chore(deps): update pnpm to v8 #139

renovate · 2023-03-31T12:12:21Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pnpm (source)	`7.33.2` -> `8.6.5`

Release Notes

pnpm/pnpm (pnpm)

`v8.6.5`

Compare Source

Patch Changes

Improve the performance of searching for auth tokens #6717.

Our Gold Sponsors

Our Silver Sponsors

`v8.6.4`

Compare Source

Patch Changes

In cases where both aliased and non-aliased dependencies exist to the same package, non-aliased dependencies will be used for resolving peer dependencies, addressing issue #6588.
Ignore the port in the URL, while searching for authentication token in the .npmrc file #6354.
Don't add the version of a local directory dependency to the lockfile. This information is not used anywhere by pnpm and is only causing more Git conflicts #6695.

Our Gold Sponsors

Our Silver Sponsors

`v8.6.3`

Compare Source

Patch Changes

When running a script in multiple projects, the script outputs should preserve colours #2148.
Don't crash when the APPDATA env variable is not set on Windows #6659.
Don't fail when a package is archived in a tarball with malformed tar headers #5362.
Peer dependencies of subdependencies should be installed, when node-linker is set to hoisted #6680.
Throw a meaningful error when applying a patch to a dependency fails.
pnpm update --global --latest should work #3779.
pnpm license ls should work even when there is a patched git protocol dependency #6595

Our Gold Sponsors

Our Silver Sponsors

`v8.6.2`

Compare Source

Patch Changes

Change lockfile version back to 6.0 as previous versions of pnpm fail to parse the version correctly #6648
When patching a dependency, only consider files specified in the 'files' field of its package.json. Ignore all others #6565
Should always treat local file dependency as new dependency #5381
Output a warning message when "pnpm" or "resolutions" are configured in a non-root workspace project #6636

Our Gold Sponsors

Our Silver Sponsors

`v8.6.1`

Compare Source

Patch Changes

When dedupe-peer-dependents is enabled (default), use the path (not id) to determine compatibility.

When multiple dependency groups can be deduplicated, the latter ones are sorted according to number of peers to allow them to benefit from deduplication.

Resolves: #6605
Some minor performance improvements by removing await from loops #6617.

Our Gold Sponsors

Our Silver Sponsors

`v8.6.0`

Compare Source

Minor Changes

Some settings influence the structure of the lockfile, so we cannot reuse the lockfile if those settings change. As a result, we need to store such settings in the lockfile. This way we will know with which settings the lockfile has been created.

A new field will now be present in the lockfile: settings. It will store the values of two settings: autoInstallPeers and excludeLinksFromLockfile. If someone tries to perform a frozen-lockfile installation and their active settings don't match the ones in the lockfile, then an error message will be thrown.

The lockfile format version is bumped from v6.0 to v6.1.

Related PR: #6557
Related issue: #6312
A new setting, exclude-links-from-lockfile, is now supported. When enabled, specifiers of local linked dependencies won't be duplicated in the lockfile.

This setting was primarily added for use by Bit CLI, which links core aspects to node_modules from external directories. As such, the locations may vary across different machines, resulting in the generation of lockfiles with differing locations.

Patch Changes

Don't print "Lockfile is up-to-date" message before finishing all the lockfile checks #6544.
When updating dependencies, preserve the range prefix in aliased dependencies. So npm:foo@1.0.0 becomes npm:foo@1.1.0.
Print a meaningful error when a project referenced by the workspace: protocol is not found in the workspace #4477.
pnpm rebuild should not fail when node-linker is set to hoisted and there are skipped optional dependencies #6553.
Peers resolution should not fail when a linked in dependency resolves a peer dependency.
Build projects in a workspace in correct order #6568.

Our Gold Sponsors

Our Silver Sponsors

`v8.5.1`

Compare Source

Patch Changes

Expanded missing command error, including 'did you mean' #6492.
When installation fails because the lockfile is not up-to-date with the package.json file(s), print out what are the differences #6536.
Normalize current working directory on Windows #6524.

Our Gold Sponsors

Our Silver Sponsors

`v8.5.0`

Compare Source

Minor Changes

pnpm patch-remove command added #6521.

Patch Changes

pnpm link -g <pkg-name> should not modify the package.json file #4341.
The deploy command should not ask for confirmation to purge the node_modules directory #6510.
Show cyclic workspace dependency details #5059.
Node.js range specified through the engines field should match prerelease versions #6509.

Our Gold Sponsors

Our Silver Sponsors

`v8.4.0`

Compare Source

Minor Changes

pnpm publish supports the --provenance CLI option #6435.

Patch Changes

Link the bin files of local workspace dependencies, when node-linker is set to hoisted 6486.
Ask the user to confirm the removal of node_modules directory unless the --force option is passed.
Do not create a node_modules folder with a .modules.yaml file if there are no dependencies inside node_modules.

Our Gold Sponsors

Our Silver Sponsors

`v8.3.1`

Compare Source

Patch Changes

Patch node-fetch to fix an error that happens on Node.js 20 #6424.

Our Gold Sponsors

Our Silver Sponsors

`v8.3.0`

Compare Source

Minor Changes

A custom compression level may be specified for the pnpm pack command using the pack-gzip-level setting #6393.
Add --check flag to pnpm dedupe. No changes will be made to node_modules or the lockfile. Exits with a non-zero status code if changes are possible.
pnpm install --resolution-only re-runs resolution to print out any peer dependency issues #6411.

