Update all non-major dependencies by renovate[bot] · Pull Request #213 · SuperchupuDev/tinyglobby

renovate · 2026-08-02T14:00:58Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@biomejs/biome (source)	`^2.5.5` → `^2.5.8`	devDependencies	patch
@types/node (source)	`^26.1.1` → `^26.2.0`	devDependencies	minor
pnpm (source)	`11.17.0` → `11.21.0`	packageManager	minor
pnpm/action-setup	`v6.0.9` → `v6.0.10`	action	patch
tinybench	`^6.1.2` → `^6.1.3`	devDependencies	patch

Release Notes

biomejs/biome (@biomejs/biome)

`v2.5.8`

Compare Source

Patch Changes

#10710 0a0fbc1 Thanks @dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.
#11251 ea9dd8a Thanks @dyc3! - Improved performance of noImportCycles.

#11247 52b44d6 Thanks @dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

Invalid:

{#each boxes as box}
  {@const area = box.width * box.height}
  <p>{area}</p>
{/each}

Valid:

{#each boxes as box}
  {const area = $derived(box.width * box.height)}
  <p>{area}</p>
{/each}

#11252 d5f5704 Thanks @Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.
#11143 6be7be1 Thanks @vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.
#11234 caefe39 Thanks @subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.
```
 :root {
   --font-stack:
-/* comment */
+    /* comment */
     system-ui;
 }
```
#11285 bca1f73 Thanks @denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.
```
-:/* comment */ where(div) {}
+:where(/* comment */ div) {}
```
#11080 af16a0b Thanks @dyc3! - HTML style attribute values are now parsed as CSS. All Biome CSS lint rules are applied to the style attributes.
#11195 6a85588 Thanks @dyc3! - Fixed Svelte files failing to parse when an expression begins with an object literal.

Now the following snippet is correctly parsed:
```
<p>{{ a: true }}</p>
<div class={{ active: isActive }}></div>
```
#11173 481d008 Thanks @Austin1serb! - Fixed #10242: JavaScript GritQL patterns with multiple metavariables now match snippets consistently in WebAssembly.
#11187 23c0369 Thanks @ematipico! - Added the nursery rule noInvalidPropertyInitValue, which reports an @property whose initial-value does not match its syntax descriptor. For example, the following declaration triggers the rule because red is not a <length>:
```
@property --size {
  syntax: "<length>";
  inherits: false;
  initial-value: red;
}
```
#11272 73896e6 Thanks @ematipico! - Improved the diagnostic emitted by noRootType.
#11240 bd0b68d Thanks @ematipico! - Fixed #11223: Improved the
performance of noMisusedPromises
when analyzing async class methods that call other methods through this.
#11172 4a0bc5c Thanks @saberoueslati! - Fixed #10806: noUselessFragments no longer causes Biome to panic when its unsafe fix removes a fragment used as a JSX attribute value.
#11227 4d603b0 Thanks @saberoueslati! - Fixed #11178: noUndeclaredVariables no longer reports Vue's built-in instance properties, such as $slots and $attrs, in template expressions or $event in inline event-handler expressions. The instance properties are still reported inside <script setup>, where they are not defined.
#11187 23c0369 Thanks @ematipico! - Fixed CSS parsing of registered custom properties: Biome now correctly validates the syntax descriptor of @property rules.

`v2.5.7`

Compare Source

Patch Changes

#10822 c171b3b Thanks @pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.
#11136 e63354c Thanks @AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.
#10094 e007143 Thanks @THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.
#11184 135f476 Thanks @subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
#8239 a519f9d Thanks @cormacrelf! - Fixed #8233, where Biome CLI in
stdin mode didn't work correctly when handling files in projects with nested
configurations. For example, with the following structure,
--stdin-file-path=subdirectory/... would not use the nested configuration in
subdirectory/biome.json:
```
├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js
```
```
biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
```
Now, the nested configuration is correctly picked up and applied.

In addition, Biome now shows a warning if --stdin-file-path is provided but
that path is ignored and therefore not formatted or fixed.
#11138 8c2c6bd Thanks @ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
```
declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;

schedule(async () => {}) ?? "fallback";
```
The following code is also now invalid, because map(() => 42) returns 42:
```
type Mapper<T> = () => T;
declare function map<T>(mapper: Mapper<T>): T;

map(() => 42) || flag;
```
#11138 8c2c6bd Thanks @ematipico! - Fixed #11087: noUnnecessaryConditions no longer reports optional chains and nullish coalescing whose receiver can be nullish.

For example, the optional chain and fallback in the following code are no longer reported:
```
declare const usage: { range: { startDate: string } } | null;
const startDate = usage?.range.startDate ?? "N/A";
```
#11118 9c16840 Thanks @subotac! - Fixed #11098: The HTML formatter now preserves the configured trailing newline when a file ends with a comment.
```
-
\ No newline at end of file
+
```
#11201 0e80610 Thanks @Bishwas-py! - Fixed #11182: suppression comments for noPositiveTabindex now suppress the rule in HTML files when the attributes of the element span multiple lines.
#11079 607afd2 Thanks @dyc3! - The HTML formatter now lays out the srcset attribute of <img> and <source> as the list of candidates it is. Runs of whitespace between candidates collapse, and once the list no longer fits on one line each candidate goes on its own line with the descriptors aligned:
```
- <img srcset="/visual@0.5.png  400w, /visual.png 805w, /visual@2x.png 1610w, /visual@3x.png 2415w" />
+ <img
+   srcset="
+     /visual@0.5.png  400w,
+     /visual.png      805w,
+     /visual@2x.png  1610w,
+     /visual@3x.png  2415w
+   "
+ />
```
#11156 fed72c7 Thanks @saberoueslati! - Fixed #11129: noUnusedVariables no longer reports Vue bindings as unused when they are assigned through automatically unwrapped template refs.

#11124 d890b39 Thanks @denbezrukov! - Fixed CSS formatting of line comments between a declaration colon and value to preserve their source indentation.

 .test {
   background:
-  /////// foo
-  // bar
+        /////// foo
+        // bar
     radial-gradient(circle, #&#8203;000, transparent);
 }

#11113 3d8ab73 Thanks @denbezrukov! - Fixed CSS formatting of long block comments between comma-separated property values:

 .foo {
   box-shadow:
-    1000px /* long long long long long long long long long long long long comment */ 1000px /* long long long long long long long long long comment */ 2px color(srgb 0.555555555 0.555555555 0.555555555),
+    1000px
+      /* long long long long long long long long long long long long comment */
+      1000px /* long long long long long long long long long comment */ 2px
+      color(srgb 0.555555555 0.555555555 0.555555555),
     1px 1px black;
 }

#11127 da5c1a5 Thanks @dyc3! - The HTML formatter now picks the quote character for an attribute by counting the quotes in the value rather than looking only for a double quote. ' and " count as the characters they stand for, and only the character that ends up as the delimiter stays escaped:
```
- <div title='123 &apos;&quot; 456'></div>
+ <div title="123 '&quot; 456"></div>
```
Entities that are not quotes, such as & or &[#39](https://redirect.github.com/biomejs/biome/issues/39);, are left exactly as written.
#11193 77035bb Thanks @dyc3! - Fixed the HTML formatter collapsing the blank line between an element and the text that follows it. A blank line before text is now kept, the way one before another element already was:
```
  <div>foo</div>
-
  text
```
#11106 ad80f57 Thanks @dyc3! - The HTML formatter now writes the HTML5 doctype in lowercase, matching Prettier:
```
- <!DOCTYPE html>
+ <!doctype html>
```
This only applies to a plain .html file whose doctype stands alone. A doctype that names a DTD keeps the case it was written with, since the rest of the declaration is not lowercased either:
```
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
```
A .vue, .svelte, or .astro file keeps whatever the author wrote.
#11188 60679db Thanks @dyc3! - Fixed the HTML formatter printing a comment twice when it ended the line of the last element in a document:
```
- text
+ text
```
#11077 4dcd0d9 Thanks @dyc3! - Fixed a bug where the HTML formatter collapsed the whitespace inside <textarea>, <xmp> and <plaintext>, changing what the page renders.
```
- <textarea>
-  line one
- line two </textarea>
+ <textarea>line one line two</textarea>
```
Biome now prints the content of these elements exactly as it appears in the source, matching the existing behavior for <pre>.
#11194 abfbb11 Thanks @dyc3! - Fixed the HTML formatter refusing to format a Svelte file containing an array pattern that skips a position:
```
{#each animals as [, value]}
	<p>{value}</p>
{/each}
```
#10094 e007143 Thanks @THEjacob1000! - Fixed useSortedClasses to correctly detect unsorted classes in static member expression tagged templates (e.g. tw.div\...``). Previously, these were silently skipped due to surrounding whitespace trivia not being stripped from the tag name.
#11078 10da30e Thanks @dyc3! - Fixed Vue single-file components failing to parse when they contain a custom block such as <i18n> or <docs>, or a <template> written in another language. Their content is no longer read as HTML, so a block may hold whatever its own tooling expects:
```
<docs>
This block is prose, and it may mention a `<my-component>` without closing it.
</docs>

<template lang="pug">
  .test
    #foo
</template>
```
Previously both blocks produced a parse error and the whole file was left unformatted. Biome now prints their content unchanged while still formatting the opening tag.
#11231 4afd901 Thanks @ematipico! - Improved the performance of the following lint rules:
- noArguments.
- noGlobalAssign.
- noUndeclaredVariables.
- noRestrictedGlobals.
- noInvalidUseBeforeDeclaration.
- noShadow.
- noRedeclare.
#11134 2fa0a62 Thanks @yanthomasdev! - Clarified the warning emitted when using the experimental json and json-pretty reporters.
#11198 ed88b13 Thanks @saberoueslati! - Fixed #11171: variables referenced only inside a Svelte attachment ({@attach ...}) are no longer reported as unused by noUnusedVariables and noUnusedImports.
#11155 6ee17ea Thanks @dyc3! - Improved performance when printing diagnostics to the console.
#11160 217f8ad Thanks @dyc3! - Improved the performance of noFloatingPromises by skipping type inference for assignment statements, which are always considered handled.
#11159 26c23d9 Thanks @saberoueslati! - Fixed #11144: noFloatingPromises no longer reports already-awaited optional Promise values.
#11138 8c2c6bd Thanks @ematipico! - Fixed #11121: noUnnecessaryConditions no longer reports conditions based on an inapplicable function overload.

