chore(deps): update pnpm to v10 #167
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
我们已跳过审查此拉取请求。原因如下：
- 它似乎是由机器人创建的（嘿，renovate[bot]！）。我们假设它知道自己在做什么！
- 我们不审查包管理更改 - 如果您希望我们更改此策略，请联系我们。
Original comment in English
We have skipped reviewing this pull request. Here's why:
- It seems to have been created by a bot (hey, renovate[bot]!). We assume it knows what it's doing!
- We don't review packaging changes - Let us know if you'd like us to change this.
审阅者指南 by Sourcery此拉取请求将 pnpm 包管理器从版本 9.15.4 更新到 10.2.0。这是一个主要版本更新，包含破坏性变更、新功能和错误修复。主要变更是在 package.json 文件中，更新了 packageManager 字段以反映新版本。 pnpm v10 主要变更流程图flowchart TD
A[pnpm v10 主要变更] --> B[安全变更]
A --> C[配置更新]
A --> D[存储变更]
B --> B1[默认禁用生命周期脚本]
B --> B2[使用 SHA256 进行安全哈希]
C --> C1[启用管理包管理器版本]
C --> C2[无默认提升]
C --> C3[减少 npm_package_* 环境变量]
D --> D1[存储版本 v10]
D --> D2[新的索引目录结构]
D --> D3[更高效的副作用跟踪]
B1 --> E[需要在 package.json 中明确批准]
B2 --> F[提高安全性和一致性]
style A fill:#f9f,stroke:#333,stroke-width:4px
style B fill:#bbf,stroke:#333
style C fill:#bbf,stroke:#333
style D fill:#bbf,stroke:#333
文件级变更
提示和命令与 Sourcery 交互
自定义您的体验访问您的仪表板以：
获取帮助Original review guide in EnglishReviewer's Guide by SourceryThis pull request updates the pnpm package manager from version 9.15.4 to 10.2.0. This is a major version update that includes breaking changes, new features, and bug fixes. The primary change is in the package.json file, where the packageManager field is updated to reflect the new version. Flow diagram of major changes in pnpm v10flowchart TD
A[pnpm v10 Major Changes] --> B[Security Changes]
A --> C[Configuration Updates]
A --> D[Store Changes]
B --> B1[Lifecycle scripts disabled by default]
B --> B2[SHA256 for secure hashing]
C --> C1[manage-package-manager-versions enabled]
C --> C2[No default hoisting]
C --> C3[Fewer npm_package_* env vars]
D --> D1[Store version v10]
D --> D2[New index directory structure]
D --> D3[More efficient side effects tracking]
B1 --> E[Requires explicit approval in package.json]
B2 --> F[Improved security and consistency]
style A fill:#f9f,stroke:#333,stroke-width:4px
style B fill:#bbf,stroke:#333
style C fill:#bbf,stroke:#333
style D fill:#bbf,stroke:#333
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
renovate
bot
force-pushed
the
renovate/pnpm-10.x
branch
from
bc62282 to
d22a88f
Compare
renovate
bot
force-pushed
the
renovate/pnpm-10.x
branch
from
d22a88f to
61e219c
Compare
renovate
bot
force-pushed
the
renovate/pnpm-10.x
branch
from
61e219c to
8a69075
Compare
renovate
bot
force-pushed
the
renovate/pnpm-10.x
branch
from
8a69075 to
1d82de8
Compare
renovate
bot
force-pushed
the
renovate/pnpm-10.x
branch
from
1d82de8 to
3e3a880
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
9.15.5->10.4.1Release Notes
pnpm/pnpm (pnpm)
v10.4.1Compare Source
Patch Changes
--allow-buildoption overlaps with thepnpm.ignoredBuildDependencieslist #9105.init-package-managershould work.v10.4.0Compare Source
Minor Changes
pnpm approve-builds --globalworks now for allowing dependencies of globally installed packages to run postinstall scripts.The
pnpm addcommand now supports a new flag,--allow-build, which allows building the specified dependencies. For instance, if you want to install a package calledbundlethat hasesbuildas a dependency and want to allowesbuildto run postinstall scripts, you can run:This will run
esbuild's postinstall script and also add it to thepnpm.onlyBuiltDependenciesfield ofpackage.json. So,esbuildwill always be allowed to run its scripts in the future.Related PR: #9086.
The
pnpm initcommand adds apackageManagerfield with the current version of pnpm CLI #9069. To disable this behaviour, set theinit-package-managersetting tofalse.Patch Changes
pnpm approve-buildsshould work after two consecutivepnpm installruns #9083.packageManagercannot start withv.v10.3.0Compare Source
Minor Changes
strict-dep-builds. When enabled, the installation will exit with a non-zero exit code if any dependencies have unreviewed build scripts (aka postinstall scripts) #9071.Patch Changes
verify-deps-before-runafterpnpm install --production|--no-optional#9019.v10.2.1Compare Source
Patch Changes
pnpm approve-buildsshould work, when executed from a subdirectory of a workspace #9042.pnpm deploy --legacyshould work without injected dependencies.v10.2.0Compare Source
Minor Changes
Packages executed via
pnpm dlxandpnpm createare allowed to be built (run postinstall scripts) by default.If the packages executed by
dlxorcreatehave dependencies that have to be built, they should be listed via the--allow-buildflag. For instance, if you want to run a package calledbundlethat hasesbuildin dependencies and want to allowesbuildto run postinstall scripts, run:Related PR: #9026.