Patch Changes

Warn user when publishConfig.directory of an injected workspace dependency does not exist #6396.
Use hard links to link the node executable on Windows machines #4315.

Our Gold Sponsors

Our Silver Sponsors

`v8.2.0`

Compare Source

Minor Changes

Allow env variables to be specified with default values in .npmrc. This is a convention used by Yarn too.
Using ${NAME-fallback} will return fallback if NAME isn't set. ${NAME:-fallback} will return fallback if NAME isn't set, or is an empty string #6018.

Patch Changes

Add -g to mismatch registries error info when original command has -g option #6224.
Don't fail with EBUSY error when trying to copy a file from the store #6201
pnpm config get <key> should print boolean values #6360
Don't print an info message about linked dependencies if they are real linked dependencies specified via the link: protocol in package.json #6372

Our Gold Sponsors

Our Silver Sponsors

	Mend Renovate. View repository job log here.

socket-security · 2023-03-31T12:14:06Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Issue	Package	Version	Note	Source
Install scripts	vue-demi	0.14.0	Install script: postinstall Source: `node ./scripts/postinstall.js`	nuxt3@3.0.0-rc.9-27703329.537338f via `package.json` nuxt@3.0.0-rc.11 via `playground/package.json`

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore vue-demi@0.14.0

codecov-commenter · 2023-03-31T15:53:18Z

Codecov Report

Patch and project coverage have no change.

Comparison is base (9b9d629) 100.00% compared to head (c35eab9) 100.00%.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #139   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            2         2           
  Lines           39        39           
  Branches         6         6           
=========================================
  Hits            39        39

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

socket-security · 2023-06-06T23:27:28Z

New dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
@nuxtjs/eslint-config-typescript	12.0.0	None	`+76`	13.1 MB	antfu
eslint-config-prettier	8.8.0	None	`+2`	423 kB	lydell
nuxt3	3.0.0-rc.9-27703329.537338f	filesystem, environment	`+132`	20.2 MB	nuxt.bot
@vitest/coverage-c8	0.31.4	None	`+4`	6 MB	oreanno
@release-it/conventional-changelog	5.1.1	filesystem	`+57`	3 MB	webpro
eslint-plugin-prettier	4.2.1	None	`+4`	491 kB	jounqin
@nuxt/test-utils	3.4.2	environment	`+11`	6.55 MB	danielroe

renovate bot added chore dependencies labels Mar 31, 2023

renovate bot force-pushed the renovate/pnpm-8.x branch 2 times, most recently from 7ff075c to b8b6775 Compare March 31, 2023 15:49

renovate bot force-pushed the renovate/pnpm-8.x branch 7 times, most recently from d39a408 to 15cd680 Compare April 8, 2023 22:20

renovate bot force-pushed the renovate/pnpm-8.x branch 6 times, most recently from 98f5b4f to 7f890eb Compare April 14, 2023 14:49

renovate bot force-pushed the renovate/pnpm-8.x branch 7 times, most recently from 73e61c3 to c7a86ae Compare April 24, 2023 16:59

renovate bot force-pushed the renovate/pnpm-8.x branch 4 times, most recently from ade1696 to 1f781f6 Compare April 29, 2023 10:07

renovate bot force-pushed the renovate/pnpm-8.x branch 5 times, most recently from 07e92a1 to a0a6f3b Compare May 24, 2023 20:47

renovate bot force-pushed the renovate/pnpm-8.x branch 7 times, most recently from 6a5579c to fc6ef17 Compare June 4, 2023 03:53

renovate bot force-pushed the renovate/pnpm-8.x branch 2 times, most recently from b782604 to c3d4fb1 Compare June 6, 2023 23:25

renovate bot force-pushed the renovate/pnpm-8.x branch 5 times, most recently from 5a0d705 to 288891d Compare June 18, 2023 03:58

renovate bot force-pushed the renovate/pnpm-8.x branch 4 times, most recently from 642162c to 0e82195 Compare June 26, 2023 11:20

renovate bot force-pushed the renovate/pnpm-8.x branch from 0e82195 to 8253d88 Compare July 2, 2023 12:37

chore(deps): update pnpm to v8

c35eab9

renovate bot force-pushed the renovate/pnpm-8.x branch from 8253d88 to c35eab9 Compare July 2, 2023 16:54

danielroe approved these changes Jul 2, 2023

View reviewed changes

danielroe merged commit 3a17d66 into main Jul 2, 2023
4 of 5 checks passed

danielroe deleted the renovate/pnpm-8.x branch July 2, 2023 18:22

chore(deps): update pnpm to v8 #139

chore(deps): update pnpm to v8 #139

renovate bot commented Mar 31, 2023 •

edited

socket-security bot commented Mar 31, 2023 •

edited

codecov-commenter commented Mar 31, 2023 •

edited

socket-security bot commented Jun 6, 2023 •

edited

chore(deps): update pnpm to v8 #139

chore(deps): update pnpm to v8 #139

Conversation

renovate bot commented Mar 31, 2023 • edited

Release Notes

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

Minor Changes

Patch Changes

Our Gold Sponsors

Our Silver Sponsors

socket-security bot commented Mar 31, 2023 • edited

Next steps

codecov-commenter commented Mar 31, 2023 • edited

Codecov Report

socket-security bot commented Jun 6, 2023 • edited

renovate bot commented Mar 31, 2023 •

edited

socket-security bot commented Mar 31, 2023 •

edited

codecov-commenter commented Mar 31, 2023 •

edited

socket-security bot commented Jun 6, 2023 •

edited