its name field.
If the manifest exists but lacks a name field, an error is thrown.
This change also replaces the find-up dependency with empathic for
improved performance and consistency across workspace tools.
Patch Changes
29ab905: Fixed pnpm update overriding the version range policy of a named catalog whose name parses as a version (e.g. catalog:express4-21). The catalog: reference carries no pinning of its own, so the prefix from the catalog entry (such as ~) is now preserved instead of being widened to ^#10321.
bee4bf4: Security: validate config dependency names and versions from the env lockfile (pnpm-lock.yaml) before using them to build filesystem paths. A committed lockfile with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions; the same validation is applied to optional subdependencies of config dependencies, and to the legacy workspace-manifest format before any lockfile is written. See GHSA-qrv3-253h-g69c.
96bdd57: Fix link: workspace protocol switching to file: after pnpm rm is run from inside a workspace package whose target workspace dependency has its own dependencies, when injectWorkspacePackages: true is set. Follow-up to #10575, which fixed the same symptom for workspace packages without dependencies.
302a2f7: No longer warn about using both packageManager and devEngines.packageManager when the two fields pin the same package manager at the same version with the same integrity hash (e.g. both pnpm@11.5.1+sha512.…). Previously the hash was stripped from the legacy packageManager field but not from devEngines.packageManager, so even identical specifications looked like a mismatch #12028.
The warning still fires on any genuine divergence, and several cases now state the specific reason instead of a single generic message: a different package manager, a different version, or contradictory integrity hashes for the same version.
3f0fb21: Fixed the progress line showing leftover characters from external processes that write to the terminal between progress updates (e.g. an SSH passphrase prompt would leave a fragment like added 0sa':). The interactive reporter now redraws each frame in place, erasing to the end of the display before reprinting, so any such remnants are cleared #12350.
564619f: Fixed pnpm approve-builds reporting "no packages awaiting approval" when a build-script dependency whose approval was revoked (e.g. after git stash drops the allowBuilds from pnpm-workspace.yaml) is re-added. The revoked packages are now correctly recorded in .modules.yaml so approve-builds can find them. #12221
3d1fd20: Skip the redundant "target bin directory already contains an exe called node" warning on Windows when the existing node.exe already matches the target (same hard link or identical content) pnpm/pnpm#12203.
1b02b47: Fix macOS Gatekeeper blocking native binaries (.node, .dylib, .so) by removing the com.apple.quarantine extended attribute after importing them from the store.
When pnpm imports files from its content-addressable store into node_modules, macOS preserves extended attributes, including com.apple.quarantine. If this xattr is present on a store blob (e.g. it was first written under a Gatekeeper-enabled app such as a Git client), it propagates to node_modules, and Gatekeeper blocks the native binary from loading even though pnpm already verified the file's integrity against the lockfile.
