Skip to content
Snippets Groups Projects

community/pnpm: upgrade to 10.1.0

Merged Fabricio Silva requested to merge fabricionaweb/aports:edge/pnpm into master

10.1.0

Minor Changes

  • Added a new command for printing the list of dependencies with ignored build scripts: pnpm ignored-builds #8963.
  • Added a new command for approving dependencies for running scripts during installation: pnpm approve-builds #8963.
  • Added a new setting called optimistic-repeat-install. When enabled, a fast check will be performed before proceeding to installation. This way a repeat install or an install on a project with everything up-to-date becomes a lot faster. But some edge cases might arise, so we keep it disabled by default for now #8977.
  • Added a new field "pnpm.ignoredBuiltDependencies" for explicitly listing packages that should not be built. When a package is in the list, pnpm will not print an info message about that package not being built #8935.

Patch Changes

  • Verify that the package name is valid when executing the publish command.
  • When running pnpm install, the preprepare and postprepare scripts of the project should be executed #8989.
  • Allow workspace: and catalog: to be part of wider version range in peerDependencies.
  • pnpm deploy should inherit the pnpm object from the root package.json #8991.
  • Make sure that the deletion of a node_modules in a sub-project of a monorepo is detected as out-of-date #8959.
  • Fix infinite loop caused by lifecycle scripts using pnpm to execute other scripts during pnpm install with verify-deps-before-run=install #8954.
  • Replace strip-ansi with the built-in util.stripVTControlCharacters #9009.
  • Do not print patched dependencies as ignored dependencies that require a build #8952.

Read full changelog https://github.com/pnpm/pnpm/releases/tag/v10.1.0


10.0.0

https://github.com/pnpm/pnpm/releases/tag/v10.0.0

Lifecycle scripts of dependencies are not executed during installation by default! This is a breaking change aimed at increasing security. In order to allow lifecycle scripts of specific dependencies, they should be listed in the pnpm.onlyBuiltDependencies field of package.json #8897. For example:

{
  "pnpm": {
    "onlyBuiltDependencies": ["fsevents"]
  }
}

Other breaking changes:

  • The # character is now escaped in directory names within node_modules/.pnpm. Related PR: #8557
  • Running pnpm add --global pnpm or pnpm add --global @pnpm/exe now fails with an error message, directing you to use pnpm self-update instead. Related PR: #8728
  • Dependencies added via a URL now record the final resolved URL in the lockfile, ensuring that any redirects are fully captured. Related Issue: #8833
  • The pnpm deploy command now only works in workspaces that have inject-workspace-packages=true. This limitation is introduced to allow us to create a proper lockfile for the deployed project using the workspace lockfile.
  • Removed conversion from lockfile v6 to v9. If you need v6-to-v9 conversion, use pnpm CLI v9.
  • pnpm test now passes all parameters after the test keyword directly to the underlying script. This matches the behavior of pnpm run test. Previously you needed to use the -- prefix. Related PR: #8619 (closed)

Read full changelog https://github.com/pnpm/pnpm/releases/tag/v10.0.0

Edited by Fabricio Silva

Merge request reports

Loading
Loading

Activity

Filter activity
  • Approvals
  • Assignees & reviewers
  • Comments (from bots)
  • Comments (from users)
  • Commits & branches
  • Edits
  • Labels
  • Lock status
  • Mentions
  • Merge request status
  • Tracking
  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
Please register or sign in to reply
Loading