chore(deps): update pnpm to v10.9.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pnpm (source)	10.6.4 -> 10.9.0

---

Release Notes

pnpm/pnpm (pnpm)

v10.9.0

Compare Source

Minor Changes

• Added support for installing JSR packages. You can now install JSR packages using the following syntax:

  pnpm add jsr:<pkg_name>
  

  or with a version range:

  pnpm add jsr:<pkg_name>@&#8203;<range>
  

  For example, running:

  pnpm add jsr:@​foo/bar
  

  will add the following entry to your package.json:

  {
    "dependencies": {
      "@​foo/bar": "jsr:^0.1.2"
    }
  }

  When publishing, this entry will be transformed into a format compatible with npm, older versions of Yarn, and previous pnpm versions:

  {
    "dependencies": {
      "@​foo/bar": "npm:@​jsr/foo__bar@^0.1.2"
    }
  }

  Related issue: #​8941.

  Note: The @jsr scope defaults to https://npm.jsr.io/ if the @jsr:registry setting is not defined.

• Added a new setting, dangerouslyAllowAllBuilds, for automatically running any scripts of dependencies without the need to approve any builds. It was already possible to allow all builds by adding this to pnpm-workspace.yaml:

  neverBuiltDependencies: []

  dangerouslyAllowAllBuilds has the same effect but also allows to be set globally via:

  pnpm config set dangerouslyAllowAllBuilds true
  

  It can also be set when running a command:

  pnpm install --dangerously-allow-all-builds
  

Patch Changes

• Fix a false negative in verifyDepsBeforeRun when nodeLinker is hoisted and there is a workspace package without dependencies and node_modules directory #​9424.
• Explicitly drop verifyDepsBeforeRun support for nodeLinker: pnp. Combining verifyDepsBeforeRun and nodeLinker: pnp will now print a warning.

v10.8.1

Compare Source

Patch Changes

• Removed bright white highlighting, which didn't look good on some light themes #​9389.
• If there is no pnpm related configuration in package.json, onlyBuiltDependencies will be written to pnpm-workspace.yaml file #​9404.

v10.8.0

Compare Source

Minor Changes

• Experimental. A new hook is supported for updating configuration settings. The hook can be provided via .pnpmfile.cjs. For example:

  module.exports = {
    hooks: {
      updateConfig: (config) => ({
        ...config,
        nodeLinker: "hoisted",
      }),
    },
  };

• Now you can use the pnpm add command with the --config flag to install new configurational dependencies #​9377.

Patch Changes

• Do not hang indefinitely, when there is a glob that starts with !/ in pnpm-workspace.yaml. This fixes a regression introduced by #​9169.
• pnpm audit --fix should update the overrides in pnpm-workspace.yaml.
• pnpm link should update overrides in pnpm-workspace.yaml, not in package.json #​9365.

v10.7.1: pnpm 10.7.1

Compare Source

Patch Changes

• pnpm config set should convert the settings to their correct type before adding them to pnpm-workspace.yaml #​9355.
• pnpm config get should read auth related settings via npm CLI #​9345.
• Replace leading ~/ in a path in .npmrc with the home directory #​9217.

Platinum Sponsors

Gold Sponsors

v10.7.0

Compare Source

Minor Changes

• pnpm config get and list also show settings set in pnpm-workspace.yaml files #​9316.

• It should be possible to use env variables in pnpm-workspace.yaml setting names and value.

• Add an ability to patch dependencies by version ranges. Exact versions override version ranges, which in turn override name-only patches. Version range * is the same as name-only, except that patch application failure will not be ignored.

  For example:

  patchedDependencies:
    foo: patches/foo-1.patch
    foo@^2.0.0: patches/foo-2.patch
    [email protected]: patches/foo-3.patch

  The above configuration would apply patches/foo-3.patch to [email protected], patches/foo-2.patch to all foo versions which satisfy ^2.0.0 except 2.1.0, and patches/foo-1.patch to the remaining foo versions.

  [!WARNING]
  The version ranges should not overlap. If you want to specialize a sub range, make sure to exclude it from the other keys. For example:

  # pnpm-workspace.yaml
  patchedDependencies:
    # the specialized sub range
    '[email protected]': patches/foo.2.2.0-2.8.0.patch
    # the more general patch, excluding the sub range above
    'foo@>=2.0.0 <2.2.0 || >2.8.0': 'patches/foo.gte2.patch

  In most cases, however, it's sufficient to just define an exact version to override the range.

• pnpm config set --location=project saves the setting to a pnpm-workspace.yaml file if no .npmrc file is present in the directory #​9316.

• Rename pnpm.allowNonAppliedPatches to pnpm.allowUnusedPatches. The old name is still supported but it would print a deprecation warning message.

• Add pnpm.ignorePatchFailures to manage whether pnpm would ignore patch application failures.

  If ignorePatchFailures is not set, pnpm would throw an error when patches with exact versions or version ranges fail to apply, and it would ignore failures from name-only patches.

  If ignorePatchFailures is explicitly set to false, pnpm would throw an error when any type of patch fails to apply.

  If ignorePatchFailures is explicitly set to true, pnpm would print a warning when any type of patch fails to apply.

Patch Changes

• Remove dependency paths from audit output to prevent out-of-memory errors #​9280.

v10.6.5

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.