[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@antfu/eslint-config	9.3.0 → 9.5.1			devDependencies	minor
@rocicorp/zero (source)	1.11.0 → 1.11.3			devDependencies	patch
danielroe/uppt	v0.6.9 → v0.6.12			action	patch
pg (source)	8.23.0 → 8.23.1			devDependencies	patch
playwright-core (source)	1.62.1 → 1.64.1			devDependencies	minor
pnpm (source)	12.9.1 → 12.16.1			devEngines.packageManager	minor
tsdown (source)	0.22.14 → 0.23.4			devDependencies	minor	0.23.5
zod (source)	4.5.4 → 4.6.7			devDependencies	minor

---

Release Notes

antfu/eslint-config (@​antfu/eslint-config)

v9.5.1

Compare Source

   🐞 Bug Fixes

• antislop plugins composition, refactor  -  by @​antfu (a213d)

    View changes on GitHub

v9.5.0

Compare Source

   🚀 Features

• Add antislop option  -  by @​antfubot and @​antfu in #​861 (f6906)

    View changes on GitHub

v9.4.1

Compare Source

   🚀 Features

• pnpm: Enforce new-line style for pnpm-workspace.yaml  -  by @​antfu (ab400)

    View changes on GitHub

v9.4.0

Compare Source

   🚀 Features

• Update plugins jsdoc v64 unicorn v74 e18e v0.8 solid v0.17  -  by @​antfu (33a41)
• pnpm:
  • Enable minimumReleaseAgeExcludePrune by default  -  by @​antfu (9526c)
  • Improve the pnpm workspaces fields ordering  -  by @​antfu (aa64d)

    View changes on GitHub

danielroe/uppt

v0.6.12

Compare Source

compare changes

🚀 Enhancements

• pr: Allow customising release pr title (#​92)
• Support publishing to multiple dist-tags (#​91)
• Add support for custom PR preambles (#​83)

❤️ Contributors

• Joaquín Sánchez (@​userquin)
• Daniel Roe (@​danielroe)

v0.6.11

Compare Source

compare changes

🚀 Enhancements

• Add nightly publishing (#​75)
• Respect hand-edited release pr versions (00ffbe0)
• pr: Run on pushes to release branches (800be04)

🩹 Fixes

• publish: Tolerate E403 when republishing nightlies (3934767)
• pr: Tighten hand-edited version pinning and surface warnings (113eb4c)
• pr: Paginate open release PR lookups and keep updating PRs with extra commits (6ec2714)

💅 Refactors

• Sync lockstep release branches via syncReleaseBranch (c777f2b)

❤️ Contributors

• @​danielroe

v0.6.10

Compare Source

compare changes

🚀 Enhancements

• pr: Treat revert commits as release-worthy (#​70)

🩹 Fixes

• pr,release: Use correct diff link + strip pending timetable line (6959b96)

🏡 Chore

• Pin README example to v0.6.9 (e01133f)
• Add back zizmor-ignore comment (83d5a78)

✅ Tests

• Add some additional tests (d79b75d)

🤖 CI

• Use pnpm/setup and devEngines (#​64)
• Replace agentscan action with the github app (511fe92)

❤️ Contributors

• Daniel Roe (@​danielroe)

brianc/node-postgres (pg)

v8.23.1

Compare Source

microsoft/playwright (playwright-core)

v1.64.1

Compare Source

Bug Fixes

• #​43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #​43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

Compare Source

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');

for (const tool of await page.webmcp.tools())
  console.log(tool.name, tool.description);

const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  use: {
    video: {
      mode: 'on',
      size: { width: 1920, height: 1080 },
      fps: 60,
      show: {
        actions: {
          style: {
            point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
            highlight: 'outline: 2px solid #​333; background: rgba(0, 128, 255, .15)',
            title: 'font-size: 16px',
          },
        },
      },
    },
  },
});

• New fps option in testOptions.video, recordVideo and
  screencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
• New style option takes CSS declarations for the point marker, the target
  highlight and the action title. It replaces the fontSize option, which is now deprecated.
• The cursor stays visible at the last action point, survives navigations and travels along a natural, eased path.
• Videos are encoded with VP9 instead of VP8, which takes less CPU and produces smaller files of the same or better
  quality.
• All video options are also available in Playwright MCP and playwright-cli.

🎯 Test runner

• New testProject.default option keeps a project in the config without running it by default. You can configure every browser you care about, and let a plain npx playwright test run just your favourite one:

  // playwright.config.ts
  import { defineConfig, devices } from '@playwright/test';
  
  export default defineConfig({
    projects: [
      { name: 'chromium', use: devices['Desktop Chrome'] },
      { name: 'firefox', use: devices['Desktop Firefox'], default: false },
      { name: 'webkit', use: devices['Desktop Safari'], default: false },
    ],
  });

  npx playwright test                     # runs chromium only
  npx playwright test --project=firefox   # runs firefox
  npx playwright test --project="*"       # runs all three, for example on CI

• New --shuffle command line option schedules tests in a random order, which helps to find tests that accidentally depend on each other.

  npx playwright test --shuffle
  # Running 42 tests using 4 workers, shuffle seed 271828182
  # ...
  
  # Pass the seed to reproduce the same order.
  npx playwright test --shuffle 271828182

• New lock option in test.describe.configure() adds test locks to all tests in a file or a group:

  test.describe.configure({ lock: 'user-settings' });

• New type option of toHaveScreenshot in testConfig.expect stores all unnamed screenshots as WebP:

  // playwright.config.ts
  export default defineConfig({
    expect: {
      toHaveScreenshot: { type: 'webp' },
    },
  });

🪆 Locator.within()

New locator.within() combines two locators that you already have, reading in the natural order —
"this button, within that dialog":

const saveButton = page.getByRole('button', { name: 'Save' });
const dialog = page.getByTestId('settings-dialog');

await saveButton.within(dialog).click();

Relative locators such as locator.nth() or locator.first() are resolved inside each parent
separately, which makes column-like queries straightforward:

// The third cell of every row, not the third cell in the table.
const thirdColumn = page.getByRole('cell').nth(2).within(page.getByRole('row'));
await expect(thirdColumn).toHaveText(['Apple', 'Banana', 'Cherry']);

New APIs

• New page.getByRef() locates an element by its aria ref, such as e2, reported by page.ariaSnapshot() in the 'ai' mode.

• New option includeShadow in page.content() and frame.content() serializes open shadow roots as declarative shadow DOM.

• New option signCount sets the initial signature counter of a virtual credential. credentials.create() and credentials.get() return the current signCount, and it is saved and restored together with the credentials in the storage state.

• New fullConfig.filteredProjects lists the projects that were selected to run after applying the --project filter. It is available in global setup and reporters.

• New apiRequestContext.addCookies(), apiRequestContext.cookies() and apiRequestContext.clearCookies() manage cookies of a request context, mirroring the BrowserContext methods:

  await request.addCookies([{ name: 'session-id', value: '42', url: 'https://example.com' }]);
  console.log(await request.cookies('https://example.com'));
  await request.clearCookies({ name: 'session-id' });

Breaking changes ⚠️

• screen property is now forwarded from the device descriptors. If you use ...devices['Desktop Chrome'] and alike, window.screen and media queries now see the emulated screen size. You can opt-out by explicitly setting screen to undefined:

  // playwright.config.ts
  export default defineConfig({
    use: {
      ...devices['Desktop Chrome'],
      screen: undefined,
    },
  });

• JSX in your test files now follows your tsconfig.json. Playwright compiles JSX in test files according to the jsx, jsxFactory, jsxFragmentFactory and jsxImportSource tsconfig options, and defaults to the automatic runtime from react/jsx-runtime.

• --update-snapshots=missing now passes the test run. Tests that only create missing snapshots now pass in the 'missing' mode of testConfig.updateSnapshots, so that CI can generate new snapshots and verify the existing ones in a single run. The mode used when the option is not specified is now called 'default' and behaves as before: missing snapshots are written and the test fails.

• Elements inside hidden iframes are considered hidden. Elements inside an iframe that is not visible, for example with visibility: hidden, are now considered hidden by actions, locator.isVisible() and expect(locator).toBeVisible().

Browser Versions

• Chromium 156.0.8078.4
• Mozilla Firefox 157.0
• WebKit 27.2

This version was also tested against the following stable channels:

• Google Chrome 155
• Microsoft Edge 155

v1.63.0

Compare Source

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock.
Tests that share a lock name never run concurrently, across files, workers and projects, while
everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group.
Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the
subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it
matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended
replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments,
and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API
steps, the subtitle is the locator or the navigation url — for example, Click with subtitle getByRole('button').
Both are rendered next to the step title in the trace viewer and the HTML report.

