skills/oxc-project__oxc
1
0
Fork 0
mirror of https://github.com/oxc-project/oxc.git synced 2026-09-14 19:36:11 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
codex/playground-property-mangling
oxc-project__oxc/package.json
T
renovate[bot] 1bb1c8c9e9 chore(deps): update pnpm to v12 (#26381) 
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Adoption](https://docs.renovatebot.com/merge-confidence/) |
[Passing](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [pnpm](https://redirect.github.com/pnpm/pnpm/tree/main/pnpm)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`11.25.0` →
`12.3.2`](https://renovatebot.com/diffs/npm/pnpm/11.25.0/12.3.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/12.3.2?slim=true)
|
![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/12.3.2?slim=true)
|
![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/11.25.0/12.3.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.25.0/12.3.2?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v12.3.2`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.3.2):
pnpm 12.3.2

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.3.1...v12.3.2)

#### Patch Changes

- `pnpm audit --fix update` no longer aborts when a vulnerable package
has no safe version inside its declared range
[#&#8203;14508](https://redirect.github.com/pnpm/pnpm/issues/14508). The
run updates every package it can and lists the rest as remaining.

- `pnpm install` no longer reruns root lifecycle scripts when the global
virtual store contains an unfinished-build marker in a package slot that
the current lockfile does not use
[pnpm/pnpm#14485](https://redirect.github.com/pnpm/pnpm/issues/14485).

- Sped up installs that have no lockfile. pnpm now links packages whose
dependency subtree has no peer dependencies into the virtual store while
resolution is still running.

- `pnpm run` and `pnpm exec` now start without reinstalling on
filesystems that keep sub-millisecond mtimes, such as NTFS. Previously,
every run on those filesystems reinstalled first
[pnpm/pnpm#14486](https://redirect.github.com/pnpm/pnpm/issues/14486).

- `pnpm import` now keeps the versions recorded in `package-lock.json`,
`npm-shrinkwrap.json`, or `yarn.lock` when it generates
`pnpm-lock.yaml`. A range in `package.json`, a catalog, or an override
still decides which versions are eligible, and the recorded version is
preferred among them. The generated lockfile previously could pin newer
versions than the source lockfile
[#&#8203;14476](https://redirect.github.com/pnpm/pnpm/issues/14476).

`pnpm import` in a workspace now imports every workspace project into
the shared lockfile. It previously imported only the project in the
current directory.

`pnpm import` now fails with `ERR_PNPM_LOCKFILE_NOT_FOUND` when none of
the three source lockfiles is present. It also fails with
`ERR_PNPM_YARN_LOCKFILE_PARSE_FAILED` when it cannot parse `yarn.lock`.
It previously generated a lockfile from scratch in both cases.

`pnpm import` always resolves locally. It warns when `--pnpr-server` or
the `pnpr-server` setting is given and does not use the server.

- Sped up installs in large workspaces. Discovering the workspace
projects no longer enumerates every matched directory to learn which
manifest files it holds
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Sped up installs in large workspaces. The resolver and the peer pass
allocate less for every dependency edge
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- `pnpm self-update`, `pnpm with`, and automatic package-manager version
switching no longer wait through registry retry delays when a configured
registry has no signatures and `registry.npmjs.org` is unavailable
[#&#8203;14483](https://redirect.github.com/pnpm/pnpm/issues/14483).

- Sped up installs in large workspaces. Saving the lockfile is faster,
and the install finishes without waiting for memory cleanup
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- `pnpm install` now relinks workspace packages when
`publishConfig.linkDirectory` changes. Frozen installs report an
outdated lockfile until it is regenerated
[pnpm/pnpm#14488](https://redirect.github.com/pnpm/pnpm/issues/14488).

- The pnpm npm wrapper keeps its placeholder shebang-less so pnpm 11 can
install pnpm 12 through the version store. Wrapper installs must allow
lifecycle scripts to install the native binary
[#&#8203;14502](https://redirect.github.com/pnpm/pnpm/issues/14502).

- Sped up dependency resolution when there is no lockfile, and for the
dependencies a lockfile does not cover.

- Sped up installs in large workspaces. Workspace `link:` targets and
importer ids are now derived from the paths' suffixes under the
workspace root
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- `pnpm install` now reports "Already up to date" when local tarball
dependencies have not changed
[#&#8203;14495](https://redirect.github.com/pnpm/pnpm/issues/14495).

- `pnpm update` now accepts `--ignore-scripts` and skips lifecycle
scripts during the update
[pnpm/pnpm#14512](https://redirect.github.com/pnpm/pnpm/issues/14512).

- Sped up installs that restore a deleted `node_modules` from a warm
global virtual store. pnpm no longer re-links packages that are already
fully present in the global virtual store
[#&#8203;14510](https://redirect.github.com/pnpm/pnpm/issues/14510).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"
/>
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.3.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.3.1):
pnpm 12.3.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.3.0...v12.3.1)

#### Patch Changes

- Sped up installs in large workspaces: the anchor for re-rendering
workspace `link:` targets is now derived once per project instead of
once per dependency edge, and project ordering hashes paths by their raw
bytes
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- After a self-update from pnpm 12.2 to 12.3, global commands such as
`node`, `npm`, and `yarn` failed with `unexpected argument '--shim'
found`. Global commands now launch normally, and their first launch
migrates the global bin directory to native shims. When self-update
downgrades to pnpm 12.2 or older, it keeps the newer native shims so
those commands continue to work.

- Sped up installs in large workspaces. The check that verifies each
project against the lockfile now runs the projects in parallel
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"
/>
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.3.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.3.0):
pnpm 12.3

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.2.1...v12.3.0)

#### Minor Changes

- Every context-aware global command (`node`, `deno`, `bun`, and the
shims created with `pnpm shim add`) is now a native executable on every
platform, so environment variables whose names are not valid shell
identifiers reach these commands. On Windows, `<name>.exe` replaces the
`.cmd` and `.ps1` shims for them. Shims written by earlier pnpm 12
releases are migrated on the next global install or self-update.

- `pnpm remove` and `pnpm update` now accept `--trust-lockfile`,
`--no-trust-lockfile`, `--trust-policy`, `--trust-policy-exclude` and
`--trust-policy-ignore-after`, the same flags `pnpm install` and `pnpm
add` take, so the supply-chain settings can be overridden for a single
run. `pnpm remove` verifies the lockfile against the active policies the
way `pnpm install` does, and `--trust-lockfile` skips that pass for
every entry, not only the package being removed.

`pnpm` now also honors `--config.trust-lockfile=<value>`, and accepts
the bare `--trust-lockfile` / `--no-trust-lockfile` spelling on the
commands that previously took the setting from the config file alone.

#### Patch Changes

- `pnpm add <local directory>`, `pnpm add <local tarball>`, `pnpm add
file:<path>` and `pnpm add <tarball URL>` work again. A specifier given
without a `<name>@` prefix is no longer read as a registry package name
and rejected with `ERR_PNPM_PACKAGE_MANAGER_ADD_RESOLVE_LATEST`
[#&#8203;14437](https://redirect.github.com/pnpm/pnpm/issues/14437).

- Fixed `pnpm deploy --legacy` ignoring `allowUnusedPatches` supplied
through `--config.allow-unused-patches` or the
`PNPM_CONFIG_ALLOW_UNUSED_PATCHES` environment variable
[pnpm/pnpm#14450](https://redirect.github.com/pnpm/pnpm/issues/14450).

- Fixed `pnpm install --lockfile-only` writing a lockfile that
referenced a missing peer-suffixed snapshot when an npm-aliased
dependency took part in a cyclic peer dependency graph. The following
`pnpm install --frozen-lockfile` failed with
`ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY`
[#&#8203;14449](https://redirect.github.com/pnpm/pnpm/issues/14449).

- `pnpm config` now accepts `-g`/`--global`, `--location`, and `--json`
before its subcommand
[pnpm/pnpm#14421](https://redirect.github.com/pnpm/pnpm/issues/14421).

- `pnpm dedupe` now converges in one pass when it re-resolves a lockfile
created by pnpm 11, so a second run no longer changes the lockfile
[#&#8203;14455](https://redirect.github.com/pnpm/pnpm/issues/14455).

- Fixed detached child processes being terminated on Windows when
another program launches `pnpm` directly, without a shell, as `nr` from
`@antfu/ni` does
[#&#8203;14447](https://redirect.github.com/pnpm/pnpm/issues/14447).

- Fixed `pnpm docs <package>@<version>` ignoring the requested version.
It now opens the selected version's homepage and reports a missing
version instead of opening the package-level homepage
[pnpm/pnpm#14428](https://redirect.github.com/pnpm/pnpm/issues/14428).

- Sped up installs in large workspaces. `pnpm-lock.yaml` is now read
while the workspace projects are being discovered
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Fixed filtered and recursive `pnpm run` and `pnpm exec` hanging when a
script reads from the terminal. Interactive prompts work again in a
script that pnpm never runs alongside another one, such as a single
`--filter`ed project, `--workspace-concurrency=1`, a dependency chain,
or a task declaring `concurrency: 1`
[#&#8203;14397](https://redirect.github.com/pnpm/pnpm/issues/14397).

- Fixed false unmet peer errors for auto-installed peers in linked
workspace packages.

- Fixed npm global installs on Windows so the PowerShell shims invoke
`pnpm.exe`.

- Fixed `pnpm with current <command>` when global options precede it,
such as `pnpm --workspace-root with current --version`
[pnpm/pnpm#14413](https://redirect.github.com/pnpm/pnpm/issues/14413).

A short-option cluster that mixes a global flag with an option owned by
the command, such as `pnpm -ro dist pack-app`, is now parsed like the
same options written after the command.

An option written before the command name is now reported as an unknown
option unless that command accepts it, instead of being taken for the
command to run. `pnpm -P exec echo` and `pnpm -z exec echo` fail the way
`pnpm --tag next exec echo` does.

- Apply pure insertions in zero-context patches at the correct line
instead of one line early.

- Improved peer dependency resolution performance when many packages
reuse the same peer ranges.

- `pnpm outdated` and `pnpm update` now follow local actions and
reusable workflows referenced with GitHub's self-repository syntax
(`uses: $/.github/actions/setup`) when looking for outdated GitHub
Actions, the same way they follow `./` references.

- The `pnpm install --help` descriptions of `--prod` and `--dev` no
longer claim that the flags take precedence over `NODE_ENV`. pnpm does
not read `NODE_ENV` when selecting which dependency groups to install
[#&#8203;14445](https://redirect.github.com/pnpm/pnpm/issues/14445).

- Sped up installs in large workspaces. The check that decides whether
the lockfile needs updating no longer compares every project against
every lockfile entry
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Sped up dependency resolution in large workspaces that use `link:`
dependencies
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- On Linux, pnpm now resolves registry hostnames through the system
resolver (`getaddrinfo`), as it already does on macOS and Windows and as
pnpm 11 did. Previously, an `/etc/resolv.conf` containing an option the
bundled pure-Rust resolver did not recognize, such as `options
no_tld_query`, made pnpm ignore the configured nameservers and silently
query Google's public DNS instead
[#&#8203;14469](https://redirect.github.com/pnpm/pnpm/issues/14469).

- Sped up dependency resolution in large workspaces. The resolver builds
fewer lookup keys for each dependency
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- `catalogMode` and `--save-catalog` no longer move a local path,
tarball, or `workspace:<path>` specifier into a catalog. Such a
specifier is resolved against the project that declares it, so one
catalog entry cannot mean the same directory for every project that
references it
[#&#8203;14437](https://redirect.github.com/pnpm/pnpm/issues/14437).

- Sped up installs in large workspaces. The workspace dependency graph
is now built once per run instead of twice
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Sped up writing `pnpm-lock.yaml` in large workspaces
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Fixed non-frozen installs through a pnpr server failing instead of
regenerating a conflicted lockfile.

- `pnpm update --interactive` renders its checklist the way pnpm 11
does. Group headings and column headers are separators the cursor skips
instead of checkboxes that select nothing. The columns of one group line
up with the next. `a` toggles all and `i` inverts the selection. The
confirmed selection is echoed as a list of package names
[#&#8203;14423](https://redirect.github.com/pnpm/pnpm/issues/14423).

- Fixed `pnpm config` commands targeting global configuration to skip
project package manager version switching, allowing registry
authentication to be configured before pnpm downloads a project-pinned
version
[pnpm/pnpm#14463](https://redirect.github.com/pnpm/pnpm/issues/14463).

- Fixed pnpm retaining the surrounding quotes in `.npmrc` values,
including auth tokens expanded from environment variables. This restores
authentication with registries configured using `:_authToken="${TOKEN}"`
[pnpm/pnpm#14427](https://redirect.github.com/pnpm/pnpm/issues/14427).

- Fetch and tarball errors no longer print the secrets of the URL they
name. Inline `user:pass@` credentials and the query string or fragment
of a signed URL are hidden, so a failed install or `pnpm add <url>`
cannot leak them into terminal scrollback or CI logs.

- When `dist-tags.latest` names a version whose manifest pnpm cannot
read, the error now names that version and the field it could not
decode, instead of reporting the tag as empty.

- Retry transient Windows file-lock errors, including sharing
violations, while linking dependencies with the default (isolated)
`nodeLinker`. This fixes
[pnpm/pnpm#14407](https://redirect.github.com/pnpm/pnpm/issues/14407).

- `pnpm run`, `pnpm exec`, `pnpm rebuild`, and the script shortcuts such
as `pnpm test` now load the pnpmfile, so `updateConfig` hook settings
such as `extraEnv` and `extraBinPaths` reach the scripts they spawn
[#&#8203;14433](https://redirect.github.com/pnpm/pnpm/issues/14433).

- The `pnpm` executable of the npm package now works when the package
was installed without running its install scripts, as under
`--ignore-scripts` or the default build-script block of pnpm and Bun
[#&#8203;14346](https://redirect.github.com/pnpm/pnpm/issues/14346). In
that case it runs through Node.js and, in a terminal, says how to switch
to the native binary.

- Sped up installs in large workspaces. The resolver no longer copies
the whole lockfile before resolving
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- `minimumReleaseAgeStrict` now defaults to `true` when
`minimumReleaseAge` is explicitly configured, whether in
`pnpm-workspace.yaml`, the global `config.yaml`, a `PNPM_CONFIG_*`
variable, or a CLI flag. The built-in 1440-minute default stays
non-strict. Previously an explicit cutoff was treated as non-strict, so
immature versions were silently added to `minimumReleaseAgeExclude`
instead of being gated with a prompt
[#&#8203;14409](https://redirect.github.com/pnpm/pnpm/issues/14409).

- Preserve environment variables whose names are not valid shell
identifiers when launching Node.js installed by `pnpm runtime set node
--global` on Unix
[pnpm/pnpm#14417](https://redirect.github.com/pnpm/pnpm/issues/14417).

- Fixed `pnpm repo` and `pnpm docs` failing to open the Windows browser
from WSL
[pnpm/pnpm#14467](https://redirect.github.com/pnpm/pnpm/issues/14467).

- `pnpm link`, `pnpm outdated`, and `pnpm import` now apply pnpmfile
`updateConfig` hooks before resolving dependencies.

- Fixed standalone installations to preserve the bundled `node-gyp`
files used to build native dependencies.

- Fixed resolution against registries whose version manifests carry
`_npmUser`, `dist.attestations`, `dist.unpackedSize`, `dist.fileCount`,
or `peerDependenciesMeta` in a shape npm does not use. Such a version
was skipped as though it had never been published, so `pnpm add` could
fail with "no version found for the latest tag" even though the registry
served it.

- `pnpm unpublish` now completes the two-factor authentication a
registry asks for instead of failing with `ERR_PNPM_UNAUTHORIZED` while
logged in. A 401 that is an OTP challenge starts the web-based
authentication flow, or prompts for a classic one-time password. The
obtained password is reused by every request of the run
[#&#8203;14464](https://redirect.github.com/pnpm/pnpm/issues/14464).

- On Windows, pnpm now resolves host names through the system resolver
instead of its own DNS client. The built-in client bound a UDP socket
for every lookup, which made Windows Defender Firewall ask to allow
`pnpm.exe` again after every `pnpm self-update`
[#&#8203;14405](https://redirect.github.com/pnpm/pnpm/issues/14405).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"
/>
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.2.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.2.1):
pnpm 12.2.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.2.0...v12.2.1)

#### Patch Changes

- Restored the `pnpm` executable target without a file extension so pnpm
12.1 and earlier can upgrade to newer pnpm 12 releases on POSIX systems.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"
/>
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.2.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.2.0):
pnpm 12.2

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.1.0...v12.2.0)

#### Minor Changes

- Catalogs can now resolve workspace dependencies through the
`workspace:` protocol.

#### Patch Changes

- Fixed `pnpm audit --fix` failing with `ERR_PNPM_INVALID_FIX_OPTION`
when used without a value, including when another flag follows it, as in
`pnpm audit --fix --json`
[#&#8203;13261](https://redirect.github.com/pnpm/pnpm/issues/13261).
Fixed `pnpm audit --fix=override` ignoring the `saveExact` and
`savePrefix` settings when writing vulnerability overrides
[#&#8203;11523](https://redirect.github.com/pnpm/pnpm/issues/11523).

- Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with
URL-scoped npm registry credentials, including bearer tokens, basic
auth, and `tokenHelper`
[pnpm/pnpm#14334](https://redirect.github.com/pnpm/pnpm/issues/14334).

- Fixed detached child processes being terminated after successful
commands on Windows.

- Sped up installs in large workspaces by resolving each named
`workspace:` dependency (`workspace:*`, `workspace:^`,
`workspace:1.2.3`) once and reusing it across every project that
declares it, instead of re-resolving it per project.

- Fixed `pnpm install --fix-lockfile` to derive its repair and
filtered-merge views from one lockfile snapshot.

- Load pnpmfile `updateConfig` hooks before packing so hook-provided
catalogs resolve in `pnpm pack`, `pnpm publish`, and `pnpm stage
publish`
[pnpm/pnpm#14377](https://redirect.github.com/pnpm/pnpm/issues/14377).

- `pnpm deploy` no longer requires `injectWorkspacePackages` to be
enabled. A linked workspace dependency is rewritten to a `file:`
dependency in the dedicated deploy lockfile, and the peer dependencies
it declares are bound to the deployed graph's own resolution.

When a peer resolves to more than one version in that graph the binding
is ambiguous, and choosing between the candidates is exactly what
injecting the package would have decided, so the deploy still fails —
now with `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER`, which names the package, the
peer, and the competing versions, instead of refusing every non-injected
workspace up front, and suggests pinning the peer to one version with an
`overrides` entry as the way to keep deploying without injection
[#&#8203;9386](https://redirect.github.com/pnpm/pnpm/issues/9386).

- Fixed global virtual store hashes for dependency cycles. Every package
that transitively depends on an allowed build now includes the engine in
its store path, independent of traversal order
[pnpm/pnpm#14341](https://redirect.github.com/pnpm/pnpm/issues/14341).

- Fixed `ERR_PNPM_CMD_SHIM_CHMOD` when several installs run at once
against a shared global virtual store. One install could remove a
command shim while another was making it executable
([pnpm/pnpm#14353](https://redirect.github.com/pnpm/pnpm/issues/14353)).

