chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #34 · nanohype/docs

renovate · 2026-08-10T08:51:22Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/check (source)	`0.9.9` → `0.9.10`
@astrojs/starlight (source)	`0.41.3` → `0.41.7`
@biomejs/biome (source)	`2.5.6` → `2.5.7`
astro (source)	`7.1.4` → `7.2.0`
pnpm (source)	`11.8.0` → `11.21.0`

Release Notes

withastro/astro (@astrojs/check)

`v0.9.10`

Compare Source

Patch Changes

#17447 b01a692 Thanks @ocavue! - Update dependency yargs to version 18. See the yargs changelog for details.

withastro/starlight (@astrojs/starlight)

`v0.41.7`

Compare Source

Patch Changes

#4114 3e486fb Thanks @delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processor

`v0.41.6`

Compare Source

Patch Changes

#4102 f1dddc0 Thanks @delucis! - Adds 1 new icon: forgejo

`v0.41.5`

Compare Source

Patch Changes

#4095 bb06434 Thanks @HiDeoo! - Fixes a regression when using a union to extend Starlight’s docsSchema().

`v0.41.4`

Compare Source

Patch Changes

#3936 712eedd Thanks @miichom! - Fixes support for modifying Zod enums when passing an extend option to Starlight’s docsSchema()
#4092 0896b91 Thanks @delucis! - Fixes support for links containing a protocol like mailto: in the sidebar
#4088 4486ba4 Thanks @delucis! - Simplifies Starlight’s client-side sidebar state persistence script slightly

biomejs/biome (@biomejs/biome)

`v2.5.7`

Compare Source

Patch Changes

#10822 c171b3b Thanks @pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.
#11136 e63354c Thanks @AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.
#10094 e007143 Thanks @THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.
#11184 135f476 Thanks @subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
#8239 a519f9d Thanks @cormacrelf! - Fixed #8233, where Biome CLI in
stdin mode didn't work correctly when handling files in projects with nested
configurations. For example, with the following structure,
--stdin-file-path=subdirectory/... would not use the nested configuration in
subdirectory/biome.json:
```
├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js
```
```
biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
```
Now, the nested configuration is correctly picked up and applied.

In addition, Biome now shows a warning if --stdin-file-path is provided but
that path is ignored and therefore not formatted or fixed.
#11138 8c2c6bd Thanks @ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
```
declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;

schedule(async () => {}) ?? "fallback";
```
The following code is also now invalid, because map(() => 42) returns 42:
```
type Mapper<T> = () => T;
declare function map<T>(mapper: Mapper<T>): T;

map(() => 42) || flag;
```
#11138 8c2c6bd Thanks @ematipico! - Fixed #11087: noUnnecessaryConditions no longer reports optional chains and nullish coalescing whose receiver can be nullish.

For example, the optional chain and fallback in the following code are no longer reported:
```
declare const usage: { range: { startDate: string } } | null;
const startDate = usage?.range.startDate ?? "N/A";
```
#11118 9c16840 Thanks @subotac! - Fixed #11098: The HTML formatter now preserves the configured trailing newline when a file ends with a comment.
```
-
\ No newline at end of file
+
```
#11201 0e80610 Thanks @Bishwas-py! - Fixed #11182: suppression comments for noPositiveTabindex now suppress the rule in HTML files when the attributes of the element span multiple lines.
#11079 607afd2 Thanks @dyc3! - The HTML formatter now lays out the srcset attribute of <img> and <source> as the list of candidates it is. Runs of whitespace between candidates collapse, and once the list no longer fits on one line each candidate goes on its own line with the descriptors aligned:
```
- <img srcset="/visual@0.5.png  400w, /visual.png 805w, /visual@2x.png 1610w, /visual@3x.png 2415w" />
+ <img
+   srcset="
+     /visual@0.5.png  400w,
+     /visual.png      805w,
+     /visual@2x.png  1610w,
+     /visual@3x.png  2415w
+   "
+ />
```
#11156 fed72c7 Thanks @saberoueslati! - Fixed #11129: noUnusedVariables no longer reports Vue bindings as unused when they are assigned through automatically unwrapped template refs.