🖼️ Aria and screen snapshots in traces

The snapshots option of tracing.start() and the testOptions.trace fixture option now accept an
object selecting what to capture on every action:

// playwright.config.ts
export default defineConfig({
  use: {
    trace: {
      mode: 'on',
      snapshots: { dom: true, aria: true, screen: true }
    },
  },
});

With aria and screen snapshots recorded, the new Display Aria mode in the trace viewer shows the action screenshot
side by side with the aria snapshot, and hovering an aria node highlights it on the screenshot.

New APIs

Browser and Context

• httpCredentials now also accepts an array of credentials. The first entry matching the request origin is used, and entries without an origin match any request.
• New option opfs includes the origin private file system in the storage state, so it can be persisted and restored into later contexts.
• New events page.on('dialogclosed') and browserContext.on('dialogclosed') are emitted when a JavaScript dialog is accepted, dismissed or closed by the user.

Locators

• New locator.ariaSnapshotJSON() and page.ariaSnapshotJSON() return the aria snapshot as a JSON value instead of YAML markup, with mode, depth and boxes options.
• apiRequestContext.get() and other request methods accept a type argument that types the response json():

const response = await request.get<User>('/api/users/42');
const user = await response.json(); // typed as User

Test runner

• New standalone testOptions.reducedMotion, testOptions.forcedColors and testOptions.contrast options.
• New --add-reporter command line option appends a reporter on top of the ones configured in playwright.config, instead of replacing them like --reporter does.
• New omitTags option for the list, line, dot, github and junit reporters suppresses the tags that are automatically appended to test titles.

Command line

• npx playwright install --no-remove keeps the browsers of other Playwright installations instead of removing them.
• npx playwright codegen --http-credentials records against pages behind HTTP authentication.

Miscellaneous

• New built-in perfetto reporter writes a Trace Event Format file for the Perfetto UI or chrome://tracing, rendering the test run as a timeline with a lane per worker.
• The HTML report renders a duration waterfall next to test steps.

Announcements

• ⚠️ The experimental @playwright/experimental-ct-react, @playwright/experimental-ct-react17 and @playwright/experimental-ct-vue packages will no longer be updated. Follow the migration guide to move to the stories model introduced in 1.62. Story ids passed to fixtures.mount() can now be typed through the generated Stories registry.
• ⚠️ Ubuntu 20.04 is not supported anymore.
• 🐧 On Linux arm64, Playwright now downloads the Chrome for Testing build of Chromium, the same build used on all other platforms.

Browser Versions

• Chromium 153.0.8010.12
• Mozilla Firefox 155.0
• WebKit 26.6

This version was also tested against the following stable channels:

• Google Chrome 153
• Microsoft Edge 153

pnpm/pnpm (pnpm)

v12.16.1: pnpm 12.16.1

Compare Source

This release fixes pnpm install hanging on a cold store in workspaces that install Cargo crates, and pnpm pack shipping a file that files excludes by name.

Patch Changes

• pnpm install no longer hangs on a cold store in a workspace that also installs Cargo crates or a Rust toolchain.

• pnpm pack and pnpm publish now apply a files entry that names a file after the glob and directory entries, as npm does. A file excluded by name, such as !dist/index.js, stays out even when a later dist/** matches it. A file named by its path, such as lib/secret.js, ships even when a later !lib/*.js matches it.

• pnpm install no longer leaves a broken symlink in an injected workspace dependency when the package links to a file outside its published files and pnpm imports by hardlink. Installing a git dependency now skips internal directory symlinks when importing its files into the store.

• pnpm install now relinks a command that a workspace project renames into the projects that depend on it when sharedWorkspaceLockfile is false pnpm/tasks#224.

• pnpm install and pnpm rebuild now refresh privately hoisted .bin shims in node_modules/.pnpm/node_modules/.bin after a dependency build replaces a script target with a native executable #​17402.

• pnpm install now reads a package's manifest to decide its peer dependencies when it updates an existing lockfile, as it does when it resolves from scratch.

• Commands, pnpm --version, pnpm self-update, and invocations with unknown flags now apply the same packageManager and devEngines.packageManager settings when switching to the pinned pnpm version or recording it in pnpm-lock.yaml. --config.<key> flags and lockfileDir now reach the version switch and lockfile sync on every entry point. Unreadable settings in pnpm-workspace.yaml or the global config.yaml that do not affect the pin decision no longer block the version switch pnpm/tasks#222.

• pnpm now accepts the --cache-dir <dir> flag, as in pnpm install --cache-dir /tmp/pnpm-cache #​17422.

• When the version or range given to pnpm unpublish matches every published version, the error now says so and shows the same command with --force. Before, the error suggested running pnpm unpublish <pkg>@<version>, the command that had just failed.

Platinum Sponsors

Gold Sponsors

v12.16.0: pnpm 12.16

Compare Source

This release adds a global --env-file flag, updates to a symlinked pnpm-lock.yaml, and pnpm setup --no-modify-path. It also fixes two security issues, in zstd decompression and in signing.

Minor Changes

• Added a repeatable global --env-file <path> flag to load environment variables from dotenv-style files before running a command. Later files override earlier files, variables already in the environment are preserved, and loaded variables are visible to user-level .npmrc interpolation and lifecycle scripts #​7111.

• pnpm can now update a pnpm-lock.yaml that is a symlink. List the directories the lockfile may link into in the symlinkedLockfileTargetDirs setting, in the global config or with PNPM_CONFIG_SYMLINKED_LOCKFILE_TARGET_DIRS. pnpm writes the update to the file the symlink points to if that file is inside one of these directories. The symlink stays in place. pnpm ignores this setting in pnpm-workspace.yaml #​17222.

• Added a --no-modify-path option to pnpm setup. It installs pnpm without adding it to PATH, leaving the shell config file, the Windows registry, and the GitHub Actions environment files unchanged. pnpm setup then prints the lines to add yourself get.pnpm.io#37.

Patch Changes

Security

• Fixed memory exposure and allocation handling vulnerabilities when processing zstd-compressed data #​17388.

• Signing in pnpm and pnpr no longer uses arithmetic that may leak the private key through timing. This covers shared artifacts, OCI registry tokens, and OIDC login state advisory.

Installing packages

• A dependency symlink that pnpm cannot point at the wanted target now fails the install with an error that names the link. This happens when the filesystem still serves the old link after pnpm removed it, as a node_modules served by a virtual filesystem does. pnpm used to remove the link again without end and crashed with a segmentation fault once the thread ran out of stack.

• Concurrent workspace installs no longer lose store-index rows when initializing the shared SQLite index #​17388.

• Agent skill links now keep the same target across installs when a package version is installed with several sets of peer dependencies. An install no longer fails with ERR_PNPM_AGENT_SKILL_PATH_OCCUPIED on a skill link that pnpm created for another of those copies #​17319.

• pnpm now fails at once, without retrying, when a downloaded package archive contains a rejected entry path #​17205.

• pnpm now builds a git-hosted dependency in every new location it links the dependency into, such as a new global virtual store slot or a fresh node_modules. When the side-effects cache holds the build output, pnpm restores it from there. Before, only the install that fetched the dependency built it. This also fixes dependencies that are already in the store #​17224.

• Changes a preResolution hook makes to the lockfiles now take effect. The hook now also runs when pnpm installs from an up-to-date lockfile. An error thrown by the hook now fails the install.

• A custom fetcher in the pnpmfile can now call fetchers.directory to fetch a package from a local directory. The call rejects with ERR_PNPM_TARBALL_INTEGRITY if the lockfile pins an archive integrity for the package. Previously, calling fetchers.directory failed with a TypeError.

• packageImportMethod: copy now also applies to packages that have lifecycle scripts or patches. On a filesystem that supports block cloning, such as ReFS or a Dev Drive on Windows, these packages were cloned #​17195.

• With nodeLinker: hoisted and autoInstallPeers: false, a package that workspace projects use with different peer versions is now installed once per peer variant, so each project's copy resolves that project's peer #​17395.

• Under nodeLinker: hoisted, pnpm install now leaves a patched package that is already in place alone. The same holds for a package whose peers include a patched package, such as every package peering on a patched react-native #​17188.

