Update all non-major dependencies #52

Open

dependathot wants to merge 1 commit from renovate/all-minor-patch into main

pull from: renovate/all-minor-patch

merge into: calltheory:main

calltheory:main

calltheory:renovate/major-tailwindcss-monorepo

calltheory:renovate/spatie-laravel-permission-8.x

calltheory:feat/vke-call-path

calltheory:ci/release-secret-scan

calltheory:fix/image-tag-defaults-to-chart-version

calltheory:fix/cosign-installer-envsubst

Conversation 0 Commits 1 Files changed 3 +155 -154

dependathot commented 2026-10-09 09:02:11 +00:00

Member

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
concurrently	10.0.5 → 10.0.6
filament/filament (source)	5.10.0 → 5.10.1
laravel-echo (source)	2.5.0 → 2.6.1
pnpm (source)	12.10.1 → 12.11.2
predis/predis	3.6.1 → 3.7.0
sentry/sentry-laravel (source)	4.28.0 → 4.29.0
vite (source)	8.3.3 → 8.3.4
wavesurfer.js (source)	8.0.1 → 8.0.2

---

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

open-cli-tools/concurrently (concurrently)

v10.0.6

Compare Source

What's Changed

• docs: update issue link to the transferred repo path by @​yzxcj797 in #​609
• docs: update API example to ESM by @​Bibin-VR in #​611
• fix: skip force-kill logging when no processes remain by @​imshunsuke in #​616
• deps: update shell-quote to 1.12.0 by @​Abicodexi and @​Mayvis in #​622

New Contributors

• @​yzxcj797 made their first contribution in #​609
• @​Bibin-VR made their first contribution in #​611
• @​imshunsuke made their first contribution in #​616
• @​Abicodexi made their first contribution in #​622

Full Changelog: https://github.com/open-cli-tools/concurrently/compare/v10.0.5...v10.0.6

filamentphp/panels (filament/filament)

v5.10.1

Compare Source

laravel/echo (laravel-echo)

v2.6.1

Compare Source

What's Changed

• pnpm audit fixes by @​joetannenbaum in #​558

Full Changelog: https://github.com/laravel/echo/compare/v2.6.0...v2.6.1

pnpm/pnpm (pnpm)

v12.11.2: pnpm 12.11.2

Compare Source

This release fixes --workspace-concurrency=Infinity, filters set by an updateConfig hook, and store fetches with enable-modules-dir=false.

Patch Changes

• --workspace-concurrency=Infinity now runs workspace projects with no concurrency limit. It used to fail with invalid digit found in string #​16793.

• pnpm install and other recursive commands now apply the filter and filterProd that an updateConfig hook sets. They used to run on every workspace project #​16792.

• enable-modules-dir=false now also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists.

Platinum Sponsors

Gold Sponsors

v12.11.1: pnpm 12.11.1

Compare Source

This release fixes two ways pnpm install could fail, runs tools of any Rust release through pnx, and treats registry.npmjs.com as an alias of the npm registry.

Patch Changes

• pnpm install no longer fails when packageManager pins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it.

• pnpm install no longer fails with ERR_PNPM_CMD_SHIM_CHMOD when node_modules/.bin holds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout.

• enable-modules-dir=false (enableModulesDir: false through the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing under node_modules. The setting exists for a node_modules that something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain --lockfile-only run still fetches nothing.

• pnpm pack and pnpm publish no longer put .npmignore and .gitignore files in the tarball. A files entry that names one still ships it.

• pnpm now treats https://registry.npmjs.com/ as an alias of https://registry.npmjs.org/. Registry requests, credentials, and trusted publishing use the canonical hostname.

• pnx --package=rust@<channel> <tool> runs a tool of that Rust release, for example pnx --package=rust@nightly-2026-01-01 cargo build. pnpm installs the release with the components and targets from rust-toolchain.toml and the target of each --target argument.

• pnpm install now links agent skills for more coding agents. It detects the agent from ANTIGRAVITY_AGENT, COPILOT_AGENT, COPILOT_CLI, CODEX_THREAD_ID, CODEX_SANDBOX, AI_AGENT, and CLAUDE_CODE pnpm/tasks#116.

• When the registry rejects pnpm stage publish, the error message now starts with "Failed to stage package".

Platinum Sponsors

Gold Sponsors

v12.11.0: pnpm 12.11.0

Compare Source

This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the permissions setting, and keeps the colors of streamed script output.

Minor Changes

• pnpm install now links the agent skills that direct dependencies ship under skills/<name>/SKILL.md into the project's agent skill directories, such as .claude/skills. A package's skills are linked only after you approve them with pnpm approve. The skills.dirs setting chooses the directories pnpm/rfcs#35.

  Added the permissions setting, which records what each dependency may do. Its build capability works like allowBuilds and takes precedence over it. pnpm approve-builds writes to permissions when pnpm-workspace.yaml already has it, and to allowBuilds otherwise.

  Added pnpm permissions, which lists the granted and denied permissions and the packages awaiting approval. pnpm approve reviews build scripts and agent skills in one prompt pnpm/rfcs#36.

• pnpm now installs and runs Rust toolchains.

  • With cargo.enabled, pnpm install installs the toolchain named in rust-toolchain.toml. pnpm verifies the release signature, stores the toolchain once per machine, and links it into .pnpm/rust. pnpm run and pnpm exec put its cargo and rustc on the PATH.
  • pnpm add -g rust@<channel> installs a toolchain globally. The cargo and rustc commands run it outside projects that pin their own. pnpm update -g, pnpm ls -g, and pnpm remove -g manage it like any global package.
  • In a project, pnpm add rust@<channel> pins the toolchain in rust-toolchain.toml.
  • pnpm shim add rust adds project-aware shims for cargo, rustc, and the other Rust tools. In a project with a rust-toolchain.toml, they run the toolchain the file names and install it on first use. Elsewhere, the next command of the same name on PATH runs, such as rustup's.

• pnpm run and pnpm exec now keep the colors of script output that they print under the project's name, such as with --stream. pnpm sets FORCE_COLOR=1 for these scripts when its own output is in color, unless FORCE_COLOR is already set.

  Script output is also rendered more cleanly:

  • A line that a progress bar redraws with \r shows only its last state.
  • Escape codes that move the cursor or clear the screen are dropped.
  • Long colored lines are cut at the terminal width.
  • pnpm -r run no longer garbles its live output when a script fails while other scripts are still running.

Patch Changes

Installing packages

• pnpm no longer panics with "unexpected error when polling the I/O driver" when it runs under QEMU user-mode emulation, such as a linux/amd64 container on an Apple Silicon Mac #​16696.

• pnpm view, pnpm update, and other commands that read registry metadata now work behind proxies that end a response by closing the connection without a TLS close_notify alert #​16704.

• pnpm now switches to the version a project pins in packageManager or devEngines.packageManager even when pnpm-workspace.yaml has a setting the running pnpm cannot read, such as a lockfile.includeResolutionSettings section. If pnpm does not switch, it still reports that setting #​16675.

• When the pnpm package has to download its native binary on first run, it now uses the registry and credentials from .npmrc and from the npm_config_registry and pnpm_config_registry environment variables. COREPACK_NPM_REGISTRY still takes precedence. A project .npmrc is not read when COREPACK_INTEGRITY_KEYS turns off the signature check #​16655.

• pnpm install and pnpm add --config now apply minimumReleaseAge when they resolve a config dependency. A config dependency range resolves to the newest version that is old enough, so a later clean pnpm install --frozen-lockfile accepts the lockfile #​16660.

• pnpm remove with catalogPrune no longer removes catalog entries that pnpm-lock.yaml still records for workspace projects missing from disk. Before, a following frozen install failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH #​16679.

• With cargo.enabled, pnpm install now writes the source replacement for vendored crates into .pnpm/crates/config.toml and includes it as optional from .cargo/config.toml. A checkout without .pnpm builds with plain Cargo #​16659.

• With nodeLinker.type set to loaded, Node.js now stops with ERR_PNPM_LOADER_UNSUPPORTED_NODE when it preloads the store loader on a version the loader cannot serve. The supported versions are ^24.18.0 || >=26.2.0. On other versions, CommonJS packages imported from ESM failed with Cannot find module on their first relative require().

• On Windows, pnpm install no longer fails with "The filename, directory name, or volume label syntax is incorrect" when a package contains a file whose name is invalid on Windows, such as icon.svg?as=metadata.d.ts. pnpm removes the invalid characters from the name and prints a warning that lists the renamed files.

• On Windows, hoisting no longer fails intermittently with link errors when a junction is created or replaced concurrently pnpm/tasks#53.

Resolving dependencies

• pnpm install --no-optional now installs the peer dependencies a project declares when autoInstallPeers is on. The lockfile marked such a peer optional: true when another dependency had it as an optional peer.

• pnpm install and pnpm dedupe now link an optional peer to the workspace package that the workspace root depends on when the picked version matches it. They installed the registry package with the same name and version #​16706.

• Removal overrides such as "debug>supports-color": "-" now also apply to an optional peer that a package declares only in peerDependenciesMeta #​16681.

• pnpm add and other installs that re-resolve dependencies now keep the locked devEngines.runtime version while it still satisfies the declared range #​16764.

• pnpm audit --fix update now updates only the dependencies whose locked version is vulnerable #​14928.

• pnpm outdated and pnpm update --interactive now apply overrides before they look up the latest version. Before, a dependency overridden to an npm alias was compared with the latest version of the package the override replaces #​16719.

Patched dependencies

• Patches saved with CRLF line endings now apply, including a patch that creates or deletes a file. pnpm rejected the git headers of such a patch with ERR_PNPM_INVALID_PATCH and the message invalid file mode: 100644 #​16641.

• A patch that changes a file's mode, such as adding or removing the executable bit, now applies the new mode on Unix pnpm/tasks#110.

Injected dependencies and deploy

• With sharedWorkspaceLockfile: false, an injected workspace package installed in the same run as its dependent now holds only the files its files field selects. The copy also held other files of the project, such as tsconfig.json #​16683.

• A script listed in syncInjectedDepsAfterScripts no longer fails when it rewrites package.json while pnpm is copying its edits into the injected copies. The sync after the script now replaces a half-copied manifest.

• pnpm deploy with a shared lockfile no longer fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH for settings.dedupeInjectedDeps or settings.dedupePeerDependents when lockfile.includeResolutionSettings is enabled. The deployed lockfile now records both settings as false, the values the deploy installs with.

• pnpm deploy now writes the dependencies in the deployed package.json sorted by name. It also sorts the allowBuilds entries in the deployed pnpm-workspace.yaml. Repeated deploys of the same lockfile now produce identical files #​16687.

Packing and publishing

• pnpm pack and pnpm publish now match .npmignore and .gitignore rules the way npm does. A negation such as !lib/** or !lib/**/!(*.map) re-includes files under a directory that an earlier * rule excluded #​16743.

• pnpm pack and pnpm publish no longer always include root files that merely start with README, LICENSE, or LICENCE, such as README_INTERNAL.md. Only README, LICENSE, LICENCE, and COPYING, with or without an extension, ship regardless of files and .npmignore, as in npm #​16753.

• pnpm publish --provenance=false and --no-provenance now turn off provenance under trusted publishing, so a package can be published from a self-hosted runner. Setting provenance: false in pnpm-workspace.yaml does the same #​16721.

Speed and resource use

• pnpm install hardlinks files from a group-writable or world-writable store again. pnpm copied every file from such a store into node_modules #​16677.

• A repeat pnpm install no longer imports patched packages and packages with build scripts again when nothing changed. Their builds no longer run again either. This happened when recursiveInstall was false or the project had a file: dependency #​16705.

• Verifying the lockfile against trustPolicy and minimumReleaseAge uses less memory. pnpm no longer keeps every published version's manifest of each checked package in memory until the install ends #​16656.

• pnpm rebuild <pkg> and pnpm rebuild --pending no longer read the manifest of every installed package to find build scripts. Only the selected packages are inspected and built. On a large node_modules served lazily, such as over a network or FUSE mount, this turned a rebuild of a few packages into a fetch of every package.

• pnpm rebuild no longer removes and recreates node_modules when the settings recorded in node_modules/.modules.yaml differ from the current configuration. The rebuild runs the build scripts against the installed packages as they are.

• pnpm store prune now compacts the store's index.db after removing package entries, so the file shrinks again #​16717.