#11124 d890b39 Thanks @denbezrukov! - Fixed CSS formatting of line comments between a declaration colon and value to preserve their source indentation.

 .test {
   background:
-  /////// foo
-  // bar
+        /////// foo
+        // bar
     radial-gradient(circle, #&#8203;000, transparent);
 }

#11113 3d8ab73 Thanks @denbezrukov! - Fixed CSS formatting of long block comments between comma-separated property values:

 .foo {
   box-shadow:
-    1000px /* long long long long long long long long long long long long comment */ 1000px /* long long long long long long long long long comment */ 2px color(srgb 0.555555555 0.555555555 0.555555555),
+    1000px
+      /* long long long long long long long long long long long long comment */
+      1000px /* long long long long long long long long long comment */ 2px
+      color(srgb 0.555555555 0.555555555 0.555555555),
     1px 1px black;
 }

#11127 da5c1a5 Thanks @dyc3! - The HTML formatter now picks the quote character for an attribute by counting the quotes in the value rather than looking only for a double quote. ' and " count as the characters they stand for, and only the character that ends up as the delimiter stays escaped:
```
- <div title='123 &apos;&quot; 456'></div>
+ <div title="123 '&quot; 456"></div>
```
Entities that are not quotes, such as & or &[#39](https://redirect.github.com/biomejs/biome/issues/39);, are left exactly as written.
#11193 77035bb Thanks @dyc3! - Fixed the HTML formatter collapsing the blank line between an element and the text that follows it. A blank line before text is now kept, the way one before another element already was:
```
  <div>foo</div>
-
  text
```
#11106 ad80f57 Thanks @dyc3! - The HTML formatter now writes the HTML5 doctype in lowercase, matching Prettier:
```
- <!DOCTYPE html>
+ <!doctype html>
```
This only applies to a plain .html file whose doctype stands alone. A doctype that names a DTD keeps the case it was written with, since the rest of the declaration is not lowercased either:
```
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
```
A .vue, .svelte, or .astro file keeps whatever the author wrote.
#11188 60679db Thanks @dyc3! - Fixed the HTML formatter printing a comment twice when it ended the line of the last element in a document:
```
- text
+ text
```
#11077 4dcd0d9 Thanks @dyc3! - Fixed a bug where the HTML formatter collapsed the whitespace inside <textarea>, <xmp> and <plaintext>, changing what the page renders.
```
- <textarea>
-  line one
- line two </textarea>
+ <textarea>line one line two</textarea>
```
Biome now prints the content of these elements exactly as it appears in the source, matching the existing behavior for <pre>.
#11194 abfbb11 Thanks @dyc3! - Fixed the HTML formatter refusing to format a Svelte file containing an array pattern that skips a position:
```
{#each animals as [, value]}
	<p>{value}</p>
{/each}
```
#10094 e007143 Thanks @THEjacob1000! - Fixed useSortedClasses to correctly detect unsorted classes in static member expression tagged templates (e.g. tw.div\...``). Previously, these were silently skipped due to surrounding whitespace trivia not being stripped from the tag name.
#11078 10da30e Thanks @dyc3! - Fixed Vue single-file components failing to parse when they contain a custom block such as <i18n> or <docs>, or a <template> written in another language. Their content is no longer read as HTML, so a block may hold whatever its own tooling expects:
```
<docs>
This block is prose, and it may mention a `<my-component>` without closing it.
</docs>

<template lang="pug">
  .test
    #foo
</template>
```
Previously both blocks produced a parse error and the whole file was left unformatted. Biome now prints their content unchanged while still formatting the opening tag.
#11231 4afd901 Thanks @ematipico! - Improved the performance of the following lint rules:
- noArguments.
- noGlobalAssign.
- noUndeclaredVariables.
- noRestrictedGlobals.
- noInvalidUseBeforeDeclaration.
- noShadow.
- noRedeclare.
#11134 2fa0a62 Thanks @yanthomasdev! - Clarified the warning emitted when using the experimental json and json-pretty reporters.
#11198 ed88b13 Thanks @saberoueslati! - Fixed #11171: variables referenced only inside a Svelte attachment ({@attach ...}) are no longer reported as unused by noUnusedVariables and noUnusedImports.
#11155 6ee17ea Thanks @dyc3! - Improved performance when printing diagnostics to the console.
#11160 217f8ad Thanks @dyc3! - Improved the performance of noFloatingPromises by skipping type inference for assignment statements, which are always considered handled.
#11159 26c23d9 Thanks @saberoueslati! - Fixed #11144: noFloatingPromises no longer reports already-awaited optional Promise values.
#11138 8c2c6bd Thanks @ematipico! - Fixed #11121: noUnnecessaryConditions no longer reports conditions based on an inapplicable function overload.