• With nodeLinker: hoisted, an install that stops partway no longer leaves the next install trusting the packages it was replacing. Before, reverting the change that started the stopped install, such as a patch edit, kept the half-replaced package in node_modules.

Repeat installs and changed settings

• A repeat pnpm install now acts on a change to these settings. Before, it reported "Already up to date".

  • storeDir or virtualStoreDir: it recreates node_modules.
  • globalVirtualStoreDir: it links the packages from the new directory.
  • virtualStoreDirMaxLength: it renames the virtual store directories.
  • dangerouslyAllowAllBuilds turned on: it runs the builds it skipped.
  • trustLockfile turned off: it verifies the lockfile.

• pnpm add, pnpm remove, and pnpm update now fail if node_modules does not match the current settings. Run pnpm install to recreate it. Previously, these commands removed and reinstalled node_modules without asking. They report:

  • ERR_PNPM_UNEXPECTED_STORE if node_modules was linked from a different store.
  • ERR_PNPM_UNEXPECTED_VIRTUAL_STORE if it was linked from a different virtual store directory.
  • ERR_PNPM_MODULES_BREAKING_CHANGE if it was installed by an incompatible pnpm version, or if node_modules/.modules.yaml cannot be read.
  • ERR_PNPM_NODE_LINKER_DIFF if it was installed with a different nodeLinker.

  pnpm update now also fails with ERR_PNPM_HOIST_PATTERN_DIFF and the other errors pnpm add reports for a changed hoist pattern or virtualStoreDirMaxLength.

• An install filtered to some workspace projects now fails if node_modules was installed with a different nodeLinker, hoistPattern, publicHoistPattern, store, or virtual store. Before, it recreated node_modules and left the projects it skipped without their dependencies. A pnpm install of the whole workspace still recreates node_modules pnpm/tasks#217.

• pnpm install and the verifyDepsBeforeRun check now notice an edited patch file when sharedWorkspaceLockfile is false.

• pnpm install now takes its fast path in a workspace with patchedDependencies when the previous install ran with another major version of pnpm.

• pnpm install now relinks the bins of a workspace package when its bin field changes, including with --frozen-lockfile and an unchanged lockfile. A filtered install relinks them in the selected projects, and the next install that covers the remaining projects relinks them there #​17324.

• pnpm install now removes command shims from node_modules/.bin when a workspace dependency renames or removes an entry from its bin field pnpm/tasks#211.

Resolving dependencies and the lockfile

• A package that a plain range and a <prefix>: specifier both resolve from one registry is now recorded once in pnpm-lock.yaml and installed once. The lockfile key names the registry a package resolved from. When that registry declares a prefix, through prefix in registries or through namedRegistries, the package is keyed <name>@<prefix>:<version> however its dependency was written: with the prefix, as a plain range its scope routes to that registry, or through the default registry. Before, the plain range was keyed <name>@<version>, so one tarball was installed twice and instanceof checks and module singletons broke between the two copies. The same name and version served by two registries still get separate entries. When several prefixes declare one registry, its packages are keyed by the lexicographically smallest prefix.

  If a scope you route reaches a registry that also declares a prefix, your next pnpm install re-keys those entries, which shows up as a lockfile diff. Commit it. pnpm install --frozen-lockfile installs the lockfile as recorded.

• pnpm install now resolves a scope's packages again when the scope is routed to another registry in registries. Before, the lockfile kept the versions and integrity resolved from the old registry, so the install failed when the new registry did not serve a locked version or served different content. pnpm records in the workspace state which registry each scope routed to, so a fresh clone without that record installs the lockfile as recorded. Changing the default registry resolves nothing again, and pnpm install --frozen-lockfile is unchanged.

• When autoDedupe is off, a workspace project's dependencies now resolve from its own ranges, like they do with sharedWorkspaceLockfile: false. Previously, another project's narrower range could hold them back. For example, ajv: "*" now resolves to the latest Ajv even if another project depends on ajv@^6. Packages that a project lists in peerDependencies still follow the versions other projects use. pnpm dedupe and installs with autoDedupe: true still pick one version that satisfies every range. Set autoDedupe: true if CI runs pnpm dedupe --check #​17235.

• An optional dependency written with a named-registry prefix, such as work:^1.0.0, now fails the install when it cannot be resolved but the lockfile already has a matching entry from that registry. Such a dependency was skipped, which removed its entries from the lockfile.

• With injectWorkspacePackages: true, a workspace: dependency written as a relative path, such as workspace:../lib-a, in a workspace package now resolves from that package's directory #​17284.

• Fixed pnpm install failing with ERR_PNPM_UNSUPPORTED_PROTOCOL when a workspace package injected through a relative path, such as workspace:../lib, has catalog: dependencies. Their catalog entries now resolve the way they do for a package injected by name #​17280.

• pnpm dedupe now refreshes cached registry metadata while re-resolving locked versions #​17208.

• pnpm dedupe --check no longer fails when the only difference is a deprecated notice that the registry added or removed after the lockfile was written #​17198.

• Installs delegated to a pnpr server now resolve every prefix declared for a registry URL. A dependency or lockfile entry that used the second of two prefixes for the same registry, such as zeta: next to work: in namedRegistries, failed on the server pnpm/tasks#204.

• Registry revisions are now addressed at <registry>/<name>@<version>+r<revision> pnpm/tasks#208.

Adding packages and global packages

• pnpm add <pkg>@<tag> and pnpm add <pkg>@<range> now install the version the tag or range resolves to, even when the saved range allows a newer one #​17234.

• pnpm add <pkg> without a version now installs the version under the dist-tag set by the tag setting. An npm: alias or a jsr: dependency without a version resolves that tag too. The setting is read from pnpm-workspace.yaml, the global config, PNPM_CONFIG_TAG, and --config.tag, and defaults to latest.

• pnpm add now accepts the lowercase short options -p, -d, -o, and -e as aliases of --save-prod, --save-dev, --save-optional, and --save-exact.

• pnpm -D install <pkg> now saves the package to devDependencies. An add option such as -D or -E written before install <pkg> was rejected as an unexpected argument.

• pnpm add -T now reports that the short option is ambiguous and points to --save-types and --tilde.

• Global packages installed with pnpm add -g are now linked from the global virtual store, so global packages that share dependencies share one copy. Set virtualStoreType: project to give each global install its own virtual store.

• pnpm add -g and the other --global commands now fail with ERR_PNPM_CONFIG_CONFLICT_VIRTUAL_STORE_DIR_WITH_GLOBAL when --virtual-store-dir is passed. A custom --hoist-pattern fails with ERR_PNPM_CONFIG_CONFLICT_HOIST_PATTERN_WITH_GLOBAL. Passing --link-workspace-packages, --shared-workspace-lockfile, or --config.lockfile-dir with --global also fails, with the matching ERR_PNPM_CONFIG_CONFLICT_*_WITH_GLOBAL code.

Registries, proxies, and login

• pnpm now reads the strictSsl and localAddress settings from pnpm-workspace.yaml, the global config.yaml, PNPM_CONFIG_* environment variables, and --config.* options. This includes pnpm self-update and the download of the pnpm version pinned in packageManager. Before, pnpm read them only from .npmrc as strict-ssl and local-address and ignored the other sources pnpm/tasks#201.

• When Corepack runs pnpm and the native binary has to be downloaded, the download now uses the proxy from pnpm's config. That proxy comes from PNPM_CONFIG_HTTPS_PROXY and the matching variables, the global config.yaml, and the user .npmrc. Previously, the download read the proxy only from HTTPS_PROXY, HTTP_PROXY, and NO_PROXY pnpm/tasks#215.

• When the pnpm package downloads its native binary on first run, as it does under Corepack, it now trusts the CA certificates from the ca, ca[], and cafile settings of .npmrc, including the ones scoped to the registry. A registry behind a private CA failed with fetch failed before, unless NODE_EXTRA_CA_CERTS named the CA. A project .npmrc is used only while the download is checked against npm's signature. Node.js versions that cannot add CA certificates after startup still need NODE_EXTRA_CA_CERTS.

• pnpm login saves the token in <pnpm config>/auth.ini again. Since v12.1.0, an unscoped login had made its registry the default for every project that did not name a registry. A login now also removes the token an earlier login saved for that registry or scope under _auth in the global config.yaml. pnpm login --scope still routes the scope through the global registries setting.

• pnpm no longer warns that a registries entry routed through the @ scope matches no configured registry. pnpm applied such an entry and its options such as serverType while reporting it as ignored pnpm/tasks#184.

Running scripts and other commands

• pnpm ci --lockfile and pnpm ci --config.lockfile=true no longer delete pnpm-lock.yaml. pnpm ci now always keeps the lockfile and runs a frozen install from it.

• pnpm deploy --legacy now checks the workspace lockfile against minimumReleaseAge and the other resolution policies, as pnpm install does, and fails with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION when a locked version is too new. It used to deploy an older version that is not in the lockfile without a warning #​17209.

• pnpm deploy now keeps a deployed symlink to a directory inside the project even if the directory is not among the deployed files, such as a link into node_modules #​17288.

• pnpm pack and pnpm publish now keep pnpm.config in the published package.json. They also always include the file pnpm.config points to in the tarball #​17210.

• pnpm -r publish --batch now sends PUT /-/pnpr/v0/publish, the batch publish endpoint that pnpr serves.

• pnpm audit --ignore and pnpm audit --ignore-unfixable now exit with a non-zero code when vulnerabilities at or above the audit level remain after ignoring. Before, these commands always exited with code 0.

• pnpm audit --fix and pnpm audit --interactive now fail with ERR_PNPM_AUDIT_FIX_WITH_IGNORE when combined with --ignore or --ignore-unfixable. Before, the fix ran and the ignore flags had no effect.

• pnpm -r run <script> now honors the requiredScripts setting from pnpm-workspace.yaml. If the script is listed there and a selected project does not define it, the run fails with ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT and names the projects that lack it.

• pnpm run and pnpm exec no longer report the dependencies as out of date after a lockfile change when dedupePeers is true #​17322.

• On macOS, killing pnpm while it runs scripts in several projects at once now ends every one of those scripts. Before, a script could keep running after pnpm died.

• pnpm run, pnpm exec, and pnpm dlx no longer dump a core file for pnpm itself when a command they started dies from a signal #​17204.

• The runtime setting is now read. Setting runtime: false in pnpm-workspace.yaml, pnpm_config_runtime=false, or --config.runtime=false stops pnpm install, pnpm add, pnpm dedupe, and the other installing commands from installing the runtimes in devEngines.runtime and engines.runtime. pnpm dedupe now also accepts --no-runtime.

• Directory selectors with legacyDirFiltering: true now include the project in the named directory along with its descendants. Excluding a directory also excludes that project pnpm/tasks#196.

• pnpm help --all and pnpm help -a now print the full list of commands. They used to fail with an "unrecognized subcommand" error.

• Reading the file-creation mask on Linux no longer sets it. pnpm had to replace the mask to learn what it was, and a file another thread created in the window between the two calls was created unmasked.

• pnpm now passes an interrupt on to the handler it replaced, with the arguments that handler expects. A handler that asked for the signal's details was called without them. Only a program that embeds pnpm and installs its own SIGINT, SIGTERM or SIGHUP handler was affected.

Store

• pnpm store prune now keeps the packages that a project still uses when pnpm copied or cloned them into node_modules. These include patched packages, built packages, and every package installed with packageImportMethod: copy. Before, the prune removed them, and the next install downloaded them again #​7192.

• pnpm store prune now keeps the packages of a project when the store path reaches its directory through a symlink. Previously, prune dropped such a project from its list and removed the packages only that project used from the global virtual store.

• pnpm store prune now removes the package metadata cache, the metadata* directories in the cache directory. This clears the outdated integrity checksums that cause ERR_PNPM_TARBALL_INTEGRITY when a registry republishes a version.

Speed

• pnpm install resolves dependencies faster in large workspaces on Linux, macOS, and Windows on x64 and arm64.

• Sped up cold installs and pnpm fetch on macOS. pnpm now links downloaded packages into the virtual store on a separate thread, so a slow link pass no longer pauses the downloads that are still in flight #​17271.

• Sped up installs that add new projects to a workspace with a peer-heavy lockfile. pnpm now reads the lockfile's locked peer versions once for all new projects #​17311.

• Warm installs no longer read the package.json of every git-hosted dependency. pnpm now stores the manifest of a git-hosted package in the store index when it fetches the package.

