feat(deps): update all non-major dependencies #248

Open

renovate wants to merge 1 commit from renovate/all-non-major into development

pull from: renovate/all-non-major

merge into: webgrip:development

webgrip:development

webgrip:agent/vik-1897

webgrip:main

webgrip:renovate/lock-file-maintenance

webgrip:renovate/go-1.25.x

webgrip:renovate/pin-dependencies

webgrip:agent/vik-1316

webgrip:agent/vik-1343

Conversation 0 Commits 1 Files changed 3 +42 -42

renovate commented 2026-10-05 19:59:33 +00:00

Member

Copy link

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update	Released	Age (d)
eslint (source)	10.11.0 → 10.12.0					devDependencies	minor	2026-10-02T20:08:19.213Z	3d
pnpm (source)	12.8.2 → 12.9.0					packageManager	minor	2026-10-02T22:27:15.887Z	3d
webgrip/workflows	v2.8.0 → v2.8.1					action	patch	2026-10-04T18:38:01.000Z	1d

📦 Grouped update: confirm the group is operationally coherent before merging.

Merge Confidence badges are included where supported — low or neutral confidence warrants a manual impact check before merge.

Released is the upstream publish time. — means the datasource reports no release timestamp. Docker Hub is the only Docker registry that reports one, so this preset treats every other Docker registry (ghcr.io, quay.io, Harbor and its proxies, dhi.io) as timestamp-optional: minimumReleaseAge cannot hold those updates back and they are eligible as soon as checks pass. For any other datasource, a missing timestamp holds the update for as long as a soak applies. A real date means the soak is enforced: add this update type's minimumReleaseAge to Released to get the eligibility moment.

---

Release Notes

eslint/eslint (eslint)

v10.12.0

Compare Source

Features

• 4618052 feat: handle astral letters in new-cap (#​21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#​21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#​21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#​21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#​21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#​21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#​21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#​21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#​21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#​21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#​21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#​21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#​21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#​21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#​21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#​21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#​21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#​21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#​21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#​21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#​21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#​21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#​21342) (ESLint Bot)

pnpm/pnpm (pnpm)

v12.9.0: pnpm 12.9

Compare Source

This release runs pnpm in StackBlitz WebContainers, adds a per-registry networkConcurrency setting, and records every installed project in the store. It also carries a security fix for pnpm login.

Minor Changes

• pnpm now automatically uses WebAssembly in StackBlitz WebContainers, including when installation scripts are disabled. Native installations continue to use the native executable when installation scripts are enabled.

• A registries entry can now set networkConcurrency, the most requests pnpm keeps in flight to that registry's origin. Requests to other registries keep the overall limit. The setting may live in pnpm-workspace.yaml or the global config.yaml.

  registries:
    https://npm.corp.example.com/:
      scopes: ["@acme"]
      networkConcurrency: 4
  

• pnpm install now records every project it installs in the store's projects directory, as a symlink to the project directory. A --frozen-store install without the global virtual store still records nothing. Only projects that used the global virtual store were recorded before #​6929.

Patch Changes

• pnpm login no longer forwards credentials in its request body to another origin during redirects.

Installing packages

• Fixed pnpm install failing on Android with ERR_PNPM_STORE_DIR_ACQUIRE_OPERATION_LOCK #​16508.

• pnpm install --frozen-lockfile again succeeds when a workspace project recorded in pnpm-lock.yaml has no directory, such as a project left out of a Docker build context. It still fails if the project's directory exists without a package.json #​16453.

• pnpm install --frozen-lockfile no longer requires a pnpm-lock.yaml in a project that has no dependencies. It also succeeds when pnpm-lock.yaml records only the pinned pnpm version, as other commands write it when they run before the first install #​16477.

• Fixed pnpm install --frozen-lockfile rejecting a fresh lockfile when an injected workspace dependency has an optional peer supplied by another workspace project #​16428.

• With nodeLinker: hoisted, a filtered install now keeps the packages of the workspace projects an earlier install put in node_modules. This also covers the install that pnpm --filter <selector> run and pnpm --filter <selector> exec start before the command. Before, these installs removed every package that only the unselected projects needed #​16483.

• pnpm install with nodeLinker: hoisted now refreshes directories supplied by custom fetchers when reinstalling. pnpm also keeps the symlinks inside those directories.

• With enableGlobalVirtualStore on, scripts can run entry points that a CommonJS require hook loads again, such as ts-node index.ts. They failed with ERR_UNKNOWN_FILE_EXTENSION on Node.js versions without built-in TypeScript support #​16436.

• pnpm now keeps each project's current lockfile and hidden hoisted dependencies in its own node_modules/.pnpm when virtualStoreDir points at a shared global virtual store. --virtual-store-dir now sets the global virtual store's location too pnpm/tasks#47.

• pnpm clean no longer deletes the project when virtualStoreDir or globalVirtualStoreDir is set to the project directory. It also leaves a directory outside the project alone when the setting reaches it through a symlink. It now removes a global virtual store that globalVirtualStoreDir places inside the project, as it does for virtualStoreDir.

Optional dependencies

• pnpm install no longer fails when a dependency of an optional dependency is missing from the registry. Like npm, pnpm now leaves out the nearest optional dependency above it, together with its subtree #​16511.

• When an optional dependency fails to build, pnpm now removes its link from node_modules. A repeat pnpm install then reports "Already up to date" and no longer reruns the failing build #​16468.

• pnpm install now prints a warning with the error when an optional dependency cannot be fetched and is skipped. The skipped package is no longer counted in the Packages: +N summary. The pnpm:skipped-optional-dependency log reports the skip with the fetch_failure reason #​16514.

Resolving dependencies

• Fixed pnpm install changing an unchanged project's direct dependency to a sibling workspace's pinned version when its dependency tree contains a cycle #​16417.

• With autoDedupe enabled, downgrading a dependency in one workspace project now moves the other projects to that version when it satisfies their ranges. This also applies to a filtered pnpm --filter <project> add #​16432.

• pnpm install and pnpm dedupe now move an optional peer to the version already in the dependency graph when no other package provides its locked version anymore. After a bump such as vue 3.5.40 to 3.5.43, the lockfile kept a second copy of @vue/server-renderer for @vue/test-utils #​16443.

• pnpm dedupe --check no longer fails right after pnpm install when a project's optional peer is satisfied by a package another workspace project installs. pnpm dedupe now picks the same versions for that package's dependencies as pnpm install #​16447.

• pnpm install no longer re-resolves an up-to-date lockfile on every run when a patched package is a peer in a peer cycle #​16418.

• With autoDedupe enabled, pnpm install --lockfile-only no longer resolves the dependency graph again when nothing changed since an earlier --lockfile-only install deduplicated the lockfile. Such an install keeps the lockfile even if versions were published since it was written, or if only a setting such as resolutionMode changed. Run pnpm dedupe to apply such a change #​16458.

Speed and network

• A repeat pnpm install in a large workspace reports "Already up to date" faster #​16487.

• Sped up dependency resolution of workspaces with many peer dependencies.

• pnpm install sends fewer registry metadata requests when the lockfile already decides which version a range resolves to. This now also covers ranges that several locked versions satisfy when one of them outranks the others, and direct dependencies kept at their locked version. Packages that minimumReleaseAgeExclude lists without a version now reuse cached registry metadata the same way they do when minimumReleaseAge is not set #​16458.

• pnpm no longer downloads every packument again on each install from a registry whose metadata responses forbid caching, such as Cache-Control: no-store. pnpm revalidates the cached metadata with a conditional request, so a registry that supports conditional requests answers with a 304 when the package has not changed #​16528.

• Cached metadata for a package published within minimumReleaseAge is now revalidated with its ETag, so the npm registry can answer 304 Not Modified. Before, the next install that checked the cache downloaded the whole document again #​16506.

• A fetch timeout while other downloads from the same host are still running now lowers concurrency for that host to one connection. Retries of that request, and later downloads from that host, use the lower concurrency. Other hosts keep the configured concurrency #​12791.

• Sped up pnpm install --offline when the version a range picks is not in the store. While it looks for a version the store holds, pnpm now reads only the versions the range admits #​16495.

• pnpm install --offline now reuses config dependency tarballs that are already present in the store pnpm/tasks#46.

Running scripts

• pnpm -s <script> runs the script again, with -s meaning --sequential as it does for pnpm run -s <script>. pnpm rejected it with "unexpected argument '-s' found" #​16446.

• pnpm run and pnpm exec now warn and run the command when the install that verifyDepsBeforeRun starts fails. This lets scripts run in sandboxes where pnpm cannot install, such as containers with a read-only store or no network #​15173.

• A filtered pnpm run or pnpm exec now finds dependencies out of date when a workspace dependency of a selected project has no node_modules directory, as after a filtered install. With verifyDepsBeforeRun: install, pnpm installs that dependency before running the command pnpm/tasks#45.

• Scripts run without a terminal no longer start a second sh each. One watchdog per pnpm command now ends every script's process group if pnpm is killed, so pnpm -r run across many projects starts half as many processes #​16489.

• Terminate batch job (Y/N)? no longer appears after pressing Ctrl+C in a script started with pnpm from PowerShell or cmd on Windows #​16502.

• pnpm rebuild and pnpm approve-builds refresh command launchers when a build changes a command's interpreter or replaces it with a native executable. Dependent packages' build scripts use the refreshed launchers.

• When pnpm run <script> or pnpm <script> finds nothing to run and --filter follows the script name, the error now suggests putting the filter option before the script name #​4655.

