Update Non-major updates #78

Merged

renovate-bot merged 1 commit from renovate/non-major-updates into dev 2026-09-30 09:01:38 +02:00

Conversation 0 Commits 1 Files changed 4 +223 -194

renovate-bot commented 2026-09-29 21:02:37 +02:00

Collaborator

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	24.13.5 → 24.13.6
drizzle-kit (source)	0.31.10 → 0.31.11
drizzle-orm (source)	0.45.2 → 0.45.3
eslint (source)	10.10.0 → 10.11.0
npm:pnpm (source)	11.27.0 → 11.27.1
pnpm (source)	11.27.0 → 11.27.1
prettier (source)	3.9.8 → 3.9.9
svelte (source)	5.57.0 → 5.57.1
typescript-eslint (source)	8.70.0 → 8.70.1

---

Release Notes

drizzle-team/drizzle-orm (drizzle-kit)

v0.31.11

Compare Source

• Warn about silent migration skips on drizzle-kit checks - thanks @​shaneikennedy

eslint/eslint (eslint)

v10.11.0

Compare Source

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#​21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#​21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#​21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#​21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#​21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#​21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#​21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#​21294) (Akinyemi Toluwalase)

Chores

• 520dd77 perf: Implement fast paths in critical areas (#​21210) (Nicholas C. Zakas)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#​21330) (Francesco Trotta)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#​21331) (renovate[bot])
• 24310e3 chore: update ecosystem plugins (#​21324) (ESLint Bot)
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#​21318) (dependabot[bot])
• ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#​21221) (Nicholas C. Zakas)
• c832660 chore: Upgrade Stylelint to the latest version in docs (#​21245) (Jung Hyeon Jun)
• f9f88fc chore: update ecosystem plugins (#​21308) (ESLint Bot)
• fc81076 ci: add more types integration tests (#​20395) (Nitin Kumar)

pnpm/pnpm (npm:pnpm)

v11.27.1: pnpm 11.27.1

Compare Source

Patch Changes

• pn, pnpx, and pnx now run the pnpm installed alongside them. They used to look pnpm up on PATH. That failed when the directory holding them was not on PATH, and it silently handed the call to an unrelated pnpm when one came first there #​14803.

• The @zkochan/cmd-shim package is now available as @pnpm/bins.cmd-shim.

• pnpm cache list-registries now prints the registry URL, matching pnpm cache view. It printed https%3A+registry.npmjs.org before and prints https://registry.npmjs.org/ now #​15046.

• pnpm deploy no longer installs the dependencies of the workspace root project into the deploy directory #​6437.

• Install warnings no longer carry the text of a package's deprecation notice. The warning names the deprecated package and version, and the pnpm:deprecation event no longer carries the notice either. pnpm view still shows it on request.

  A deprecation warning now names the newest version of the package that is not deprecated, and says when reaching it means widening the range you declared:

  WARN  deprecated foo@1.0.0. 2.3.1 is not deprecated, outside the range you declared.
  

  pnpm works this out from the metadata it already fetched, so it costs no extra request. An install that reuses the lockfile without fetching metadata names no version.

  pnpm strips control characters from the package name and version in a deprecation warning, and from the notice pnpm outdated --long prints.

  The text sanitizer now also strips the Unicode line and paragraph separators U+2028 and U+2029.

• pnpm exec <command> and pnpm <command> run from a subdirectory of a project now find the executables installed in the project's node_modules/.bin. The command still runs in the subdirectory. PNPM_PACKAGE_NAME names the project #​5068.

• pnpm exec and pnpm dlx now wait for the command to finish shutting down after Ctrl+C. A signal sent to pnpm alone now reaches the command, the way it does with pnpm run. pnpm used to exit on the interrupt and terminate the command while it was still shutting down #​7374.

• Warnings about ignored environment variables in project .npmrc credentials now link to the npmrc documentation pnpm/pnpm#15051.

• pnpm audit --interactive --fix=update no longer opens a second prompt for selecting dependencies to update #​14927.

• Fixed pnpm dedupe requiring a second pass after bumping a direct dependency in package.json pnpm/pnpm#14987.

• pnpm deploy now writes plain versions for registry dependencies with peer dependencies in the deployed package.json. The deployed lockfile retains the resolved peer bindings. npm aliases keep their target package names #​14873.

• pnpm publish now allows a detached Git HEAD in CI, including checkouts of release tags. The working tree must still be clean. Branch and remote-history checks still apply when HEAD is attached pnpm/pnpm#5894.

• pnpm dlx and pnx now prompt to approve dependency build scripts in interactive terminals. Cached packages with pending builds also prompt for approval. Without an interactive terminal, use --allow-build to allow the required builds. Fixes pnpm/pnpm#14943.

• pnpm install --force now removes obsolete dependency links inside virtual-store packages when their dependencies change. Invalid dependency names are ignored during obsolete-link cleanup #​15039.

• pnpm add -g and pnpm update -g now ignore incomplete unrelated global package groups when every command from the replaced group is retained. Operations that could remove a global command still require complete ownership information.

