Aller au contenu
verdict:

pnpm 11.28.3

digest

Notes de version

note: la synthèse et les notes de version sont en anglais

note: pas de synthèse pour cette release digest

Les releases digest sont listées sans synthèse. Les notes de version originales de cette version sont ci-dessous.

release-notesgithub.com/pnpm/pnpm · 192 lignes
  1. pnpm 11.28.3 updates `undici` to clear a security advisory, fixes "database disk image is malformed" errors when several pnpm processes share a store, and makes packages, catalogs, projects, and commands named like `constructor` work.
  3. ### Patch Changes
  5. #### Installing packages
  7. * pnpm now ships `undici` 7.29.1, so security scans of pnpm no longer report [GHSA-3wwx-pv8p-q78v](https://github.com/advisories/GHSA-3wwx-pv8p-q78v).
  9. * pnpm no longer fails with "database disk image is malformed" or reads stale store entries while another pnpm process writes to the same store.
  11. * Names that match built-in JavaScript object properties, such as `constructor`, `toString`, or `__proto__`, now work like any other name. pnpm crashed, wrote a wrong lockfile, or silently skipped such names in:
  13. * `pnpm add`, `pnpm install`, and `pnpm import`, for dependencies, peer dependencies, and `file:` dependencies that point to a directory named `constructor`.
  14. * Catalog entries and catalog names. Pruning unused entries crashed, and a new catalog named `toString` was not written.
  15. * Workspace projects, project directories, and files inside injected packages.
  16. * Registry prefixes and override version references such as `$toString`.
  17. * Hoisting, `pnpm list`, and `pnpm why`.
  18. * Command names. `pnpm constructor` runs the `constructor` script like any other unknown command, and `pnpm help constructor` no longer crashes.
  19. * Resolving through a pnpr server when a project lives in a directory named `constructor`.
  21. * `pnpm install` no longer re-resolves an up-to-date lockfile on every run when a patched package is a peer in a peer cycle [#16418](https://github.com/pnpm/pnpm/issues/16418).
  23. * POSIX bin shims and the `pnpm`, `pn`, `pnpx`, and `pnx` launchers now run inside a Nix build, where the system default path holds none of the utilities they call. Installing again replaces the shims already in `node_modules` [#16377](https://github.com/pnpm/pnpm/issues/16377).
  25. * In a project that pins another pnpm version, pnpm now passes a command with an option it does not know to the pinned version. Before, `pnpm install --auto-dedupe` failed with "Unknown option" even though the pinned pnpm supports it [#16353](https://github.com/pnpm/pnpm/issues/16353).
  27. * pnpm now fails with `ERR_PNPM_INVALID_ALLOW_BUILDS` when `allowBuilds` is not an object or one of its values is not `true`, `false`, or a string. Such values used to be ignored silently.
  29. * Removing a dependency whose bins are declared through `directories.bin` no longer leaves broken shims in `node_modules/.bin`.
  31. * A custom resolver's `shouldRefreshResolution` hook that rejects no longer crashes pnpm with an unhandled rejection when another hook has already asked for a refresh.
  33. #### Updating dependencies
  35. * When `minimumReleaseAge` hides the version that `latest` points to, pnpm now falls back to a prerelease of the same major before a stable version of an older major. A stable version of the same major is still preferred. For example, while a new `1.0.0` is too new, pnpm picks `1.0.0-beta.4` rather than an old `0.0.1` [#16388](https://github.com/pnpm/pnpm/issues/16388).
  37. * `pnpm --filter <project> update <pkg>` now fails with `ERR_PNPM_NO_PACKAGE_IN_DEPENDENCIES` when the selected projects do not depend on `<pkg>`, also in a workspace with a shared lockfile and a root project. It used to exit successfully.
  39. * `pnpm audit --fix` now updates vulnerable packages in a single project that sets `updateConfig.ignoreDependencies`. It used to leave them on the vulnerable version.
  41. * `pnpm update --global` now removes hard-linked executables from `PNPM_HOME` when migrating packages from the old global layout [#16420](https://github.com/pnpm/pnpm/issues/16420).
  43. * Updating a pinned GitHub Action now rewrites the version in its `# vX.Y.Z` comment even when the action name contains the same version text. The action name used to change while the comment kept the old version.
  45. #### Workspaces and deploy
  47. * `pnpm deploy` no longer fails with `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER` in a workspace with `injectWorkspacePackages: true` when a workspace package also lists its peer dependency as a dev dependency [#16375](https://github.com/pnpm/pnpm/issues/16375).
  49. * `pnpm deploy` no longer copies the workspace root's `packageManager` and `devEngines.packageManager` fields into the deployed `package.json` [#16403](https://github.com/pnpm/pnpm/issues/16403).
  51. * `--filter` fixes:
  53. * A `...pkg...` selector combined with another dependents selector, such as `--filter ...a --filter ...b...`, no longer adds the dependencies of the other selector's dependents.
  54. * `--filter "[<since>]"` now detects changes in projects whose directory names contain non-ASCII characters. The change used to be credited to the parent project.
  56. #### Running scripts
  58. * After relaying a signal to a script, pnpm keeps waiting for a process in the script's process group whose main thread has exited while its other threads still run. Linux reports such a process as a zombie, so the wait used to end before those threads finished [pnpm/tasks#56](https://github.com/pnpm/tasks/issues/56).
