chore(deps): update pnpm to v8

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pnpm (source)	7.22.0 -> 8.14.1

---

Release Notes

pnpm/pnpm (pnpm)

v8.14.1

Compare Source

Patch Changes

• Resolve the current working directory to its real location before doing any operations #​6524.
• Allow using token helpers in pnpm publish #​7316.
• Handle Git repository names containing capital letters #​7488.
• When hoisted-workspace-packages is true don't hoist the root package even if it has a name. Otherwise we would create a circular symlink.

Our Gold Sponsors

Our Silver Sponsors

v8.14.0

Compare Source

Minor Changes

• A new option added for hoisting packages from the workspace. When hoist-workspace-packages is set to true, packages from the workspace are symlinked to either <workspace_root>/node_modules/.pnpm/node_modules or to <workspace_root>/node_modules depending on other hoisting settings (hoist-pattern and public-hoist-pattern) #​7451.
• The pnpm dedupe command now accepts more command line options that the pnpm install command also accepts. Example: pnpm dedupe --store-dir=local-store-dir

Patch Changes

• The package information output by cat-index should be sorted by key.
• pnpm deploy should not touch the target directory if it already exists and isn't empty #​7351.
• pnpm add a-module-already-in-dev-deps will show a message to notice the user that the package was not moved to "dependencies" #​926 and fix #​7319.
• Don't install Node.js when use-node-version is set in a WebContainer #​7478.
• Fix copy-on-write on Windows Dev Drives #​7468.

Our Gold Sponsors

Our Silver Sponsors

v8.13.1

Minor Changes

• New commands added for inspecting the store:

  • pnpm cat-index: Prints the index file of a specific package in the store. The package is specified by its name and version:

    pnpm cat-index <pkg name>@&#8203;<pkg version>
    

  • pnpm cat-file: Prints the contents of a file based on the hash value stored in the index file. For example:

    pnpm cat-file sha512-mvavhfVcEREI7d8dfvfvIkuBLnx7+rrkHHnPi8mpEDUlNpY4CUY+CvJ5mrrLl18iQYo1odFwBV7z/cOypG7xxQ==
    

  • (EXPERIMENTAL) pnpm find-hash: Lists the packages that include the file with the specified hash. For example:

    pnpm find-hash sha512-mvavhfVcEREI7d8dfvfvIkuBLnx7+rrkHHnPi8mpEDUlNpY4CUY+CvJ5mrrLl18iQYo1odFwBV7z/cOypG7xxQ==
    

    This command is experimental. We might change how it behaves.

  Related issue: #​7413.

• A new setting added for symlinking injected dependencies from the workspace, if their dependencies use the same peer dependencies as the dependent package. The setting is called dedupe-injected-deps #​7416.

• Use --fail-if-no-match if you want the CLI fail if no packages were matched by the command #​7403.

Patch Changes

• pnpm list --parseable should not print the same dependency multiple times #​7429.
• Fix error message texts in the pnpm env commands #​7456.
• Better support for light themed terminals by the pnpm update --interactive command #​7439.
• Fix EPERM error that occasionally happened on Windows during renames in the store #​7213.
• Fix error as in update -i -r with Git specifiers #​7415.
• Added support for boolean values in 'bundleDependencies' package.json fields when installing a dependency. Fix to properly handle 'bundledDependencies' alias #​7411.

Our Gold Sponsors

Our Silver Sponsors

v8.12.1

Compare Source

Patch Changes

• Don't report dependencies with optional dependencies as being added on repeat install. This was a bug in reporting #​7384.
• Fix a bug where --fix-lockfile crashes on tarballs #​7368.
• Do not create empty patch directory.
• Installation should not fail if an empty node_modules directory cannot be removed #​7405.

Our Gold Sponsors

Our Silver Sponsors

v8.12.0

Compare Source

Minor Changes

• Add support for basic authorization header #​7371.

Patch Changes

• Fix a bug where pnpm incorrectly passes a flag to a run handler as a fallback command #​7244.
• When dedupe-direct-deps is set to true, commands of dependencies should be deduplicated #​7359.

Our Gold Sponsors

Our Silver Sponsors

v8.11.0

Compare Source

Minor Changes

• (IMPORTANT) When the package tarballs aren't hosted on the same domain on which the registry (the server with the package metadata) is, the dependency keys in the lockfile should only contain /<pkg_name>@&#8203;<pkg_version, not <domain>/<pkg_name>@&#8203;<pkg_version>.

  This change is a fix to avoid the same package from being added to node_modules/.pnpm multiple times. The change to the lockfile is backward compatible, so previous versions of pnpm will work with the fixed lockfile.

  We recommend that all team members update pnpm in order to avoid repeated changes in the lockfile.

  Related PR: #​7318.

Patch Changes

• pnpm add a-module-already-in-dev-deps will show a message to notice the user that the package was not moved to "dependencies" #​926.
• The modules directory should not be removed if the registry configuration has changed.
• Fix missing auth tokens in registries with paths specified (e.g. //npm.pkg.github.com/pnpm). #​5970 #​2933

Our Gold Sponsors

Our Silver Sponsors

v8.10.5

Compare Source

Patch Changes

• Don't fail on an empty pnpm-workspace.yaml file #​7307.

Our Gold Sponsors

Our Silver Sponsors

v8.10.4

Compare Source

Patch Changes

• Fixed out-of-memory exception that was happening on dependencies with many peer dependencies, when node-linker was set to hoisted #​6227.

Our Gold Sponsors

Our Silver Sponsors

v8.10.3

Compare Source

Patch Changes

• (Important) Increased the default amount of allowed concurrent network request on systems that have more than 16 CPUs #​7285.

• pnpm patch should reuse existing patch when shared-workspace-file=false #​7252.

• Don't retry fetching missing packages, since the retries will never work #​7276.

• When using pnpm store prune --force alien directories are removed from the store #​7272.

• Downgraded npm-packlist because the newer version significantly slows down the installation of local directory dependencies, making it unbearably slow.

  npm-packlist was upgraded in this PR to fix #​6997. We added our own file deduplication to fix the issue of duplicate file entries.

• Fixed a performance regression on running installation on a project with an up to date lockfile #​7297.

• Throw an error on invalid pnpm-workspace.yaml file #​7273.

Our Gold Sponsors

Our Silver Sponsors

	Mend Renovate. View repository job log here.

[renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Progress: resolved 0, reused 0, downloaded 1, added 0
undefined
 ERR_PNPM_FETCH_404  GET https://registry.npmjs.org/@kaname-png/plugin-subcommands-advanced/-/plugin-subcommands-advanced-2.1.8.tgz: Not Found - 404

This error happened while installing a direct dependency of /tmp/renovate/repos/github/usepolystar/neph

No authorization header was set for the request.