Patch Changes
pnpm deployfails to read the correctprojectIdwhen the deploy source is the same as the workspace directory #9001.overridesfrom adding invalid version ranges topeerDependenciesby keeping thepeerDependenciesand overriding them with proddependencies#8978.pnpm approve-builds.v10.1.0Compare Source
Minor Changes
pnpm ignored-builds#8963.pnpm approve-builds#8963.optimistic-repeat-install. When enabled, a fast check will be performed before proceeding to installation. This way a repeat install or an install on a project with everything up-to-date becomes a lot faster. But some edge cases might arise, so we keep it disabled by default for now #8977.Patch Changes
pnpm install, thepreprepareandpostpreparescripts of the project should be executed #8989.workspace:andcatalog:to be part of wider version range inpeerDependencies.pnpm deployshould inherit thepnpmobject from the rootpackage.json#8991.node_modulesin a sub-project of a monorepo is detected as out-of-date #8959.pnpmto execute other scripts duringpnpm installwithverify-deps-before-run=install#8954.strip-ansiwith the built-inutil.stripVTControlCharacters#9009.v10.0.0Compare Source
Major Changes
Lifecycle scripts of dependencies are not executed during installation by default! This is a breaking change aimed at increasing security. In order to allow lifecycle scripts of specific dependencies, they should be listed in the
pnpm.onlyBuiltDependenciesfield ofpackage.json#8897. For example:{ "pnpm": { "onlyBuiltDependencies": ["fsevents"] } }pnpm linkbehavior updated:The
pnpm linkcommand now adds overrides to the rootpackage.json.pnpm linkfrom the package’s directory. Previously, you needed to usepnpm link -g.Related PR: #8653
Secure hashing with SHA256:
Various hashing algorithms have been updated to SHA256 for enhanced security and consistency:
node_modules/.pnpmare now hashed with SHA256.packageExtensionsChecksumfield ofpnpm-lock.yamlis now SHA256.Configuration updates:
manage-package-manager-versions: enabled by default. pnpm now manages its own version based on thepackageManagerfield inpackage.jsonby default.public-hoist-pattern: nothing is hoisted by default. Packages containingeslintorprettierin their name are no longer hoisted to the root ofnode_modules. Related Issue: #8378Upgraded
@yarnpkg/extensionsto v2.0.3. This may alter your lockfile.virtual-store-dir-max-length: the default value on Windows has been reduced to 60 characters.Reduced environment variables for scripts:
During script execution, fewer
npm_package_*environment variables are set. Onlyname,version,bin,engines, andconfigremain.Related Issue: #8552
All dependencies are now installed even if
NODE_ENV=production. Related Issue: #8827Changes to the global store:
Store version bumped to v10.
Some registries allow identical content to be published under different package names or versions. To accommodate this, index files in the store are now stored using both the content hash and package identifier.
This approach ensures that we can:
Related PR: #8510
Related Issue: #8204
More efficient side effects indexing. The structure of index files in the store has changed. Side effects are now tracked more efficiently by listing only file differences rather than all files.
Related PR: #8636
A new
indexdirectory stores package content mappings. Previously, these files were infiles.Other breaking changes:
#character is now escaped in directory names withinnode_modules/.pnpm.Related PR: #8557
pnpm add --global pnpmorpnpm add --global @​pnpm/exenow fails with an error message, directing you to usepnpm self-updateinstead.Related PR: #8728
Related Issue: #8833
pnpm deploycommand now only works in workspaces that haveinject-workspace-packages=true. This limitation is introduced to allow us to create a proper lockfile for the deployed project using the workspace lockfile.pnpm testnow passes all parameters after thetestkeyword directly to the underlying script. This matches the behavior ofpnpm run test. Previously you needed to use the--prefix.Related PR: #8619
node-gypupdated to version 11.pnpm deploynow tries creating a dedicated lockfile from a shared lockfile for deployment. It will fallback to deployment without a lockfile if there is no shared lockfile orforce-legacy-deployis set totrue.Minor Changes
Added support for a new type of dependencies called "configurational dependencies". These dependencies are installed before all the other types of dependencies (before "dependencies", "devDependencies", "optionalDependencies").
Configurational dependencies cannot have dependencies of their own or lifecycle scripts. They should be added using exact version and the integrity checksum. Example:
{ "pnpm": { "configDependencies": { "my-configs": "1.0.0+sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==" } } }Related RFC: #8.
Related PR: #8915.
New settings:
New
verify-deps-before-runsetting. This setting controls howpnpmchecksnode_modulesbefore running scripts:install: Automatically runpnpm installifnode_modulesis outdated.warn: Print a warning ifnode_modulesis outdated.prompt: Prompt the user to confirm runningpnpm installifnode_modulesis outdated.error: Throw an error ifnode_modulesis outdated.false: Disable dependency checks.Related Issue: #8585
New
inject-workspace-packagessetting enables hard-linking all local workspace dependencies instead of symlinking them. Previously, this could be achieved usingdependenciesMeta[].injected, which remains supported.Related PR: #8836
Faster repeat installs:
On repeated installs,
pnpmperforms a quick check to ensurenode_modulesis up to date.Related PR: #8838
pnpm addintegrates with default workspace catalog:When adding a dependency,
pnpm addchecks the default workspace catalog. If the dependency and version requirement match the catalog,pnpm adduses thecatalog:protocol. Without a specified version, it matches the catalog’s version. If it doesn’t match, it falls back to standard behavior.Related Issue: #8640
pnpm dlxnow resolves packages to their exact versions and uses these exact versions for cache keys. This ensurespnpm dlxalways installs the latest requested packages.Related PR: #8811
No
node_modulesvalidation on certain commands. Commands that should not modifynode_modules(e.g.,pnpm install --lockfile-only) no longer validate or purgenode_modules.Related PR: #8657
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.