pnpm/pnpm (pnpm)
### [`v9.11.0`](https://redirect.github.com/pnpm/pnpm/compare/v9.10.0...v9.11.0)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.10.0...v9.11.0)
### [`v9.10.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v9.10.0): pnpm 9.10
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.9.0...v9.10.0)
#### Minor Changes
- Support for a new CLI flag, `--exclude-peers`, added to the `list` and `why` commands. When `--exclude-peers` is used, peer dependencies are not printed in the results, but dependencies of peer dependencies are still scanned [#8506](https://redirect.github.com/pnpm/pnpm/pull/8506).
- Added a new setting to `package.json` at `pnpm.auditConfig.ignoreGhsas` for ignoring vulnerabilities by their GHSA code [#6838](https://redirect.github.com/pnpm/pnpm/issues/6838).
For instance:
```json
{
"pnpm": {
"auditConfig": {
"ignoreGhsas": [
"GHSA-42xw-2xvc-qx8m",
"GHSA-4w2v-q235-vp99",
"GHSA-cph5-m8f7-6c5x",
"GHSA-vh95-rmgr-6w4m"
]
}
}
}
```
#### Patch Changes
- Throw an exception if pnpm switches to the same version of itself.
- Reduce memory usage during peer dependencies resolution.
#### Platinum Sponsors
#### Gold Sponsors
#### Our Silver Sponsors
### [`v9.9.0`](https://redirect.github.com/pnpm/pnpm/compare/v9.8.0...v9.9.0)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.8.0...v9.9.0)
### [`v9.8.0`](https://redirect.github.com/pnpm/pnpm/compare/v9.7.1...v9.8.0)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.7.1...v9.8.0)
### [`v9.7.1`](https://redirect.github.com/pnpm/pnpm/compare/v9.7.0...v9.7.1)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.7.0...v9.7.1)
### [`v9.7.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v9.7.0): pnpm 9.7
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.6.0...v9.7.0)
#### Minor Changes
- Added pnpm version management. If the `manage-package-manager-versions` setting is set to `true`, pnpm will switch to the version specified in the `packageManager` field of `package.json` [#8363](https://redirect.github.com/pnpm/pnpm/pull/8363). This is the same field used by Corepack. Example:
```json
{
"packageManager": "pnpm@9.3.0"
}
```
- Added the ability to apply patch to all versions [#8337](https://redirect.github.com/pnpm/pnpm/pull/8337).
If the key of `pnpm.patchedDependencies` is a package name without a version (e.g. `pkg`), pnpm will attempt to apply the patch to all versions of the package. Failures will be skipped. If there's only one version of `pkg` installed, `pnpm patch pkg` and subsequent `pnpm patch-commit $edit_dir` will create an entry named `pkg` in `pnpm.patchedDependencies`. And pnpm will attempt to apply this patch to other versions of `pkg` in the future.
- Change the default edit dir location when running `pnpm patch` from a temporary directory to `node_modules/.pnpm_patches/pkg[@version]` to allow the code editor to open the edit dir in the same file tree as the main project [#8379](https://redirect.github.com/pnpm/pnpm/issues/8379).
- Substitute environment variables in config keys [#6679](https://redirect.github.com/pnpm/pnpm/issues/6679).
#### Patch Changes
- `pnpm install` should run `node-gyp rebuild` if the project has a `binding.gyp` file even if the project doesn't have an install script [#8293](https://redirect.github.com/pnpm/pnpm/issues/8293).
- Print warnings to stderr [#8342](https://redirect.github.com/pnpm/pnpm/pull/8342).
- Peer dependencies of optional peer dependencies should be automatically installed [#8323](https://redirect.github.com/pnpm/pnpm/issues/8323).
#### Platinum Sponsors
#### Gold Sponsors
#### Our Silver Sponsors
### [`v9.6.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v9.6.0): pnpm 9.6
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.5.0...v9.6.0)
#### Minor Changes
- Support specifying node version (via `pnpm.executionEnv.nodeVersion` in `package.json`) for running lifecycle scripts per each package in a workspace [#6720](https://redirect.github.com/pnpm/pnpm/issues/6720).
- Overrides now support the [`catalogs:` protocol](https://pnpm.io/catalogs) [#8303](https://redirect.github.com/pnpm/pnpm/issues/8303).
#### Patch Changes
- The `pnpm deploy` command now supports the [`catalog:` protocol](https://pnpm.io/catalogs) [#8298](https://redirect.github.com/pnpm/pnpm/pull/8298).
- The `pnpm outdated` command now supports the [`catalog:` protocol](https://pnpm.io/catalogs) [#8304](https://redirect.github.com/pnpm/pnpm/pull/8304).
- Correct the error message when trying to run `pnpm patch` without `node_modules/.modules.yaml` [#8257](https://redirect.github.com/pnpm/pnpm/issues/8257).
- Silent reporting fixed with the `pnpm exec` command [#7608](https://redirect.github.com/pnpm/pnpm/issues/7608).
- Add registries information to the calculation of dlx cache hash [#8299](https://redirect.github.com/pnpm/pnpm/pull/8299).
#### Platinum Sponsors
#### Gold Sponsors
#### Our Silver Sponsors
### [`v9.5.0`](https://redirect.github.com/pnpm/pnpm/compare/v9.5.0-beta.3...v9.5.0)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.4.0...v9.5.0)
### [`v9.4.0`](https://redirect.github.com/pnpm/pnpm/compare/v9.3.0...v9.4.0)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.3.0...v9.4.0)
### [`v9.3.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v9.3.0)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.2.0...v9.3.0)
#### Minor Changes
- **Semi-breaking.** Dependency key names in the lockfile are shortened if they are longer than 1000 characters. We don't expect this change to affect many users. Affected users most probably can't run install successfully at the moment. This change is required to fix some edge cases in which installation fails with an out-of-memory error or "Invalid string length (RangeError: Invalid string length)" error. The max allowed length of the dependency key can be controlled with the `peers-suffix-max-length` setting [#8177](https://redirect.github.com/pnpm/pnpm/pull/8177).
#### Patch Changes
- Set `reporter-hide-prefix` to `true` by default for `pnpm exec`. In order to show prefix, the user now has to explicitly set `reporter-hide-prefix=false` [#8174](https://redirect.github.com/pnpm/pnpm/issues/8174).
#### Platinum Sponsors
#### Gold Sponsors
#### Our Silver Sponsors
### [`v9.2.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v9.2.0)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.1.4...v9.2.0)
#### Minor Changes
- If `package-manager-strict-version` is set to `true`, pnpm will fail if its version doesn't exactly match the version in the "packageManager" field of `package.json`.
#### Patch Changes
- Update `@yarnpkg/pnp` to the latest version, fixing issue with `node:` imports [#8161](https://redirect.github.com/pnpm/pnpm/issues/8161).
- Deduplicate bin names to prevent race condition and corrupted bin scripts [#7833](https://redirect.github.com/pnpm/pnpm/issues/7833).
- pnpm doesn't fail if its version doesn't match the one specified in the "packageManager" field of `package.json` [#8087](https://redirect.github.com/pnpm/pnpm/issues/8087).
- `exec` now also streams prefixed output when `--recursive` or `--parallel` is specified just as `run` does [#8065](https://redirect.github.com/pnpm/pnpm/issues/8065).
#### Platinum Sponsors
#### Gold Sponsors
#### Our Silver Sponsors
### [`v9.1.4`](https://redirect.github.com/pnpm/pnpm/compare/v9.1.3...v9.1.4)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.1.3...v9.1.4)
### [`v9.1.3`](https://redirect.github.com/pnpm/pnpm/compare/v9.1.2...v9.1.3)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.1.2...v9.1.3)
### [`v9.1.2`](https://redirect.github.com/pnpm/pnpm/releases/tag/v9.1.2)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.1.1...v9.1.2)
#### Patch Changes
- Reduced memory usage during peer dependencies resolution [#8084](https://redirect.github.com/pnpm/pnpm/pull/8084).
- Details in the `pnpm licenses` output are not misplaced anymore [#8071](https://redirect.github.com/pnpm/pnpm/pull/8071).
#### Platinum Sponsors
#### Gold Sponsors
#### Our Silver Sponsors
### [`v9.1.1`](https://redirect.github.com/pnpm/pnpm/compare/v9.1.0...v9.1.1)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.1.0...v9.1.1)
### [`v9.1.0`](https://redirect.github.com/pnpm/pnpm/compare/v9.1.0-0...v9.1.0)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.0.6...v9.1.0)
### [`v9.0.6`](https://redirect.github.com/pnpm/pnpm/compare/v9.0.5...v9.0.6)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.0.5...v9.0.6)
### [`v9.0.5`](https://redirect.github.com/pnpm/pnpm/compare/v9.0.4...v9.0.5)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.0.4...v9.0.5)
### [`v9.0.4`](https://redirect.github.com/pnpm/pnpm/compare/v9.0.3...v9.0.4)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.0.3...v9.0.4)
### [`v9.0.3`](https://redirect.github.com/pnpm/pnpm/compare/v9.0.2...v9.0.3)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.0.2...v9.0.3)
### [`v9.0.2`](https://redirect.github.com/pnpm/pnpm/compare/v9.0.1...v9.0.2)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.0.1...v9.0.2)
### [`v9.0.1`](https://redirect.github.com/pnpm/pnpm/compare/v9.0.0...v9.0.1)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.0.0...v9.0.1)
### [`v9.0.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v9.0.0)
[Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v8.15.9...v9.0.0)
##### Major Changes
- Node.js v16 support discontinued
If you still require Node.js 16, don't worry. We ship pnpm bundled with Node.js. This means that regardless of which Node.js version you've installed, pnpm will operate using the necessary Node.js runtime. For this to work you need to install pnpm either using the [standalone script](https://pnpm.io/installation#using-a-standalone-script) or install the `@pnpm/exe` package.
- Configuration updates:
- [`dedupe-injected-deps`](https://pnpm.io/npmrc#dedupe-injected-deps): enabled by default.
- [`link-workspace-packages`](https://pnpm.io/npmrc#link-workspace-packages): disabled by default. This means that by default, dependencies will be linked from workspace packages only when they are specified using the [workspace protocol](https://pnpm.io/workspaces#workspace-protocol-workspace).
- [`hoist-workspace-packages`](https://pnpm.io/npmrc#hoist-workspace-packages): enabled by default.
- [`enable-pre-post-scripts`](https://pnpm.io/cli/run#enable-pre-post-scripts): enabled by default.
- Use the same directory for state files on macOS as on Linux (`~/.local/state/pnpm`).
- pnpm will now check the `package.json` file for a `packageManager` field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.
- Lockfile changes:
- Lockfile v9 is adopted. This new format has changes for better readability, and better resistence to Git conflicts.
- Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 [#7470](https://redirect.github.com/pnpm/pnpm/pull/7470).
- Dependency resolution changes:
- Correct resolution of peer dependencies that have their own peer dependencies.
Related issue: [#7444](https://redirect.github.com/pnpm/pnpm/issues/7444).
Related PR: [#7606](https://redirect.github.com/pnpm/pnpm/pull/7606).
- Optional peer dependencies may be resolved from any packages in the dependency graph [#7830](https://redirect.github.com/pnpm/pnpm/pull/7830).
- `pnpm licenses list` prints license information of all versions of the same package in case different versions use different licenses. The format of the `pnpm licenses list --json` output has been changed [#7528](https://redirect.github.com/pnpm/pnpm/pull/7528).
- A new command added for printing completion code to the console: `pnpm completion [shell]`. The old command that modified the user's shell dotfiles has been removed [#3083](https://redirect.github.com/pnpm/pnpm/issues/3083).