• pnpm update --depth <n> with a large n, such as the --depth=9999 that update-browserslist-db runs, now finishes as fast as --depth Infinity. It used memory and stack in proportion to n on lockfiles with depend

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coldtea-pr-lens]

◈ PR Lens

Note

This drawing shows 7fca7b7, and the branch has new commits since. Tick Redraw to draw the latest one

• Redraw

🟢 +0 new · 🟠 ~1 changed · 🔴 -0 removed · 0 flows · 1 file · commit 7fca7b7

Architecture

1 component touched across 2 lanes.

Open the interactive canvas

Data flow

No data-flow sequence changed in this PR.

View

• Architecture lens
• Data flow lens
• Expand every detail

Tip

Run npx skills add coldteadotai/pr-lens, then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."

🪧 More tips

• Run npx @coldtea/pr-lens-cli analyze --base origin/main on a branch, then npx @coldtea/pr-lens-cli render .pr-lens/graph.json. Same lenses, your own model key, before the pull request exists.
• Untick Architecture lens or Data flow lens under View to hide a diagram, or tick Expand every detail to open every section. The comment redraws in a few seconds.
• Click the link under each diagram to open it on a canvas you can zoom, pan and step through.
• The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change.
• Open a diagram on the canvas, then press W or click play to walk through the change one step at a time.
• The CLI's render reads .github/pr-lens.yml and applies your renames, exclusions and lane pins at draw time.
• Set github.comment.collapsed: true in .github/pr-lens.yml to fold the comment behind one View architecture and data flow row. Drawing still runs on every push.
• Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and your model provider's key as its api-key to run PR Lens from your own CI. Any /chat/completions endpoint works.
• Push a commit and the comment redraws for the new head. A slow older run never overwrites a newer one.
• Switch GitHub to dark mode and the diagrams follow. The moving dots are this pull request's data in motion.

---

Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords: 1

• chore(deps)

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4f26a3d0-49f3-4124-8b87-43561389a339

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Error: ERR_PNPM_NO_MATCHING_VERSION

  × installing dependencies
  ├─▶ Failed to resolve dependency tree: No matching version found for @nuxt/
  │   schema@npm:@nuxt/schema-nightly@5.0.0-2611021341-1acc301 while fetching
  │   it from https://registry.npmjs.org/
  │   
  │   Failed to resolve @nuxt/schema@npm:@nuxt/schema-nightly@5.0.0-
  │   2611021341-1acc301
  │   This error happened while installing the dependencies of nuxt-
  │   nightly@5.0.0-2611021341-1acc301
  ╰─▶ No matching version found for @nuxt/schema@npm:@nuxt/schema-
      nightly@5.0.0-2611021341-1acc301 while fetching it from https://
      registry.npmjs.org/
  help: The latest release of @nuxt/schema-nightly is "4.6.0-
        29853280.6c7f9fd4". Published at 10/5/2026
        
        Other releases are:
          * 3x: 3.21.11-29765736.81f86ac5 published at 8/5/2026
          * 4x: 4.6.3-2610271557-6bc4a52 published at 10/27/2026
          * 5x: 5.0.0-2611010234-c709ec8 published at 11/1/2026
          * pr-22649: 3.9.0-28354214.15a5e77d published at 11/29/2023
          * pr-23368: 3.10.0-28412264.57594fa2 published at 1/8/2024
          * pr-24010: 3.9.0-28378645.e9794ea0 published at 12/16/2023
          * pr-24787: 3.9.0-28378659.75a82c63 published at 12/16/2023
          * pr-24894: 3.10.0-28404855.4f7de5af published at 1/3/2024
          * pr-24922: 3.10.0-28394973.15b95165 published at 12/27/2023
          * pr-24960: 3.9.2-28423518.40bfb173 published at 1/16/2024
          * pr-25071: 3.10.0-28425618.d0e71656 published at 1/18/2024
          * pr-25210: 3.10.0-28422040.922a0429 published at 1/15/2024
          * pr-25770: 3.10.2-28463758.ae976d69 published at 2/13/2024
          * pr-25936: 3.11.0-28508900.dcd73d30 published at 3/15/2024
          * pr-26085: 3.11.0-28494221.a1f9ca9e published at 3/5/2024
          * pr-26928: 3.12.0-28567604.d4b61ffd published at 4/25/2024
          * pr-27037: 3.12.0-28577690.5048d11c published at 5/2/2024
        
        If you need the full list of all 4243 published versions run "pnpm
        view @nuxt/schema-nightly versions".