Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 3, 2025

Bumps pnpm from 8.9.2 to 10.20.0.

Release notes

Sourced from pnpm's releases.

pnpm 10.20

Minor Changes

  • Support --all option in pnpm --help to list all commands #8628.

Patch Changes

  • When the latest version doesn't satisfy the maturity requirement configured by minimumReleaseAge, pick the highest version that is mature enough, even if it has a different major version #10100.
  • create command should not verify patch info.
  • Set managePackageManagerVersions to false, when switching to a different version of pnpm CLI, in order to avoid subsequent switches #10063.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.20.0

Minor Changes

  • Support --all option in pnpm --help to list all commands #8628.

Patch Changes

  • When the latest version doesn't satisfy the maturity requirement configured by minimumReleaseAge, pick the highest version that is mature enough, even if it has a different major version #10100.
  • create command should not verify patch info.
  • Set managePackageManagerVersions to false, when switching to a different version of pnpm CLI, in order to avoid subsequent switches #10063.

10.19.0

Minor Changes

  • You can now allow specific versions of dependencies to run postinstall scripts. onlyBuiltDependencies now accepts package names with lists of trusted versions. For example:

    onlyBuiltDependencies:
      - nx@21.6.4 || 21.6.5
      - esbuild@0.25.1

    Related PR: #10104.

  • Added support for exact versions in minimumReleaseAgeExclude #9985.

    You can now list one or more specific versions that pnpm should allow to install, even if those versions don’t satisfy the maturity requirement set by minimumReleaseAge. For example:

    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
      - nx@21.6.5
      - webpack@4.47.0 || 5.102.1

10.18.3

Patch Changes

  • Fix a bug where pnpm would infinitely recurse when using verifyDepsBeforeInstall: install and pre/post install scripts that called other pnpm scripts #10060.
  • Fixed scoped registry keys (e.g., @scope:registry) being parsed as property paths in pnpm config get when --location=project is used #9362.
  • Remove pnpm-specific CLI options before passing to npm publish to prevent "Unknown cli config" warnings #9646.
  • Fixed EISDIR error when bin field points to a directory #9441.
  • Preserve version and hasBin for variations packages #10022.
  • Fixed pnpm config set --location=project incorrectly handling keys with slashes (auth tokens, registry settings) #9884.
  • When both pnpm-workspace.yaml and .npmrc exist, pnpm config set --location=project now writes to pnpm-workspace.yaml (matching read priority) #10072.
  • Prevent a table width error in pnpm outdated --long #10040.
  • Sync bin links after injected dependencies are updated by build scripts. This ensures that binaries created during build processes are properly linked and accessible to consuming projects #10057.

... (truncated)

Commits
  • 49f03d1 chore(release): 10.20.0
  • 5c27936 fix(create): create command should not verify patch info (#10122)
  • 6e9ad42 feat: support -a option in pnpm --help to list all commands (#8628)
  • a1a1ab3 fix: don't ever switch to another version of pnpm when it has beens switched ...
  • d9bcd61 chore(release): 10.19.1-oidc-test.3
  • 34c727a chore(release): 10.19.1-oidc-test.2
  • 0cde128 chore: update repository fields
  • eb0df0d chore(release): 10.19.1-oidc-test.1
  • e5ac91f chore(release): 10.19.1-oidc-test.0
  • afdc1e9 chore: add artifact keyword to artifact packages
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for pnpm since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) from 8.9.2 to 10.20.0.
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/main/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v10.20.0/pnpm)

---
updated-dependencies:
- dependency-name: pnpm
  dependency-version: 10.20.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 3, 2025
@vercel
Copy link

vercel bot commented Nov 3, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
devs-in-tech Ready Ready Preview Comment Nov 3, 2025 8:11pm

@netlify
Copy link

netlify bot commented Nov 3, 2025

Deploy Preview for devsintech failed. Why did it fail? →

Name Link
🔨 Latest commit 6c66893
🔍 Latest deploy log https://app.netlify.com/projects/devsintech/deploys/69090c4883cc830008e11433

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant