Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Sep 17, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
pnpm (source) 10.16.110.28.1 age confidence
prettier (source) 3.6.23.8.0 age confidence
publint (source) 0.3.120.3.16 age confidence
typescript (source) 5.9.25.9.3 age confidence
vite (source) 7.1.57.3.1 age confidence
vitest (source) 4.0.64.0.17 age confidence

Release Notes

pnpm/pnpm (pnpm)

v10.28.1

Compare Source

v10.28.0

Compare Source

v10.27.0

Compare Source

v10.26.2: pnpm 10.26.2

Compare Source

Patch Changes

  • Improve error message when a package version exists but does not meet the minimumReleaseAge constraint. The error now clearly states that the version exists and shows a human-readable time since release (e.g., "released 6 hours ago") #​10307.

  • Fix installation of Git dependencies using annotated tags #​10335.

    Previously, pnpm would store the annotated tag object's SHA in the lockfile instead of the actual commit SHA. This caused ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out commit hash didn't match the stored tag object hash.

  • Binaries of runtime engines (Node.js, Deno, Bun) are written to node_modules/.bin before lifecycle scripts (install, postinstall, prepare) are executed #​10244.

  • Try to avoid making network calls with preferOffline #​10334.

Platinum Sponsors

Bit

Gold Sponsors

Discord CodeRabbit Workleap
Stackblitz Vite

v10.26.1: pnpm 10.26.1

Compare Source

Patch Changes

  • Don't fail on pnpm add, when blockExoticSubdeps is set to true #​10324.
  • Always resolve git references to full commits and ensure HEAD points to the commit after checkout #​10310.

Platinum Sponsors

Bit

Gold Sponsors

Discord CodeRabbit Workleap
Stackblitz Vite

v10.26.0

Compare Source

v10.25.0

Compare Source

v10.24.0

Compare Source

v10.23.0: pnpm 10.23

Compare Source

Minor Changes

  • Added --lockfile-only option to pnpm list #​10020.

Patch Changes

  • pnpm self-update should download pnpm from the configured npm registry #​10205.
  • pnpm self-update should always install the non-executable pnpm package (pnpm in the registry) and never the @pnpm/exe package, when installing v11 or newer. We currently cannot ship @pnpm/exe as pkg doesn't work with ESM #​10190.
  • Node.js runtime is not added to "dependencies" on pnpm add, if there's a engines.runtime setting declared in package.json #​10209.
  • The installation should fail if an optional dependency cannot be installed due to a trust policy check failure #​10208.
  • pnpm list and pnpm why now display npm: protocol for aliased packages (e.g., foo npm:[email protected]) #​8660.
  • Don't add an extra slash to the Node.js mirror URL #​10204.
  • pnpm store prune should not fail if the store contains Node.js packages #​10131.

Platinum Sponsors

Bit

Gold Sponsors

Discord CodeRabbit Workleap
Stackblitz Vite

v10.22.0: pnpm 10.22

Compare Source

Minor Changes

  • Added support for trustPolicyExclude #​10164.

    You can now list one or more specific packages or versions that pnpm should allow to install, even if those packages don't satisfy the trust policy requirement. For example:

    trustPolicy: no-downgrade
    trustPolicyExclude:
      - [email protected]
      - [email protected] || 5.102.1
  • Allow to override the engines field on publish by the publishConfig.engines field.

Patch Changes

  • Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #​10179.

Platinum Sponsors

Bit

Gold Sponsors

Discord CodeRabbit Workleap
Stackblitz Vite

v10.21.0

Compare Source

v10.20.0

Compare Source

Minor Changes
  • Support --all option in pnpm --help to list all commands #​8628.
Patch Changes
  • When the latest version doesn't satisfy the maturity requirement configured by minimumReleaseAge, pick the highest version that is mature enough, even if it has a different major version #​10100.
  • create command should not verify patch info.
  • Set managePackageManagerVersions to false, when switching to a different version of pnpm CLI, in order to avoid subsequent switches #​10063.

v10.19.0

Compare Source

Minor Changes
  • You can now allow specific versions of dependencies to run postinstall scripts. onlyBuiltDependencies now accepts package names with lists of trusted versions. For example:

    onlyBuiltDependencies:
      - [email protected] || 21.6.5
      - [email protected]

    Related PR: #​10104.

  • Added support for exact versions in minimumReleaseAgeExclude #​9985.

    You can now list one or more specific versions that pnpm should allow to install, even if those versions don’t satisfy the maturity requirement set by minimumReleaseAge. For example:

    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
      - [email protected]
      - [email protected] || 5.102.1

v10.18.3

Compare Source

Patch Changes
  • Fix a bug where pnpm would infinitely recurse when using verifyDepsBeforeInstall: install and pre/post install scripts that called other pnpm scripts #​10060.
  • Fixed scoped registry keys (e.g., @scope:registry) being parsed as property paths in pnpm config get when --location=project is used #​9362.
  • Remove pnpm-specific CLI options before passing to npm publish to prevent "Unknown cli config" warnings #​9646.
  • Fixed EISDIR error when bin field points to a directory #​9441.
  • Preserve version and hasBin for variations packages #​10022.
  • Fixed pnpm config set --location=project incorrectly handling keys with slashes (auth tokens, registry settings) #​9884.
  • When both pnpm-workspace.yaml and .npmrc exist, pnpm config set --location=project now writes to pnpm-workspace.yaml (matching read priority) #​10072.
  • Prevent a table width error in pnpm outdated --long #​10040.
  • Sync bin links after injected dependencies are updated by build scripts. This ensures that binaries created during build processes are properly linked and accessible to consuming projects #​10057.

v10.18.2

Compare Source

Patch Changes
  • pnpm outdated --long should work #​10040.
  • Replace ndjson with split2. Reduce the bundle size of pnpm CLI #​10054.
  • pnpm dlx should request the full metadata of packages, when minimumReleaseAge is set #​9963.
  • pnpm version switching should work when the pnpm home directory is in a symlinked directory #​9715.
  • Fix EPIPE errors when piping output to other commands #​10027.

v10.18.1

Compare Source

Patch Changes
  • Don't print a warning, when --lockfile-only is used #​8320.
  • pnpm setup creates a command shim to the pnpm executable. This is needed to be able to run pnpm self-update on Windows #​5700.
  • When using pnpm catalogs and running a normal pnpm install, pnpm produced false positive warnings for "skip adding to the default catalog because it already exists". This warning now only prints when using pnpm add --save-catalog as originally intended.

v10.18.0

Compare Source

Minor Changes
  • Added network performance monitoring to pnpm by implementing warnings for slow network requests, including both metadata fetches and tarball downloads.

    Added configuration options for warning thresholds: fetchWarnTimeoutMs and fetchMinSpeedKiBps.
    Warning messages are displayed when requests exceed time thresholds or fall below speed minimums

    Related PR: #​10025.

Patch Changes
  • Retry filesystem operations on EAGAIN errors #​9959.
  • Outdated command respects minimumReleaseAge configuration #​10030.
  • Correctly apply the cleanupUnusedCatalogs configuration when removing dependent packages.
  • Don't fail with a meaningless error when scriptShell is set to false #​8748.
  • pnpm dlx should not fail when minimumReleaseAge is set #​10037.

v10.17.1

Compare Source

Patch Changes
  • When a version specifier cannot be resolved because the versions don't satisfy the minimumReleaseAge setting, print this information out in the error message #​9974.
  • Fix state.json creation path when executing pnpm patch in a workspace project #​9733.
  • When minimumReleaseAge is set and the latest tag is not mature enough, prefer a non-deprecated version as the new latest #​9987.

v10.17.0

Compare Source

Minor Changes
  • The minimumReleaseAgeExclude setting now supports patterns. For instance:

    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
      - "@​eslint/*"

    Related PR: #​9984.