For example, the condition in the following code is no longer reported because query({}) selects the overload that returns boolean:
```
declare function query(options: { initial: string }): { isPending: false };
declare function query(options: { initial?: string }): { isPending: boolean };

const { isPending } = query({});
isPending || fallback;
```
#11152 c4fc6a9 Thanks @dyc3! - Improved the performance of collecting rule timings with --profile-rules in heavily multithreaded environments.
#11128 4d3ff76 Thanks @ematipico! - Fixed #7635: noDeprecatedImports now detects deprecated ambient declarations that are exported separately.
#11117 01f7ef5 Thanks @subotac! - Fixed #11014: noDelete no longer reports process.env["FOO"] style property deletions.
#11168 9847e68 Thanks @saberoueslati! - Added the nursery rule noNonScalableViewport, which reports viewport metadata that disables user scaling with user-scalable=no.

For example:
```
<meta name="viewport" content="width=device-width, user-scalable=no" />
```
#11154 a1d6b1f Thanks @dyc3! - Improved the performance of noImportCycles by skipping graph traversals for imports that cannot be part of a cycle.
#11175 d96d6dd Thanks @ematipico! - Fixed CSS parsing of registered custom properties: Biome now correctly validates the syntax descriptor of @property rules.

`v2.5.6`

Compare Source

Patch Changes

#11035 0e4b03b Thanks @ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

#11043 22ec076 Thanks @denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

 .example {
   value: outer(
     1,
     /* comment */
     nested(
-      first,
-      second
-    )
+        first,
+        second
+      )
   );
 }

#11007 c9acb25 Thanks @BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.
#10152 50a9bd8 Thanks @Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.
#11105 8ffe2b9 Thanks @dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.
#10533 5809875 Thanks @Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.
#11040 0abb620 Thanks @Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.
#10858 6d18204 Thanks @ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.
#11009 2c36626 Thanks @ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

The following statements are now reported:
```
type AsyncCallback = () => Promise<void>;
declare const callback: AsyncCallback;
callback();

[1, 2, 3].map(async (value) => value);
```
#10973 9cb044c Thanks @ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:
```
function unresolvedReturnType(): MissingType {
  return "value" as const;
}
```
#11071 15047a2 Thanks @dyc3! - The HTML parser now accepts mixed-case doctype declarations.
#11030 cc90e65 Thanks @marschattha! - The rdjson reporter now populates the severity field of each diagnostic (ERROR, WARNING, or INFO), so tools consuming Reviewdog Diagnostic Format output no longer need to assume a default severity.
#11009 2c36626 Thanks @ematipico! - Fixed a performance regression in type-aware JavaScript lint rules by inferring only requested types and memoizing export resolution.
#11056 903b177 Thanks @dyc3! - Added support for Svelte declaration tags using let and const. Biome can now parse, format, and lint bindings declared in these tags.
#11045 89c27c6 Thanks @ematipico! - Improved the performance of Biome formatter up to ~7% across the board.
#9806 781d68d Thanks @dyc3! - Added the nursery rule noJsRestrictedProperties, which ports ESLint's no-restricted-properties rule. Biome now flags restricted member access and object destructuring, and biome migrate eslint preserves the rule's options.

pnpm/pnpm (pnpm)

`v11.21.0`: pnpm 11.21

Compare Source

Minor Changes

Added interactive group selection to pnpm update --global --interactive.
Running pnpm setup, pnpm self-update, or a command that modifies the global installation (such as pnpm add --global) through sudo now prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail with ERR_PNPM_SUDO_NOT_SUPPORTED in pnpm v12. Read-only global commands (such as pnpm bin --global) are unaffected.

