chore(deps): update pnpm packages to v11.6.0#217
Merged
Conversation
renovate
Bot
added
dependencies
|
js-utils-kit
juk-cli
juk-web
@js-utils-kit/array
@js-utils-kit/charset
@js-utils-kit/constants
@js-utils-kit/core
@js-utils-kit/env
@js-utils-kit/fs
@js-utils-kit/number
@js-utils-kit/object
@js-utils-kit/pm
@js-utils-kit/regex
@js-utils-kit/string
@js-utils-kit/system
@js-utils-kit/types
@js-utils-kit/valid
commit: |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
11.5.3→11.6.0Release Notes
pnpm/pnpm (pnpm)
v11.6.0Compare Source
Minor Changes
pnpm installcompletes without re-resolving whenpnpm-lock.yamlwas deleted butnode_modulesis intact: the up-to-date check now treats the current lockfile (node_modules/.pnpm/lock.yaml) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restorespnpm-lock.yamlfrom it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the registry.615c669: Added support for configuring URL-scoped registry settings throughnpm_config_//…andpnpm_config_//…environment variables, for example:This provides a file-free way to supply registry authentication. Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace
.npmrcbut is still overridden by command-line options. When the same key is provided through both prefixes,pnpm_config_wins.Raised the default network concurrency from
min(64, max(cpuCores * 3, 16))tomin(96, max(cpuCores * 3, 64)). Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. ThenetworkConcurrencysetting still overrides the default.Patch Changes
.npmrcuses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level~/.npmrcor runningpnpm config set "<key>" <value>— with a link to https://pnpm.io/npmrc. Thepnpm config setexample is only suggested when the key has no${...}placeholder, so the snippet is always safe to copy-paste.os/cpu/libcfields are missing from the registry metadata or the lockfile. Some registries strip these fields from the package metadata, which made pnpm download and install the binaries of every platform regardless ofsupportedArchitectures. The missing platform fields of an optional dependency are now inferred from its name (e.g.@nx/nx-win32-arm64-msvc→os: win32,cpu: arm64), so foreign-platform binaries are skipped without even downloading them #11702.Configuration
📅 Schedule: (in timezone Asia/Kolkata)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.