Registry commands

• pnpm whoami, pnpm bugs, pnpm docs, pnpm repo, pnpm star, pnpm unstar, and pnpm stars now honor the --registry option.

• --registry now takes precedence over a scope's configured registry for scoped packages in pnpm access, pnpm view, pnpm repo, pnpm star, pnpm unstar, pnpm owner, pnpm deprecate, pnpm undeprecate, pnpm unpublish, pnpm dist-tag, pnpm team, and pnpm stage. Without --registry, pnpm access now sends a scoped package or scope to the registry configured for that scope.

• Registry commands now keep the path of a registry URL such as https://example.com/npm/ when they build request URLs. This applies to pnpm access, pnpm owner, pnpm ping, pnpm search, pnpm star, pnpm stars, pnpm team, pnpm unstar, and pnpm whoami.

• pnpm view now honors the network retry settings.

• pnpm repo now fetches the repository URLs of several packages in parallel.

Platinum Sponsors

Gold Sponsors

predis/predis (predis/predis)

v3.7.0

Compare Source

Added

• Added BLESS * command family (#​1733)
• Added optional CELL_SIZE argument for CMS.INITBY(DIM|PROB) (#​1729)

Fixed

• Fixed Redis Cluster not retrying slot map discovery on StreamInitException (#​1717)
• Fixed client iteration when using replication (#​1730)
• Fixed *StreamConnection looping forever when closed in the middle of a bulk reply (#​1731)
• Fixed cluster CAS transactions returning transaction objects for reads and sending MULTI twice (#​1735)
• Fixed cleanup of empty transactions and transaction callbacks that throw PHP errors (#​1735)
• Fixed MultiExec::multi() being ignored as the first call of a CAS transaction (#​1735)
• Fixed spl_object_hash() deprecation on PHP 8.6 in ConnectionErrorProof pipeline (#​1738)
• Fixed ConnectionErrorProof pipeline returning too few responses or throwing ValueError (#​1739)

Security

• Fixed aborted cluster transactions leaving node connections in MULTI (#​1735)

getsentry/sentry-laravel (sentry/sentry-laravel)

v4.29.0

Compare Source

The Sentry SDK team is happy to announce the immediate availability of Sentry Laravel SDK v4.29.0.

Features

• Add the data_collection config option to control which data is collected automatically. (#​1179)

  When data_collection is null (the default), data collection keeps following send_default_pii.

  // config/sentry.php
  'data_collection' => [
      'user_info' => false,
      'http_bodies' => ['incomingRequest', 'outgoingRequest'],
      'database_query_data' => false,
      'gen_ai' => [
          'inputs' => false,
          'outputs' => true,
      ],
  ],
  

  When data_collection is set, the breadcrumbs.sql_bindings and tracing.sql_bindings options are ignored.

• Show the data collection status in php artisan about. (#​1198)

• Add the origin of slow HTTP client requests to their spans. Configure this with the tracing.http_client_requests_origin and tracing.http_client_requests_origin_threshold_ms options (default: 250). (#​1066)

• Add gen_ai.evaluate spans for laravel/ai 1.0 classifications. Configure this with the tracing.gen_ai_evaluate option. (#​1181), (#​1182), (#​1199)

• Add Integration::setConversationId() to set the gen AI conversation ID for integrations that do not provide it, such as classifications, or for AI calls proxied across multiple requests. (#​1193)

Bug Fixes

• Report cache operations from the session driver as session.* spans and breadcrumbs instead of cache.*. (#​1129)
• Finish the agent and chat spans of failed laravel/ai agent invocations so later requests do not inherit them. (#​1160)

Misc

• Bump the PHP SDK to version 4.34.0

vitejs/vite (vite)

v8.3.4

Compare Source

Features

• bundled-dev: support import.meta.hot.acceptExports (#​23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #​23575) (#​23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#​23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #​23652) (#​23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#​23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#​23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#​23688) (cf52011)
• deps: update all non-major dependencies (#​23648) (8a4c19c)
• deps: update rolldown-related dependencies (#​23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #​23392) (#​23484) (70d56ea)
• don't treat modules ending with js-like query as js (#​23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#​23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #​23628) (#​23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#​23678) (8579189)
• remove input option unescaping for now (#​23694) (facc2fb)
• server: match static aliases on path boundaries (#​23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#​23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#​23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#​23674) (182f5b2)

katspaugh/wavesurfer.js (wavesurfer.js)

v8.0.2

Compare Source

• 8.0.2
• fix(Spectrogram): judge autoGain digital silence before pre-emphasis (#​4371) by @​koyukan
• fix(Fetcher): fall back to arrayBuffer() when response.blob() fails (#​4378) by @​Copilot
• fix(Renderer): continuously auto-scroll while dragging the playhead near the container edge (#​4381) by @​Copilot
• fix(Envelope): keep drawing and dragging stable when zoomed (#​4382) by @​ArianMoeini
• fix(Record): align continuous waveform with elapsed time (#​4379) by @​ArianMoeini
• docs: Update README

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [concurrently](https://github.com/open-cli-tools/concurrently) | [`10.0.5` → `10.0.6`](https://renovatebot.com/diffs/npm/concurrently/10.0.5/10.0.6) |  |  | | [filament/filament](https://github.com/filamentphp/filament) ([source](https://github.com/filamentphp/panels)) | `5.10.0` → `5.10.1` |  |  | | [laravel-echo](https://github.com/laravel/echo/tree/2.x/packages/laravel-echo) ([source](https://github.com/laravel/echo)) | [`2.5.0` → `2.6.1`](https://renovatebot.com/diffs/npm/laravel-echo/2.5.0/2.6.1) |  |  | | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`12.10.1` → `12.11.2`](https://renovatebot.com/diffs/npm/pnpm/12.10.1/12.11.2) |  |  | | [predis/predis](https://github.com/predis/predis) | `3.6.1` → `3.7.0` |  |  | | [sentry/sentry-laravel](https://sentry.io) ([source](https://github.com/getsentry/sentry-laravel)) | `4.28.0` → `4.29.0` |  |  | | [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.3.3` → `8.3.4`](https://renovatebot.com/diffs/npm/vite/8.3.3/8.3.4) |  |  | | [wavesurfer.js](https://wavesurfer.xyz) ([source](https://github.com/katspaugh/wavesurfer.js)) | [`8.0.1` → `8.0.2`](https://renovatebot.com/diffs/npm/wavesurfer.js/8.0.1/8.0.2) |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/18) for more information. --- ### Release Notes <details> <summary>open-cli-tools/concurrently (concurrently)</summary> ### [`v10.0.6`](https://github.com/open-cli-tools/concurrently/releases/tag/v10.0.6) [Compare Source](https://github.com/open-cli-tools/concurrently/compare/v10.0.5...v10.0.6) #### What's Changed - docs: update issue link to the transferred repo path by [@&#8203;yzxcj797](https://github.com/yzxcj797) in [#&#8203;609](https://github.com/open-cli-tools/concurrently/pull/609) - docs: update API example to ESM by [@&#8203;Bibin-VR](https://github.com/Bibin-VR) in [#&#8203;611](https://github.com/open-cli-tools/concurrently/pull/611) - fix: skip force-kill logging when no processes remain by [@&#8203;imshunsuke](https://github.com/imshunsuke) in [#&#8203;616](https://github.com/open-cli-tools/concurrently/pull/616) - deps: update shell-quote to 1.12.0 by [@&#8203;Abicodexi](https://github.com/Abicodexi) and [@&#8203;Mayvis](https://github.com/Mayvis) in [#&#8203;622](https://github.com/open-cli-tools/concurrently/pull/622) #### New Contributors - [@&#8203;yzxcj797](https://github.com/yzxcj797) made their first contribution in [#&#8203;609](https://github.com/open-cli-tools/concurrently/pull/609) - [@&#8203;Bibin-VR](https://github.com/Bibin-VR) made their first contribution in [#&#8203;611](https://github.com/open-cli-tools/concurrently/pull/611) - [@&#8203;imshunsuke](https://github.com/imshunsuke) made their first contribution in [#&#8203;616](https://github.com/open-cli-tools/concurrently/pull/616) - [@&#8203;Abicodexi](https://github.com/Abicodexi) made their first contribution in [#&#8203;622](https://github.com/open-cli-tools/concurrently/pull/622) **Full Changelog**: <https://github.com/open-cli-tools/concurrently/compare/v10.0.5...v10.0.6> </details> <details> <summary>filamentphp/panels (filament/filament)</summary> ### [`v5.10.1`](https://github.com/filamentphp/panels/compare/v5.10.0...v5.10.1) [Compare Source](https://github.com/filamentphp/panels/compare/v5.10.0...v5.10.1) </details> <details> <summary>laravel/echo (laravel-echo)</summary> ### [`v2.6.1`](https://github.com/laravel/echo/blob/HEAD/CHANGELOG.md#v261---2026-10-07) [Compare Source](https://github.com/laravel/echo/compare/v2.5.0...v2.6.1) ##### What's Changed - pnpm audit fixes by [@&#8203;joetannenbaum](https://github.com/joetannenbaum) in [#&#8203;558](https://github.com/laravel/echo/pull/558) **Full Changelog**: <https://github.com/laravel/echo/compare/v2.6.0...v2.6.1> </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v12.11.2`](https://github.com/pnpm/pnpm/releases/tag/v12.11.2): pnpm 12.11.2 [Compare Source](https://github.com/pnpm/pnpm/compare/v12.11.1...v12.11.2) This release fixes `--workspace-concurrency=Infinity`, filters set by an `updateConfig` hook, and store fetches with `enable-modules-dir=false`. ##### Patch Changes - `--workspace-concurrency=Infinity` now runs workspace projects with no concurrency limit. It used to fail with `invalid digit found in string` [#&#8203;16793](https://github.com/pnpm/pnpm/issues/16793). - `pnpm install` and other recursive commands now apply the `filter` and `filterProd` that an `updateConfig` hook sets. They used to run on every workspace project [#&#8203;16792](https://github.com/pnpm/pnpm/issues/16792). - `enable-modules-dir=false` now also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.11.1`](https://github.com/pnpm/pnpm/releases/tag/v12.11.1): pnpm 12.11.1 [Compare Source](https://github.com/pnpm/pnpm/compare/v12.11.0...v12.11.1) This release fixes two ways `pnpm install` could fail, runs tools of any Rust release through `pnx`, and treats `registry.npmjs.com` as an alias of the npm registry. ##### Patch Changes - `pnpm install` no longer fails when `packageManager` pins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it. - `pnpm install` no longer fails with `ERR_PNPM_CMD_SHIM_CHMOD` when `node_modules/.bin` holds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout. - `enable-modules-dir=false` (`enableModulesDir: false` through the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing under `node_modules`. The setting exists for a `node_modules` that something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain `--lockfile-only` run still fetches nothing. - `pnpm pack` and `pnpm publish` no longer put `.npmignore` and `.gitignore` files in the tarball. A `files` entry that names one still ships it. - pnpm now treats `https://registry.npmjs.com/` as an alias of `https://registry.npmjs.org/`. Registry requests, credentials, and trusted publishing use the canonical hostname. - `pnx --package=rust@<channel> <tool>` runs a tool of that Rust release, for example `pnx --package=rust@nightly-2026-01-01 cargo build`. pnpm installs the release with the components and targets from `rust-toolchain.toml` and the target of each `--target` argument. - `pnpm install` now links agent skills for more coding agents. It detects the agent from `ANTIGRAVITY_AGENT`, `COPILOT_AGENT`, `COPILOT_CLI`, `CODEX_THREAD_ID`, `CODEX_SANDBOX`, `AI_AGENT`, and `CLAUDE_CODE` [pnpm/tasks#116](https://github.com/pnpm/tasks/issues/116). - When the registry rejects `pnpm stage publish`, the error message now starts with "Failed to stage package". <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v12.11.0`](https://github.com/pnpm/pnpm/releases/tag/v12.11.0): pnpm 12.11.0 [Compare Source](https://github.com/pnpm/pnpm/compare/v12.10.1...v12.11.0) This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the `permissions` setting, and keeps the colors of streamed script output. ##### Minor Changes - `pnpm install` now links the agent skills that direct dependencies ship under `skills/<name>/SKILL.md` into the project's agent skill directories, such as `.claude/skills`. A package's skills are linked only after you approve them with `pnpm approve`. The `skills.dirs` setting chooses the directories [pnpm/rfcs#35](https://github.com/pnpm/rfcs/pull/35). Added the `permissions` setting, which records what each dependency may do. Its `build` capability works like `allowBuilds` and takes precedence over it. `pnpm approve-builds` writes to `permissions` when `pnpm-workspace.yaml` already has it, and to `allowBuilds` otherwise. Added `pnpm permissions`, which lists the granted and denied permissions and the packages awaiting approval. `pnpm approve` reviews build scripts and agent skills in one prompt [pnpm/rfcs#36](https://github.com/pnpm/rfcs/pull/36). - pnpm now installs and runs Rust toolchains. - With `cargo.enabled`, `pnpm install` installs the toolchain named in `rust-toolchain.toml`. pnpm verifies the release signature, stores the toolchain once per machine, and links it into `.pnpm/rust`. `pnpm run` and `pnpm exec` put its `cargo` and `rustc` on the `PATH`. - `pnpm add -g rust@<channel>` installs a toolchain globally. The `cargo` and `rustc` commands run it outside projects that pin their own. `pnpm update -g`, `pnpm ls -g`, and `pnpm remove -g` manage it like any global package. - In a project, `pnpm add rust@<channel>` pins the toolchain in `rust-toolchain.toml`. - `pnpm shim add rust` adds project-aware shims for `cargo`, `rustc`, and the other Rust tools. In a project with a `rust-toolchain.toml`, they run the toolchain the file names and install it on first use. Elsewhere, the next command of the same name on `PATH` runs, such as rustup's. - `pnpm run` and `pnpm exec` now keep the colors of script output that they print under the project's name, such as with `--stream`. pnpm sets `FORCE_COLOR=1` for these scripts when its own output is in color, unless `FORCE_COLOR` is already set. Script output is also rendered more cleanly: - A line that a progress bar redraws with `\r` shows only its last state. - Escape codes that move the cursor or clear the screen are dropped. - Long colored lines are cut at the terminal width. - `pnpm -r run` no longer garbles its live output when a script fails while other scripts are still running. ##### Patch Changes ##### Installing packages - pnpm no longer panics with "unexpected error when polling the I/O driver" when it runs under QEMU user-mode emulation, such as a `linux/amd64` container on an Apple Silicon Mac [#&#8203;16696](https://github.com/pnpm/pnpm/issues/16696). - `pnpm view`, `pnpm update`, and other commands that read registry metadata now work behind proxies that end a response by closing the connection without a TLS `close_notify` alert [#&#8203;16704](https://github.com/pnpm/pnpm/issues/16704). - pnpm now switches to the version a project pins in `packageManager` or `devEngines.packageManager` even when `pnpm-workspace.yaml` has a setting the running pnpm cannot read, such as a `lockfile.includeResolutionSettings` section. If pnpm does not switch, it still reports that setting [#&#8203;16675](https://github.com/pnpm/pnpm/issues/16675). - When the `pnpm` package has to download its native binary on first run, it now uses the registry and credentials from `.npmrc` and from the `npm_config_registry` and `pnpm_config_registry` environment variables. `COREPACK_NPM_REGISTRY` still takes precedence. A project `.npmrc` is not read when `COREPACK_INTEGRITY_KEYS` turns off the signature check [#&#8203;16655](https://github.com/pnpm/pnpm/issues/16655). - `pnpm install` and `pnpm add --config` now apply `minimumReleaseAge` when they resolve a config dependency. A config dependency range resolves to the newest version that is old enough, so a later clean `pnpm install --frozen-lockfile` accepts the lockfile [#&#8203;16660](https://github.com/pnpm/pnpm/issues/16660). - `pnpm remove` with `catalogPrune` no longer removes catalog entries that `pnpm-lock.yaml` still records for workspace projects missing from disk. Before, a following frozen install failed with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` [#&#8203;16679](https://github.com/pnpm/pnpm/issues/16679). - With `cargo.enabled`, `pnpm install` now writes the source replacement for vendored crates into `.pnpm/crates/config.toml` and includes it as optional from `.cargo/config.toml`. A checkout without `.pnpm` builds with plain Cargo [#&#8203;16659](https://github.com/pnpm/pnpm/issues/16659). - With `nodeLinker.type` set to `loaded`, Node.js now stops with `ERR_PNPM_LOADER_UNSUPPORTED_NODE` when it preloads the store loader on a version the loader cannot serve. The supported versions are `^24.18.0 || >=26.2.0`. On other versions, CommonJS packages imported from ESM failed with `Cannot find module` on their first relative `require()`. - On Windows, `pnpm install` no longer fails with "The filename, directory name, or volume label syntax is incorrect" when a package contains a file whose name is invalid on Windows, such as `icon.svg?as=metadata.d.ts`. pnpm removes the invalid characters from the name and prints a warning that lists the renamed files. - On Windows, hoisting no longer fails intermittently with link errors when a junction is created or replaced concurrently [pnpm/tasks#53](https://github.com/pnpm/tasks/issues/53). ##### Resolving dependencies - `pnpm install --no-optional` now installs the peer dependencies a project declares when `autoInstallPeers` is on. The lockfile marked such a peer `optional: true` when another dependency had it as an optional peer. - `pnpm install` and `pnpm dedupe` now link an optional peer to the workspace package that the workspace root depends on when the picked version matches it. They installed the registry package with the same name and version [#&#8203;16706](https://github.com/pnpm/pnpm/issues/16706). - Removal overrides such as `"debug>supports-color": "-"` now also apply to an optional peer that a package declares only in `peerDependenciesMeta` [#&#8203;16681](https://github.com/pnpm/pnpm/issues/16681). - `pnpm add` and other installs that re-resolve dependencies now keep the locked `devEngines.runtime` version while it still satisfies the declared range [#&#8203;16764](https://github.com/pnpm/pnpm/issues/16764). - `pnpm audit --fix update` now updates only the dependencies whose locked version is vulnerable [#&#8203;14928](https://github.com/pnpm/pnpm/issues/14928). - `pnpm outdated` and `pnpm update --interactive` now apply `overrides` before they look up the latest version. Before, a dependency overridden to an npm alias was compared with the latest version of the package the override replaces [#&#8203;16719](https://github.com/pnpm/pnpm/issues/16719). ##### Patched dependencies - Patches saved with CRLF line endings now apply, including a patch that creates or deletes a file. pnpm rejected the git headers of such a patch with `ERR_PNPM_INVALID_PATCH` and the message `invalid file mode: 100644` [#&#8203;16641](https://github.com/pnpm/pnpm/issues/16641). - A patch that changes a file's mode, such as adding or removing the executable bit, now applies the new mode on Unix [pnpm/tasks#110](https://github.com/pnpm/tasks/issues/110). ##### Injected dependencies and deploy - With `sharedWorkspaceLockfile: false`, an injected workspace package installed in the same run as its dependent now holds only the files its `files` field selects. The copy also held other files of the project, such as `tsconfig.json` [#&#8203;16683](https://github.com/pnpm/pnpm/issues/16683). - A script listed in `syncInjectedDepsAfterScripts` no longer fails when it rewrites `package.json` while pnpm is copying its edits into the injected copies. The sync after the script now replaces a half-copied manifest. - `pnpm deploy` with a shared lockfile no longer fails with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` for `settings.dedupeInjectedDeps` or `settings.dedupePeerDependents` when `lockfile.includeResolutionSettings` is enabled. The deployed lockfile now records both settings as `false`, the values the deploy installs with. - `pnpm deploy` now writes the dependencies in the deployed `package.json` sorted by name. It also sorts the `allowBuilds` entries in the deployed `pnpm-workspace.yaml`. Repeated deploys of the same lockfile now produce identical files [#&#8203;16687](https://github.com/pnpm/pnpm/issues/16687). ##### Packing and publishing - `pnpm pack` and `pnpm publish` now match `.npmignore` and `.gitignore` rules the way npm does. A negation such as `!lib/**` or `!lib/**/!