For example, the condition in the following code is no longer reported because query({}) selects the overload that returns boolean:
```
declare function query(options: { initial: string }): { isPending: false };
declare function query(options: { initial?: string }): { isPending: boolean };

const { isPending } = query({});
isPending || fallback;
```
#11152 c4fc6a9 Thanks @dyc3! - Improved the performance of collecting rule timings with --profile-rules in heavily multithreaded environments.
#11128 4d3ff76 Thanks @ematipico! - Fixed #7635: noDeprecatedImports now detects deprecated ambient declarations that are exported separately.
#11117 01f7ef5 Thanks @subotac! - Fixed #11014: noDelete no longer reports process.env["FOO"] style property deletions.
#11168 9847e68 Thanks @saberoueslati! - Added the nursery rule noNonScalableViewport, which reports viewport metadata that disables user scaling with user-scalable=no.

For example:
```
<meta name="viewport" content="width=device-width, user-scalable=no" />
```
#11154 a1d6b1f Thanks @dyc3! - Improved the performance of noImportCycles by skipping graph traversals for imports that cannot be part of a cycle.
#11175 d96d6dd Thanks @ematipico! - Fixed CSS parsing of registered custom properties: Biome now correctly validates the syntax descriptor of @property rules.

withastro/astro (astro)

`v7.2.0`

Compare Source

Minor Changes

#17174 0224a3a Thanks @matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.
```
astro preview --background
```
When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:
```
astro preview status
astro preview logs
astro preview logs --follow
astro preview stop
```
If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.
#17532 7f94895 Thanks @florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:
```
// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  logger: {
-    entrypoint: new URL('./src/logger.js', import.meta.url),
+    entrypoint: './src/logger.js',
  },
});
```
Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.
#17084 961bbe5 Thanks @matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.
```
import type { AstroPrerenderer, PrerenderResult } from 'astro';

const prerenderer: AstroPrerenderer = {
  name: 'my-adapter:prerenderer',
  getStaticPaths,
  async render(request, { routeData }): Promise<PrerenderResult> {
    const { response, metadata } = await renderInRuntime(request, routeData);
    return { response, metadata };
  },
};
```
This is a non-breaking widening: prerenderers that return a bare Response continue to work unchanged, and in-process prerenderers can keep returning a Response since the build collects their metadata directly.
#16871 90c98ae Thanks @adamchal! - Adds session: false in astro.config to opt out of session support. Projects that do not set session: false see no behavior change.
```
import { defineConfig } from 'astro/config';

export default defineConfig({
  session: false,
});
```
The session runtime and dependencies (unstorage) are now tree-shaken out of the SSR bundle for any project where no session driver is wired via:
- session: false
- no session config at all
- a session config without a driver
Useful for serverless/edge runtimes where cold-start parse time is sensitive.
#17084 961bbe5 Thanks @matthewp! - Adds experimental support for incremental static builds with experimental.incrementalBuild.