Patch Changes
  • Don't ignore the minimumReleaseAge check, when the package is requested by exact version and the packument is loaded from cache #​9978.
  • When minimumReleaseAge is set and the active version under a dist-tag is not mature enough, do not downgrade to a prerelease version in case the original version wasn't a prerelease one #​9979.
prettier/prettier (prettier)

v3.8.0

Compare Source

diff

🔗 Release note

v3.7.4

Compare Source

diff

LWC: Avoid quote around interpolations (#​18383 by @​kovsu)
<!-- Input -->
<div foo={bar}>   </div>

<!-- Prettier 3.7.3 (--embedded-language-formatting off) -->
<div foo="{bar}"></div>

<!-- Prettier 3.7.4 (--embedded-language-formatting off) -->
<div foo={bar}></div>
TypeScript: Fix comment inside union type gets duplicated (#​18393 by @​fisker)
// Input
type Foo = (/** comment */ a | b) | c;

// Prettier 3.7.3
type Foo = /** comment */ (/** comment */ a | b) | c;

// Prettier 3.7.4
type Foo = /** comment */ (a | b) | c;
TypeScript: Fix unstable comment print in union type comments (#​18395 by @​fisker)
// Input
type X = (A | B) & (
  // comment
  A | B
);

// Prettier 3.7.3 (first format)
type X = (A | B) &
  (// comment
  A | B);

// Prettier 3.7.3 (second format)
type X = (
  | A
  | B // comment
) &
  (A | B);

// Prettier 3.7.4
type X = (A | B) &
  // comment
  (A | B);

v3.7.3

Compare Source

diff

API: Fix prettier.getFileInfo() change that breaks VSCode extension (#​18375 by @​fisker)

An internal refactor accidentally broke the VSCode extension plugin loading.

v3.7.2

Compare Source

diff

JavaScript: Fix string print when switching quotes (#​18351 by @​fisker)
// Input
console.log("A descriptor\\'s .kind must be \"method\" or \"field\".")

// Prettier 3.7.1
console.log('A descriptor\\'s .kind must be "method" or "field".');

// Prettier 3.7.2
console.log('A descriptor\\\'s .kind must be "method" or "field".');
JavaScript: Preserve quote for embedded HTML attribute values (#​18352 by @​kovsu)
// Input
const html = /* HTML */ ` <div class="${styles.banner}"></div> `;

// Prettier 3.7.1
const html = /* HTML */ ` <div class=${styles.banner}></div> `;

// Prettier 3.7.2
const html = /* HTML */ ` <div class="${styles.banner}"></div> `;
TypeScript: Fix comment in empty type literal (#​18364 by @​fisker)
// Input
export type XXX = {
  // tbd
};

// Prettier 3.7.1
export type XXX = { // tbd };

// Prettier 3.7.2
export type XXX = {
  // tbd
};

v3.7.1

Compare Source

diff

API: Fix performance regression in doc printer (#​18342 by @​fisker)

Prettier 3.7.1 can be very slow when formatting big files, the regression has been fixed.

v3.7.0

Compare Source

diff

🔗 Release Notes

publint/publint (publint)

v0.3.16

Compare Source

Patch Changes
  • Re-enable file existence checks for TS and TSX files if they do not use custom conditions. In v0.3.10, this was done unconditionally instead which missed catching possible file typos if only common conditions are used. (7b1408e)

v0.3.15

Compare Source

Patch Changes
  • Skip file existence checks when crawling subpath imports as they may be dev-only and not used after bundling or publish. This check may be improved in the future when publint can scan for files to see if the subpath imports are used. (0d72997)

  • Handle exports["default"] and exports['default'] for CJS_WITH_ESMODULE_DEFAULT_EXPORT rule (8285f77)

v0.3.14

Compare Source

Patch Changes
  • Add a new warning when an entrypoint is exported as CJS-only, has a default export, and has the __esModule marker. This setup has different interpretations by bundlers and runtimes, and implicit handling detection that may not be obvious for both package authors and users, hence it is discouraged. (#​201)

v0.3.13

Compare Source

Patch Changes
  • Improve message for "main" field with empty value and has missing files (0499518)

  • Update fallback arrays message for CLI output (37b9dd5)

microsoft/TypeScript (typescript)

v5.9.3: TypeScript 5.9.3

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

Downloads are available on:

vitejs/vite (vite)

v7.3.1

Compare Source

Please refer to CHANGELOG.md for details.

v7.3.0

Compare Source

Please refer to CHANGELOG.md for details.

