chore(deps): update pnpm to v8 #149
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.21.0->8.1.0Release Notes
pnpm/pnpm
v8.1.0Compare Source
Minor Changes
dedupe-direct-deps, which is disabled by default. When set totrue, dependencies that are already symlinked to the rootnode_modulesdirectory of the workspace will not be symlinked to subprojectnode_modulesdirectories. This feature was enabled by default in v8.0.0 but caused issues, so it's best to disable it by default #6299.ignore-workspace-cyclesto silence workspace cycle warning #6308.Patch Changes
Our Gold Sponsors
Our Silver Sponsors
v8.0.0Compare Source
We are excited to announce the latest release of pnpm! To install it, check the installation page.
Major Changes
Node.js 14 Support Discontinued
If you still require Node.js 14, don't worry. We ship pnpm bundled with Node.js. This means that regardless of which Node.js version you've installed, pnpm will operate using the necessary Node.js runtime. For this to work you need to install pnpm either using the standalone script or install the
@pnpm/exepackage.Configuration Updates
auto-install-peers: enabled by default.dedupe-peer-dependents: enabled by default.resolve-peers-from-workspace-root: enabled by default.save-workspace-protocol: set torollingby default.resolution-mode: set tolowest-directby default.publishConfig.linkDirectory: enabled by default.Most of the configuration changes are related to peer dependencies. Most of these settings were implemented long ago, and we recommended them to users encountering peer dependency issues. The recently added
dedupe-peer-dependentsresolved many such problems. With these new defaults, pnpm will face significantly fewer issues during migration from other package managers.Lockfile Modifications
importerssection. The newpnpm-lock.yamlfile is more resistant to git merge conflicts!resolutionobject inpnpm-lock.yaml.Other Changes
filesfield in thepackage.json, only the files that are listed in it will be deployed. The same logic is applied when injecting packages. This behaviour can be changed by setting thedeploy-all-filessetting totrue(Related issue #5911).Migration Instructions
Before updating pnpm to v8 in your CI, regenerate your
pnpm-lock.yaml. To upgrade your lockfile, runpnpm installand commit the changes. Existing dependencies will not be updated; however, due to configuration changes in pnpm v8, some missing peer dependencies may be added to the lockfile and some packages may get deduplicated.You can commit the new lockfile even before upgrading Node.js in the CI, as pnpm v7 already supports the new lockfile format.
pnpm v7 Support
pnpm v7 will likely not receive any new features, but it will continue to get bug fixes for a few months and vulnerability fixes for at least a year.
Our Gold Sponsors
Our Silver Sponsors
v7.30.5Compare Source
Patch Changes
pnpm auditshould work even if there are nopackage.jsonfile, just apnpm-lock.yamlfile.dedupe-peer-dependentsistrue#6154.Our Gold Sponsors
Our Silver Sponsors
v7.30.4Compare Source
v7.30.3Compare Source
Patch Changes
Our Gold Sponsors
Our Silver Sponsors
v7.30.2Compare Source
v7.30.1Compare Source
Patch Changes
pnpm-lock.yamlfile if it has no changes andpnpm install --frozen-lockfilewas executed #6158.git+sshthat use semver selectors #6239.pnpm auditoutput #6203Our Gold Sponsors
Our Silver Sponsors
v7.30.0Compare Source
Minor Changes
patches-dirsetting #6215Patch Changes
Our Gold Sponsors
Our Silver Sponsors
v7.29.3Compare Source
Patch Changes
node_modules/.pnpm/node_modulesdirectory through theNODE_PATHenv variable, then the command's ownnode_modulesdirectory #5176.extend-node-pathis set back totrueby default. It was set tofalsein v7.29.2 in order to fix issues with multiple versions of Jest in one workspace. It has caused other issues, so now we keep extendingNODE_PATH. We have fixed the Jest issue with a different solution #6213.Our Gold Sponsors
Our Silver Sponsors
v7.29.2Compare Source
v7.29.1Compare Source
Patch Changes
Our Gold Sponsors
Our Silver Sponsors
v7.29.0Compare Source
Minor Changes
A new setting is now supported:
dedupe-peer-dependents.When this setting is set to
true, packages with peer dependencies will be deduplicated after peers resolution.For instance, let's say we have a workspace with two projects and both of them have
webpackin their dependencies.webpackhasesbuildin its optional peer dependencies, and one of the projects hasesbuildin its dependencies. In this case, pnpm will link two instances ofwebpackto thenode_modules/.pnpmdirectory: one withesbuildand another one without it:This makes sense because
webpackis used in two projects, and one of the projects doesn't haveesbuild, so the two projects cannot share the same instance ofwebpack. However, this is not what most developers expect, especially since in a hoistednode_modules, there would only be one instance ofwebpack. Therefore, you may now use thededupe-peer-dependentssetting to deduplicatewebpackwhen it has no conflicting peer dependencies (explanation at the end). In this case, if we setdedupe-peer-dependentstotrue, both projects will use the samewebpackinstance, which is the one that hasesbuildresolved:What are conflicting peer dependencies? By conflicting peer dependencies we mean a scenario like the following one:
In this case, we cannot dedupe
webpackaswebpackhasreactin its peer dependencies andreactis resolved from two different versions in the context of the two projects.Patch Changes
The configuration added by
pnpm setupshould check if the pnpm home directory is already in the PATH before adding to the PATH.Before this change, this code was added to the shell:
Now this will be added:
Add
skippedstatus in exec report summary when script is missing #6139.pnpm env -gshould fail with a meaningful error message if pnpm cannot find the pnpm home directory, which is the directory into which Node.js is installed.Should not throw an error when local dependency use file protocol #6115.
Fix the incorrect error block when subproject has been patched #6183
Our Gold Sponsors
Our Silver Sponsors
v7.28.0Compare Source
Minor Changes
--report-summaryforpnpm execandpnpm run#6008.pnpm why --jsonor--long#6103.pnpm.peerDependencyRules.allowedVersionspackage.jsonoption to support theparent>childselector syntax. This syntax allows for extending specificpeerDependencies#6108.Patch Changes
peerDependenciesMetaand notpeerDependencies,dependencies, oroptionalDependencies, the dependency's peers were not considered deterministically before.patch-commitshould auto apply patches in workspaces #6048pnpm config setshould write to the global config file by default #5877.Our Gold Sponsors
Our Silver Sponsors
v7.27.1Compare Source
Patch Changes
store pathdescription to thepnpmcli help.pnpm store prune, when a tarball integrity error happens.strict-ssl,ca,key, andcertsettings should work with HTTPS proxy servers #4689.Our Gold Sponsors
Our Silver Sponsors
v7.27.0Compare Source
Minor Changes
resolution-modeadded:lowest-direct. With this resolution mode direct dependencies will be resolved to their lowest versions. So if there isfoo@^1.1.0in the dependencies, then1.1.0will be installed, even if the latest version offoois1.2.0.pnpm run /build:.*/and execute the matched scripts with the RegExp #5871.Patch Changes
Fix version number replacing for namespaced workspace packages.
workspace:@​foo/bar@*should be replaced withnpm:@​foo/bar@<version>on publish #6052.When resolving dependencies, prefer versions that are already used in the root of the project. This is important to minimize the number of packages that will be nested during hoisting #6054.
Deduplicate direct dependencies.
Let's say there are two projects in the workspace that dependend on
foo. One project hasfoo@1.0.0in the dependencies while another one hasfoo@^1.0.0in the dependencies. In this case,foo@1.0.0should be installed to both projects as satisfies the version specs of both projects.Use Map rather than Object in
createPackageExtenderto prevent read the prototype property to native functionOur Gold Sponsors
Our Silver Sponsors
v7.26.3Compare Source
Patch Changes
pnpm-lock.yamllockfile format #5976.Our Gold Sponsors
Our Silver Sponsors
v7.26.2Compare Source
Patch Changes
pnpm auditoutput for better readability #5981node-linkeris set tohoisted#5992.Our Gold Sponsors
Configuration
📅 Schedule: Branch creation - "before 6pm on Friday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.