(*.map)` re-includes files under a directory that an earlier `*` rule excluded [#&#8203;16743](https://github.com/pnpm/pnpm/issues/16743). - `pnpm pack` and `pnpm publish` no longer always include root files that merely start with `README`, `LICENSE`, or `LICENCE`, such as `README_INTERNAL.md`. Only `README`, `LICENSE`, `LICENCE`, and `COPYING`, with or without an extension, ship regardless of `files` and `.npmignore`, as in npm [#&#8203;16753](https://github.com/pnpm/pnpm/issues/16753). - `pnpm publish --provenance=false` and `--no-provenance` now turn off provenance under trusted publishing, so a package can be published from a self-hosted runner. Setting `provenance: false` in `pnpm-workspace.yaml` does the same [#&#8203;16721](https://github.com/pnpm/pnpm/issues/16721). ##### Speed and resource use - `pnpm install` hardlinks files from a group-writable or world-writable store again. pnpm copied every file from such a store into `node_modules` [#&#8203;16677](https://github.com/pnpm/pnpm/issues/16677). - A repeat `pnpm install` no longer imports patched packages and packages with build scripts again when nothing changed. Their builds no longer run again either. This happened when `recursiveInstall` was `false` or the project had a `file:` dependency [#&#8203;16705](https://github.com/pnpm/pnpm/issues/16705). - Verifying the lockfile against `trustPolicy` and `minimumReleaseAge` uses less memory. pnpm no longer keeps every published version's manifest of each checked package in memory until the install ends [#&#8203;16656](https://github.com/pnpm/pnpm/issues/16656). - `pnpm rebuild <pkg>` and `pnpm rebuild --pending` no longer read the manifest of every installed package to find build scripts. Only the selected packages are inspected and built. On a large `node_modules` served lazily, such as over a network or FUSE mount, this turned a rebuild of a few packages into a fetch of every package. - `pnpm rebuild` no longer removes and recreates `node_modules` when the settings recorded in `node_modules/.modules.yaml` differ from the current configuration. The rebuild runs the build scripts against the installed packages as they are. - `pnpm store prune` now compacts the store's `index.db` after removing package entries, so the file shrinks again [#&#8203;16717](https://github.com/pnpm/pnpm/issues/16717). ##### Registry commands - `pnpm whoami`, `pnpm bugs`, `pnpm docs`, `pnpm repo`, `pnpm star`, `pnpm unstar`, and `pnpm stars` now honor the `--registry` option. - `--registry` now takes precedence over a scope's configured registry for scoped packages in `pnpm access`, `pnpm view`, `pnpm repo`, `pnpm star`, `pnpm unstar`, `pnpm owner`, `pnpm deprecate`, `pnpm undeprecate`, `pnpm unpublish`, `pnpm dist-tag`, `pnpm team`, and `pnpm stage`. Without `--registry`, `pnpm access` now sends a scoped package or scope to the registry configured for that scope. - Registry commands now keep the path of a registry URL such as `https://example.com/npm/` when they build request URLs. This applies to `pnpm access`, `pnpm owner`, `pnpm ping`, `pnpm search`, `pnpm star`, `pnpm stars`, `pnpm team`, `pnpm unstar`, and `pnpm whoami`. - `pnpm view` now honors the network retry settings. - `pnpm repo` now fetches the repository URLs of several packages in parallel. <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> <details> <summary>predis/predis (predis/predis)</summary> ### [`v3.7.0`](https://github.com/predis/predis/blob/HEAD/CHANGELOG.md#v370-2026-10-08) [Compare Source](https://github.com/predis/predis/compare/v3.6.1...v3.7.0) ##### Added - Added `BLESS *` command family ([#&#8203;1733](https://github.com/predis/predis/issues/1733)) - Added optional `CELL_SIZE` argument for `CMS.INITBY(DIM|PROB)` ([#&#8203;1729](https://github.com/predis/predis/issues/1729)) ##### Fixed - Fixed Redis Cluster not retrying slot map discovery on `StreamInitException` ([#&#8203;1717](https://github.com/predis/predis/issues/1717)) - Fixed client iteration when using replication ([#&#8203;1730](https://github.com/predis/predis/issues/1730)) - Fixed `*StreamConnection` looping forever when closed in the middle of a bulk reply ([#&#8203;1731](https://github.com/predis/predis/issues/1731)) - Fixed cluster CAS transactions returning transaction objects for reads and sending `MULTI` twice ([#&#8203;1735](https://github.com/predis/predis/issues/1735)) - Fixed cleanup of empty transactions and transaction callbacks that throw PHP errors ([#&#8203;1735](https://github.com/predis/predis/issues/1735)) - Fixed `MultiExec::multi()` being ignored as the first call of a CAS transaction ([#&#8203;1735](https://github.com/predis/predis/issues/1735)) - Fixed `spl_object_hash()` deprecation on PHP 8.6 in `ConnectionErrorProof` pipeline ([#&#8203;1738](https://github.com/predis/predis/issues/1738)) - Fixed `ConnectionErrorProof` pipeline returning too few responses or throwing `ValueError` ([#&#8203;1739](https://github.com/predis/predis/issues/1739)) ##### Security - Fixed aborted cluster transactions leaving node connections in `MULTI` ([#&#8203;1735](https://github.com/predis/predis/issues/1735)) </details> <details> <summary>getsentry/sentry-laravel (sentry/sentry-laravel)</summary> ### [`v4.29.0`](https://github.com/getsentry/sentry-laravel/blob/HEAD/CHANGELOG.md#4290) [Compare Source](https://github.com/getsentry/sentry-laravel/compare/4.28.0...4.29.0) The Sentry SDK team is happy to announce the immediate availability of Sentry Laravel SDK v4.29.0. ##### Features - Add the `data_collection` config option to control which data is collected automatically. [(#&#8203;1179)](https://github.com/getsentry/sentry-laravel/pull/1179) When `data_collection` is `null` (the default), data collection keeps following `send_default_pii`. ```php // config/sentry.php 'data_collection' => [ 'user_info' => false, 'http_bodies' => ['incomingRequest', 'outgoingRequest'], 'database_query_data' => false, 'gen_ai' => [ 'inputs' => false, 'outputs' => true, ], ], ``` When `data_collection` is set, the `breadcrumbs.sql_bindings` and `tracing.sql_bindings` options are ignored. - Show the data collection status in `php artisan about`. [(#&#8203;1198)](https://github.com/getsentry/sentry-laravel/pull/1198) - Add the origin of slow HTTP client requests to their spans. Configure this with the `tracing.http_client_requests_origin` and `tracing.http_client_requests_origin_threshold_ms` options (default: `250`). [(#&#8203;1066)](https://github.com/getsentry/sentry-laravel/pull/1066) - Add `gen_ai.evaluate` spans for `laravel/ai` 1.0 classifications. Configure this with the `tracing.gen_ai_evaluate` option. [(#&#8203;1181)](https://github.com/getsentry/sentry-laravel/pull/1181), [(#&#8203;1182)](https://github.com/getsentry/sentry-laravel/pull/1182), [(#&#8203;1199)](https://github.com/getsentry/sentry-laravel/pull/1199) - Add `Integration::setConversationId()` to set the gen AI conversation ID for integrations that do not provide it, such as classifications, or for AI calls proxied across multiple requests. [(#&#8203;1193)](https://github.com/getsentry/sentry-laravel/pull/1193) ##### Bug Fixes - Report cache operations from the session driver as `session.*` spans and breadcrumbs instead of `cache.*`. [(#&#8203;1129)](https://github.com/getsentry/sentry-laravel/pull/1129) - Finish the agent and chat spans of failed `laravel/ai` agent invocations so later requests do not inherit them. [(#&#8203;1160)](https://github.com/getsentry/sentry-laravel/pull/1160) ##### Misc - Bump the PHP SDK to version `4.34.0` </details> <details> <summary>vitejs/vite (vite)</summary> ### [`v8.3.4`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small) [Compare Source](https://github.com/vitejs/vite/compare/v8.3.3...v8.3.4) ##### Features - **bundled-dev:** support `import.meta.hot.acceptExports` ([#&#8203;23463](https://github.com/vitejs/vite/issues/23463)) ([bc0f21c](https://github.com/vitejs/vite/commit/bc0f21c56a2e003a4d2dd23ccb9da3ec8c706c4e)) ##### Bug Fixes - avoid mutating hmr defaults (fix [#&#8203;23575](https://github.com/vitejs/vite/issues/23575)) ([#&#8203;23576](https://github.com/vitejs/vite/issues/23576)) ([574d5e3](https://github.com/vitejs/vite/commit/574d5e351905fe99891364d03c2440531378f7fd)) - **build:** correct preloads when chunkImportMap is enabled with non-root base ([#&#8203;23698](https://github.com/vitejs/vite/issues/23698)) ([2a8c0f0](https://github.com/vitejs/vite/commit/2a8c0f05c76e35c43ab3560984a5103c8db8dbcd)) - **build:** wait for in-flight stylesheets in preload helper (fix [#&#8203;23652](https://github.com/vitejs/vite/issues/23652)) ([#&#8203;23662](https://github.com/vitejs/vite/issues/23662)) ([036b745](https://github.com/vitejs/vite/commit/036b74599b2fe1d8c61475371b856ceb88d26963)) - **bundled-dev:** serve `/@vite/client` and stub `@vite/env` ([#&#8203;23664](https://github.com/vitejs/vite/issues/23664)) ([5afc5a8](https://github.com/vitejs/vite/commit/5afc5a8876624888fc1e8f43fed1c85c4b0e830b)) - **client:** skip rewriting unchanged adopted styles ([#&#8203;23697](https://github.com/vitejs/vite/issues/23697)) ([fa71469](https://github.com/vitejs/vite/commit/fa7146938b0ca703653c90c20907191a01c032ba)) - **css:** resolve imported preprocessors from their file path with lightningcss ([#&#8203;23688](https://github.com/vitejs/vite/issues/23688)) ([cf52011](https://github.com/vitejs/vite/commit/cf52011c46409a4a45f3d74bba631b8f005c4bc9)) - **deps:** update all non-major dependencies ([#&#8203;23648](https://github.com/vitejs/vite/issues/23648)) ([8a4c19c](https://github.com/vitejs/vite/commit/8a4c19cfc035f2dd203f2fa6d00ab9256a5e77c9)) - **deps:** update rolldown-related dependencies ([#&#8203;23649](https://github.com/vitejs/vite/issues/23649)) ([794516d](https://github.com/vitejs/vite/commit/794516d50cff80e405bc9b3e5faac1c82987566c)) - **dev:** a restart requested during a restart used to be dropped (fix [#&#8203;23392](https://github.com/vitejs/vite/issues/23392)) ([#&#8203;23484](https://github.com/vitejs/vite/issues/23484)) ([70d56ea](https://github.com/vitejs/vite/commit/70d56ea1848909edab416934f3f68ce14343eb73)) - don't treat modules ending with js-like query as js ([#&#8203;23687](https://github.com/vitejs/vite/issues/23687)) ([fcb6f12](https://github.com/vitejs/vite/commit/fcb6f1252a95857823d935f98554b938888d41a0)) - **html:** avoid adding filesystem root to watcher ([#&#8203;23689](https://github.com/vitejs/vite/issues/23689)) ([3a7f2ae](https://github.com/vitejs/vite/commit/3a7f2aea757d59bae66ad6edf6b321d26a7e6778)) - **html:** skip caching CSS of chunks in a cycle (fix [#&#8203;23628](https://github.com/vitejs/vite/issues/23628)) ([#&#8203;23636](https://github.com/vitejs/vite/issues/23636)) ([15d82f7](https://github.com/vitejs/vite/commit/15d82f7dc679ab9c18d5ce2c3711157c2365ddd1)) - **optimizer:** scan deep imports with custom extensions ([#&#8203;23678](https://github.com/vitejs/vite/issues/23678)) ([8579189](https://github.com/vitejs/vite/commit/8579189bae8626b6ddab55a09325e209d62e027e)) - remove input option unescaping for now ([#&#8203;23694](https://github.com/vitejs/vite/issues/23694)) ([facc2fb](https://github.com/vitejs/vite/commit/facc2fb1fffce03d9e2dd7011d0bd0eeddc7d0f6)) - **server:** match static aliases on path boundaries ([#&#8203;23643](https://github.com/vitejs/vite/issues/23643)) ([b28db28](https://github.com/vitejs/vite/commit/b28db28e9e62d9866a9a0f1b22e74589cc180577)) - **watcher:** normalize file before root check in `ensureWatchedFile` ([#&#8203;23673](https://github.com/vitejs/vite/issues/23673)) ([12bb28c](https://github.com/vitejs/vite/commit/12bb28c22379c8d2fe90088fa0eefbfa2ab3fb80)) ##### Performance Improvements - **module-runner:** skip cloning call sites that have no source map ([#&#8203;23646](https://github.com/vitejs/vite/issues/23646)) ([3d67486](https://github.com/vitejs/vite/commit/3d674869a50a0bca84a8cc8dc55bd35d57100e37)) ##### Code Refactoring - **bundled-dev:** import CSS HMR helpers from `/@vite/client` ([#&#8203;23674](https://github.com/vitejs/vite/issues/23674)) ([182f5b2](https://github.com/vitejs/vite/commit/182f5b2a65391da5bee05f9c3df1aeb3794e98d9)) </details> <details> <summary>katspaugh/wavesurfer.js (wavesurfer.js)</summary> ### [`v8.0.2`](https://github.com/katspaugh/wavesurfer.js/releases/tag/8.0.2) [Compare Source](https://github.com/katspaugh/wavesurfer.js/compare/8.0.1...8.0.2) - 8.0.2 - fix(Spectrogram): judge autoGain digital silence before pre-emphasis ([#&#8203;4371](https://github.com/katspaugh/wavesurfer.js/issues/4371)) by [@&#8203;koyukan](https://github.com/koyukan) - fix(Fetcher): fall back to arrayBuffer() when response.blob() fails ([#&#8203;4378](https://github.com/katspaugh/wavesurfer.js/issues/4378)) by [@&#8203;Copilot](https://github.com/Copilot) - fix(Renderer): continuously auto-scroll while dragging the playhead near the container edge ([#&#8203;4381](https://github.com/katspaugh/wavesurfer.js/issues/4381)) by [@&#8203;Copilot](https://github.com/Copilot) - fix(Envelope): keep drawing and dragging stable when zoomed ([#&#8203;4382](https://github.com/katspaugh/wavesurfer.js/issues/4382)) by [@&#8203;ArianMoeini](https://github.com/ArianMoeini) - fix(Record): align continuous waveform with elapsed time ([#&#8203;4379](https://github.com/katspaugh/wavesurfer.js/issues/4379)) by [@&#8203;ArianMoeini](https://github.com/ArianMoeini) - docs: Update README *** [](https://www.npmjs.com/package/wavesurfer.js/v/8.0.2) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzguMCIsInVwZGF0ZWRJblZlciI6IjQ0LjEzOC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

