Sync dev → main - #1824
Merged
Merged
Conversation
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [bun](https://bun.com) ([source](https://redirect.github.com/oven-sh/bun)) | [`1.4.0` → `1.4.2`](https://renovatebot.com/diffs/npm/bun/1.4.0/1.4.2) |  |  | --- ### Release Notes <details> <summary>oven-sh/bun (bun)</summary> ### [`v1.4.2`](https://redirect.github.com/oven-sh/bun/releases/tag/bun-v1.4.2): Bun v1.4.2 [Compare Source](https://redirect.github.com/oven-sh/bun/compare/bun-v1.4.1...bun-v1.4.2) To install Bun v1.4.2 ```bash curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun ``` Windows: ```bash powershell -c "irm bun.sh/install.ps1|iex" ``` To upgrade to Bun v1.4.2: ```bash bun upgrade ``` ##### [Read Bun v1.4.2's release notes on Bun's blog](https://bun.sh/blog/bun-v1.4.2) ##### Thanks to 3 contributors! - [@​dylan-conway](https://redirect.github.com/dylan-conway) - [@​jarred-sumner](https://redirect.github.com/jarred-sumner) - [@​robobun](https://redirect.github.com/robobun) ### [`v1.4.1`](https://redirect.github.com/oven-sh/bun/compare/bun-v1.4.0...bun-v1.4.1) [Compare Source](https://redirect.github.com/oven-sh/bun/compare/bun-v1.4.0...bun-v1.4.1) </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Almaty) - Branch creation - "on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/yamcodes/arkenv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6ImRldiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
github-actions
Bot
added
the
github actions
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [bun](https://bun.com) ([source](https://redirect.github.com/oven-sh/bun)) | `1.4.0` → `1.4.2` |  |  | uses-with | patch | | [changesets/action](https://redirect.github.com/changesets/action) | `v2.1.1` → `v2.1.2` |  |  | action | patch | --- ### Release Notes <details> <summary>oven-sh/bun (bun)</summary> ### [`v1.4.2`](https://redirect.github.com/oven-sh/bun/releases/tag/bun-v1.4.2): Bun v1.4.2 [Compare Source](https://redirect.github.com/oven-sh/bun/compare/bun-v1.4.1...bun-v1.4.2) To install Bun v1.4.2 ```bash curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun ``` Windows: ```bash powershell -c "irm bun.sh/install.ps1|iex" ``` To upgrade to Bun v1.4.2: ```bash bun upgrade ``` ##### [Read Bun v1.4.2's release notes on Bun's blog](https://bun.sh/blog/bun-v1.4.2) ##### Thanks to 3 contributors! - [@​dylan-conway](https://redirect.github.com/dylan-conway) - [@​jarred-sumner](https://redirect.github.com/jarred-sumner) - [@​robobun](https://redirect.github.com/robobun) ### [`v1.4.1`](https://redirect.github.com/oven-sh/bun/compare/bun-v1.4.0...bun-v1.4.1) [Compare Source](https://redirect.github.com/oven-sh/bun/compare/bun-v1.4.0...bun-v1.4.1) </details> <details> <summary>changesets/action (changesets/action)</summary> ### [`v2.1.2`](https://redirect.github.com/changesets/action/releases/tag/v2.1.2) [Compare Source](https://redirect.github.com/changesets/action/compare/v2.1.1...v2.1.2) ##### Patch Changes - [#​735](https://redirect.github.com/changesets/action/pull/735) [`8833883`](https://redirect.github.com/changesets/action/commit/88338839e35c3e0fa61f3c9c3f27e7572cd5f2cf) Thanks [@​bluwy](https://redirect.github.com/bluwy)! - Handle error when pushing git tags with the git CLI - [#​724](https://redirect.github.com/changesets/action/pull/724) [`36f529f`](https://redirect.github.com/changesets/action/commit/36f529f13ab58bbcf6331035cb950385586e8a89) Thanks [@​bluwy](https://redirect.github.com/bluwy)! - Improve log messages - [#​724](https://redirect.github.com/changesets/action/pull/724) [`36f529f`](https://redirect.github.com/changesets/action/commit/36f529f13ab58bbcf6331035cb950385586e8a89) Thanks [@​bluwy](https://redirect.github.com/bluwy)! - Fix root action double error logs - [#​729](https://redirect.github.com/changesets/action/pull/729) [`ca85897`](https://redirect.github.com/changesets/action/commit/ca8589735af2ff6977a0f6474537d550040530d8) Thanks [@​bluwy](https://redirect.github.com/bluwy)! - Always switch and reset branch when generating version commits, similar to if `push-with-git-cli` is enabled </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Almaty) - Branch creation - "on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/yamcodes/arkenv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6ImRldiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [globals](https://redirect.github.com/sindresorhus/globals) | [`17.11.0` → `17.12.0`](https://renovatebot.com/diffs/npm/globals/17.11.0/17.12.0) |  |  | --- ### Release Notes <details> <summary>sindresorhus/globals (globals)</summary> ### [`v17.12.0`](https://redirect.github.com/sindresorhus/globals/releases/tag/v17.12.0) [Compare Source](https://redirect.github.com/sindresorhus/globals/compare/v17.11.0...v17.12.0) - Update globals (2026-09-01) ([#​353](https://redirect.github.com/sindresorhus/globals/issues/353)) [`50a2119`](https://redirect.github.com/sindresorhus/globals/commit/50a2119) - Add `__webpack_layer__` global ([#​351](https://redirect.github.com/sindresorhus/globals/issues/351)) [`779a11a`](https://redirect.github.com/sindresorhus/globals/commit/779a11a) *** </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Almaty) - Branch creation - "on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/yamcodes/arkenv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6ImRldiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
github-actions
Bot
added
the
example
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [tsdown](http://tsdown.dev/) ([source](https://redirect.github.com/rolldown/tsdown)) | [`0.22.14` → `0.23.0`](https://renovatebot.com/diffs/npm/tsdown/0.22.14/0.23.0) |  |  | --- ### Release Notes <details> <summary>rolldown/tsdown (tsdown)</summary> ### [`v0.23.0`](https://redirect.github.com/rolldown/tsdown/releases/tag/v0.23.0) [Compare Source](https://redirect.github.com/rolldown/tsdown/compare/v0.22.14...v0.23.0) ##### 🧭 Migration Guide Most users can upgrade directly. Before upgrading, run one final build with `tsdown@0.22.14` and resolve all deprecation warnings. - **config**: - `bundle: false` → `unbundle: true`; `bundle: true` can be removed - `outExtension` → `outExtensions` - `publicDir` / `--public-dir` → `copy` / `--copy` - `removeNodeProtocol: true` → `nodeProtocol: 'strip'` - `injectStyle` → `css.inject` - **deps**: - `inlineOnly` / `deps.onlyAllowBundle` → `deps.onlyBundle` - `skipNodeModulesBundle: true` → `deps.neverBundle: true` - `resolveDepSubpath` now defaults to `false`; set it to `true` to preserve the previous behavior - **dts**: - Select a generator with `dts.generator`, for example `{ generator: 'oxc' }` - `dts.cjsReexport` was removed; dual-format builds now generate CJS declarations in a separate pass - **attw**: - The default profile changed from `strict` to `esm-only`; set `profile: 'strict'` to preserve the previous checks - **programmatic API**: - `build()` now returns `{ bundles, watch }`; replace `const bundles = await build()` with `const { bundles } = await build()` - **requirements**: - Node.js 25 is no longer supported; use `^22.18.0`, `^24.11.0`, or `>=26.0.0` - The packages no longer publish legacy `types` and `typesVersions` fallbacks; use TypeScript’s `bundler`, `node16`, or `nodenext` module resolution ##### 🚨 Breaking Changes - Drop support for Node.js 25 - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(26950)</samp>](https://redirect.github.com/rolldown/tsdown/commit/26950f1) - Remove deprecated tsup compatibility options - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(50766)</samp>](https://redirect.github.com/rolldown/tsdown/commit/507661c) - Drop `types` and `typesVersions`fields - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(be3ea)</samp>](https://redirect.github.com/rolldown/tsdown/commit/be3ea86) - **attw**: - Change default profile to `esm-only` - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(9b3cf)</samp>](https://redirect.github.com/rolldown/tsdown/commit/9b3cfca) - **deps**: - Remove deprecated `deps.onlyAllowBundle` - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(30c55)</samp>](https://redirect.github.com/rolldown/tsdown/commit/30c553d) - Disable `resolveDepSubpath` by default - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(d300f)</samp>](https://redirect.github.com/rolldown/tsdown/commit/d300fcc) - Remove deprecated `skipNodeModulesBundle` - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(f2a3d)</samp>](https://redirect.github.com/rolldown/tsdown/commit/f2a3d8e) - **dts**: - Remove dts.cjsReexport option - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(9c70f)</samp>](https://redirect.github.com/rolldown/tsdown/commit/9c70fa9) - Make `dts.generator` the only way to select generator - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(eb75f)</samp>](https://redirect.github.com/rolldown/tsdown/commit/eb75f9d) ##### 🚀 Features - Expose programmatic watch controls - by [@​sxzz](https://redirect.github.com/sxzz) in [#​1062](https://redirect.github.com/rolldown/tsdown/issues/1062) [<samp>(96a40)</samp>](https://redirect.github.com/rolldown/tsdown/commit/96a4098) - **css**: Support function form for `css.modules.localsConvention` - by [@​sxzz](https://redirect.github.com/sxzz) and [@​lazerg](https://redirect.github.com/lazerg) [<samp>(b566f)</samp>](https://redirect.github.com/rolldown/tsdown/commit/b566f6d) - **report**: Add `summary` option to skip per-file size logs - by [@​lazerg](https://redirect.github.com/lazerg) in [#​1036](https://redirect.github.com/rolldown/tsdown/issues/1036) [<samp>(020e9)</samp>](https://redirect.github.com/rolldown/tsdown/commit/020e9cd) ##### 🐞 Bug Fixes - Allow `unplugin-unused` v0.5+ - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(53c78)</samp>](https://redirect.github.com/rolldown/tsdown/commit/53c78cb) - Ignore optional dependencies in type definitions - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(94622)</samp>](https://redirect.github.com/rolldown/tsdown/commit/946224d) - **cli**: - Camel-case nested flag keys - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(bf53f)</samp>](https://redirect.github.com/rolldown/tsdown/commit/bf53f43) - **css**: - Watch files imported via `@import` - by [@​lazerg](https://redirect.github.com/lazerg) in [#​1038](https://redirect.github.com/rolldown/tsdown/issues/1038) [<samp>(ebee5)</samp>](https://redirect.github.com/rolldown/tsdown/commit/ebee509) - **deps**: - Apply `resolveDepSubpath` when `neverBundle` is `true` - by [@​lazerg](https://redirect.github.com/lazerg) in [#​1053](https://redirect.github.com/rolldown/tsdown/issues/1053) [<samp>(4943c)</samp>](https://redirect.github.com/rolldown/tsdown/commit/4943c08) - **exports**: - Scope inlined dependencies to configs with exports - by [@​lazerg](https://redirect.github.com/lazerg) in [#​1040](https://redirect.github.com/rolldown/tsdown/issues/1040) [<samp>(d5b80)</samp>](https://redirect.github.com/rolldown/tsdown/commit/d5b8015) - **migrate**: - Pin migrated projects to tsdown 0.22.14 - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(113fb)</samp>](https://redirect.github.com/rolldown/tsdown/commit/113fb8a) - Support non-interactive environments - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(51e41)</samp>](https://redirect.github.com/rolldown/tsdown/commit/51e4183) ##### 🏎 Performance - Remove `asyncDispose` polyfill - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(82675)</samp>](https://redirect.github.com/rolldown/tsdown/commit/826755e) - Replace `ansis` with `util.styleText` - by [@​sxzz](https://redirect.github.com/sxzz) [<samp>(be6bf)</samp>](https://redirect.github.com/rolldown/tsdown/commit/be6bfd2) ##### [View changes on GitHub](https://redirect.github.com/rolldown/tsdown/compare/v0.22.14...v0.23.0) </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Almaty) - Branch creation - "on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/yamcodes/arkenv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6ImRldiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pnpm](https://redirect.github.com/pnpm/pnpm/tree/main/pnpm) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`11.24.0` → `12.0.0`](https://renovatebot.com/diffs/npm/pnpm/11.24.0/12.0.0) |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v12.0.