Patch Changes

Fixed pnpm failing to start under asynchronous Node.js module loaders when no .pnpmfile.mjs exists pnpm/pnpm#11701.
Fixed minimumReleaseAge fallback for custom dist-tags so the selected version does not exceed the registry’s original tag target.
Removing a dependency from package.json and reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped from pnpm-lock.yaml, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune.
Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in pnpm-lock.yaml directly, reusing the same check the pnpm.overrides fast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions.
Fixed a CI regression where github:owner/repo dependencies (and other shorthand Git specifiers) would fail to install with Permission denied (publickey) on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. git+ssh:// or git@host:...):
- The repository visibility probe (an HTTP HEAD request) now retries transient failures such as 429 Too Many Requests, so host throttling of CI runners is no longer mistaken for a private repository.
- For non-SSH specifiers, anonymous HTTPS git ls-remote access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured.
- When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL.
- A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. codeload.github.com, which would fail to download for a private repository); it stays a regular git resolution so installs can use ambient Git credentials such as credential helpers and tokens.
Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL.

Fixes pnpm/pnpm#13276.
ng build and nuxt build now work under the global virtual store: pnpm's built-in compatibility extensions add the tslib dependency that @angular/build uses without declaring and the unplugin dependency that @nuxt/vite-builder v4 uses without declaring.
Fixed link: dependencies under enableGlobalVirtualStore so linked children are materialized and slots remain isolated by their resolved link targets.
An install that skips resolution because pnpm-lock.yaml is already up to date now reacts fully to packages the lockfile removed — for example after pulling a lockfile in which a dependency was deleted. The hoist layer is recomputed, so a package that became hoistable when a direct dependency was removed is hoisted, and pendingBuilds entries for removed packages are dropped instead of staying pending forever.
The held-back-update warning printed by pnpm update no longer fires when minimumReleaseAge is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See #13071.
Checking whether ignoredOptionalDependencies is up to date no longer reorders the configured patterns. The check sorted them in place, which could move an ! exclusion ahead of the pattern it excludes from and flip which optional dependencies were ignored.
Changing autoInstallPeers, dedupePeers, peersSuffixMaxLength, excludeLinksFromLockfile, or injectWorkspacePackages no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it: no package or project declares a peer dependency for the peer settings, and no project depends on a directory or on another workspace project for the link and injection settings. The new setting is recorded in pnpm-lock.yaml and the install proceeds from the existing resolution. Every other case still falls back to a full resolution.
Adding, editing, or removing an entry in patchedDependencies no longer re-resolves the dependency graph. Resolution never reads a patch — it only records the patch file's hash against the package it matches — so the install now rewrites the affected entries in pnpm-lock.yaml and materializes the patched package from the store instead. Installs still fall back to a full resolution when the patched package is reachable as a peer dependency, and when the new configuration would leave a patch unused while allowUnusedPatches is off, so ERR_PNPM_UNUSED_PATCH is still reported.
Resolving a private git repository no longer blocks on an interactive credential prompt: git ls-remote now fails fast with an authentication error when git has no credentials for the repository #13522.
Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same ERR_PNPM_NO_OFFLINE_META condition used by offline resolution.
POSIX shell shims now follow symbolic links before computing basedir, preventing execution failures when a shim is invoked via an external symlink on PATH #13405.
The automatic packageManager version switch works again on registries whose tarball URLs point at a different host than the registry itself (load-balanced feed proxies, Artifactory-style mirrors). Package-manager entries are now always recorded with integrity-only resolutions — the download URL is derived from the trusted bootstrap registry instead — and entries persisted in an invalid shape by an earlier pnpm are discarded and re-resolved instead of failing every command #13619.
Registries that serve no npm signature metadata (private mirrors and feed proxies commonly strip dist.signatures) no longer break the automatic packageManager version switch and pnpm self-update #13147. When the configured registry cannot provide a verifiable signature, pnpm now fetches the signature from registry.npmjs.org and verifies it against the same embedded npm keys over the installed integrity — which proves exactly the same thing. If no signature can be obtained from either source (for example, both are unreachable, or the registry publishes only a shasum), pnpm proceeds with a warning instead of failing, but only when the packages resolve through a registry configured in the user's own (non-project) configuration; the download stays pinned by the lockfile integrity, and a signature that exists but does not validate still fails the switch.
pnpm fetch, and any install run with virtualStoreOnly, no longer writes a .pnp.cjs loader under nodeLinker: pnp. These installs populate the virtual store without linking the project, so the loader would have claimed the project resolves out of a store it was never linked into. The importer links and node_modules/.package-map.json were already skipped; the PnP loader now follows the same rule.
Prevent pnpm from removing project files when modulesDir resolves to the project root.
Speed up installs after adding ignoredOptionalDependencies patterns by removing newly ignored optional dependencies and pruning packages that are no longer reachable without resolving the dependency graph again.
When a failed install re-copies a bin script from the store, rerunning pnpm install now reapplies the executable bit to the bin instead of leaving it non-executable #12742.
pnpm root -g and pnpm bin -g now print warnings to stderr instead of stdout, so their stdout stays a clean, machine-readable path. Previously, running either command with --global in a project that pins a package manager (e.g. via the packageManager field) printed a warning like [WARN] Using --global skips the package manager check for this project ahead of the path, breaking programs that capture the output as a path #13672.

In pnpm 12, pnpm root -g and pnpm prefix -g are now supported (they previously failed with ERR_PNPM_CLI_ROOT_GLOBAL_UNSUPPORTED / ERR_PNPM_CLI_PREFIX_GLOBAL_UNSUPPORTED), and the reporter output of dlx, create, config, sbom, with, store, prefix, root, and bin goes to stderr, matching pnpm 11.
pnpm setup no longer makes Node.js print a MODULE_TYPELESS_PACKAGE_JSON warning about dist/worker.js on every command. The package.json it writes next to a standalone executable now declares "type": "module".
pnpm update without saving no longer records a version that the manifest's range excludes. The kept range stays authoritative: a requested version outside it is skipped with a warning, and a requested range, a dist tag, or --latest resolves within it instead of past it. Previously each of these could write a lockfile entry that contradicted its own specifier, which the next pnpm install --frozen-lockfile rejected with ERR_PNPM_OUTDATED_LOCKFILE #12764.
pnpm version -r --json now outputs [] instead of human-readable text when no pending changes exist pnpm/pnpm#13217.

Platinum Sponsors

Gold Sponsors

`v11.20.0`: pnpm 11.20

Compare Source

Minor Changes

Security fix. Affects projects using namedRegistries on pnpm 11.1.0–11.19.x. It is semi-breaking for those projects — see "If you use named registries" below.

The lockfile recorded no marker for which registry a package came from. Packages were keyed by name@version alone, and entry lookup went through refToRelative(ref, name), so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single packages: entry and whichever resolved first decided the tarball every consumer got.

That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell.

Packages resolved from a named registry are now recorded under registry-qualified keys (<name>@<registryName>:<version>, e.g. foo@work:1.0.0), so each registry gets its own entry and the lockfile pins which one a dependency came from.

The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use namedRegistries sees no difference, and older pnpm versions keep reading the file.

If you use named registries

Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating.

Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Madrid)

Branch creation
- "after 2pm on sunday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

pkg-pr-new · 2026-08-02T14:01:30Z

Open in StackBlitz

npm i https://pkg.pr.new/tinyglobby@213

commit: fdffd23

renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from a9285d2 to cbbd9be Compare August 8, 2026 22:02

renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from faaf507 to 151fffe Compare August 11, 2026 23:27

Update all non-major dependencies

fdffd23

renovate Bot force-pushed the renovate/all-minor-patch branch from 151fffe to fdffd23 Compare August 12, 2026 09:04

Navigation Menu

Uh oh!

Update all non-major dependencies - #213

Update all non-major dependencies#213
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.5.8

Patch Changes

v2.5.7

Patch Changes

v2.5.6

Patch Changes

v11.21.0: pnpm 11.21

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v11.20.0: pnpm 11.20

Minor Changes

If you use named registries

Configuration

Uh oh!

pkg-pr-new Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 2, 2026 •

edited

Loading

`v2.5.8`

`v2.5.7`

`v2.5.6`

`v11.21.0`: pnpm 11.21

`v11.20.0`: pnpm 11.20

pkg-pr-new Bot commented Aug 2, 2026 •

edited

Loading