• Resolving a Node.js runtime now fails when unofficial-builds.nodejs.org cannot be reached. pnpm used to ignore that failure and leave the musl builds out of pnpm-lock.yaml. pnpm update then wrote a different lockfile on a machine whose network blocks the mirror pnpm/pnpm#14813.

• pnpm now deduplicates a package whose child dependency resolved an optional peer in one workspace project but not in another. Two copies of next could appear when only some projects could reach styled-jsx's optional babel-plugin-macros peer #​14800.

• Fixed shell completion of package scripts for pnpm run and pnpm run-script pnpm/pnpm#15034.

  Bash completion now preserves literal script names containing glob characters and shell punctuation in pnpm v11 and v12.

• pnpm sbom now publishes a valid URL in the CycloneDX externalReferences[].url and the SPDX homepage. An npm shorthand such as vercel/ms or gitlab:group/subgroup/project is expanded to the git+https URL npm derives for it. An scp-style remote such as git@github.com:vercel/ms.git is expanded the same way. Any other URL is published in its normalized form, without embedded credentials. A value that names no repository, an email address for example, is left out. pnpm used to publish the raw value, so a shorthand produced a URL that consumers such as Dependency-Track reject pnpm/pnpm#14773.

• pnpm setup now describes the displayed configuration changes as "the following configuration changes."

• pnpm --version now reports why the pnpm version a project pins cannot be installed or recorded, then prints the version of the running CLI. It used to fail, which made the command unusable where the filesystem is read-only. pnpm --version also honors --store-dir and its --store alias now #​14831.

• pnpm install --force now reinstalls dependencies when the manifest and lockfile are unchanged. It previously reported "Already up to date" without reinstalling. Files changed in node_modules are restored when the store content is intact. Combining --force with --frozen-store now reports a configuration conflict on repeat installs #​919.

• pnpm install now installs git-hosted dependencies without preparing them when their builds are explicitly denied by allowBuilds. Dependencies that require preparation still need an explicit allow or deny decision pnpm/pnpm#10522.

• pnpm runtime set and pnpm env use now use the pnpm version that started the command. They could run a different installed pnpm when the command was started through Corepack or another wrapper.

• The install summary now names the version each dependency resolved to when node-linker is hoisted. It also lists what an install restores after node_modules is deleted, and both sides of a version change. The summary showed the range recorded in package.json, or nothing at all #​15161.

• The @pnpm/npm-lifecycle package is now available as @pnpm/exec.npm-lifecycle.

• Fixed minimumReleaseAge making pnpm download a package's full metadata again on every install. The cached copy carried a validator the registry could not match, so pnpm could never revalidate it pnpm/pnpm#15103.

• pnpm now measures a pnpm.overrides entry written as a bare path, such as ./local-dep, from the directory holding pnpm-workspace.yaml. It used to be measured from each package the override rewrote, so the dependency linked to a directory that does not exist #​11131.

• pnpm now preserves scalar YAML anchors and aliases when editing pnpm-workspace.yaml. Removing the entry that defines an anchor keeps surviving aliases valid. Entries updated to different values are written separately #​8245.

• pnpm now preserves comments and existing key order when updating package.yaml. New keys are appended to their mapping pnpm/pnpm#2008.

• pnpm install --prod no longer downloads the registry packages that only a devDependency reaches #​881.

• pnpm update --global no longer reinstalls a global package when its dependency graph resolves to what is already installed. It reports Already up to date pnpm/pnpm#12002.

• The minimumReleaseAge approval prompt now counts and displays each package version once pnpm/pnpm#15083.

• pnpm run no longer sends a script a second SIGINT when Ctrl+C is pressed in a terminal. A script that shuts down on the first SIGINT and exits at once on a second used to die before its shutdown finished #​7374.

• pnpm now reads a pnpm-workspace.yaml whose tasks section uses a setting only pnpm 12 acts on, such as concurrencyGroup. A task's unrecognized fields are ignored, unless the field only differs in case from concurrency or dependsOn, which pnpm reports as a typo.

  The warning about unrecognized top-level settings now names cargo, concurrencyGroups, and pipelines as pnpm 12 settings.

• pnpm -r list --json now prints one JSON array. It printed a separate array for each project when sharedWorkspaceLockfile was false, so the output could not be parsed.

  pnpm -r list now reads each project's own modules directory when the projects keep their own lockfiles, so --long and --parseable report the packages that project installed #​15011.

• A signal sent to pnpm while it runs without a terminal, as a container runtime or a service manager does, now reaches the script even when the shell running it stays the script's parent. pnpm then waits for the script to finish shutting down. Such a signal used to end the shell at once or stay with it, and the script was never told to stop #​7374.

• Fixed minimumReleaseAge being skipped for packages served by a registry that returns the same ETag for abbreviated and full package metadata pnpm/pnpm#14925.