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.0.0): pnpm 12 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.26.0...v12.0.0) #### Major Changes - Git dependencies on known hosts (GitHub, GitLab, Bitbucket) are now treated as identities rather than transport choices. Every representation of the same repository — `github:owner/repo`, `owner/repo`, `git+https://…`, `git+ssh://git@…` — resolves through the host's canonical HTTPS URL, and the lockfile never records an SSH URL for them. Repositories whose archive endpoint is anonymously reachable resolve to the host's archive (fast tarball download); all others resolve to a `git` clone of the canonical HTTPS URL, which every machine with access to the repository can fetch. To reach a private hosted repository over SSH, configure the machine (not the project) with git's own URL rewriting, for example: ```sh git config --global url."git@github.com:".insteadOf https://github.com/ ``` pnpm shells out to `git`, so the rewrite applies to all of pnpm's git operations automatically. URLs of unknown hosts (self-hosted servers) are unaffected and keep their exact URL, including SSH. URLs with embedded credentials are also kept verbatim and never resolve to a host archive. This removes the network probing that previously decided between HTTPS and SSH at resolution time, which could record a transport that only worked on the machine that happened to run the resolution (e.g. an SSH URL that broke CI runners without SSH keys). - A project's `pnpm-workspace.yaml` may no longer carry a setting pnpm does not recognize. Such a setting used to be ignored in silence — a misspelled `minimumReleaseAge` dropped the policy it was meant to set, and nothing said so. Now it is reported, suggesting the closest real setting name when the key looks like a typo, and it fails the command with `ERR_PNPM_UNRECOGNIZED_WORKSPACE_SETTINGS` when the project pins a pnpm version the running pnpm satisfies: with the pin honored, the setting cannot be meant for a different pnpm version, so it is a mistake to fix rather than a key to ignore. Everywhere else it is a warning, so a project that has yet to be cleaned up keeps working. The `pnpm config` subcommands never fail on such a setting, so a broken file can still be inspected and repaired, and `pnpm config get <key>` prints the value with no warnings at all. Keys the global config file cannot set are likewise split between workspace-only settings (still directed to `pnpm-workspace.yaml`) and settings unknown to this version. - Dependency cycles are now broken canonically during peer resolution: the members of each cycle are ordered by package id, and the edges that close a cycle are always cut at the same place, no matter where the installation walks into the cycle from. Previously the cut depended on the walk path, so installing the same dependencies could produce different lockfiles depending on importer order or resolution order [#​13846](https://redirect.github.com/pnpm/pnpm/issues/13846), and a peer-resolution verdict computed for one occurrence of a cyclic package could be wrongly reused at another [#​13865](https://redirect.github.com/pnpm/pnpm/issues/13865). With canonical cycle breaking the lockfile is a pure function of the dependency graph: repeated installs, reordered importers, and reordered dependencies all produce byte-identical lockfiles. Peer dependencies of packages inside a cycle keep nearest-wins resolution along the canonical order, and a dependency edge that closes a cycle references an occurrence of its target resolved at the importer level. On large cycle-heavy workspaces peer resolution is 2–3× faster, uses about 25% less memory, and produces a substantially smaller lockfile (fewer redundant peer variants). Existing lockfiles keep working: headless (`--frozen-lockfile`) installs consume them unchanged, and installs that skip resolution leave them untouched. The first install that actually re-resolves (for example after a dependency change) re-keys walk-order-dependent peer variants of cyclic packages once. - `packageImportMethod: auto` now tries hardlinks before cloning on Linux. A reflink materializes a new inode and copies extent bookkeeping inside the filesystem's metadata trees, where a hardlink is one directory entry — on btrfs this roughly halves the time an install spends materializing `node_modules` from a warm store. ext4 installs are unchanged (cloning was never supported there, so `auto` already hardlinked), and macOS keeps clone-first, where APFS `clonefile` is the platform's cheap primitive. Cloning remains the fallback when the store refuses hardlinks, and remains available explicitly via `packageImportMethod: clone`. - Under `engineStrict`, an install fails when an incompatible package is reached through a regular `dependencies` edge of an installable package, even when that whole subtree hangs off an `optionalDependencies` entry. pnpm v11 installs the package and emits an install-check warning instead. Packages reachable only through optional edges, or through a package that was itself skipped, are still skipped in both versions [#​13286](https://redirect.github.com/pnpm/pnpm/issues/13286). #### Minor Changes - Globally installed bins can now follow the project you run them in. The new `globalShims` setting is a record of package names to policies that selects which globally installed packages get project-aware shims; it defaults to `{ node: true, deno: true, bun: true }` and merges key-wise, so `globalShims: { bun: false }` switches one default off and `globalShims: { typescript: true }` adds another package. With the default, a project that pins Node.js through `devEngines.runtime` or `engines.runtime` gets the pinned stable release — authenticated against the Node.js release-team signatures — downloaded on first use and run whenever you type `node` inside the project, with no shell hooks. Candidates that are not signature-verified (Deno, Bun, Node.js prereleases, and ordinary package bins you enable) ask "Do you trust this project?" once per candidate