dependathot added 1 commit 2026-10-09 09:02:12 +00:00

Update all non-major dependencies a2fd973ca6

dependathot force-pushed renovate/all-minor-patch from a2fd973ca6 to b174ac8c6f 2026-10-10 09:02:22 +00:00 Compare

dependathot force-pushed renovate/all-minor-patch from b174ac8c6f to 8690da3494 2026-10-11 09:02:13 +00:00 Compare

All checks were successful

Hide checks

renovate/stability-days Updates have met minimum release age requirement

Details

Application Tests / frontend (pull_request) Successful in 32s

Details

Application Tests / security-audit (pull_request) Successful in 2m23s

Details

Application Tests / php (pull_request) Successful in 2m51s

Details

Application Tests / tag (pull_request) Has been skipped

Details

Application Tests / publish-images (., Dockerfile, laravel) (pull_request) Has been skipped

Details

Application Tests / publish-images (agent-worker, Dockerfile, agent-worker) (pull_request) Has been skipped

Details

Application Tests / publish-images (docker/asterisk, Dockerfile, asterisk) (pull_request) Has been skipped

Details

Application Tests / publish-images (docker/asterisk-config-sync, Dockerfile, asterisk-config-sync) (pull_request) Has been skipped

Details

Application Tests / scan-images (agent-worker) (pull_request) Has been skipped

Details

Application Tests / scan-images (asterisk) (pull_request) Has been skipped

Details

Application Tests / scan-images (asterisk-config-sync) (pull_request) Has been skipped

Details

Application Tests / scan-images (laravel) (pull_request) Has been skipped

Details

Application Tests / publish-helm (pull_request) Has been skipped

Details

Application Tests / publish-archives (pull_request) Has been skipped

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/all-minor-patch:renovate/all-minor-patch

git switch renovate/all-minor-patch

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

calltheory/orbital!52

No description provided.