• Package-name filters now support ? to match one character #​2817.

The pinned pnpm and pnpm self-update

• pnpm no longer downloads the project's pinned pnpm version again on every command when nodeVersion in pnpm-workspace.yaml names a different Node.js major than the node on PATH. Before, each of those commands took about a second longer and failed without network access #​16497.

• Several pnpm commands started at once in a project that pins packageManager no longer fail with The process cannot access the file because it is being used by another process on Windows while the pinned pnpm is being installed.

• pnpm can now switch to a packageManager version below 11 on x64 musl Linux, such as Alpine #​16467.

• A devEngines.packageManager range no longer makes pnpm replace the version recorded in pnpm-lock.yaml with the running pnpm while the recorded version still satisfies the range. When pnpm does record a version, it records the running pnpm only if it meets minimumReleaseAge. Otherwise it records the newest version in the range that meets it, or the running pnpm if none does #​16431.

• On Windows, pnpm self-update now replaces a pnpm.exe left in PNPM_HOME or in PNPM_HOME\bin. Windows ran that executable in place of the updated pnpm.cmd shim, so pnpm --version kept printing the old version after a successful update. If the executable was in PNPM_HOME, self-update now asks you to run pnpm setup #​9094.

• pnpm self-update now checks that a version installed as the JavaScript pnpm can start before making it the global pnpm. If Node.js is missing, the update fails and the current pnpm stays in place.

Other commands

• pnpm deploy now finds patches and local dependencies when the target directory sits under a symlink, such as /tmp on macOS. It failed with ERR_PNPM_PATCH_NOT_FOUND #​16470.

• pnpm deploy --legacy now resolves the deployed project's relative file:, link:, and path dependencies from the project's own directory #​16475.

• pnpm update --global now removes hard-linked executables from PNPM_HOME when migrating packages from the old global layout #​16420.

• pnpm store prune no longer fails on store index entries that pnpm 11 wrote for git-hosted packages without a package.json. Entries that still cannot be read are kept and counted in the prune summary.

• pnpm store prune now aborts when an error other than a missing directory occurs while scanning project directories in the mark phase.

• pnpm config get and pnpm config list now report a setting given on the command line with --config.<name>=<value>. Before, a value such as --config.node-linker=hoisted reached the install but was absent from the reported configuration #​16276.

• pnpm -r pkg get now reports every selected project when several share a package name. Projects with the same name are keyed by their directory relative to the workspace root. Before, only one of them appeared in the output.

• The install summary shows a link: dependency as + name <- path, and the Node.js API's hideLinkedPkgsDiff reporter option leaves matching linked dependencies out of the summary.

• The --force help text of pnpm install and pnpm add now says that --force keeps skipping optional dependencies built for other platforms. It points to forceIgnoresPlatform and the --os, --cpu, and --libc options for installing them #​16435.

• The homepage field of the published pnpm package points to https://pnpm.io again.

Platinum Sponsors

Gold Sponsors

webgrip/workflows (webgrip/workflows)

v2.8.1

Compare Source

Fixed

• CLAUDE.md is een bestand dat AGENTS.md importeert, geen symlink (56484b8)
• dnscontrol: haal de OpenBao-optie weg, Forgejo geeft daar geen OIDC-token (cdd9995)

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Released | Age (d) | |---|---|---|---|---|---|---|---|---|---| | [eslint](https://eslint.org) ([source](https://github.com/eslint/eslint)) | [`10.11.0` → `10.12.0`](https://renovatebot.com/diffs/npm/eslint/10.11.0/10.12.0) |  |  |  |  | devDependencies | minor | 2026-10-02T20:08:19.213Z | 3d | | [pnpm](https://github.com/pnpm/pnpm/tree/main/pnpm) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`12.8.2` → `12.9.0`](https://renovatebot.com/diffs/npm/pnpm/12.8.2/12.9.0) |  |  |  |  | packageManager | minor | 2026-10-02T22:27:15.887Z | 3d | | [webgrip/workflows](https://forgejo.webgrip.dev/webgrip/workflows) | `v2.8.0` → `v2.8.1` |  |  |  |  | action | patch | 2026-10-04T18:38:01.000Z | 1d | 📦 **Grouped update**: confirm the group is operationally coherent before merging. Merge Confidence badges are included where supported — low or neutral confidence warrants a manual impact check before merge. `Released` is the upstream publish time. `—` means the datasource reports no release timestamp. Docker Hub is the only Docker registry that reports one, so this preset treats every other Docker registry (ghcr.io, quay.io, Harbor and its proxies, dhi.io) as `timestamp-optional`: `minimumReleaseAge` cannot hold those updates back and they are eligible as soon as checks pass. For any other datasource, a missing timestamp holds the update for as long as a soak applies. A real date means the soak is enforced: add this update type's `minimumReleaseAge` to `Released` to get the eligibility moment. --- ### Release Notes <details> <summary>eslint/eslint (eslint)</summary> ### [`v10.12.0`](https://github.com/eslint/eslint/releases/tag/v10.12.0) [Compare Source](https://github.com/eslint/eslint/compare/v10.11.0...v10.12.0) #### Features - [`4618052`](https://github.com/eslint/eslint/commit/4618052eed6bb3ef420cf0db0490bbda2fd835a5) feat: handle astral letters in `new-cap` ([#&#8203;21357](https://github.com/eslint/eslint/issues/21357)) (sary) - [`4ec5168`](https://github.com/eslint/eslint/commit/4ec5168d6d6888e3f7b163eb82963d40e45a75fa) feat: allow `SourceCode#getText()` to accept tokens and comments ([#&#8203;21340](https://github.com/eslint/eslint/issues/21340)) (electrohyun) #### Bug Fixes - [`bc51eee`](https://github.com/eslint/eslint/commit/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7) fix: `prefer-arrow-callback` false positive in conditional test ([#&#8203;21373](https://github.com/eslint/eslint/issues/21373)) (Daniel Pinto) - [`bbff86c`](https://github.com/eslint/eslint/commit/bbff86c41521cc435e20754e26007f657a843038) fix: skip lines with multiple comments in `max-lines-per-function` ([#&#8203;21332](https://github.com/eslint/eslint/issues/21332)) (xbinaryx) - [`efc4d6b`](https://github.com/eslint/eslint/commit/efc4d6bdc4c4d1dfba8bdab6a8f44f27a1b1d00a) fix: astral letters in `consistent-return`, `no-eval`, `no-invalid-this` ([#&#8203;21360](https://github.com/eslint/eslint/issues/21360)) (lumir) - [`93de066`](https://github.com/eslint/eslint/commit/93de066d4125f8df013d40305e8009f4634a5cba) fix: prefer-exponentiation-operator autofix for async function base ([#&#8203;21322](https://github.com/eslint/eslint/issues/21322)) (Vladimir Babin) - [`02e34ff`](https://github.com/eslint/eslint/commit/02e34ffba6adbed72365177c7caee71d950834e5) fix: add missing space after `else` in `curly` autofix ([#&#8203;21355](https://github.com/eslint/eslint/issues/21355)) (Pixel) - [`b14b8bc`](https://github.com/eslint/eslint/commit/b14b8bc213ccfc19d3edcfa9ce6af62622661160) fix: correct `id-length` message for long private names ([#&#8203;21348](https://github.com/eslint/eslint/issues/21348)) (Pixel) - [`69aac01`](https://github.com/eslint/eslint/commit/69aac01d898837a934c9e735e0b7881cc1df09e8) fix: support `TSFunctionType` in `getFunctionHeadLoc` ([#&#8203;21335](https://github.com/eslint/eslint/issues/21335)) (xbinaryx) - [`686630e`](https://github.com/eslint/eslint/commit/686630eb34ec1cddf399a4e6eaeebb080116a532) fix: `no-loss-of-precision` false positive with `0.e5` ([#&#8203;21337](https://github.com/eslint/eslint/issues/21337)) (sethamus) #### Documentation - [`67eb586`](https://github.com/eslint/eslint/commit/67eb586e2eda290813b329d4f40e605ad696bc4f) docs: Update README (GitHub Actions Bot) - [`5370d7e`](https://github.com/eslint/eslint/commit/5370d7ee35a6523873f798e87f3ccc73779d5d21) docs: clarify `one-var` `separateRequires` matches any `require()` call ([#&#8203;21192](https://github.com/eslint/eslint/issues/21192)) (sethamus) - [`8816c1d`](https://github.com/eslint/eslint/commit/8816c1ddfcfa31318ad17cddcfb68acffa30940f) docs: Update README (GitHub Actions Bot) - [`3d2e7ce`](https://github.com/eslint/eslint/commit/3d2e7cedb7409d8a2c5f2c2fafb14fa22790e40e) docs: fix typo in no-unused-expressions documentation ([#&#8203;21346](https://github.com/eslint/eslint/issues/21346)) (bytedoe) #### Chores - [`152067f`](https://github.com/eslint/eslint/commit/152067f0f81f08b6cce9cf8eeaddb8558731b4f6) chore: update ecosystem plugins ([#&#8203;21362](https://github.com/eslint/eslint/issues/21362)) (ESLint Bot) - [`b56d58e`](https://github.com/eslint/eslint/commit/b56d58e0b1f3c919a6b7661254af760cdd909d6e) chore: update github/codeql-action action to v4.38.2 ([#&#8203;21376](https://github.com/eslint/eslint/issues/21376)) (renovate\[bot]) - [`bfaea12`](https://github.com/eslint/eslint/commit/bfaea12ddc30b458fe4cfbb6c306a62b5299c177) perf: cache normalized config globals per languageOptions ([#&#8203;21364](https://github.com/eslint/eslint/issues/21364)) (James Ross) - [`322209e`](https://github.com/eslint/eslint/commit/322209ef164e8a00a25ec7ca166969ddc853355c) ci: avoid Nx cache in ecosystem tests and disable failing test ([#&#8203;21369](https://github.com/eslint/eslint/issues/21369)) (Francesco Trotta) - [`d166567`](https://github.com/eslint/eslint/commit/d166567901e09940c1de4ad0e95d572eeab5c927) chore: update dependency prettier to v3.9.9 ([#&#8203;21371](https://github.com/eslint/eslint/issues/21371)) (renovate\[bot]) - [`29585ce`](https://github.com/eslint/eslint/commit/29585ceba7ad35368d1b763bd1e80d899f28842c) chore: update dependency eslint-plugin-expect-type to ^0.7.0 ([#&#8203;21359](https://github.com/eslint/eslint/issues/21359)) (renovate\[bot]) - [`39d79ba`](https://github.com/eslint/eslint/commit/39d79ba9650542ac66d585d1899304abd630c07d) chore: update github/codeql-action action to v4.38.1 ([#&#8203;21354](https://github.com/eslint/eslint/issues/21354)) (renovate\[bot]) - [`182a6e9`](https://github.com/eslint/eslint/commit/182a6e993a8a5dbdad5a628b69ad7382d48bf24f) chore: update dependency prettier to v3.9.8 ([#&#8203;21352](https://github.com/eslint/eslint/issues/21352)) (renovate\[bot]) - [`f995127`](https://github.com/eslint/eslint/commit/f995127230dad258069c29b7f51971681bd53f00) chore: remove CLAUDE.md in favor of AGENTS.md ([#&#8203;21339](https://github.com/eslint/eslint/issues/21339)) (Jarren) - [`b95fb6c`](https://github.com/eslint/eslint/commit/b95fb6cb335f82a0ccabb0944ac3b89c703bd947) chore: update dependency prettier to v3.9.7 ([#&#8203;21347](https://github.com/eslint/eslint/issues/21347)) (renovate\[bot]) - [`3782dd4`](https://github.com/eslint/eslint/commit/3782dd458fdfbe492e600d9a54b295a9721ed815) chore: update ecosystem plugins ([#&#8203;21342](https://github.com/eslint/eslint/issues/21342)) (ESLint Bot) </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v12.9.0`](https://github.com/pnpm/pnpm/releases/tag/v12.9.0): pnpm 12.9 [Compare Source](https://github.com/pnpm/pnpm/compare/v12.8.2...v12.9.0) This release runs pnpm in StackBlitz WebContainers, adds a per-registry `networkConcurrency` setting, and records every installed project in the store. It also carries a security fix for `pnpm login`. ##### Minor Changes - pnpm now automatically uses WebAssembly in StackBlitz WebContainers, including when installation scripts are disabled. Native installations continue to use the native executable when installation scripts are enabled. - A `registries` entry can now set `networkConcurrency`, the most requests pnpm keeps in flight to that registry's origin. Requests to other registries keep the overall limit. The setting may live in `pnpm-workspace.yaml` or the global `config.yaml`. ```yaml registries: https://npm.corp.example.com/: scopes: ["@acme"] networkConcurrency: 4 ``` - `pnpm install` now records every project it installs in the store's `projects` directory, as a symlink to the project directory. A `--frozen-store` install without the global virtual store still records nothing. Only projects that used the global virtual store were recorded before [#&#8203;6929](https://github.com/pnpm/pnpm/issues/6929). ##### Patch Changes - `pnpm login` no longer forwards credentials in its request body to another origin during redirects. ##### Installing packages - Fixed `pnpm install` failing on Android with `ERR_PNPM_STORE_DIR_ACQUIRE_OPERATION_LOCK` [#&#8203;16508](https://github.com/pnpm/pnpm/issues/16508). - `pnpm install --frozen-lockfile` again succeeds when a workspace project recorded in `pnpm-lock.yaml` has no directory, such as a project left out of a Docker build context. It still fails if the project's directory exists without a `package.json` [#&#8203;16453](https://github.com/pnpm/pnpm/issues/16453). - `pnpm install --frozen-lockfile` no longer requires a `pnpm-lock.yaml` in a project that has no dependencies. It also succeeds when `pnpm-lock.yaml` records only the pinned pnpm version, as other commands write it when they run before the first install [#&#8203;16477](https://github.com/pnpm/pnpm/issues/16477). - Fixed `pnpm install --frozen-lockfile` rejecting a fresh lockfile when an injected workspace dependency has an optional peer supplied by another workspace project [#&#8203;16428](https://github.com/pnpm/pnpm/issues/16428). - With `nodeLinker: hoisted`, a filtered install now keeps the packages of the workspace projects an earlier install put in `node_modules`. This also covers the install that `pnpm --filter <selector> run` and `pnpm --filter <selector> exec` start before the command. Before, these installs removed every package that only the unselected projects needed [#&#8203;16483](https://github.com/pnpm/pnpm/issues/16483). - `pnpm install` with `nodeLinker: hoisted` now refreshes directories supplied by custom fetchers when reinstalling. pnpm also keeps the symlinks inside those directories. - With `enableGlobalVirtualStore` on, scripts can run entry points that a CommonJS require hook loads again, such as `ts-node index.ts`. They failed with `ERR_UNKNOWN_FILE_EXTENSION` on Node.js versions without built-in TypeScript support [#&#8203;16436](https://github.com/pnpm/pnpm/issues/16436). - pnpm now keeps each project's current lockfile and hidden hoisted dependencies in its own `node_modules/.pnpm` when `virtualStoreDir` points at a shared global virtual store. `--virtual-store-dir` now sets the global virtual store's location too [pnpm/tasks#47](https://github.com/pnpm/tasks/issues/47). - `pnpm clean` no longer deletes the project when `virtualStoreDir` or `globalVirtualStoreDir` is set to the project directory. It also leaves a directory outside the project alone when the setting reaches it through a symlink. It now removes a global virtual store that `globalVirtualStoreDir` places inside the project, as it does for `virtualStoreDir`. ##### Optional dependencies - `pnpm install` no longer fails when a dependency of an optional dependency is missing from the registry. Like npm, pnpm now leaves out the nearest optional dependency above it, together with its subtree [#&#8203;16511](https://github.com/pnpm/pnpm/issues/16511). - When an optional dependency fails to build, pnpm now removes its link from `node_modules`. A repeat `pnpm install` then reports "Already up to date" and no longer reruns the failing build [#&#8203;16468](https://github.com/pnpm/pnpm/issues/16468). - `pnpm install` now prints a warning with the error when an optional dependency cannot be fetched and is skipped. The skipped package is no longer counted in the `Packages: +N` summary. The `pnpm:skipped-optional-dependency` log reports the skip with the `fetch_failure` reason [#&#8203;16514](https://github.com/pnpm/pnpm/issues/16514). ##### Resolving dependencies - Fixed `pnpm install` changing an unchanged project's direct dependency to a sibling workspace's pinned version when its dependency tree contains a cycle [#&#8203;16417](https://github.com/pnpm/pnpm/issues/16417). - With `autoDedupe` enabled, downgrading a dependency in one workspace project now moves the other projects to that version when it satisfies their ranges. This also applies to a filtered `pnpm --filter <project> add` [#&#8203;16432](https://github.com/pnpm/pnpm/issues/16432). - `pnpm install` and `pnpm dedupe` now move an optional peer to the version already in the dependency graph when no other package provides its locked version anymore. After a bump such as `vue` 3.5.40 to 3.5.43, the lockfile kept a second copy of `@vue/server-renderer` for `@vue/test-utils` [#&#8203;16443](https://github.com/pnpm/pnpm/issues/16443). - `pnpm dedupe --check` no longer fails right after `pnpm install` when a project's optional peer is satisfied by a package another workspace project installs. `pnpm dedupe` now picks the same versions for that package's dependencies as `pnpm install` [#&#8203;16447](https://github.com/pnpm/pnpm/issues/16447). - `pnpm install` no longer re-resolves an up-to-date lockfile on every run when a patched package is a peer in a peer cycle [#&#8203;16418](https://github.com/pnpm/pnpm/issues/16418). - With `autoDedupe` enabled, `pnpm install --lockfile-only` no longer resolves the dependency graph again when nothing changed since an earlier `--lockfile-only` install deduplicated the lockfile. Such an install keeps the lockfile even if versions were published since it was written, or if only a setting such as `resolutionMode` changed. Run `pnpm dedupe` to apply such a change [#&#8203;16458](https://github.com/pnpm/pnpm/issues/16458). ##### Speed and network - A repeat `pnpm install` in a large workspace reports "Already up to date" faster [#&#8203;16487](https://github.com/pnpm/pnpm/issues/16487). - Sped up dependency resolution of workspaces with many peer dependencies. - `pnpm install` sends fewer registry metadata requests when the lockfile already decides which version a range resolves to. This now also covers ranges that several locked versions satisfy when one of them outranks the others, and direct dependencies kept at their locked version. Packages that `minimumReleaseAgeExclude` lists without a version now reuse cached registry metadata the same way they do when `minimumReleaseAge` is not set [#&#8203;16458](https://github.com/pnpm/pnpm/issues/16458). - pnpm no longer downloads every packument again on each install from a registry whose metadata responses forbid caching, such as `Cache-Control: no-store`. pnpm revalidates the cached metadata with a conditional request, so a registry that supports conditional requests answers with a 304 when the package has not changed [#&#8203;16528](https://github.com/pnpm/pnpm/issues/16528). - Cached metadata for a package published within `minimumReleaseAge` is now revalidated with its ETag, so the npm registry can answer `304 Not Modified`. Before, the next install that checked the cache downloaded the whole document again [#&#8203;16506](https://github.com/pnpm/pnpm/issues/16506). - A fetch timeout while other downloads from the same host are still running now lowers concurrency for that host to one connection. Retries of that request, and later downloads from that host, use the lower concurrency. Other hosts keep the configured concurrency [#&#8203;12791](https://github.com/pnpm/pnpm/issues/12791). - Sped up `pnpm install --offline` when the version a range picks is not in the store. While it looks for a version the store holds, pnpm now reads only the versions the range admits [#&#8203;16495](https://github.com/pnpm/pnpm/issues/16495). - `pnpm install --offline` now reuses config dependency tarballs that are already present in the store [pnpm/tasks#46](https://github.com/pnpm/tasks/issues/46). ##### Running scripts - `pnpm -s <script>` runs the script again, with `-s` meaning `--sequential` as it does for `pnpm run -s <script>`. pnpm rejected it with "unexpected argument '-s' found" [#&#8203;16446](https://github.com/pnpm/pnpm/issues/16446). - `pnpm run` and `pnpm exec` now warn and run the command when the install that `verifyDepsBeforeRun` starts fails. This lets scripts run in sandboxes where pnpm cannot install, such as containers with a read-only store or no network [#&#8203;15173](https://github.com/pnpm/pnpm/issues/15173). - A filtered `pnpm run` or `pnpm exec` now finds dependencies out of date when a workspace dependency of a selected project has no `node_modules` directory, as after a filtered install. With `verifyDepsBeforeRun: install`, pnpm installs that dependency before running the command [pnpm/tasks#45](https://github.com/pnpm/tasks/issues/45). - Scripts run without a terminal no longer start a second `sh` each. One watchdog per pnpm command now ends every script's process group if pnpm is killed, so `pnpm -r run` across many projects starts half as many processes [#&#8203;16489](https://github.com/pnpm/pnpm/issues/16489). - `Terminate batch job (Y/N)?` no longer appears after pressing Ctrl+C in a script started with `pnpm` from PowerShell or cmd on Windows [#&#8203;16502](https://github.com/pnpm/pnpm/issues/16502). - `pnpm rebuild` and `pnpm approve-builds` refresh command launchers when a build changes a command's interpreter or replaces it with a native executable. Dependent packages' build scripts use the refreshed launchers. - When `pnpm run <script>` or `pnpm <script>` finds nothing to run and `--filter` follows the script name, the error now suggests putting the filter option before the script name [#&#8203;4655](https://github.com/pnpm/pnpm/issues/4655). - Package-name filters now support `?` to match one character [#&#8203;2817](https://github.com/pnpm/pnpm/issues/2817). ##### The pinned pnpm and `pnpm self-update` - pnpm no longer downloads the project's pinned pnpm version again on every command when `nodeVersion` in `pnpm-workspace.yaml` names a different Node.js major than the `node` on `PATH`. Before, each of those commands took about a second longer and failed without network access [#&#8203;16497](https://github.com/pnpm/pnpm/issues/16497). - Several `pnpm` commands started at once in a project that pins `packageManager` no longer fail with `The process cannot access the file because it is being used by another process` on Windows while the pinned pnpm is being installed. - pnpm can now switch to a `packageManager` version below 11 on x64 musl Linux, such as Alpine [#&#8203;16467](https://github.com/pnpm/pnpm/issues/16467). - A `devEngines.packageManager` range no longer makes pnpm replace the version recorded in `pnpm-lock.yaml` with the running pnpm while the recorded version still satisfies the range. When pnpm does record a version, it records the running pnpm only if it meets `minimumReleaseAge`. Otherwise it records the newest version in the range that meets it, or the running pnpm if none does [#&#8203;16431](https://github.com/pnpm/pnpm/issues/16431). - On Windows, `pnpm self-update` now replaces a `pnpm.exe` left in `PNPM_HOME` or in `PNPM_HOME\bin`. Windows ran that executable in place of the updated `pnpm.cmd` shim, so `pnpm --version` kept printing the old version after a successful update. If the executable was in `PNPM_HOME`, `self-update` now asks you to run `pnpm setup` [#&#8203;9094](https://github.com/pnpm/pnpm/issues/9094). - `pnpm self-update` now checks that a version installed as the JavaScript `pnpm` can start before making it the global `pnpm`. If Node.js is missing, the update fails and the current `pnpm` stays in place. ##### Other commands - `pnpm deploy` now finds patches and local dependencies when the target directory sits under a symlink, such as `/tmp` on macOS. It failed with `ERR_PNPM_PATCH_NOT_FOUND` [#&#8203;16470](https://github.com/pnpm/pnpm/issues/16470). - `pnpm deploy --legacy` now resolves the deployed project's relative `file:`, `link:`, and path dependencies from the project's own directory [#&#8203;16475](https://github.com/pnpm/pnpm/issues/16475). - `pnpm update --global` now removes hard-linked executables from `PNPM_HOME` when migrating packages from the old global layout [#&#8203;16420](https://github.com/pnpm/pnpm/issues/16420). - `pnpm store prune` no longer fails on store index entries that pnpm 11 wrote for git-hosted packages without a `package.json`. Entries that still cannot be read are kept and counted in the prune summary. - `pnpm store prune` now aborts when an error other than a missing directory occurs while scanning project directories in the mark phase. - `pnpm config get` and `pnpm config list` now report a setting given on the command line with `--config.<name>=<value>`. Before, a value such as `--config.node-linker=hoisted` reached the install but was absent from the reported configuration [#&#8203;16276](https://github.com/pnpm/pnpm/issues/16276). - `pnpm -r pkg get` now reports every selected project when several share a package name. Projects with the same name are keyed by their directory relative to the workspace root. Before, only one of them appeared in the output. - The install summary shows a `link:` dependency as `+ name <- path`, and the Node.js API's `hideLinkedPkgsDiff` reporter option leaves matching linked dependencies out of the summary. - The `--force` help text of `pnpm install` and `pnpm add` now says that `--force` keeps skipping optional dependencies built for other platforms. It points to `forceIgnoresPlatform` and the `--os`, `--cpu`, and `--libc` options for installing them [#&#8203;16435](https://github.com/pnpm/pnpm/issues/16435). - The `homepage` field of the published `pnpm` package points to <https://pnpm.io> again. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> <details> <summary>webgrip/workflows (webgrip/workflows)</summary> ### [`v2.8.1`](https://forgejo.webgrip.dev/webgrip/workflows/releases/tag/v2.8.1) [Compare Source](https://forgejo.webgrip.dev/webgrip/workflows/compare/v2.8.0...v2.8.1) ##### Fixed - CLAUDE.md is een bestand dat AGENTS.md importeert, geen symlink ([56484b8](https://forgejo.webgrip.dev/webgrip/workflows/commit/56484b80b89548a161569f4d6ab96605b449785c)) - **dnscontrol:** haal de OpenBao-optie weg, Forgejo geeft daar geen OIDC-token ([cdd9995](https://forgejo.webgrip.dev/webgrip/workflows/commit/cdd99953fb25f00c7204fb57b9b9980c36abdac9)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Amsterdam) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzIuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzMi41IiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcG1lbnQiLCJsYWJlbHMiOlsiYXV0b21lcmdlIiwiZGVwZW5kZW5jaWVzIiwiZ2l0aHViLWFjdGlvbnMiLCJyZW5vdmF0ZSIsInR5cGUvbWlub3IiLCJ0eXBlL3BhdGNoIl19-->

renovate added 1 commit 2026-10-05 19:59:33 +00:00

ci(actions): Update dependency webgrip/workflows ( v2.8.0 ➔ v2.8.1 ) bf87b80d5b

renovate force-pushed renovate/all-non-major from bf87b80d5b to 81c28a8b7b 2026-10-05 21:01:31 +00:00 Compare

renovate changed title from ci(actions): Update dependency webgrip/workflows ( v2.8.0 ➔ v2.8.1 ) to feat(deps): update all non-major dependencies 2026-10-05 21:01:43 +00:00

renovate force-pushed renovate/all-non-major from 81c28a8b7b to 41c3ba07be 2026-10-05 23:00:45 +00:00 Compare

Some checks failed

Hide all checks

[Workflow] On Pull Request / ploeg-pin (pull_request) Successful in 28s

Details

renovate/stability-days Updates have met minimum release age requirement

Details

[Workflow] On Pull Request / release-policy (pull_request) Failing after 24s

Details

[Workflow] On Pull Request / checks (pull_request) Failing after 2m13s

Details

[Workflow] On Pull Request / warnings (pull_request) Successful in 0s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/all-non-major:renovate/all-non-major

git switch renovate/all-non-major

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch development

git merge --no-ff renovate/all-non-major

git switch renovate/all-non-major

git rebase development

git switch development

git merge --ff-only renovate/all-non-major

git switch renovate/all-non-major

git rebase development

git switch development

git merge --no-ff renovate/all-non-major

git switch development

git merge --squash renovate/all-non-major

git switch development

git merge --ff-only renovate/all-non-major

git switch development

git merge renovate/all-non-major

git push origin development

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/unfold!248

No description provided.