- Fixed the PowerShell shim generated by `npm install -g pnpm` on
Windows so it invokes the native `pnpm.exe` binary
[pnpm/pnpm#14362](https://redirect.github.com/pnpm/pnpm/issues/14362).

- Fixed context-aware global shims on WSL2 so native Linux installations
dispatch through the project runtime.

- `pnpm install` no longer writes global `minimumReleaseAgeExclude`
entries to the project's `pnpm-workspace.yaml`
[pnpm/pnpm#14347](https://redirect.github.com/pnpm/pnpm/issues/14347).

- Fixed `catalog:` ranges in workspace package peer dependencies being
reported as unmet
[pnpm/pnpm#14361](https://redirect.github.com/pnpm/pnpm/issues/14361).

- `globalDir` and `globalBinDir` are honored wherever they are set, so
`pnpm add -g` no longer fails with `ERR_PNPM_GLOBAL_BIN_DIR_NOT_IN_PATH`
after `pnpm config set -g global-bin-dir`
[#&#8203;14336](https://redirect.github.com/pnpm/pnpm/issues/14336). The
global `config.yaml` is read again, `PNPM_CONFIG_GLOBAL_DIR` /
`PNPM_CONFIG_GLOBAL_BIN_DIR` reach the directories derived from them,
and a leading `~/` is expanded before that derivation. A project's
`pnpm-workspace.yaml` still cannot set either key.

- Fixed the install progress line reporting `added 0` under `nodeLinker:
hoisted`, even when packages were linked into `node_modules`
[#&#8203;14348](https://redirect.github.com/pnpm/pnpm/issues/14348).

- An auto-installed optional peer is now resolved to a version its
declared peer range accepts, even when the workspace root depends on
that package at a version outside the range. Previously the root's
version was used and then reported as an unmet optional peer
[#&#8203;13867](https://redirect.github.com/pnpm/pnpm/issues/13867).

- Fixed `pnpm run "/pattern/"` running matching scripts one at a time in
a single project. Matching scripts now run concurrently up to
`workspaceConcurrency`, and their output is prefixed so concurrent lines
remain distinguishable [pnpm discussion
14357](https://redirect.github.com/orgs/pnpm/discussions/14357).

- Fixed a slowdown at the end of a resolving install in a large
workspace. The peer-dependency report now inspects only the projects the
resolution flagged, rather than every project in the lockfile
([pnpm/pnpm#14359](https://redirect.github.com/pnpm/pnpm/issues/14359)).

- Speed up workspace discovery for literal directories and conventional
trailing-star patterns.

Workspace patterns now follow the same dot-directory rule as pnpm 11: a
wildcard no longer matches a dot-prefixed directory, so `packages/*` and
`**` skip `packages/.cache` and `.git`. A pattern that names a
dot-prefixed directory still matches it, as `packages/.cache` and
`packages/.*` do.

- `pnpm audit` now ends its output with a trailing newline, including
the `--json`, `--fix`, and `--ignore` output.

- Retry transient Windows file-lock errors while replacing hoisted
packages during installation.
This fixes
[pnpm/pnpm#14349](https://redirect.github.com/pnpm/pnpm/issues/14349).

- Fixed command-line `--side-effects-cache` overrides being ignored when
`pnpm-workspace.yaml` uses the object form of `sideEffectsCache`
[pnpm/pnpm#14338](https://redirect.github.com/pnpm/pnpm/issues/14338).

- Speed up workspace project discovery in large monorepos: workspace
patterns are now probed concurrently and the discovered projects'
`package.json` files are read in parallel
[#&#8203;14352](https://redirect.github.com/pnpm/pnpm/issues/14352).

- Fixed repeated `pnpm dedupe` runs alternating between peer resolutions
when a peer is provided through an npm alias.

- Fixed `pnpm repo <package>` and `pnpm docs <package>` resolving bare
package names through the `latest` tag, and prevented malformed package
ranges from crashing registry selection.

- Fixed non-ASCII characters in configuration values being mangled
during environment-variable substitution. Paths such as `storeDir:
./café-store` are now preserved
[#&#8203;14383](https://redirect.github.com/pnpm/pnpm/issues/14383).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/notion.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/notion_light.svg" />
<img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"
/>
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.1.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.1.0):
pnpm 12.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.0.0...v12.1.0)

#### Minor Changes

- `pnpm login` and `pnpm adduser` now record the granted token in the
global `config.yaml`, under the `_auth` setting, with `--scope`'s scope
routed to that registry under `registries`. `pnpm logout` removes it
from there, and still from an `auth.ini` an earlier version wrote.
Tokens already in `auth.ini` keep working.

- A `scope` set in a project's `pnpm-workspace.yaml` is now ignored,
with a warning naming where to set it instead. `pnpm login` records the
scope as a `@scope:registry` route in the machine-global `auth.ini`,
which outranks `~/.npmrc` in every project — so a repository-committed
file could redirect a scope such as `@acme` for all of a user's other
projects after one routine login. Use `--scope`, the `PNPM_CONFIG_SCOPE`
environment variable, or the global config file instead
[#&#8203;13557](https://redirect.github.com/pnpm/pnpm/issues/13557).

- Verified remote build artifacts are persisted in the shared store with
their signed origin metadata. Later installs reverify the artifact
against current trust, policy, platform, and source before reuse, while
invalid remote variants are quarantined per channel
([pnpm/pnpm#13771](https://redirect.github.com/pnpm/pnpm/issues/13771)).

- Persist completed recursive tasks so `--resume-from` skips exactly the
work that passed during a matching interrupted or failed `pnpm -r run` /
`pnpm -r exec` invocation. When no compatible state exists, pnpm retains
its graph-based resume behavior.

- Workspace install, rebuild, pack, publish, stage, and lifecycle work
now starts as soon as its dependencies finish instead of waiting for an
unrelated topological group.

- Added per-task concurrency limits to workspace task orchestration. Set
`tasks.<name>.concurrency` in `pnpm-workspace.yaml` to limit how many
instances of that task may run across workspace projects at once:

  ```yaml
  tasks:
    build:
      concurrency: 2
  ```

- `sideEffectsCache` now declares the whole of how a package's build
output is reused — whether one is restored, whether one is saved, and
the remote tier tha

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (in timezone Asia/Shanghai)

- Branch creation
  - "before 10am on the first day of the month"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/oxc-project/oxc).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-07 08:06:59 +00:00

21 lines
964 B
JSON
Raw Permalink Blame History

{
"name": "oxc",
"private": true,
"scripts": {
"build": "pnpm --workspace-concurrency=1 --filter \"./napi/*\" --filter \"./apps/*\" --filter \"./packages/*\" build",
"build-dev": "pnpm --workspace-concurrency=1 --filter \"./napi/*\" --filter \"./apps/*\" --filter \"./packages/*\" build-dev",
"build-test": "pnpm --workspace-concurrency=1 --filter \"./napi/*\" --filter \"./apps/*\" --filter \"./packages/*\" build-test",
"build-wasm-dev": "pnpm --workspace-concurrency=1 --filter \"./napi/*\" build-wasm-dev",
"test": "pnpm --workspace-concurrency=1 --filter \"./napi/*\" --filter \"./apps/*\" --filter \"./packages/*\" test",
"fmt": "oxfmt -c oxfmtrc.jsonc",
"lint": "oxlint -c oxlintrc.json --deny-warnings --report-unused-disable-directives"
},
"devDependencies": {
"@napi-rs/cli": "catalog:",
"oxfmt": "^0.66.0",
"oxlint": "^1.66.0",
"oxlint-tsgolint": "7.0.2001"
},
"packageManager": "pnpm@12.3.2"
}
Reference in New Issue View Git Blame Copy Permalink