and remember the answer machine-locally; the record values name the policy per package: `"auto"` (or its shorthand `true`) defers to artifact authentication, `"always"` switches without ever asking (useful in CI), and `"prompt"` always asks, even for authenticated candidates. Set `globalShims: false` to disable the feature, or `PNPM_SHIM_BYPASS=1` to bypass it for one invocation. On Windows, programs can keep spawning the global `node.exe` directly, without a shell. - pnpm installs the other package managers now, not just itself: npm, Yarn Classic, Yarn Berry, Yarn 6 (`yarnpkg/zpm`), and Bun. Each is resolved and fetched through the trusted package-manager registries, and an npm-published one is verified against npm's signature for its exact version before it is executed. Three things use it: - A git-hosted dependency is prepared with the package manager it asks for. Its `packageManager` / `devEngines.packageManager` pin is honored, and a `yarn.lock` written by Yarn Classic no longer gets installed by Yarn Berry. pnpm provides that package manager when the dependency pinned a version, or when the host cannot satisfy what the dependency needs — so a repository built with Yarn now installs on a machine that has only pnpm, while a host that already has a suitable one keeps using its own. - `pnpm dlx` (`pnx`) runs one of them for a single command: `pnx yarn@4 install`, `pnx npm@11 ci`, `pnx bun@1.3.0 install`. Naming a package manager, or a runtime (`node`, `deno`, `bun`), there now provisions the real thing instead of installing the npm package that shares its name — unless the specifier locates a package rather than asking for a released version (`pnx yarn@npm:yarn@1.22.22`, `pnx yarn@yarnpkg/berry`), which installs what it names — `pnx yarn@4` was previously a missing version, since Yarn 4 is published as `@yarnpkg/cli-dist`, and `pnx node@22` now runs that Node.js release rather than a wrapper that downloads one. `--package` naming a package manager picks which of its commands to run, so `pnx --package npm@11 npx create-something` runs that npm's `npx`. - `pnpm shim add yarn` links a `yarn` command that runs whatever version the current project pins, and `pnpm shim rm` / `pnpm shim ls` manage those shims. It works for any package, not only package managers. Shims are never created as a side effect of `pnpm setup` or an install — a shim shadows the rest of your `PATH`, so pnpm only writes one when asked. Installing a package manager globally (`pnpm add -g yarn`) now makes it follow a project's pin too, the way a globally installed Node.js already follows `devEngines.runtime`: the pinned version runs where a project pins one, and the globally installed copy is the fallback everywhere else. An explicit `globalShims` entry, including `false`, is left as you set it. `pnpm add` follows the same rule about what a name means. `pnpm add -g yarn@4` installs Yarn Berry — it used to fail, because npm's `yarn` package stops at Classic — and `pnpm add -g node@22` / `pnpm add -g deno@2` install that Node.js or Deno release rather than a wrapper package that downloads one. In a project, naming a package manager records which one the project uses instead of installing it as a dependency, and naming a runtime records it under `engines.runtime` as `node@runtime:22` already did. The declaration goes where the package manager reads it. Yarn is started from a project pin by corepack, which reads only `packageManager` and only accepts an exact version there, so `pnpm add yarn@4` resolves the line and writes `"packageManager": "yarn@4.18.0"` — the same thing `corepack use yarn@4` writes, down to the `+sha512.…` integrity for the Yarn Classic line that corepack pins its tarball with. Every other package manager is recorded in `devEngines.packageManager`, which holds a range. Only one of the two fields is ever left behind: they declare the same thing, and corepack refuses to run a project whose declarations disagree. A JavaScript package manager on a machine without Node.js gets a managed LTS runtime to run on. What changes for a project coming from v11: `pnpm add yarn` records the project's package manager instead of installing the npm package that shares the name (that package is still reachable as `pnpm add yarn@npm:yarn@1.22.22`), `pnpm add -g yarn` installs the current Yarn line rather than Classic, `pnpm add -g node` / `pnpm add -g deno` and `pnx node` / `pnx deno` install a Node.js or Deno release rather than a wrapper package, and a globally installed package manager defers to a project's pin where there is one. - Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally. Configure it with the new `remoteSideEffectsCache` setting. A workspace names the eligible `organization` and `packages`; everything describing the act of signing — `publish`, `keyId`, `builderId`, `trustedKeys`, `privateKey` and the provenance fields — is refused in `pnpm-workspace.yaml` and read from the global config file or the environment instead. - Added the `audit.ignorePrune` setting. When set to `true`, `pnpm audit --fix` removes ignored GHSA entries that no longer appear in the audit report. - `pnpm init` now pins the latest pnpm version, instead of the version of pnpm that ran the command. A project scaffolded by an outdated pnpm therefore no longer inherits that staleness through its own `devEngines.packageManager` / `packageManager` pin [#​7490](https://redirect.github.com/pnpm/pnpm/issues/7490). The version is read from the `latest` tag on the package-manager registries. When that lookup cannot answer — no network, an unreachable or slow registry, `offline`, or a `latest` that the `minimumReleaseAge` / `trustPolicy` settings reject — `pnpm init` pins the running version as before, and never fails or hangs on the lookup. A `latest` that is older than the running pnpm is never pinned either. - Allowed `pnpm update --patches` to refresh registry revisions through a configured pnpr server while retaining locked package versions. - Added explicit registry revision selection with `<version>+rN` and `pnpm update --patches` for refreshing revision artifacts without changing package versions. Registry-backed lockfile policy checks recognize historical revisions, and pnpr now preserves safe revision histories from upstream registries. - Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the `registries` setting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts. - Running `pnpm setup`, `pnpm self-update`, or a command that modifies the global installation (such as `pnpm add --global`) through `sudo` now fails with `ERR_PNPM_SUDO_NOT_SUPPORTED` instead of silently operating on the root user's home directory. pnpm keeps global packages and configuration in the invoking user's home directory, so these commands never need root permissions. Read-only global commands (such as `pnpm bin --global`) still work under sudo. - `pnpm stage approve` now approves several staged packages at once. Run it without a stage id to pick from the staged versions interactively, or pass a list of stage ids. The whole batch is approved with a single one-time password, and pnpm asks for a new one only once the registry stops accepting it. Inside a workspace, the selected packages are approved in dependency order, and a package whose workspace dependency could not be approved is skipped instead of being published against a dependency that never reached the registry. #### Patch Changes - Deprecated the pnpmfile `filterLog` hook in pnpm v12. The Rust CLI ignores it and emits a warning. - The built-in compatibility database no longer adds dependencies that were detected by static analysis of published packages. Those entries named packages that are only imported for their types, so installing them was at best unnecessary and at worst broke the dependent: `@typescript-eslint/types` gained a `typescript` dependency resolved to the newest release, which put TypeScript 7 under older `@typescript-eslint` versions and made ESLint fail with "Cannot read properties of undefined (reading 'Intrinsic')". The database keeps its `@yarnpkg/extensions` entries and pnpm's own curated ones. - When no directory above the project accepts a hard link — inside an AI agent sandbox that only grants write access to the project, or a container with just the project mounted writable — the default store is now created at `<project>/node_modules/.pnpm-store` instead of in the pnpm home directory. In those environments the home store is either read-only or on another volume, which forces every package to be copied instead of hard linked [#​13525](https://redirect.github.com/pnpm/pnpm/issues/13525). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/notion.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/notion_light.svg" /> <img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.26.0`](https://redirect.github.com/pnpm/pnpm/compare/v11.25.0...v11.26.0) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.25.0...v11.26.0) ### [`v11.25.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.25.0): pnpm 11.25 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.24.0...v11.25.0) #### Minor Changes - Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally. Configure it with the new `remoteSideEffectsCache` setting. A workspace names the eligible `organization` and `packages`; everything describing the act of signing — `publish`, `keyId`, `builderId`, `trustedKeys`, `privateKey` and the provenance fields — is refused in `pnpm-workspace.yaml` and read from the global config file or the environment instead. - Added macOS and Windows x64 and arm64 support to remote shared build artifacts [pnpm/pnpm#13771](https://redirect.github.com/pnpm/pnpm/issues/13771). - Added the `audit.ignorePrune` setting. When set to `true`, `pnpm audit --fix` removes ignored GHSA entries that no longer appear in the audit report. - Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject. Dependency side effects use package and source-integrity subjects, while workspace tasks use project and task subjects. This changes shared-artifact request bodies and signed payloads. A pnpr server and its clients have to be on matching versions. - `pnpm init` now pins the latest pnpm version, instead of the version of pnpm that ran the command. A project scaffolded by an outdated pnpm therefore no longer inherits that staleness through its own `devEngines.packageManager` / `packageManager` pin [#​7490](https://redirect.github.com/pnpm/pnpm/issues/7490). The version is read from the `latest` tag on the package-manager registries. When that lookup cannot answer — no network, an unreachable or slow registry, `offline`, or a `latest` that the `minimumReleaseAge` / `trustPolicy` settings reject — `pnpm init` pins the running version as before, and never fails or hangs on the lookup. A `latest` that is older than the running pnpm is never pinned either. - A `scope` set in a project's `pnpm-workspace.yaml` is now ignored, with a warning naming where to set it instead. `pnpm login` records the scope as a `@scope:registry` route in the machine-global `auth.ini`, which outranks `~/.npmrc` in every project — so a repository-committed file could redirect a scope such as `@acme` for all of a user's other projects after one routine login. Use `--scope`, the `PNPM_CONFIG_SCOPE` environment variable, or the global config file instead [#​13557](https://redirect.github.com/pnpm/pnpm/issues/13557). - Verified remote build artifacts are persisted in the shared store with their signed origin metadata. Later installs reverify the artifact against current trust, policy, platform, and source before reuse, while invalid remote variants are quarantined per channel ([pnpm/pnpm#13771](https://redirect.github.com/pnpm/pnpm/issues/13771)). - Persist completed recursive tasks so `--resume-from` skips exactly the work that passed during a matching interrupted or failed `pnpm -r run` / `pnpm -r exec` invocation. When no compatible state exists, pnpm retains its graph-based resume behavior. - Allowed `pnpm update --patches` to refresh registry revisions through a configured pnpr server while retaining locked package versions. - Added explicit registry revision selection with `<version>+rN` and `pnpm update --patches` for refreshing revision artifacts without changing package versions. Registry-backed lockfile policy checks recognize historical revisions, and pnpr now preserves safe revision histories from upstream registries. - Workspace install, rebuild, pack, publish, stage, and lifecycle work now starts as soon as its dependencies finish instead of waiting for an unrelated topological group. - `pnpm stage approve` now approves several staged packages at once. Run it without a stage id to pick from the staged versions interactively, or pass a list of stage ids. The whole batch is approved with a single one-time password, and pnpm asks for a new one only once the registry stops accepting it. Inside a workspace, the selected packages are approved in dependency order, and a package whose workspace dependency could not be approved is skipped instead of being published against a dependency that never reached the registry. - Added per-task concurrency limits to workspace task orchestration. Set `tasks.<name>.concurrency` in `pnpm-workspace.yaml` to limit how many instances of that task may run across workspace projects at once: ```yaml tasks: build: concurrency: 2 ``` - Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the `registries` setting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts. - `sideEffectsCache` now declares the whole of how a package's build output is reused — whether one is restored, whether one is saved, and the remote tier that shares it between machines: ```yaml sideEffectsCache: read: true write: true remote: org: acme packages: ['native-addon'] ``` `sideEffectsCache: true`, `sideEffectsCacheReadonly`, `remoteSideEffectsCache`, and its `organization` field all keep working. Where a field is set under both spellings the one above wins; where it is set under only one, it is kept. Two behaviors change, both bringing this CLI in line with what the Rust one already did: `sideEffectsCacheReadonly: true` now blocks writing to the cache, and setting it alongside `sideEffectsCache: false` gives a read-only view rather than switching the cache off entirely. A cache can also be declared write-only now, to populate one the run does not read. - Workspace task orchestration ([pnpm/rfcs#23](https://redirect.github.com/pnpm/rfcs/pull/23)). `pnpm -r run` and `pnpm -r exec` now schedule per task instead of in topological chunks: a task starts as soon as the tasks it depends on have finished, so a project no longer waits for unrelated projects that happen to share its chunk. A new `tasks` section in `pnpm-workspace.yaml` declares what a task depends on, using the `^` convention: ```yaml tasks: build: dependsOn: ['^build'] test: dependsOn: ['build'] lint: {} ``` `^name` means the named task in each of the project's workspace dependencies; a bare `name` means the task in the same project; an entry with no `dependsOn` declares an empty dependency list. A task with no entry behaves as `dependsOn: ['^<its own name>']`, which is exactly what the previous chunked ordering implied — an unconfigured workspace gets the scheduler improvement and nothing else changes meaning. A project without the script is reported skipped and passes its edges through to its own dependencies, so a scriptless package does not sever a chain. Also part of this change: - A dependency cycle among the tasks of a run is now an error naming the participating tasks (`ERR_PNPM_TASK_CYCLE`) instead of silently running in an arbitrary order. Setting `ignoreWorkspaceCycles: true` downgrades the error to a warning: the cycle's tasks run in an arbitrary order relative to each other. - `--resume-from` now skips exactly the transitive dependencies of the anchor package; work unrelated to the anchor still runs. - Under `--no-bail`, tasks whose dependencies failed are reported as skipped, not failed, and do not add to the exit code. - With `--bail` (the default), the first failure still ends the run at once and nothing new is dispatched — including scripts already queued behind the concurrency limit. - `pnpm -r run --dry-run <script>` prints the task graph that would execute without running anything (including skipping the `verifyDepsBeforeRun` check); `--json` emits the tasks and their resolved dependency edges. - Output is inherited rather than piped only when at most one script can ever be in flight (`--workspace-concurrency=1`, or the graph forces the scripts to run one after another). #### Patch Changes - An `_auth` entry in the global config file no longer decides which registry packages come from when something else says. A `registry` or `registries` declared in `pnpm-workspace.yaml` or the global config now wins over the route inferred from a stored credential, which still applies where nothing else declares one. The `pnpm_config__auth` environment variable is unchanged: it stays the way to point a CI runner at a mandated proxy, and still overrides what a repository declares. - Prevent installs through a symlinked `node_modules` directory from rewriting the target checkout [pnpm/pnpm#14286](https://redirect.github.com/pnpm/pnpm/issues/14286). - Treat empty scripts selected by a regular expression as missing before running dependent tasks. - The options type of the `fetch` command now declares `allowBuilds`, a setting its handler already forwarded to the installer. Type-level only — what `pnpm fetch` does is unchanged. - Filter hidden scripts matched by a regular expression during recursive runs when a visible script also matches. - Fixed automatically switched pnpm versions forcing all descendant pnpm processes to use the same version [pnpm/pnpm#14309](https://redirect.github.com/pnpm/pnpm/issues/14309). - Fixed `ERR_PNPM_UNUSED_PATCH` validation during incremental installs [pnpm/pnpm#13692](https://redirect.github.com/pnpm/pnpm/issues/13692). - Fixed `pnpm deploy --prod` failing when an excluded dev dependency was also declared as an optional peer dependency [pnpm/pnpm#14302](https://redirect.github.com/pnpm/pnpm/issues/14302). - `pnpm update -g` no longer downgrades a global package. `--latest` resolves the `latest` dist-tag, which can point at an older release than the one installed — after `pnpm add -g <pkg>@next`, for instance [#​14270](https://redirect.github.com/pnpm/pnpm/issues/14270). `pnpm update -g` also no longer changes the pnpm version. pnpm's own global install belongs to `pnpm self-update` [#​14270](https://redirect.github.com/pnpm/pnpm/issues/14270). - Copying a built package to its other hoisted locations no longer replaces the destination directory. With `nodeLinker: hoisted`, that replacement deleted the dependencies nested inside the destination's `node_modules`, and made concurrent copies of the same build chunk fail with `ERR_PNPM_ENOENT: no such file or directory, rename '.../node_modules/_tmp_...'` [#​12880](https://redirect.github.com/pnpm/pnpm/issues/12880). - `pnpm update` no longer replaces the specifier a project declares for a dependency that is also listed in `overrides`. A `catalog:` reference stays a `catalog:` reference, and a declared range stays as written, instead of being rewritten to the version the override resolved to [#​12115](https://redirect.github.com/pnpm/pnpm/issues/12115). - `pnpm update` no longer moves the range a project declares for a dependency that `overrides` also lists, even when the override repeats that range verbatim. Previously the updated `package.json` disagreed with the lockfile, so the next `pnpm install --frozen-lockfile` failed with a specifier mismatch [#​14224](https://redirect.github.com/pnpm/pnpm/issues/14224). - Make `pnpm add --lockfile-only` skip dependency linking [pnpm/pnpm#14286](https://redirect.github.com/pnpm/pnpm/issues/14286). - `--production` is accepted again as an alias of `--prod` on `install`, `fetch`, `prune`, `update`, `list`, `why`, and `sbom`, and the install that `verifyDepsBeforeRun` reproduces is now spelled with `--prod`. `pnpm run` no longer aborts with "unexpected argument '--production' found" after a production-only install [#​14147](https://redirect.github.com/pnpm/pnpm/issues/14147). - The progress output no longer overwrites the lines above it once it grows taller than the terminal window [#​14270](https://redirect.github.com/pnpm/pnpm/issues/14270). - Restoring a dependency's build from the remote side-effects cache no longer downloads files the store already holds. - Forward `patchedDependencies` hashes and `packageExtensions` to pnpr so server-side resolution preserves patches and package extensions in the lockfile and installed packages. - Published the workspace task graph and scheduler as `@pnpm/workspace.task-scheduler` so other workspace commands can use the same dependency-aware scheduling as recursive run and exec. - The environment variables for the remote side-effects cache are named for the setting they configure: `PNPM_SIDE_EFFECTS_CACHE_REMOTE_KEY_ID`, `..._BUILDER_ID`, `..._IMAGE_DIGEST`, `..._ARCHITECTURE_BASELINE`, `..._PRIVATE_KEY`, `..._BUILD_ENV`, `..._TRUSTED_KEYS` and `..._PUBLISH`. The `PNPM_REMOTE_SIDE_EFFECTS_CACHE_*` names keep working, and the new one wins when both are set. - A `devEngines.packageManager` range pin on pnpm is now recorded in `pnpm-lock.yaml`'s `packageManagerDependencies` when the running pnpm already satisfies it, using the running version and keeping the range as the recorded specifier. Previously only an exact pin — or a range resolved on the way through a version switch — reached the lockfile, so a range pin written by hand (or by any tool other than `pnpm add` / `pnpm self-update`) left the project without the shared resolution the pin exists to provide. - Fixed recursive `run` cleanup on Windows when a lifecycle script fails while another script's process tree is still running. - The update notification now suggests `pnpm self-update` when `PNPM_HOME` manages the pnpm in use, and the [standalone install script](https://pnpm.io/installation) otherwise — under Corepack, or when another package manager installed pnpm. `pnpm self-update` under Corepack names the standalone install script too. - Enforce `allowBuilds` when a prepared git dependency is reused from the shared store, and use the lockfile's canonical git resolution ID in approval suggestions. - Topologically sorting workspace projects now runs in linear time, fixing installs and lockfile updates that stalled for seconds on workspaces with thousands of projects forming deep dependency chains [#​14149](https://redirect.github.com/pnpm/pnpm/issues/14149), [#​14151](https://redirect.github.com/pnpm/pnpm/issues/14151). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/notion.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/notion_light.svg" /> <img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Almaty) - Branch creation - "on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/yamcodes/arkenv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6ImRldiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@rolldown/plugin-babel](https://redirect.github.com/rolldown/plugins/tree/main/packages/babel#readme) ([source](https://redirect.github.com/rolldown/plugins/tree/HEAD/packages/babel)) | [`0.2.3` → `0.2.4`](https://renovatebot.com/diffs/npm/@rolldown%2fplugin-babel/0.2.3/0.2.4) |  |  | --- ### Release Notes <details> <summary>rolldown/plugins (@​rolldown/plugin-babel)</summary> ### [`v0.2.4`](https://redirect.github.com/rolldown/plugins/blob/HEAD/packages/babel/CHANGELOG.md#small-024-2026-09-07-small) ##### Bug Fixes - **babel:** set `inputSourceMap: false` to avoid combining source map twice ([#​131](https://redirect.github.com/rolldown/plugins/issues/131)) ([249a7d2](https://redirect.github.com/rolldown/plugins/commit/249a7d237cb0fc7cae4bb52086bba28df31798d3)) - **deps:** update all non-major dependencies ([#​124](https://redirect.github.com/rolldown/plugins/issues/124)) ([6373896](https://redirect.github.com/rolldown/plugins/commit/6373896fc628e5b156a68ffddbaf2ea4bd4bcf71)), references [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) - **deps:** update all non-major dependencies ([#​65](https://redirect.github.com/rolldown/plugins/issues/65)) ([465fb38](https://redirect.github.com/rolldown/plugins/commit/465fb3860ef37ac916e67c76c518c24298a7712d)) - **deps:** update all non-major dependencies ([#​88](https://redirect.github.com/rolldown/plugins/issues/88)) ([0032957](https://redirect.github.com/rolldown/plugins/commit/0032957d949511d815308a8d60345f826f993c96)), references [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) - **deps:** update all non-major dependencies ([#​99](https://redirect.github.com/rolldown/plugins/issues/99)) ([fa5b6df](https://redirect.github.com/rolldown/plugins/commit/fa5b6df52a03a284a3c0950b56f50b8bae9305cb)), references [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) - **deps:** update rolldown-related dependencies ([#​59](https://redirect.github.com/rolldown/plugins/issues/59)) ([e0e474c](https://redirect.github.com/rolldown/plugins/commit/e0e474c00f1fcc237b81c3c64ad71de488227db7)) - **deps:** update rolldown-related dependencies ([#​66](https://redirect.github.com/rolldown/plugins/issues/66)) ([717a2a6](https://redirect.github.com/rolldown/plugins/commit/717a2a6ee1b3f43ae9a0f63bed0e3c031500d2ba)) - **deps:** update rolldown-related dependencies ([#​78](https://redirect.github.com/rolldown/plugins/issues/78)) ([6a57129](https://redirect.github.com/rolldown/plugins/commit/6a57129a927c1fd548d03644114801c0f1e2c424)) ##### Miscellaneous Chores - **deps:** update all non-major dependencies ([#​106](https://redirect.github.com/rolldown/plugins/issues/106)) ([6b89bca](https://redirect.github.com/rolldown/plugins/commit/6b89bcaa8ee477f0471697e04a55f10683f13702)), references [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) - **deps:** update all non-major dependencies ([#​77](https://redirect.github.com/rolldown/plugins/issues/77)) ([0b70858](https://redirect.github.com/rolldown/plugins/commit/0b70858300ac4b7227611303f036b3684256fb31)) - **deps:** update all non-major dependencies ([#​90](https://redirect.github.com/rolldown/plugins/issues/90)) ([b73d0dd](https://redirect.github.com/rolldown/plugins/commit/b73d0dda75d5b013daf03ebf9636a69aa372c7b4)), references [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) - **deps:** update all non-major dependencies ([#​92](https://redirect.github.com/rolldown/plugins/issues/92)) ([59dcaf4](https://redirect.github.com/rolldown/plugins/commit/59dcaf442a7d5613b415f7d101d9c0ca63c5b1b4)), references [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) [#​8203](https://redirect.github.com/rolldown/plugins/issues/8203) - **deps:** update rolldown-related dependencies ([#​128](https://redirect.github.com/rolldown/plugins/issues/128)) ([c0365e0](https://redirect.github.com/rolldown/plugins/commit/c0365e08c01018491108da62944b9869bb795c53)) - use pnpm catalog for some packages ([#​82](https://redirect.github.com/rolldown/plugins/issues/82)) ([d717e25](https://redirect.github.com/rolldown/plugins/commit/d717e2507bce0250702674a138801141d453e4d6)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Almaty) - Branch creation - "on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/yamcodes/arkenv). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6ImRldiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
github-actions
Bot
added
the
playground
## Summary - preserve benchmark table styling while satisfying Biome specificity ordering - fix the pre-existing autofix.ci failure in `viewer.html` ## Validation - `git diff --check` - Confirmed CI diagnostics from run 34628606400 - Local Biome execution blocked because pnpm 12.0.0 is unavailable for macOS arm64 in the configured registry Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Update all www deployment workflows from Vercel CLI 54.7.1 to pinned 59.16.0. Run 34621903135 failed because Vercel CLI 54 passed --unsafe-perm to pnpm 12; 59.16.0 is compatible with pnpm 12. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
## Summary - remove the unused `error` binding from `scripts/verify-artifacts.js` - preserve the existing size-limit failure handling Fixes the pre-existing Biome autofix/lint failure identified in #1833. ## Validation - `npx --yes @biomejs/biome@2.5.11 check scripts/verify-artifacts.js` - `node --check scripts/verify-artifacts.js` - `git diff --check` Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
## Summary Fix the React peer dependency conflict affecting Next.js example installs. ## Root cause `@arkenv/nextjs` used the pnpm workspace-only `catalog:` alias for its published React peer dependency. The resulting npm metadata pinned React to `19.2.5`, conflicting with projects using React `19.2.8` and causing `ERESOLVE` during installs. ## Fix Set the peer dependency to the supported React range: ```json "react": "^18.2.0 || ^19.0.0" ``` This matches Next.js's supported React range and allows the examples to resolve successfully. --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>
github-actions
Bot
added
docs
arkenv
@arkenv/build
@arkenv/bun-plugin
@arkenv/cli
@arkenv/fumadocs-ui
@arkenv/nextjs
@arkenv/nuxt
@arkenv/vite-plugin
commit: |
## Summary - Rewrite the existing changeset as a consumer-facing release note - Explain support for React 18.2.0+ in React 18 and all React 19 releases - Include a concise installation example This PR targets the `dev` branch. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to dev, this PR will be updated. # Releases ## @arkenv/nextjs@0.1.6 ### Patch Changes - #### Widen the React peer dependency range _[`#1833`](#1833) [`230ed72`](230ed72) [@yamcodes](https://github.com/yamcodes)_ Allow `@arkenv/nextjs` to work with React 18.2.0 and later in the React 18 line, as well as every React 19 release, instead of requiring React 19.2.5. Install it alongside a supported React version, such as `pnpm add @arkenv/nextjs react@^18.2.0`. Co-authored-by: arkenv-bot[bot] <237618717+arkenv-bot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is automatically maintained by the Sync PR workflow.
It tracks all commits on
devthat have not yet been merged intomain, keeping the two branches in sync after every push todev.🌍 Preview the latest dev documentation: https://arkenv-dev.vercel.app
Note
This PR is opened and managed by arkenv-bot. It is skipped by Pullfrog and other bot-aware workflows.