v7.2.7

Compare Source

v7.2.6

Compare Source

7.2.6 (2025-12-01)

v7.2.4

Compare Source

Bug Fixes

v7.2.3

Compare Source

Bug Fixes
Performance Improvements
Miscellaneous Chores

v7.2.2

Compare Source

Bug Fixes

v7.2.1

Compare Source

Bug Fixes
Code Refactoring

v7.2.0

Compare Source

Bug Fixes
  • css: fallback to sass when sass-embedded platform binary is missing (#​21002) (b1fd616)
  • module-runner: make getBuiltins response JSON serializable (#​21029) (ad5b3bf)
  • types: add undefined to optional properties for exactOptionalProperties type compatibility (#​21040) (2833c55)
Miscellaneous Chores

v7.1.12

Compare Source

Please refer to CHANGELOG.md for details.

v7.1.11

Compare Source

Bug Fixes
Miscellaneous Chores
Code Refactoring
Build System

v7.1.10

Compare Source

Bug Fixes
Documentation
Miscellaneous Chores

v7.1.9

Compare Source

Reverts

v7.1.8

Compare Source

Bug Fixes
Documentation
Miscellaneous Chores

v7.1.7

Compare Source

Bug Fixes
  • build: fix ssr environment emitAssets: true when sharedConfigBuild: true (#​20787) (4c4583c)
  • client: use CSP nonce when rendering error overlay (#​20791) (9bc9d12)
  • deps: update all non-major dependencies (#​20811) (9f2247c)
  • glob: handle glob imports from folders starting with dot (#​20800) (105abe8)
  • hmr: trigger prune event when import is removed from non hmr module (#​20768) (9f32b1d)
  • hmr: wait for import.meta.hot.prune callbacks to complete before running other HMRs (#​20698) (98a3484)

v7.1.6

Compare Source

Bug Fixes
  • deps: update all non-major dependencies (#​20773) (88af2ae)
  • esbuild: inject esbuild helper functions with minified $ variables correctly (#​20761) (7e8e004)
  • fallback terser to main thread when nameCache is provided (#​20750) (a679a64)
  • types: strict env typings fail when skipLibCheck is false (#​20755) (cc54e29)
Miscellaneous Chores
vitest-dev/vitest (vitest)

v4.0.17

Compare Source

   🚀 Features
   🐞 Bug Fixes

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai
Copy link

coderabbitai bot commented Sep 17, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate bot changed the title chore(deps): update pnpm to v10.17.0 chore(deps): update npm Sep 18, 2025
@renovate renovate bot force-pushed the renovate/npm branch 3 times, most recently from 63d3cbf to 357505f Compare September 22, 2025 17:46
@renovate renovate bot force-pushed the renovate/npm branch 3 times, most recently from cff0e72 to 8e47a39 Compare October 2, 2025 08:25
@renovate renovate bot force-pushed the renovate/npm branch 4 times, most recently from b6e9d07 to 6cf2961 Compare October 6, 2025 14:38
@renovate renovate bot force-pushed the renovate/npm branch 3 times, most recently from d5c5b1a to 817c779 Compare October 14, 2025 18:02
@renovate renovate bot force-pushed the renovate/npm branch 5 times, most recently from feb0025 to 6f5fd78 Compare October 24, 2025 02:01
@renovate renovate bot force-pushed the renovate/npm branch 4 times, most recently from 7504702 to 75824f4 Compare November 4, 2025 17:06
@renovate renovate bot force-pushed the renovate/npm branch 6 times, most recently from b65e64c to c58b38e Compare November 20, 2025 18:15
@renovate renovate bot force-pushed the renovate/npm branch 4 times, most recently from 358e792 to 3d37bc8 Compare November 27, 2025 16:07
@renovate renovate bot force-pushed the renovate/npm branch 5 times, most recently from dd2ca9a to 3ce5d11 Compare December 3, 2025 06:37
@renovate renovate bot force-pushed the renovate/npm branch 3 times, most recently from f26d968 to e5a6819 Compare December 10, 2025 02:53
@renovate renovate bot force-pushed the renovate/npm branch 3 times, most recently from 2f01fcc to 8856782 Compare December 19, 2025 05:39
@renovate renovate bot force-pushed the renovate/npm branch 3 times, most recently from 3a81b58 to 475c6d9 Compare January 12, 2026 13:46
@greptile-apps
Copy link

greptile-apps bot commented Jan 15, 2026

Skipped: This PR was opened by one of your excluded authors: (renovate[bot])

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant