build(deps-dev): bump all

renovate[bot] commented 4 months ago

This PR contains the following updates:

Package	Change	Type	Update
cspell (source)	`8.6.1` -> `8.7.0`	devDependencies	minor
node (source)	`20.12.1` -> `20.12.2`	engines	patch
pnpm (source)	`9.0.0-beta.3+sha256.e55cdbdef21da8b4fd68345716937e473f0645e2f65313f390b0d33f2d2440a3` -> `9.0.0-rc.0`	packageManager	patch
pnpm (source)	`9.0.0-beta.3` -> `9.0.0-rc.0`	engines	patch

Release Notes

streetsidesoftware/cspell (cspell)

### [`v8.7.0`](https://togithub.com/streetsidesoftware/cspell/blob/HEAD/packages/cspell/CHANGELOG.md#870-2024-04-10) [Compare Source](https://togithub.com/streetsidesoftware/cspell/compare/v8.6.1...v8.7.0) **Note:** Version bump only for package cspell

nodejs/node (node)

### [`v20.12.2`](https://togithub.com/nodejs/node/releases/tag/v20.12.2): 2024-04-10, Version 20.12.2 'Iron' (LTS), @RafaelGSS [Compare Source](https://togithub.com/nodejs/node/compare/v20.12.1...v20.12.2) This is a security release. ##### Notable Changes - CVE-2024-27980 - Command injection via args parameter of `child_process.spawn` without shell option enabled on Windows ##### Commits - \[[`69ffc6d50d`](https://togithub.com/nodejs/node/commit/69ffc6d50d)] - **src**: disallow direct .bat and .cmd file spawning (Ben Noordhuis) [nodejs-private/node-private#563](https://togithub.com/nodejs-private/node-private/pull/563)

pnpm/pnpm (pnpm)

### [`v9.0.0-rc.0`](https://togithub.com/pnpm/pnpm/releases/tag/v9.0.0-rc.0) [Compare Source](https://togithub.com/pnpm/pnpm/compare/v9.0.0-beta.3...v9.0.0-rc.0) Installation instructions: https://pnpm.io/9.x/installation ##### Major Changes - Node.js v16 support dropped. Use at least Node.js v18.12. - Lockfile version bumped to v9. - Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 [#7470](https://togithub.com/pnpm/pnpm/pull/7470). - The [`dedupe-injected-deps`](https://pnpm.io/npmrc#dedupe-injected-deps) setting is `true` by default. - The default value of the `link-workspace-packages` setting changed from `true` to `false`. This means that by default, dependencies will be linked from workspace packages only when they are specified using the [workspace protocol](https://pnpm.io/workspaces#workspace-protocol-workspace). - The default value of the [hoist-workspace-packages](https://pnpm.io/npmrc#hoist-workspace-packages) is `true`. - `pnpm licenses list` prints license information of all versions of the same package in case different versions use different licenses. The format of the `pnpm licenses list --json` output has been changed [#7528](https://togithub.com/pnpm/pnpm/pull/7528). - A new command added for printing completion code to the console: `pnpm completion [shell]`. The old command that modified the user's shell dotfiles has been removed [#3083](https://togithub.com/pnpm/pnpm/issues/3083). - pnpm will now check the `package.json` file for a `packageManager` field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires. - `enable-pre-post-scripts` is set to `true` by default. This means that when you run a script like `start`, `prestart` and `poststart` will also run. - When installing git-hosted dependencies, only pick the files that would be packed with the package [#7638](https://togithub.com/pnpm/pnpm/pull/7638). - Use the same directory for state files on macOS as on Linux (`~/.local/state/pnpm`). - Peer dependencies of peer dependencies are now resolved correctly. When peer dependencies have peer dependencies of their own, the peer dependencies are grouped with their own peer dependencies before being linked to their dependents. For instance, if `card` has `react` in peer dependencies and `react` has `typescript` in its peer dependencies, then the same version of `react` may be linked from different places if there are multiple versions of `typescript`. For instance: project1/package.json { "dependencies": { "card": "1.0.0", "react": "16.8.0", "typescript": "7.0.0" } } project2/package.json { "dependencies": { "card": "1.0.0", "react": "16.8.0", "typescript": "8.0.0" } } node_modules .pnpm card@1.0.0(react@16.8.0(typescript@7.0.0)) node_modules card react --> ../../react@16.8.0(typescript@7.0.0)/node_modules/react react@16.8.0(typescript@7.0.0) node_modules react typescript --> ../../typescript@7.0.0/node_modules/typescript typescript@7.0.0 node_modules typescript card@1.0.0(react@16.8.0(typescript@8.0.0)) node_modules card react --> ../../react@16.8.0(typescript@8.0.0)/node_modules/react react@16.8.0(typescript@8.0.0) node_modules react typescript --> ../../typescript@8.0.0/node_modules/typescript typescript@8.0.0 node_modules typescript In the above example, both projects have `card` in dependencies but the projects use different versions of `typescript`. Hence, even though the same version of `card` is used, `card` in `project1` will reference `react` from a directory where it is placed with `typescript@7.0.0` (because it resolves `typescript` from the dependencies of `project1`), while `card` in `project2` will reference `react` with `typescript@8.0.0`. Related issue: [#7444](https://togithub.com/pnpm/pnpm/issues/7444). Related PR: [#7606](https://togithub.com/pnpm/pnpm/pull/7606). - Optional peer dependencies may be resolved from any packages in the dependency graph [#7830](https://togithub.com/pnpm/pnpm/pull/7830). ##### Minor Changes - It is now possible to install only a subdirectory from a Git repository. For example, `pnpm add github:user/repo#path:packages/foo` will add a dependency from the `packages/foo` subdirectory. This new parameter may be combined with other supported parameters separated by `&`. For instance, the next command will install the same package from the `dev` branch: `pnpm add github:user/repo#dev&path:packages/bar`. Related issue: [#4765](https://togithub.com/pnpm/pnpm/issues/4765). Related PR: [#7487](https://togithub.com/pnpm/pnpm/pull/7487). - `node-gyp` updated to version 10. - PowerShell completion support added [#7597](https://togithub.com/pnpm/pnpm/pull/7597). - Support `node-options` option inside `.npmrc` file when running scripts [#7596](https://togithub.com/pnpm/pnpm/issues/7596). - Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported: `:certfile`, `:keyfile`, and `:ca`. For instance: //registry.mycomp.com/:certfile=server-cert.pem //registry.mycomp.com/:keyfile=server-key.pem //registry.mycomp.com/:cafile=client-cert.pem Related issue: [#7427](https://togithub.com/pnpm/pnpm/issues/7427). Related PR: [#7626](https://togithub.com/pnpm/pnpm/pull/7626). - Add a field named `ignoredOptionalDependencies`. This is an array of strings. If an optional dependency has its name included in this array, it will be skipped [#7714](https://togithub.com/pnpm/pnpm/pull/7714). - The checksum of the `.pnpmfile.cjs` is saved into the lockfile. If the pnpmfile gets modified, the lockfile is reanalyzed to apply the changes [#7662](https://togithub.com/pnpm/pnpm/pull/7662). - Added cache for `pnpm dlx` [#5277](https://togithub.com/pnpm/pnpm/issues/5277). ##### Patch Changes - Package tarballs are not downloaded during `--lockfile-only` installation [#1328](https://togithub.com/pnpm/pnpm/issues/1328). - Peer dependency rules should only affect reporting, not data in the lockfile [#7758](https://togithub.com/pnpm/pnpm/pull/7758). - Link overrides should be able to use absolute path [#7749](https://togithub.com/pnpm/pnpm/pull/7749). ##### Platinum Sponsors