When enabled, Astro can skip regenerating static pages from dynamic routes when both the page's module dependencies and its data cache key are unchanged from the previous build. This currently applies to pages returned from getStaticPaths() that include a cacheKey.
```
// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    incrementalBuild: true,
  },
});
```
Return a cacheKey for each generated page from getStaticPaths():
```
---
export async function getStaticPaths() {
  const posts = await fetchPosts();

  return posts.map((post) => ({
    params: { slug: post.slug },
    props: { post },
    cacheKey: post.digest,
  }));
}
---
```
For incremental builds to skip rendering in CI, Astro's cache directory must be preserved between builds. Astro empties the output directory on each build and restores skipped pages from the cache directory, so only that directory needs to persist. For the default config, cache and restore node_modules/.astro/ before running astro build.

See the experimental incremental static builds documentation for more information.
#17084 961bbe5 Thanks @matthewp! - Adds the optional digest property to content collection entries.

Loaders can provide an opaque digest value that changes when an entry changes. This is now reflected in the CollectionEntry type returned by getCollection() and getEntry(), making it easier to detect content changes without re-hashing large entry bodies.
```
---
import { getCollection } from 'astro:content';

const posts = await getCollection('blog');

for (const post of posts) {
  console.log(post.digest);
}
---
```
The property is optional because not every loader provides a digest. See incremental static builds for how digest can be used as a cacheKey.

Patch Changes

#17534 5a5337e Thanks @florian-lefebvre! - Improves logger.entrypoint reference docs
#17529 d52a787 Thanks @QVinto! - Fixes astro dev crashing with Invalid URL when --host is set to a specific non-loopback address

Vite only reports a local URL for loopback hosts. When the dev server was started with --host <custom-address> bound to a specific non-loopback address (a LAN or Tailscale IP, for example), the URL was reported under network and local was empty, so writing the dev lock file threw Invalid URL and killed a server that had already started successfully.

The lock file URL now falls back to the network URL, and a server that exposes no URL at all is left untracked rather than being taken down by lock file bookkeeping.
#17566 296248c Thanks @astrobot-houston! - Fixes fontProviders.googleicons() returning the full icon font (~3.9MB) instead of only the requested glyphs when multiple experimental.glyphs are specified
#17560 ef45de1 Thanks @astrobot-houston! - Fixes Astro.url.pathname for non-index pages when using build.format: 'preserve'. Previously, a page like src/pages/about-me.astro would output to dist/about-me.html but Astro.url.pathname would incorrectly return /about-me/ instead of /about-me.html.
#17573 0089f83 Thanks @astrobot-houston! - Fixes a Content Layer build crash that could occur when another dependency causes an older version of neotraverse to be hoisted to the project root
#17571 116f700 Thanks @astrobot-houston! - Fixes cookies set via Astro.cookies.set() inside a custom 404.astro or 500.astro error page being silently dropped from the final response
#17579 3ea55ce Thanks @bluwy! - Supports the devEngines field in package.json when detecting the package manager for install commands
#17422 e4e2037 Thanks @jiwonyoon-dev! - Fixes popover being rendered as popover="true"/popover="false" on custom elements (tag names containing a hyphen). Per the Popover API, the attribute only accepts "auto", "manual", or being absent, so boolean values are now always rendered as a bare popover attribute (or omitted), regardless of the tag name.

`v7.1.6`

Compare Source

Patch Changes

#17536 ff97b86 Thanks @dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes
#17383 296e1b0 Thanks @thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev

#17543 bbc1ec9 Thanks @ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

For example, you can reduce the size of chunks to 1MB:

// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    collectionStorage: {
      type: 'chunked',
      chunkSize: 1024 * 1024,
    },
  },
});

#17545 5214663 Thanks @ematipico! - Bumps the Astro compiler to the latest version. Changelog.

`v7.1.5`

Compare Source

Patch Changes

#17524 7613030 Thanks @matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent
#17480 f61ba9c Thanks @florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.
#17525 e614b7b Thanks @matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments
#17284 c775c1f Thanks @matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead
#17474 c895b12 Thanks @nicksnyder! - Updates dependency js-yaml to v4.3.0
Updated dependencies [c895b12]:
- @astrojs/internal-helpers@0.10.2
- @astrojs/markdown-remark@7.2.2
- @astrojs/markdown-satteri@0.3.5

pnpm/pnpm (pnpm)

`v11.21.0`: pnpm 11.21

Compare Source

Minor Changes

Added interactive group selection to pnpm update --global --interactive.
Running pnpm setup, pnpm self-update, or a command that modifies the global installation (such as pnpm add --global) through sudo now prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail with ERR_PNPM_SUDO_NOT_SUPPORTED in pnpm v12. Read-only global commands (such as pnpm bin --global) are unaffected.