After importing a package, pnpm now strips com.apple.quarantine from its native binaries, matching Homebrew's behaviour of dropping quarantine from verified downloads. The cleanup is macOS-only, runs in a single batched xattr call per package, is restricted to n
✂ Note
PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
Branch creation
Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
If you want to rebase/retry this PR, check this box
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: this dependency update bumps vite-plus 0.1.24→0.2.1 and pnpm 11.6→11.8 with a large lockfile churn, which exceeds the low-risk approval threshold. The zrr-website-slides Workers build also failed; human review is needed before merge. Requested reviewer: zrr1999.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: this dependency update bumps vite-plus 0.1.24→0.2.1 and pnpm 11.6→11.8 with large lockfile churn, exceeding the low-risk threshold; prek CI failed on minimumReleaseAge for oxlint 1.71.0 and Workers builds are failing. Reviewer zrr1999 is already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: this dependency update bumps vite-plus 0.1.24→0.2.1 and pnpm 11.6→11.8 with large lockfile churn, exceeding the low-risk approval threshold. Cursor Bugbot did not run on this PR; reviewer zrr1999 is already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: this dependency update bumps vite-plus 0.1.24→0.2.1 and pnpm 11.6→11.8 with large lockfile churn, exceeding the low-risk approval threshold. prek CI passed; Cursor Bugbot did not run on this PR. Reviewer zrr1999 is already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: this dependency update bumps vite-plus 0.1.24→0.2.1 and pnpm 11.6→11.9 with large lockfile churn, exceeding the low-risk threshold; prek failed on minimumReleaseAge and Workers builds are failing. Cursor Bugbot did not run; reviewer zrr1999 is already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: this dependency update bumps vite-plus 0.1.24→0.2.1 and pnpm 11.6→11.9 with large lockfile churn, exceeding the low-risk threshold; prek failed on minimumReleaseAge (astro-mermaid@2.1.0) and all Workers builds failed. Cursor Bugbot did not run; reviewer zrr1999 is already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: this dependency update bumps vite-plus 0.1.24→0.2.1 and pnpm 11.6→11.9 with large lockfile churn, exceeding the low-risk threshold; prek failed on minimumReleaseAge and Workers builds are failing. Cursor Bugbot did not run; reviewer zrr1999 is already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
zrr1999
changed the title
⬆️ deps: Update dependencies (non-major)
📦 build(deps): update dependencies and upgrade Astro to v7
Jun 25, 2026
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: this dependency update bumps vite-plus 0.1.24→0.2.1 and pnpm 11.6→11.9 with large lockfile churn, exceeding the low-risk threshold; Workers builds are failing for zrr-website-slides. Cursor Bugbot did not run; reviewer zrr1999 is already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: this dependency update bumps vite-plus 0.1.24→0.2.1 and pnpm 11.6→11.9 with large lockfile churn, exceeding the low-risk threshold; all Workers builds failed. Cursor Bugbot did not run; reviewer zrr1999 is already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: this dependency update upgrades Astro to v7 and bumps vite-plus and pnpm with large lockfile churn, exceeding the low-risk approval threshold. Cursor Bugbot did not run on this PR; reviewer zrr1999 is already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Risk: medium. Not approving: this Astro v7 and toolchain dependency update exceeds the low-risk approval threshold. Reviewer zrr1999 is already assigned.
Sent by Cursor Approval Agent: Pull Request Approver
zrr1999
changed the title
📦 build(deps): update dependencies and upgrade Astro to v7
⬆️ deps: update dependencies and upgrade Astro to v7
Jun 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
zrr1999
changed the title
This PR contains the following updates:
1.18.0→1.21.02.0.2→2.1.011.15.0→11.16.01.69.0→1.71.011.6.0→11.9.00.1.24→0.2.10.1.24→0.2.13.5.38→3.5.394.100.0→4.104.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
lucide-icons/lucide (@lucide/astro)
v1.21.0: Version 1.21.0Compare Source
What's Changed
versionscripts in package scripts by @ericfennis in #4479broken-boneicon by @Patolord in #4131New Contributors
Full Changelog: lucide-icons/lucide@1.20.0...1.21.0
v1.20.0: Version 1.20.0Compare Source
What's Changed
square-arrow-*icons by @jguddas in #3926search-icons by @jamiemlaw in #4099save-checkicon by @Konixy in #3120tag-plusandtag-xicons by @adam-kov in #3980banknote-checkicon by @mfjramirezf in #3956clock-arrow-inicon by @jguddas in #2403summaryicon by @jpjacobpadilla in #3114user-round-arrow-inicon by @jguddas in #2283clock-arrow-outicon by @jguddas in #2404pencil-sparklesicon by @jennieboops in #4445New Contributors
Full Changelog: lucide-icons/lucide@1.19.0...1.20.0
v1.19.0: Version 1.19.0Compare Source
What's Changed
star-*icons by @RajnishKMehta in #3918save-penicon by @vaporvee in #4179wrench-officon by @nilsjonsson in #4434adicon by @jamiemlaw in #4323eye-dashedicon by @karsa-mistmere in #4415save-plusicon by @jwlinqx in #4448list-sort-descendingicon by @ericfennis in #4457wallet-cardsicon by @jguddas in #3888podiumicon by @jguddas in #2124New Contributors
Full Changelog: lucide-icons/lucide@1.18.0...1.19.0
joesaby/astro-mermaid (astro-mermaid)
v2.1.0Compare Source
Features
v2.0.4Compare Source
Bug Fixes
v2.0.3Compare Source
Bug Fixes
mermaid-js/mermaid (mermaid)
v11.16.0Compare Source
Minor Changes
#7535
ea1c48fThanks @ragelink! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available ascynefin-beta). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design.#7721
f45cc2cThanks @notionparallax! - feat(treeView): add box-drawing character input support for treeView diagrams#7550
f1f4d45Thanks @DominicBurkart! - feat(xychart): add per-point text labels for xychart line plots#7527
b4d0442Thanks @notionparallax! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures.#7793
a6f097dThanks @SSDWGG! - feat(er): support optional ER attribute types with a?suffix#7772
37f2e36Thanks @devareddy05! - feat(gantt): support multipleexcludes/includeslines so long exclusion lists can be split into commented groups (#6270)#7708
4e63e9dThanks @txmxthy! - feat(architecture): addalign row|column {ids…}directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly.#7760
05223beThanks @ngdaniels! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice#7251
216e4e9Thanks @ydah! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta).#7774
e5c75e6Thanks @ngdaniels! - feat(xychart): enable rotate label on X-axis#7791
974fa7bThanks @knsv-bot! - feat(swimlane): add swimlane as a standalone diagram type with a dedicated layered orthogonal layout algorithmPatch Changes
#7744
633c261Thanks @ashishjain0512! - fix(architecture): addarchitecture.seedconfig option to make architecture diagrams render deterministically. Resolves #7729.#7732
c8ba156Thanks @rkdfx! - fix: tolerate leading horizontal whitespace before YAML frontmatter delimiters. Closes #7613#7314
4e4e6c4Thanks @darshanr0107! - fix(flowchart): Prevent crash when flowchart node shape is undefined#7762
cfd2391Thanks @Dharya-dev! - fix(class): support styling and callbacks for generic classes#7284
c1f116dThanks @darshanr0107! - fix(gantt): Render gantt vertical markers without affecting row layout or chart height#7786
72fbab1Thanks @knsv-bot! - fix(er): allow special characters (e.g. dots) in ER diagram attribute names and types by escaping them with backticks#7672
4887e97Thanks @sjackson0109! - fix(flowchart): respect per-subgraph direction keyword in Dagre layout. Fixes #4648#7734