• pnpm install now returns "Already up to date" in a workspace where dedupeDirectDeps left a project without a node_modules directory of its own. Such a project forced a full install on every run.

• Installs in different projects that share a global virtual store no longer fail on Windows with Access is denied while repairing the same slot #​15114.

• pnpm sbom now emits a license value as a CycloneDX expression only when it is a valid SPDX license expression. Anything else is emitted as a CycloneDX license name pnpm/pnpm#14786.

• A dependency's own bins can no longer take over another package's bin shim. The POSIX shims pnpm generates used to look up their shell helpers on PATH, where a dependency's bins come first #​14837. Reinstalling replaces the shims already in your node_modules. On Cygwin, MSYS2, and WSL the shims still take their Windows path conversion from PATH, so a dependency can still redirect them there.

• POSIX bin shims now convert a Windows-form path such as C:\node_modules\.bin\tsc correctly. The shim mangled the backslashes in such a path and could not reach the package it runs. Installing again replaces the shims already in node_modules #​14867.

• pnpm pack now writes tarball entries grouped by file extension and file name, the order npm uses. Packages that ship many same-named files, such as template collections, pack much smaller #​14766.

• A command run in a project that the workspace does not include now acts on that project alone. A project is outside the workspace when it has a manifest of its own and no pattern in the packages setting selects it, or when a ! pattern excludes it. A directory with no manifest of its own, such as a package's source directory, still belongs to the workspace. pnpm install in an excluded project used to install every project in the workspace #​3561.

• POSIX bin shims now take cygpath and wslpath from the system default path on Cygwin, MSYS2, and WSL2. The shims looked both helpers up on PATH, where a dependency's own bins come first, so a dependency could redirect another package's shim. Installing again replaces the shims already in node_modules #​14866.

• pnpm update and pnpm audit --fix=update no longer copy dependencies added by packageExtensions, a readPackage hook, or an override into package.json. Those dependencies keep the specifier the hook or override gives them. pnpm update --latest no longer resolves past that specifier. pnpm audit --fix=update now warns when one of them pins a vulnerable version. The warning points at pnpm audit --fix #​14928.

Platinum Sponsors

Gold Sponsors

prettier/prettier (prettier)

v3.9.9

Compare Source

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#​20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

<!-- Prettier 3.9.8 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here.

<!-- Prettier 3.9.9 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

sveltejs/svelte (svelte)

v5.57.1

Compare Source

Patch Changes

• fix: cancel deferred event listeners during cleanup (#​18749)

• fix: preserve global CSS in components without scopable elements (#​18793)

• fix: reduce SSR render result garbage collection (#​18798)

• fix: resolve the fallback of an each block in the enclosing scope (#​18803)

• perf: speed up parser interactions with Acorn or avoid them where possible (#​18740)

• fix: prevent effect tree of batches from interfering with each other (#​18508)

• fix: serialize input default values during server rendering (#​18733)

• fix: remove WAS_MARKED flag in favor of Set (#​18127)

• fix: throw set_context_after_init when setContext is called after an await during SSR (#​18739)

• fix: make Object.hasOwn reactive for state proxy ownership changes (#​18838)

• fix: keep $state.eager when used as a variable initializer (#​18809)

• perf: avoid regex matching in parser where possible (#​18736)

• fix: in non-async mode, only push variable to current_sources when active_reaction is updating (#​18550)

• fix: recognise aria-braillelabel and aria-brailleroledescription as known ARIA attributes (#​18765)

typescript-eslint/typescript-eslint (typescript-eslint)