Patch Changes

Fixed pnpm failing to start under asynchronous Node.js module loaders when no .pnpmfile.mjs exists pnpm/pnpm#11701.
Fixed minimumReleaseAge fallback for custom dist-tags so the selected version does not exceed the registry’s original tag target.
Removing a dependency from package.json and reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped from pnpm-lock.yaml, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune.
Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in pnpm-lock.yaml directly, reusing the same check the pnpm.overrides fast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions.
Fixed a CI regression where github:owner/repo dependencies (and other shorthand Git specifiers) would fail to install with Permission denied (publickey) on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. git+ssh:// or git@host:...):
- The repository visibility probe (an HTTP HEAD request) now retries transient failures such as 429 Too Many Requests, so host throttling of CI runners is no longer mistaken for a private repository.
- For non-SSH specifiers, anonymous HTTPS git ls-remote access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured.
- When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL.
- A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. codeload.github.com, which would fail to download for a private repository); it stays a regular git resolution so installs can use ambient Git credentials such as credential helpers and tokens.
Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL.

Fixes pnpm/pnpm#13276.
ng build and nuxt build now work under the global virtual store: pnpm's built-in compatibility extensions add the tslib dependency that @angular/build uses without declaring and the unplugin dependency that @nuxt/vite-builder v4 uses without declaring.
Fixed link: dependencies under enableGlobalVirtualStore so linked children are materialized and slots remain isolated by their resolved link targets.
An install that skips resolution because pnpm-lock.yaml is already up to date now reacts fully to packages the lockfile removed — for example after pulling a lockfile in which a dependency was deleted. The hoist layer is recomputed, so a package that became hoistable when a direct dependency was removed is hoisted, and pendingBuilds entries for removed packages are dropped instead of staying pending forever.
The held-back-update warning printed by pnpm update no longer fires when minimumReleaseAge is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See #13071.
Checking whether ignoredOptionalDependencies is up to date no longer reorders the configured patterns. The check sorted them in place, which could move an ! exclusion ahead of the pattern it excludes from and flip which optional dependencies were ignored.
Changing autoInstallPeers, dedupePeers, peersSuffixMaxLength, excludeLinksFromLockfile, or injectWorkspacePackages no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it: no package or project declares a peer dependency for the peer settings, and no project depends on a directory or on another workspace project for the link and injection settings. The new setting is recorded in pnpm-lock.yaml and the install proceeds from the existing resolution. Every other case still falls back to a full resolution.
Adding, editing, or removing an entry in patchedDependencies no longer re-resolves the dependency graph. Resolution never reads a patch — it only records the patch file's hash against the package it matches — so the install now rewrites the affected entries in pnpm-lock.yaml and materializes the patched package from the store instead. Installs still fall back to a full resolution when the patched package is reachable as a peer dependency, and when the new configuration would leave a patch unused while allowUnusedPatches is off, so ERR_PNPM_UNUSED_PATCH is still reported.
Resolving a private git repository no longer blocks on an interactive credential prompt: git ls-remote now fails fast with an authentication error when git has no credentials for the repository #13522.
Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same ERR_PNPM_NO_OFFLINE_META condition used by offline resolution.
POSIX shell shims now follow symbolic links before computing basedir, preventing execution failures when a shim is invoked via an external symlink on PATH #13405.
The automatic packageManager version switch works again on registries whose tarball URLs point at a different host than the registry itself (load-balanced feed proxies, Artifactory-style mirrors). Package-manager entries are now always recorded with integrity-only resolutions — the download URL is derived from the trusted bootstrap registry instead — and entries persisted in an invalid shape by an earlier pnpm are discarded and re-resolved instead of failing every command #13619.
Registries that serve no npm signature metadata (private mirrors and feed proxies commonly strip dist.signatures) no longer break the automatic packageManager version switch and pnpm self-update #13147. When the configured registry cannot provide a verifiable signature, pnpm now fetches the signature from registry.npmjs.org and verifies it against the same embedded npm keys over the installed integrity — which proves exactly the same thing. If no signature can be obtained from either source (for example, both are unreachable, or the registry publishes only a shasum), pnpm proceeds with a warning instead of failing, but only when the packages resolve through a registry configured in the user's own (non-project) configuration; the download stays pinned by the lockfile integrity, and a signature that exists but does not validate still fails the switch.
pnpm fetch, and any install run with virtualStoreOnly, no longer writes a .pnp.cjs loader under nodeLinker: pnp. These installs populate the virtual store without linking the project, so the loader would have claimed the project resolves out of a store it was never linked into. The importer links and node_modules/.package-map.json were already skipped; the PnP loader now follows the same rule.
Prevent pnpm from removing project files when modulesDir resolves to the project root.
Speed up installs after adding ignoredOptionalDependencies patterns by removing newly ignored optional dependencies and pruning packages that are no longer reachable without resolving the dependency graph again.
When a failed install re-copies a bin script from the store, rerunning pnpm install now reapplies the executable bit to the bin instead of leaving it non-executable #12742.
pnpm root -g and pnpm bin -g now print warnings to stderr instead of stdout, so their stdout stays a clean, machine-readable path. Previously, running either command with --global in a project that pins a package manager (e.g. via the packageManager field) printed a warning like [WARN] Using --global skips the package manager check for this project ahead of the path, breaking programs that capture the output as a path #13672.