a4c1e50Thanks @OfirHaf! - fix(block): read block padding and sanitize config dynamically instead of at module load time#7674
cc75089Thanks @cyphercodes! - fix(block): respect current DOMPurify config when sanitizing labels#7711
be2e282Thanks @Jinacker! - fix(flowchart): render flowchart and state self-loop edges as a single SVG path.#7781
d945968Thanks @Dharya-dev! - fix(radar): align axis labels based on angular position to prevent clipping#7661
2f5e9e8Thanks @nabila401! - fix(venn): fix 3-circle venn diagram union rendering#7780
8dcdce4Thanks @Dharya-dev! - fix(xychart): truncate plot data to match x-axis category count#7235
1bbc189Thanks @darshanr0107! - fix: Support consecutive LaTeX in node text#7247
365c1b1Thanks @darshanr0107! - fix(treeView): Ensure treemap labels render correctly in large nested diagrams#7754
06a32b7Thanks @palgunatm66! - fix(sequence): sequenceDiagram rect backgrounds using theme-aware fallback colors#7693
afaf306Thanks @dull-bird! - fix(quadrant-chart): allow CJK, emoji, Latin-1 accented characters, and other non-ASCII text in unquoted axis/quadrant/point labels. Fixes #7120.#7751
79e97cdThanks @puneetdixit200! - fix(state): render state diagram click tooltips with mermaidTooltip#7570
c2305dfThanks @PinguinsRule! - fix(state): Fix invalid syntax between state and '{'#7758
a4a250bThanks @mk24x7! - fix(venn): render labeled higher-arity unions when the underlying pairwise unions are not declared. Resolves #7656.Updated dependencies [
ea1c48f,b4d0442,4e63e9d,216e4e9]:oxc-project/oxc (oxlint)
v1.71.0Compare Source
🚀 Features
0dc2405linter: Add schema foreslint/no-restricted-properties(#23619) (Sysix)b638d0elinter: Add schema fornode/callback-return(#23615) (Sysix)eb8bedclinter: Add schema forimport/extensions(#23557) (WaterWhisperer)46f3625linter: Implement node/no-sync rule (#23589) (fujitani sora)b01739alinter: Add schema forunicorn/numeric-separators-style(#23554) (Mikhail Baev)68afd2alinter/node: Implementno-mixed-requiresrule (#23539) (fujitani sora)a421215linter: Add schema foreslint/prefer-destructuring(#23410) (WaterWhisperer)84438belinter/jsdoc: Added missing options torequire-param-description(#23416) (kapobajza)51910dflinter/jsdoc: Add missing options torequire-param-typerule (#23418) (kapobajza)e90925flinter/unicorn: Implement prefer-number-coercion rule (#23497) (Shekhudd1c866linter/vue: Implement no-async-in-computed-properties rule (#23493) (bab)b02444elinter: Add schema forreact/jsx-no-script-url(#23475) (WaterWhisperer)a8dce46linter/unicorn: Implementmax-nested-callsrule (#23461) (arieleli01212)🐛 Bug Fixes
a303c23linter/jsx-a11y: Alignanchor-is-validconfig with upstream (#23446) (camc314)📚 Documentation
b50bf4dlinter: Remove manually written options doc foreslint/arrow-body-style(#23490) (Mikhail Baev)v1.70.0Compare Source
🚀 Features
2e8bda4linter/vue: Implement no-dupe-keys rule (#23350) (bab)1490a0alinter/react: Implement react-compiler rule (#23202) (Boshen)dd560aelinter/unicorn: Implementno-array-fill-with-reference-typerule (#23397) (Mikhail Baev)af36c2flinter: Add schema forreact/jsx-curly-brace-presence(#23400) (WaterWhisperer)47d34a3linter: Add schema forreact/jsx-handler-names(#23393) (WaterWhisperer)f4250d0linter: Add schema forunicorn/import-style(#23386) (WaterWhisperer)30c74celinter: Add schema forjsx_a11y/no-noninteractive-element-to-interactive-role(#23384) (Sysix)cfbe8dclinter: Add schema forjsx_a11y/no-interactive-element-to-noninteractive-role(#23382) (WaterWhisperer)d15b7fflinter: Add schema fortypescript/no-restricted-types(#23381) (WaterWhisperer)028a811linter: Add schema forjsx-a11y/media-has-caption(#23377) (Sysix)b3b1038linter: Add schema forjsx-a11y/label-has-associated-control(#23376) (Sysix)7ada6b2linter: Add schema forjsx_a11y/no-distracting-elements(#23379) (WaterWhisperer)ee3dd49linter: Add schema forjsx-a11y/img-redundant-alt(#23374) (Sysix)df5f8ddlinter: Add short descriptions to most lint rules. (#23365) (Connor Shea)e3fd735linter: Add