chore(deps): bump % pnpm@8.6.1

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pnpm (source)	`8.5.1` -> `8.6.1`

Release Notes

pnpm/pnpm

### [`v8.6.1`](https://togithub.com/pnpm/pnpm/releases/tag/v8.6.1) [Compare Source](https://togithub.com/pnpm/pnpm/compare/v8.6.0...v8.6.1) #### Patch Changes - When `dedupe-peer-dependents` is enabled (default), use the path (not id) to determine compatibility. When multiple dependency groups can be deduplicated, the latter ones are sorted according to number of peers to allow them to benefit from deduplication. Resolves: [#6605](https://togithub.com/pnpm/pnpm/issues/6605) - Some minor performance improvements by removing await from loops [#6617](https://togithub.com/pnpm/pnpm/pull/6617). #### Our Gold Sponsors

#### Our Silver Sponsors

### [`v8.6.0`](https://togithub.com/pnpm/pnpm/releases/tag/v8.6.0) [Compare Source](https://togithub.com/pnpm/pnpm/compare/v8.5.1...v8.6.0) #### Minor Changes - Some settings influence the structure of the lockfile, so we cannot reuse the lockfile if those settings change. As a result, we need to store such settings in the lockfile. This way we will know with which settings the lockfile has been created. A new field will now be present in the lockfile: `settings`. It will store the values of two settings: `autoInstallPeers` and `excludeLinksFromLockfile`. If someone tries to perform a `frozen-lockfile` installation and their active settings don't match the ones in the lockfile, then an error message will be thrown. The lockfile format version is bumped from v6.0 to v6.1. Related PR: [#6557](https://togithub.com/pnpm/pnpm/pull/6557) Related issue: [#6312](https://togithub.com/pnpm/pnpm/issues/6312) - A new setting, `exclude-links-from-lockfile`, is now supported. When enabled, specifiers of local linked dependencies won't be duplicated in the lockfile. This setting was primarily added for use by [Bit CLI](https://togithub.com/teambit/bit), which links core aspects to `node_modules` from external directories. As such, the locations may vary across different machines, resulting in the generation of lockfiles with differing locations. #### Patch Changes - Don't print "Lockfile is up-to-date" message before finishing all the lockfile checks [#6544](https://togithub.com/pnpm/pnpm/issues/6544). - When updating dependencies, preserve the range prefix in aliased dependencies. So `npm:foo@1.0.0` becomes `npm:foo@1.1.0`. - Print a meaningful error when a project referenced by the `workspace:` protocol is not found in the workspace [#4477](https://togithub.com/pnpm/pnpm/issues/4477). - `pnpm rebuild` should not fail when `node-linker` is set to `hoisted` and there are skipped optional dependencies [#6553](https://togithub.com/pnpm/pnpm/pull/6553). - Peers resolution should not fail when a linked in dependency resolves a peer dependency. - Build projects in a workspace in correct order [#6568](https://togithub.com/pnpm/pnpm/pull/6568). #### Our Gold Sponsors

#### Our Silver Sponsors

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

OpenINF / openinf-util-object