  60. * A lifecycle script run with `unsafePerm: false` now fails with an error when pnpm cannot create `node_modules/.tmp`. It used to hang.
  62. * `pnpm run` with `verifyDepsBeforeRun` no longer crashes with an unhandled rejection when a lockfile it did not need to compare fails to load.
  64. * `pnpm run -r` now closes the collapsible CI log section of a project whose script fails, so the output of later projects is no longer nested inside it.
  66. * `pnpm run --resume-from` no longer crashes when a saved run state file contains `null`.
  68. #### Store
  70. * `pnpm store prune` now removes the packages that only expired `pnpm dlx` cache entries used, as long as the store still has another registered project. They used to stay until the next `pnpm store prune` [#16383](https://github.com/pnpm/pnpm/discussions/16383).
  72. * `pnpm store prune` now stops with an error when it cannot read a project directory for a reason other than the directory missing, such as a permission error. It used to skip the directory.
  74. #### Publishing and registry output
  76. * `pnpm publish` now includes bare `README` files and README files with Markdown extensions such as `readme.markdown` in registry metadata [#12704](https://github.com/pnpm/pnpm/issues/12704).
  78. * `pnpm pack-app` now accepts an entry file or output directory inside the project whose name starts with two dots, such as `..build/entry.cjs`. It used to fail with `ERR_PNPM_PACK_APP_ENTRY_OUTSIDE_PROJECT`.
  80. * Registry error messages now always say "(response body truncated)" when pnpm cut the response body short. The marker was missing when the body was cut at exactly 64 KiB.
  82. <!-- sponsors -->
  84. ## Platinum Sponsors
  86. <table>
  87. <tbody>
  88. <tr>
  89. <td align="center" valign="middle">
  90. <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
  91. </td>
  92. <td align="center" valign="middle">
  93. <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  94. <picture>
  95. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" />
  96. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" />
  97. <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" />
  98. </picture>
  99. </a>
  100. </td>
  101. <td align="center" valign="middle">
  102. <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
  103. </td>
  104. </tr>
  105. <tr>
  106. <td align="center" valign="middle">
  107. <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  108. <picture>
  109. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" />
  110. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
  111. <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" />
  112. </picture>
  113. </a>
  114. </td>
  115. </tr>
  116. </tbody>
  117. </table>
  119. ## Gold Sponsors
  121. <table>
  122. <tbody>
  123. <tr>
  124. <td align="center" valign="middle">
  125. <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  126. <picture>
  127. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" />
  128. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" />
  129. <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" />
  130. </picture>
  131. </a>
  132. </td>
  133. <td align="center" valign="middle">
  134. <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  135. <picture>
  136. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" />
  137. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" />
  138. <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" />
  139. </picture>
  140. </a>
  141. </td>
  142. <td align="center" valign="middle">
  143. <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
  144. </td>
  145. </tr>
  146. <tr>
  147. <td align="center" valign="middle">
  148. <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  149. <picture>
  150. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
  151. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" />
  152. <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" />
  153. </picture>
  154. </a>
  155. </td>
  156. <td align="center" valign="middle">
  157. <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  158. <picture>
  159. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" />
  160. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
  161. <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" />
  162. </picture>
  163. </a>
  164. </td>
  165. <td align="center" valign="middle">
  166. <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  167. <picture>
  168. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" />
  169. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" />
  170. <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" />
  171. </picture>
  172. </a>
  173. </td>
  174. </tr>
  175. <tr>
  176. <td align="center" valign="middle">
  177. <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer">
  178. <picture>
  179. <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" />
  180. <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" />
  181. <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
  182. </picture>
  183. </a>
  184. </td>
  185. <td align="center" valign="middle">
  186. <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a>
  187. </td>
  188. </tr>
  189. </tbody>
  190. </table>
  192. <!-- sponsors end -->

voir sur githubdetected 2026-10-01 via npm