schema forjsx_a11y/alt-text(#23369) (Sysix)0f2fff4linter: Add schema forreact/exhaustive-deps(#23372) (Mikhail Baev)e3e4e10linter: Add schema forreact_perf/jsx-no-new-object-as-prop(#23368) (Mikhail Baev)9366d44linter: Add schema forunicorn/prefer-at(#23366) (WaterWhisperer)f57b55dlinter: Add schema fortypescript/array-type(#23355) (Sysix)0dcf912linter: Add schema fortypescript/ban-ts-comment(#23354) (Sysix)51fa83elinter: Add schema forreact/no-did-update-set-state(#23357) (Mikhail Baev)59db0bdlinter: Add schema forconsistent-generic-constructors(#23353) (Sysix)c4775c0linter: Add schema fortypescript/consistent-type-assertions(#23349) (Sysix)6e516f7linter: Add schema fortypescript/consistent-type-imports(#23348) (Sysix)012134dlinter: Add schema forreact/jsx-no-target-blank(#23345) (WaterWhisperer)0806aaelinter: Add schema forjsx_a11y/no-noninteractive-tabindex(#23337) (Mikhail Baev)0708b5alinter: Add schema forreact/jsx-filename-extension(#23315) (Mikhail Baev)150bce1linter: Add schema fortypescript/no-empty-object-type(#23309) (Sysix)f9e36f1linter: Add schema fortypescript/no-duplicate-type-constituents(#23308) (Sysix)937accflinter: Add schema fortypescript/no-invalid-void-type(#23307) (Sysix)3e042b9linter: Add schema fortypescript/no-misused-promises(#23306) (Sysix)da212d1linter: Add schema fortypescript/no-unnecessary-condition(#23305) (Sysix)f8f0d38linter: Add schema fortypescript/parameter-properties(#23304) (Sysix)2275fc7linter: Add schema fortypescript/prefer-nullish-coalescing(#23302) (Sysix)d353858linter: Add schema fortypescript/prefer-string-starts-ends-with(#23301) (Sysix)03060f5linter: Add schema fortypescript/triple-slash-reference(#23300) (Sysix)6619ceelinter: Add schema forpromise/param-names(#23298) (Sysix)8bf108elinter: Add schema forpromise/catch-or-return(#23297) (Sysix)48158d0linter: Add schema forvitest/consistent-each-for(#23294) (Sysix)7e74c98linter: Add schema forvitest/consistent-test-filename(#23293) (Sysix)ff94d4alinter: Add schema forvitest/consistent-vitest-vi(#23292) (Sysix)2409a10linter: Add schema forvitest/prefer-import-in-mock(#23291) (Sysix)3d782b7linter: Add schema forreact/no-unstable-nested-components(#23287) (Mikhail Baev)0a0bc2flinter/jsx-a11y: AddallowedRedundantRolesoption tono-redundant-roles(#22820) (bab)80758a5linter/vue: Implement no-side-effects-in-computed-properties rule (#23282) (bab)e3869aclinter: Add schema forreact/no-object-type-as-default-prop(#23279) (Mikhail Baev)4480609linter: Add schema forreact/jsx-props-no-spreading(#23276) (Mikhail Baev)08d68a5linter/react: Implementjsx-no-literalsrule (#23145) (kapobajza)9a2788blinter/unicorn: Implementprefer-export-fromrule (#22935) (AliceLanniste)bdb723clinter/unicorn: Implement prefer-single-call rule (#23235) (Yuzhe Shi)31543edlinter: Add schema forvue/define-props-destructuring(#23252) (Sysix)21b6c3dlinter: Add schema foroxc/no-async-endpoint-handlers(#23251) (Sysix)e77ff81linter: Add schema forunicorn/prefer-object-from-entries(#23249) (Mikhail Baev)bcac2d6linter: Add schema forjest/vitest/no-restricted-matchers(#23247) (Sysix)539f036linter: Add schema forjest/vitest/no-restricted-*-methods(#23246) (Sysix)dd1b927linter/vue: Implement require-default-prop rule (#22951) (bab)3f018e7linter: Add schema forunicorn/no-instanceof-builtins(#23225) (Mikhail Baev)e0d0f78linter: Verify promise/no-callback-in-promise schema (#23141) (beanscg)123d4f4linter: Add schema forjest/vitest/valid-expect(#23185) (Sysix)46c8a21linter: Add schema forjest/vitest/require-top-level-describe(#23184) (Sysix)41465cflinter: Add schema forjest/vitest/prefer-snapshot-hint(#23183) (Sysix)d068b9blinter: Add schema forjest/vitest/prefer-expect-assertions(#23181) (Sysix)064a1eelinter: Add schema forjest/prefer-ending-with-an-expect(#23180) (Sysix)d046797linter: Add schema forjest/vitest/no-standalone-expect(#23179) (Sysix)137b9a6linter: Add schema forjest/vitest/no-large-snapshots(#23178) (Sysix)0f3e4a5linter: Add schema forjest/vitest/no-hooks(#23177) (Sysix)cd0b384linter: Add schema forunicorn/explicit-length-check(#23155) (Mikhail Baev)01b74c4linter: Add schema forjest/no-deprecated-functions(#23136) (Sysix)9d6a387linter: Add schema forunicorn/catch-error-name(#23137) (Mikhail Baev)0da8efalinter: Add schema forjest/vitest/max-nested-describe(#23131) (Sysix)d71c9fdlinter: Add schema foreslint/no-use-before-define(#23129) (Sysix)🐛 Bug Fixes