In pnpm 12, pnpm root -g and pnpm prefix -g are now supported (they previously failed with ERR_PNPM_CLI_ROOT_GLOBAL_UNSUPPORTED / ERR_PNPM_CLI_PREFIX_GLOBAL_UNSUPPORTED), and the reporter output of dlx, create, config, sbom, with, store, prefix, root, and bin goes to stderr, matching pnpm 11.
pnpm setup no longer makes Node.js print a MODULE_TYPELESS_PACKAGE_JSON warning about dist/worker.js on every command. The package.json it writes next to a standalone executable now declares "type": "module".
pnpm update without saving no longer records a version that the manifest's range excludes. The kept range stays authoritative: a requested version outside it is skipped with a warning, and a requested range, a dist tag, or --latest resolves within it instead of past it. Previously each of these could write a lockfile entry that contradicted its own specifier, which the next pnpm install --frozen-lockfile rejected with ERR_PNPM_OUTDATED_LOCKFILE #12764.
pnpm version -r --json now outputs [] instead of human-readable text when no pending changes exist pnpm/pnpm#13217.

Platinum Sponsors

Gold Sponsors


		config help if that's undesired. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added deps security Security-relevant (never disclose a vulnerability in a public issue — see SECURITY.md) needs-review labels Aug 10, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from b57cc74 to 81e68b6 Compare August 12, 2026 01:30

renovate Bot removed needs-review security Security-relevant (never disclose a vulnerability in a public issue — see SECURITY.md) labels Aug 12, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch from 81e68b6 to 687242b Compare August 12, 2026 06:15

chore(deps): update all non-major dependencies

7b33a26

renovate Bot force-pushed the renovate/all-minor-patch branch from 687242b to 7b33a26 Compare August 12, 2026 22:56

stxkxs merged commit da7ce52 into main Aug 13, 2026
6 checks passed

stxkxs deleted the renovate/all-minor-patch branch August 13, 2026 02:31

Navigation Menu

Uh oh!

chore(deps): update all non-major dependencies - #34

chore(deps): update all non-major dependencies#34
stxkxs merged 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

v11.21.0: pnpm 11.21

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Aug 10, 2026 •

edited

Loading

`v11.21.0`: pnpm 11.21