- When installing git-hosted dependencies, only pick the files that would be packed with the package [#7638](https://redirect.github.com/pnpm/pnpm/pull/7638).
##### Minor Changes
- It is now possible to install only a subdirectory from a Git repository.
For example, `pnpm add github:user/repo#path:packages/foo` will add a dependency from the `packages/foo` subdirectory.
This new parameter may be combined with other supported parameters separated by `&`. For instance, the next command will install the same package from the `dev` branch: `pnpm add github:user/repo#dev&path:packages/bar`.
Related issue: [#4765](https://redirect.github.com/pnpm/pnpm/issues/4765).
Related PR: [#7487](https://redirect.github.com/pnpm/pnpm/pull/7487).
- `node-gyp` updated to version 10.
- PowerShell completion support added [#7597](https://redirect.github.com/pnpm/pnpm/pull/7597).
- Support `node-options` option inside `.npmrc` file when running scripts [#7596](https://redirect.github.com/pnpm/pnpm/issues/7596).
- Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported: `:certfile`, `:keyfile`, and `:ca`. For instance:
//registry.mycomp.com/:certfile=server-cert.pem
//registry.mycomp.com/:keyfile=server-key.pem
//registry.mycomp.com/:cafile=client-cert.pem
Related issue: [#7427](https://redirect.github.com/pnpm/pnpm/issues/7427).
Related PR: [#7626](https://redirect.github.com/pnpm/pnpm/pull/7626).
- Add a field named `ignoredOptionalDependencies`. This is an array of strings. If an optional dependency has its name included in this array, it will be skipped [#7714](https://redirect.github.com/pnpm/pnpm/pull/7714).
- The checksum of the `.pnpmfile.cjs` is saved into the lockfile. If the pnpmfile gets modified, the lockfile is reanalyzed to apply the changes [#7662](https://redirect.github.com/pnpm/pnpm/pull/7662).
- Added cache for `pnpm dlx` [#5277](https://redirect.github.com/pnpm/pnpm/issues/5277).
##### Patch Changes
- Package tarballs are not downloaded during `--lockfile-only` installation [#1328](https://redirect.github.com/pnpm/pnpm/issues/1328).
- Peer dependency rules should only affect reporting, not data in the lockfile [#7758](https://redirect.github.com/pnpm/pnpm/pull/7758).
- Link overrides should be able to use absolute path [#7749](https://redirect.github.com/pnpm/pnpm/pull/7749).
- `pnpm dlx` should not read settings from the current working directory [#7916](h
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box
This PR contains the following updates:
>=8.15.9->>=9.11.0Release Notes
pnpm/pnpm (pnpm)
### [`v9.11.0`](https://redirect.github.com/pnpm/pnpm/compare/v9.10.0...v9.11.0) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.10.0...v9.11.0) ### [`v9.10.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v9.10.0): pnpm 9.10 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v9.9.0...v9.10.0) #### Minor Changes - Support for a new CLI flag, `--exclude-peers`, added to the `list` and `why` commands. When `--exclude-peers` is used, peer dependencies are not printed in the results, but dependencies of peer dependencies are still scanned [#8506](https://redirect.github.com/pnpm/pnpm/pull/8506). - Added a new setting to `package.json` at `pnpm.auditConfig.ignoreGhsas` for ignoring vulnerabilities by their GHSA code [#6838](https://redirect.github.com/pnpm/pnpm/issues/6838). For instance: ```json { "pnpm": { "auditConfig": { "ignoreGhsas": [ "GHSA-42xw-2xvc-qx8m", "GHSA-4w2v-q235-vp99", "GHSA-cph5-m8f7-6c5x", "GHSA-vh95-rmgr-6w4m" ] } } } ``` #### Patch Changes - Throw an exception if pnpm switches to the same version of itself. - Reduce memory usage during peer dependencies resolution. #### Platinum SponsorsConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.