26ddac6linter: Avoid config schema generation forjsx_a11y/no-noninteractive-element-interactions(#23385) (Sysix)40556adlinter: Parsejsx-a11y/control-has-associated-labelconfig withDefaultRuleConfig(#23373) (Sysix)71e9648linter: Expose no-noninteractive-element-interactions schema (#23283) (camc314)6c86d1clinter/react-perf: Correct nativeAllowList all schema (#23229) (camc314)4dd52delinter/react-perf: Re-generate stale snapshots (#23228) (camc314)8f3db61linter: Allow options foreslint/capitalized-comments(#23139) (Sysix)⚡ Performance
f09707elinter:jest/no-deprecated-functionsstore config version asusize(#23138) (Sysix)📚 Documentation
f682e25linter: Remove manually written options doc foreslint/prefer-arrow-callback(#23438) (Mikhail Baev)64c942clinter: Remove manually written options doc foreslint/no-sequences(#23420) (Mikhail Baev)14abf32linter/react-perf: Use autogenerated docs (#23227) (camc314)pnpm/pnpm (pnpm)
v11.9.0Compare Source
v11.8.0Compare Source
Minor Changes
c112b61: Added a--dry-runoption topnpm install. It runs a full dependency resolution and reports what an install would change, but writes nothing to disk (no lockfile, nonode_modules) and always exits with code 0. This mirrors the preview semantics ofnpm install --dry-run#7340.179ebc4:pnpm run --no-bailnow exits with a non-zero exit code when any of the executed scripts fail, while still running every matched script to completion. This makes the exit-code behavior of--no-bailconsistent between recursive and non-recursive runs (recursive runs already failed at the end). Previously, a non-recursivepnpm run --no-bailalways exited with code 0, even when a script failed #8013.0474a9c: Added support for generating Node.js package maps atnode_modules/.package-map.jsonduring isolated and hoisted installs. Added thenode-experimental-package-mapsetting to inject the generated map into pnpm-managed Node.js script environments, and thenode-package-map-typesetting to choose betweenstandardandloosepackage maps.dcededc:pnpm sbomnow marks components reachable only throughdevDependencieswith CycloneDXscope: "excluded"and thecdx:npm:package:developmentproperty. Theexcludedscope documents "component usage for test and other non-runtime purposes", which matches the semantics of a devDependency; the property is the CycloneDX npm-taxonomy marker emitted by@cyclonedx/cyclonedx-npm, so both modern (scope) and existing (property) consumers are covered. Components reachable at runtime (including installedoptionalDependencies) omitscopeand default torequired.1495cb0: Added per-package SBOM generation with--outand--splitflags. Use--out out/%s.cdx.jsonto write one SBOM per workspace package to individual files, or--splitfor NDJSON output to stdout. When--filterselects a single package, the SBOM root component now uses that package's metadata. Workspace inter-dependencies (workspace:protocol) and their transitive dependencies are included. Author, repository, and license fall back to the root manifest when the package doesn't define them.293921a: feat(view): support searching project manifest upward when package name is omittedWhen running
pnpm viewwithout a package name, the command now searchesupward for the nearest project manifest (
package.json,package.yaml, orpackage.json5) and uses itsnamefield.If the manifest exists but lacks a
namefield, an error is thrown.This change also replaces the
find-updependency withempathicforimproved performance and consistency across workspace tools.
Patch Changes
29ab905: Fixedpnpm updateoverriding the version range policy of a named catalog whose name parses as a version (e.g.catalog:express4-21). Thecatalog:reference carries no pinning of its own, so the prefix from the catalog entry (such as~) is now preserved instead of being widened to^#10321.bee4bf4: Security: validate config dependency names and versions from the env lockfile (pnpm-lock.yaml) before using them to build filesystem paths. A committed lockfile with a traversal-shapedconfigDependenciesname (such as../../PWNED) or version (such as../../../PWNED) could previously causepnpm installto create symlinks or write package files outsidenode_modules/.pnpm-configand the store. Names must now be valid npm package names and versions must be exact semver versions; the same validation is applied to optional subdependencies of config dependencies, and to the legacy workspace-manifest format before any lockfile is written. See GHSA-qrv3-253h-g69c.96bdd57: Fixlink:workspace protocol switching tofile:afterpnpm rmis run from inside a workspace package whose target workspace dependency has its own dependencies, wheninjectWorkspacePackages: trueis set. Follow-up to #10575, which fixed the same symptom for workspace packages without dependencies.302a2f7: No longer warn about using bothpackageManageranddevEngines.packageManagerwhen the two fields pin the same package manager at the same version with the same integrity hash (e.g. bothpnpm@11.5.1+sha512.…). Previously the hash was stripped from the legacypackageManagerfield but not fromdevEngines.packageManager, so even identical specifications looked like a mismatch #12028.The warning still fires on any genuine divergence, and several cases now state the specific reason instead of a single generic message: a different package manager, a different version, or contradictory integrity hashes for the same version.
3f0fb21: Fixed the progress line showing leftover characters from external processes that write to the terminal between progress updates (e.g. an SSH passphrase prompt would leave a fragment likeadded 0sa':). The interactive reporter now redraws each frame in place, erasing to the end of the display before reprinting, so any such remnants are cleared #12350.564619f: Fixedpnpm approve-buildsreporting "no packages awaiting approval" when a build-script dependency whose approval was revoked (e.g. aftergit stashdrops theallowBuildsfrompnpm-workspace.yaml) is re-added. The revoked packages are now correctly recorded in.modules.yamlsoapprove-buildscan find them. #122213d1fd20: Skip the redundant "target bin directory already contains an exe called node" warning on Windows when the existingnode.exealready matches the target (same hard link or identical content) pnpm/pnpm#12203.1b02b47: Fix macOS Gatekeeper blocking native binaries (.node,.dylib,.so) by removing thecom.apple.quarantineextended attribute after importing them from the store.When pnpm imports files from its content-addressable store into
node_modules, macOS preserves extended attributes, includingcom.apple.quarantine. If this xattr is present on a store blob (e.g. it was first written under a Gatekeeper-enabled app such as a Git client), it propagates tonode_modules, and Gatekeeper blocks the native binary from loading even though pnpm already verified the file's integrity against the lockfile.After importing a package, pnpm now strips
com.apple.quarantinefrom its native binaries, matching Homebrew's behaviour of dropping quarantine from verified downloads. The cleanup is macOS-only, runs in a single batchedxattrcall per package, is restricted to nConfiguration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.