v8.70.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "after 11pm every weekday,before 5am every weekday,every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | [`24.13.5` → `24.13.6`](https://renovatebot.com/diffs/npm/@types%2fnode/24.13.5/24.13.6) |  |  | | [drizzle-kit](https://orm.drizzle.team) ([source](https://github.com/drizzle-team/drizzle-orm)) | [`0.31.10` → `0.31.11`](https://renovatebot.com/diffs/npm/drizzle-kit/0.31.10/0.31.11) |  |  | | [drizzle-orm](https://orm.drizzle.team) ([source](https://github.com/drizzle-team/drizzle-orm)) | [`0.45.2` → `0.45.3`](https://renovatebot.com/diffs/npm/drizzle-orm/0.45.2/0.45.3) |  |  | | [eslint](https://eslint.org) ([source](https://github.com/eslint/eslint)) | [`10.10.0` → `10.11.0`](https://renovatebot.com/diffs/npm/eslint/10.10.0/10.11.0) |  |  | | [npm:pnpm](https://github.com/pnpm/pnpm/tree/main/pnpm) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | `11.27.0` → `11.27.1` |  |  | | [pnpm](https://github.com/pnpm/pnpm/tree/main/pnpm) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | `11.27.0` → `11.27.1` |  |  | | [prettier](https://prettier.io) ([source](https://github.com/prettier/prettier)) | [`3.9.8` → `3.9.9`](https://renovatebot.com/diffs/npm/prettier/3.9.8/3.9.9) |  |  | | [svelte](https://svelte.dev) ([source](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte)) | [`5.57.0` → `5.57.1`](https://renovatebot.com/diffs/npm/svelte/5.57.0/5.57.1) |  |  | | [typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint) ([source](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)) | [`8.70.0` → `8.70.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.70.0/8.70.1) |  |  | --- ### Release Notes <details> <summary>drizzle-team/drizzle-orm (drizzle-kit)</summary> ### [`v0.31.11`](https://github.com/drizzle-team/drizzle-orm/releases/tag/drizzle-kit%400.31.11) [Compare Source](https://github.com/drizzle-team/drizzle-orm/compare/drizzle-kit@0.31.10...drizzle-kit@0.31.11) - Warn about silent migration skips on drizzle-kit checks - thanks [@&#8203;shaneikennedy](https://github.com/shaneikennedy) </details> <details> <summary>eslint/eslint (eslint)</summary> ### [`v10.11.0`](https://github.com/eslint/eslint/releases/tag/v10.11.0) [Compare Source](https://github.com/eslint/eslint/compare/v10.10.0...v10.11.0) #### Features - [`d136fa4`](https://github.com/eslint/eslint/commit/d136fa4b0d2dd4a9e738ca1c012cc674d1441127) feat: object-shorthand handle quoted properties for `ignoreConstructors` ([#&#8203;21271](https://github.com/eslint/eslint/issues/21271)) (Pavel) - [`397b3b8`](https://github.com/eslint/eslint/commit/397b3b8134b8ce1a61cbf414d4c29c945ba25690) feat: report unsafe labeled `continue` in `no-unsafe-finally` rule ([#&#8203;21316](https://github.com/eslint/eslint/issues/21316)) (electrohyun) - [`d3dd47f`](https://github.com/eslint/eslint/commit/d3dd47f42e4cb5f9da27e3a2e741aa21e02ea1a4) feat: only exempt `new-cap` built-ins that reference the global ([#&#8203;21290](https://github.com/eslint/eslint/issues/21290)) (sethamus) #### Bug Fixes - [`22b09f5`](https://github.com/eslint/eslint/commit/22b09f54f67a9512d4cea39ddbab9b6973d5c476) fix: ignore `__proto__` properties in `prefer-object-spread` ([#&#8203;21311](https://github.com/eslint/eslint/issues/21311)) (xbinaryx) - [`b684bb1`](https://github.com/eslint/eslint/commit/b684bb1cd7e6be03ad1b7a951baead936d9c2166) fix: make TimePass.parse optional in types and docs ([#&#8203;21313](https://github.com/eslint/eslint/issues/21313)) (ntnyq) - [`26d11bc`](https://github.com/eslint/eslint/commit/26d11bce3e0e21f223613d4bb4be3423839b229e) fix: don't report `__proto__` properties in `object-shorthand` ([#&#8203;21310](https://github.com/eslint/eslint/issues/21310)) (xbinaryx) #### Documentation - [`9ecfdc5`](https://github.com/eslint/eslint/commit/9ecfdc5319f83580cf3b81beab7e936015fef2fa) docs: note that --cache can serve stale results for cross-file rules ([#&#8203;21312](https://github.com/eslint/eslint/issues/21312)) (bytedoe) - [`6c789ff`](https://github.com/eslint/eslint/commit/6c789ff39bc5420e94e8dafeb328bf2b7e3d35ab) docs: Update README (GitHub Actions Bot) - [`5997825`](https://github.com/eslint/eslint/commit/5997825635dc9c4e81434894607ef2e3887e0ea3) docs: clarify preserve-caught-error known limitation ([#&#8203;21294](https://github.com/eslint/eslint/issues/21294)) (Akinyemi Toluwalase) #### Chores - [`520dd77`](https://github.com/eslint/eslint/commit/520dd77a35922fb537e2dbfb3c839d047acbdd68) perf: Implement fast paths in critical areas ([#&#8203;21210](https://github.com/eslint/eslint/issues/21210)) (Nicholas C. Zakas) - [`92086c8`](https://github.com/eslint/eslint/commit/92086c87e042413a3d0363d8fc3fbb11db98d06a) test: update `EMFILE` error generation for Node.js 26.9.0 compatibility ([#&#8203;21330](https://github.com/eslint/eslint/issues/21330)) (Francesco Trotta) - [`9ac7eb6`](https://github.com/eslint/eslint/commit/9ac7eb60525ec768c2fdc6699e5a292aa913ce9e) chore: update github/codeql-action action to v4.38.0 ([#&#8203;21331](https://github.com/eslint/eslint/issues/21331)) (renovate\[bot]) - [`24310e3`](https://github.com/eslint/eslint/commit/24310e3a0e22b3c086ca402f88448676f2e1cfcd) chore: update ecosystem plugins ([#&#8203;21324](https://github.com/eslint/eslint/issues/21324)) (ESLint Bot) - [`45ad79e`](https://github.com/eslint/eslint/commit/45ad79e54a39b54b4ce8eb47e612bd2f72a7a651) ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 ([#&#8203;21318](https://github.com/eslint/eslint/issues/21318)) (dependabot\[bot]) - [`ac74e37`](https://github.com/eslint/eslint/commit/ac74e37322ebf122ada676f153dc55c81f3caab0) chore: Add AGENTS.md with AI disclosure requirements ([#&#8203;21221](https://github.com/eslint/eslint/issues/21221)) (Nicholas C. Zakas) - [`c832660`](https://github.com/eslint/eslint/commit/c8326608e710e670beaf982501aed80ea104919a) chore: Upgrade Stylelint to the latest version in docs ([#&#8203;21245](https://github.com/eslint/eslint/issues/21245)) (Jung Hyeon Jun) - [`f9f88fc`](https://github.com/eslint/eslint/commit/f9f88fcccd965fdc162b89c4615dd4018e3cabdf) chore: update ecosystem plugins ([#&#8203;21308](https://github.com/eslint/eslint/issues/21308)) (ESLint Bot) - [`fc81076`](https://github.com/eslint/eslint/commit/fc81076a5b8145360654d81cbc130cf7d25dca77) ci: add more types integration tests ([#&#8203;20395](https://github.com/eslint/eslint/issues/20395)) (Nitin Kumar) </details> <details> <summary>pnpm/pnpm (npm:pnpm)</summary> ### [`v11.27.1`](https://github.com/pnpm/pnpm/releases/tag/v11.27.1): pnpm 11.27.1 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.27.0...v11.27.1) ##### Patch Changes - `pn`, `pnpx`, and `pnx` now run the pnpm installed alongside them. They used to look pnpm up on `PATH`. That failed when the directory holding them was not on `PATH`, and it silently handed the call to an unrelated pnpm when one came first there [#&#8203;14803](https://github.com/pnpm/pnpm/issues/14803). - The `@zkochan/cmd-shim` package is now available as `@pnpm/bins.cmd-shim`. - `pnpm cache list-registries` now prints the registry URL, matching `pnpm cache view`. It printed `https%3A+registry.npmjs.org` before and prints `https://registry.npmjs.org/` now [#&#8203;15046](https://github.com/pnpm/pnpm/issues/15046). - `pnpm deploy` no longer installs the dependencies of the workspace root project into the deploy directory [#&#8203;6437](https://github.com/pnpm/pnpm/issues/6437). - Install warnings no longer carry the text of a package's deprecation notice. The warning names the deprecated package and version, and the `pnpm:deprecation` event no longer carries the notice either. `pnpm view` still shows it on request. A deprecation warning now names the newest version of the package that is not deprecated, and says when reaching it means widening the range you declared: ``` WARN deprecated foo@1.0.0. 2.3.1 is not deprecated, outside the range you declared. ``` pnpm works this out from the metadata it already fetched, so it costs no extra request. An install that reuses the lockfile without fetching metadata names no version. pnpm strips control characters from the package name and version in a deprecation warning, and from the notice `pnpm outdated --long` prints. The text sanitizer now also strips the Unicode line and paragraph separators U+2028 and U+2029. - `pnpm exec <command>` and `pnpm <command>` run from a subdirectory of a project now find the executables installed in the project's `node_modules/.bin`. The command still runs in the subdirectory. `PNPM_PACKAGE_NAME` names the project [#&#8203;5068](https://github.com/pnpm/pnpm/issues/5068). - `pnpm exec` and `pnpm dlx` now wait for the command to finish shutting down after `Ctrl+C`. A signal sent to pnpm alone now reaches the command, the way it does with `pnpm run`. pnpm used to exit on the interrupt and terminate the command while it was still shutting down [#&#8203;7374](https://github.com/pnpm/pnpm/issues/7374). - Warnings about ignored environment variables in project `.npmrc` credentials now link to the npmrc documentation [pnpm/pnpm#15051](https://github.com/pnpm/pnpm/issues/15051). - `pnpm audit --interactive --fix=update` no longer opens a second prompt for selecting dependencies to update [#&#8203;14927](https://github.com/pnpm/pnpm/issues/14927). - Fixed `pnpm dedupe` requiring a second pass after bumping a direct dependency in `package.json` [pnpm/pnpm#14987](https://github.com/pnpm/pnpm/issues/14987). - `pnpm deploy` now writes plain versions for registry dependencies with peer dependencies in the deployed `package.json`. The deployed lockfile retains the resolved peer bindings. npm aliases keep their target package names [#&#8203;14873](https://github.com/pnpm/pnpm/issues/14873). - `pnpm publish` now allows a detached Git HEAD in CI, including checkouts of release tags. The working tree must still be clean. Branch and remote-history checks still apply when HEAD is attached [pnpm/pnpm#5894](https://github.com/pnpm/pnpm/issues/5894). - `pnpm dlx` and `pnx` now prompt to approve dependency build scripts in interactive terminals. Cached packages with pending builds also prompt for approval. Without an interactive terminal, use `--allow-build` to allow the required builds. Fixes [pnpm/pnpm#14943](https://github.com/pnpm/pnpm/issues/14943). - `pnpm install --force` now removes obsolete dependency links inside virtual-store packages when their dependencies change. Invalid dependency names are ignored during obsolete-link cleanup [#&#8203;15039](https://github.com/pnpm/pnpm/issues/15039). - `pnpm add -g` and `pnpm update -g` now ignore incomplete unrelated global package groups when every command from the replaced group is retained. Operations that could remove a global command still require complete ownership information. - Resolving a Node.js runtime now fails when unofficial-builds.nodejs.org cannot be reached. pnpm used to ignore that failure and leave the musl builds out of `pnpm-lock.yaml`. `pnpm update` then wrote a different lockfile on a machine whose network blocks the mirror [pnpm/pnpm#14813](https://github.com/pnpm/pnpm/issues/14813). - pnpm now deduplicates a package whose child dependency resolved an optional peer in one workspace project but not in another. Two copies of `next` could appear when only some projects could reach `styled-jsx`'s optional `babel-plugin-macros` peer [#&#8203;14800](https://github.com/pnpm/pnpm/issues/14800). - Fixed shell completion of package scripts for `pnpm run` and `pnpm run-script` [pnpm/pnpm#15034](https://github.com/pnpm/pnpm/issues/15034). Bash completion now preserves literal script names containing glob characters and shell punctuation in pnpm v11 and v12. - `pnpm sbom` now publishes a valid URL in the CycloneDX `externalReferences[].url` and the SPDX `homepage`. An npm shorthand such as `vercel/ms` or `gitlab:group/subgroup/project` is expanded to the `git+https` URL npm derives for it. An scp-style remote such as `git@github.com:vercel/ms.git` is expanded the same way. Any other URL is published in its normalized form, without embedded credentials. A value that names no repository, an email address for example, is left out. pnpm used to publish the raw value, so a shorthand produced a URL that consumers such as Dependency-Track reject [pnpm/pnpm#14773](https://github.com/pnpm/pnpm/issues/14773). - `pnpm setup` now describes the displayed configuration changes as "the following configuration changes." - `pnpm --version` now reports why the pnpm version a project pins cannot be installed or recorded, then prints the version of the running CLI. It used to fail, which made the command unusable where the filesystem is read-only. `pnpm --version` also honors `--store-dir` and its `--store` alias now [#&#8203;14831](https://github.com/pnpm/pnpm/issues/14831). - `pnpm install --force` now reinstalls dependencies when the manifest and lockfile are unchanged. It previously reported "Already up to date" without reinstalling. Files changed in `node_modules` are restored when the store content is intact. Combining `--force` with `--frozen-store` now reports a configuration conflict on repeat installs [#&#8203;919](https://github.com/pnpm/pnpm/issues/919). - `pnpm install` now installs git-hosted dependencies without preparing them when their builds are explicitly denied by `allowBuilds`. Dependencies that require preparation still need an explicit allow or deny decision [pnpm/pnpm#10522](https://github.com/pnpm/pnpm/issues/10522). - `pnpm runtime set` and `pnpm env use` now use the pnpm version that started the command. They could run a different installed pnpm when the command was started through Corepack or another wrapper. - The install summary now names the version each dependency resolved to when `node-linker` is `hoisted`. It also lists what an install restores after `node_modules` is deleted, and both sides of a version change. The summary showed the range recorded in `package.json`, or nothing at all [#&#8203;15161](https://github.com/pnpm/pnpm/issues/15161). - The `@pnpm/npm-lifecycle` package is now available as `@pnpm/exec.npm-lifecycle`. - Fixed `minimumReleaseAge` making pnpm download a package's full metadata again on every install. The cached copy carried a validator the registry could not match, so pnpm could never revalidate it [pnpm/pnpm#15103](https://github.com/pnpm/pnpm/issues/15103). - pnpm now measures a `pnpm.overrides` entry written as a bare path, such as `./local-dep`, from the directory holding `pnpm-workspace.yaml`. It used to be measured from each package the override rewrote, so the dependency linked to a directory that does not exist [#&#8203;11131](https://github.com/pnpm/pnpm/issues/11131). - pnpm now preserves scalar YAML anchors and aliases when editing `pnpm-workspace.yaml`. Removing the entry that defines an anchor keeps surviving aliases valid. Entries updated to different values are written separately [#&#8203;8245](https://github.com/pnpm/pnpm/issues/8245). - pnpm now preserves comments and existing key order when updating `package.yaml`. New keys are appended to their mapping [pnpm/pnpm#2008](https://github.com/pnpm/pnpm/issues/2008). - `pnpm install --prod` no longer downloads the registry packages that only a devDependency reaches [#&#8203;881](https://github.com/pnpm/pnpm/issues/881). - `pnpm update --global` no longer reinstalls a global package when its dependency graph resolves to what is already installed. It reports `Already up to date` [pnpm/pnpm#12002](https://github.com/pnpm/pnpm/issues/12002). - The `minimumReleaseAge` approval prompt now counts and displays each package version once [pnpm/pnpm#15083](https://github.com/pnpm/pnpm/issues/15083). - `pnpm run` no longer sends a script a second `SIGINT` when `Ctrl+C` is pressed in a terminal. A script that shuts down on the first `SIGINT` and exits at once on a second used to die before its shutdown finished [#&#8203;7374](https://github.com/pnpm/pnpm/issues/7374). - pnpm now reads a `pnpm-workspace.yaml` whose `tasks` section uses a setting only pnpm 12 acts on, such as `concurrencyGroup`. A task's unrecognized fields are ignored, unless the field only differs in case from `concurrency` or `dependsOn`, which pnpm reports as a typo. The warning about unrecognized top-level settings now names `cargo`, `concurrencyGroups`, and `pipelines` as pnpm 12 settings. - `pnpm -r list --json` now prints one JSON array. It printed a separate array for each project when `sharedWorkspaceLockfile` was `false`, so the output could not be parsed. `pnpm -r list` now reads each project's own modules directory when the projects keep their own lockfiles, so `--long` and `--parseable` report the packages that project installed [#&#8203;15011](https://github.com/pnpm/pnpm/issues/15011). - A signal sent to pnpm while it runs without a terminal, as a container runtime or a service manager does, now reaches the script even when the shell running it stays the script's parent. pnpm then waits for the script to finish shutting down. Such a signal used to end the shell at once or stay with it, and the script was never told to stop [#&#8203;7374](https://github.com/pnpm/pnpm/issues/7374). - Fixed `minimumReleaseAge` being skipped for packages served by a registry that returns the same ETag for abbreviated and full package metadata [pnpm/pnpm#14925](https://github.com/pnpm/pnpm/issues/14925). - `pnpm install` now returns "Already up to date" in a workspace where `dedupeDirectDeps` left a project without a `node_modules` directory of its own. Such a project forced a full install on every run. - Installs in different projects that share a global virtual store no longer fail on Windows with `Access is denied` while repairing the same slot [#&#8203;15114](https://github.com/pnpm/pnpm/issues/15114). - `pnpm sbom` now emits a license value as a CycloneDX expression only when it is a valid SPDX license expression. Anything else is emitted as a CycloneDX license name [pnpm/pnpm#14786](https://github.com/pnpm/pnpm/issues/14786). - A dependency's own bins can no longer take over another package's bin shim. The POSIX shims pnpm generates used to look up their shell helpers on `PATH`, where a dependency's bins come first [#&#8203;14837](https://github.com/pnpm/pnpm/issues/14837). Reinstalling replaces the shims already in your `node_modules`. On Cygwin, MSYS2, and WSL the shims still take their Windows path conversion from `PATH`, so a dependency can still redirect them there. - POSIX bin shims now convert a Windows-form path such as `C:\node_modules\.bin\tsc` correctly. The shim mangled the backslashes in such a path and could not reach the package it runs. Installing again replaces the shims already in `node_modules` [#&#8203;14867](https://github.com/pnpm/pnpm/issues/14867). - `pnpm pack` now writes tarball entries grouped by file extension and file name, the order npm uses. Packages that ship many same-named files, such as template collections, pack much smaller [#&#8203;14766](https://github.com/pnpm/pnpm/issues/14766). - A command run in a project that the workspace does not include now acts on that project alone. A project is outside the workspace when it has a manifest of its own and no pattern in the `packages` setting selects it, or when a `!` pattern excludes it. A directory with no manifest of its own, such as a package's source directory, still belongs to the workspace. `pnpm install` in an excluded project used to install every project in the workspace [#&#8203;3561](https://github.com/pnpm/pnpm/issues/3561). - POSIX bin shims now take `cygpath` and `wslpath` from the system default path on Cygwin, MSYS2, and WSL2. The shims looked both helpers up on `PATH`, where a dependency's own bins come first, so a dependency could redirect another package's shim. Installing again replaces the shims already in `node_modules` [#&#8203;14866](https://github.com/pnpm/pnpm/issues/14866). - `pnpm update` and `pnpm audit --fix=update` no longer copy dependencies added by `packageExtensions`, a `readPackage` hook, or an override into `package.json`. Those dependencies keep the specifier the hook or override gives them. `pnpm update --latest` no longer resolves past that specifier. `pnpm audit --fix=update` now warns when one of them pins a vulnerable version. The warning points at `pnpm audit --fix` [#&#8203;14928](https://github.com/pnpm/pnpm/issues/14928). <!-- sponsors --> ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> <details> <summary>prettier/prettier (prettier)</summary> ### [`v3.9.9`](https://github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#399) [Compare Source](https://github.com/prettier/prettier/compare/3.9.8...3.9.9) [diff](https://github.com/prettier/prettier/compare/3.9.8...3.9.9) ##### Markdown: Fix text with `$` been incorrectly parsed as math syntax ([#&#8203;20140](https://github.com/prettier/prettier/pull/20140) by [@&#8203;fisker](https://github.com/fisker)) <!-- prettier-ignore --> ```md <!-- Input --> **Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here. <!-- Prettier 3.9.8 --> **Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here. <!-- Prettier 3.9.9 --> **Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here. ``` </details> <details> <summary>sveltejs/svelte (svelte)</summary> ### [`v5.57.1`](https://github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5571) [Compare Source](https://github.com/sveltejs/svelte/compare/svelte@5.57.0...svelte@5.57.1) ##### Patch Changes - fix: cancel deferred event listeners during cleanup ([#&#8203;18749](https://github.com/sveltejs/svelte/pull/18749)) - fix: preserve global CSS in components without scopable elements ([#&#8203;18793](https://github.com/sveltejs/svelte/pull/18793)) - fix: reduce SSR render result garbage collection ([#&#8203;18798](https://github.com/sveltejs/svelte/pull/18798)) - fix: resolve the fallback of an each block in the enclosing scope ([#&#8203;18803](https://github.com/sveltejs/svelte/pull/18803)) - perf: speed up parser interactions with Acorn or avoid them where possible ([#&#8203;18740](https://github.com/sveltejs/svelte/pull/18740)) - fix: prevent effect tree of batches from interfering with each other ([#&#8203;18508](https://github.com/sveltejs/svelte/pull/18508)) - fix: serialize input default values during server rendering ([#&#8203;18733](https://github.com/sveltejs/svelte/pull/18733)) - fix: remove `WAS_MARKED` flag in favor of `Set` ([#&#8203;18127](https://github.com/sveltejs/svelte/pull/18127)) - fix: throw `set_context_after_init` when `setContext` is called after an `await` during SSR ([#&#8203;18739](https://github.com/sveltejs/svelte/pull/18739)) - fix: make Object.hasOwn reactive for state proxy ownership changes ([#&#8203;18838](https://github.com/sveltejs/svelte/pull/18838)) - fix: keep `$state.eager` when used as a variable initializer ([#&#8203;18809](https://github.com/sveltejs/svelte/pull/18809)) - perf: avoid regex matching in parser where possible ([#&#8203;18736](https://github.com/sveltejs/svelte/pull/18736)) - fix: in non-async mode, only push variable to current\_sources when active\_reaction is updating ([#&#8203;18550](https://github.com/sveltejs/svelte/pull/18550)) - fix: recognise `aria-braillelabel` and `aria-brailleroledescription` as known ARIA attributes ([#&#8203;18765](https://github.com/sveltejs/svelte/pull/18765)) </details> <details> <summary>typescript-eslint/typescript-eslint (typescript-eslint)</summary> ### [`v8.70.1`](https://github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/typescript-eslint/CHANGELOG.md#8701-2026-09-21) [Compare Source](https://github.com/typescript-eslint/typescript-eslint/compare/v8.70.0...v8.70.1) This was a version bump only for typescript-eslint to align it with other projects, there were no code changes. See [GitHub Releases](https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.70.1) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - "after 11pm every weekday,before 5am every weekday,every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](undefined) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIzNC4wIiwidGFyZ2V0QnJhbmNoIjoiZGV2IiwibGFiZWxzIjpbXX0=-->

renovate-bot added 1 commit 2026-09-29 21:02:37 +02:00

Update Non-major updates 045109f1cf

renovate-bot scheduled this pull request to auto merge when all checks succeed 2026-09-29 21:02:37 +02:00

renovate-bot force-pushed renovate/non-major-updates from 045109f1cf to 333a57256b 2026-09-30 09:01:33 +02:00 Compare

renovate-bot merged commit 60606e6696 into dev 2026-09-30 09:01:38 +02:00

renovate-bot deleted branch renovate/non-major-updates 2026-09-30 09:01:38 +02:00

renovate-bot referenced this pull request from a commit 2026-09-30 09:01:38 +02:00

Merge pull request 'Update Non-major updates' (#78) from renovate/non-major-updates into dev

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

Compat/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority

Critical

The priority is critical

  

Priority

High

The priority is high

  

Priority

Low

The priority is low

  

Priority

Medium

The priority is medium

  

Reviewed

Confirmed

Issue has been confirmed

  

Reviewed

Duplicate

This issue or pull request already exists

  

Reviewed

Invalid

Invalid issue

  

Reviewed

Won't Fix

This issue won't be fixed

  

Status

Abandoned

Somebody has started to work on this but abandoned work

  

Status

Blocked

Something is blocking this issue or pull request

  

Status

Need More Info

Feedback is required to reproduce issue or to continue work

No labels

Compat/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/Security

Kind/Testing

Priority

Critical

Priority

High

Priority

Low

Priority

Medium

Reviewed

Confirmed

Reviewed

Duplicate

Reviewed

Invalid

Reviewed

Won't Fix

Status

Abandoned

Status

Blocked

Status

Need More Info

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

IC3P3/hcss-website!78

No description provided.