chore(deps): update pnpm to v12.11.2 (#1178)

> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`12.9.1` →
`12.11.2`](https://renovatebot.com/diffs/npm/pnpm/12.9.1/12.11.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/12.11.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/12.9.1/12.11.2?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v12.11.2`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.2):
pnpm 12.11.2

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.11.1...v12.11.2)

This release fixes `--workspace-concurrency=Infinity`, filters set by an
`updateConfig` hook, and store fetches with `enable-modules-dir=false`.

##### Patch Changes

- `--workspace-concurrency=Infinity` now runs workspace projects with no
concurrency limit. It used to fail with `invalid digit found in string`
[#&#8203;16793](https://redirect.github.com/pnpm/pnpm/issues/16793).

- `pnpm install` and other recursive commands now apply the `filter` and
`filterProd` that an `updateConfig` hook sets. They used to run on every
workspace project
[#&#8203;16792](https://redirect.github.com/pnpm/pnpm/issues/16792).

- `enable-modules-dir=false` now also fetches the packages an install
reuses from an existing lockfile, so the store holds every package the
lockfile lists.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.11.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.1):
pnpm 12.11.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.11.0...v12.11.1)

This release fixes two ways `pnpm install` could fail, runs tools of any
Rust release through `pnx`, and treats `registry.npmjs.com` as an alias
of the npm registry.

##### Patch Changes

- `pnpm install` no longer fails when `packageManager` pins the pnpm
version that is already running and the registry does not publish that
version. pnpm warns and continues. A registry mirror that has not synced
a release no longer blocks the commands of a project pinned to it.

- `pnpm install` no longer fails with `ERR_PNPM_CMD_SHIM_CHMOD` when
`node_modules/.bin` holds a shim that another user created, if everyone
can already execute it and it is not world-writable. This happens when
several users share one checkout.

- `enable-modules-dir=false` (`enableModulesDir: false` through the
Node.js addon) fetches the registry packages the host can install into
the store again, as pnpm v10 did, while still writing nothing under
`node_modules`. The setting exists for a `node_modules` that something
else mounts from the store, such as a FUSE daemon, and that consumer no
longer has to download each package on first access. A plain
`--lockfile-only` run still fetches nothing.

- `pnpm pack` and `pnpm publish` no longer put `.npmignore` and
`.gitignore` files in the tarball. A `files` entry that names one still
ships it.

- pnpm now treats `https://registry.npmjs.com/` as an alias of
`https://registry.npmjs.org/`. Registry requests, credentials, and
trusted publishing use the canonical hostname.

- `pnx --package=rust@<channel> <tool>` runs a tool of that Rust
release, for example `pnx --package=rust@nightly-2026-01-01 cargo
build`. pnpm installs the release with the components and targets from
`rust-toolchain.toml` and the target of each `--target` argument.

- `pnpm install` now links agent skills for more coding agents. It
detects the agent from `ANTIGRAVITY_AGENT`, `COPILOT_AGENT`,
`COPILOT_CLI`, `CODEX_THREAD_ID`, `CODEX_SANDBOX`, `AI_AGENT`, and
`CLAUDE_CODE`
[pnpm/tasks#116](https://redirect.github.com/pnpm/tasks/issues/116).

- When the registry rejects `pnpm stage publish`, the error message now
starts with "Failed to stage package".

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.11.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.0):
pnpm 12.11.0

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.10.1...v12.11.0)

This release adds Rust toolchain management, links the agent skills that
dependencies ship, adds the `permissions` setting, and keeps the colors
of streamed script output.

##### Minor Changes

- `pnpm install` now links the agent skills that direct dependencies
ship under `skills/<name>/SKILL.md` into the project's agent skill
directories, such as `.claude/skills`. A package's skills are linked
only after you approve them with `pnpm approve`. The `skills.dirs`
setting chooses the directories
[pnpm/rfcs#35](https://redirect.github.com/pnpm/rfcs/pull/35).

Added the `permissions` setting, which records what each dependency may
do. Its `build` capability works like `allowBuilds` and takes precedence
over it. `pnpm approve-builds` writes to `permissions` when
`pnpm-workspace.yaml` already has it, and to `allowBuilds` otherwise.

Added `pnpm permissions`, which lists the granted and denied permissions
and the packages awaiting approval. `pnpm approve` reviews build scripts
and agent skills in one prompt
[pnpm/rfcs#36](https://redirect.github.com/pnpm/rfcs/pull/36).

- pnpm now installs and runs Rust toolchains.

- With `cargo.enabled`, `pnpm install` installs the toolchain named in
`rust-toolchain.toml`. pnpm verifies the release signature, stores the
toolchain once per machine, and links it into `.pnpm/rust`. `pnpm run`
and `pnpm exec` put its `cargo` and `rustc` on the `PATH`.
- `pnpm add -g rust@<channel>` installs a toolchain globally. The
`cargo` and `rustc` commands run it outside projects that pin their own.
`pnpm update -g`, `pnpm ls -g`, and `pnpm remove -g` manage it like any
global package.
- In a project, `pnpm add rust@<channel>` pins the toolchain in
`rust-toolchain.toml`.
- `pnpm shim add rust` adds project-aware shims for `cargo`, `rustc`,
and the other Rust tools. In a project with a `rust-toolchain.toml`,
they run the toolchain the file names and install it on first use.
Elsewhere, the next command of the same name on `PATH` runs, such as
rustup's.

- `pnpm run` and `pnpm exec` now keep the colors of script output that
they print under the project's name, such as with `--stream`. pnpm sets
`FORCE_COLOR=1` for these scripts when its own output is in color,
unless `FORCE_COLOR` is already set.

  Script output is also rendered more cleanly:

- A line that a progress bar redraws with `\r` shows only its last
state.
  - Escape codes that move the cursor or clear the screen are dropped.
  - Long colored lines are cut at the terminal width.
- `pnpm -r run` no longer garbles its live output when a script fails
while other scripts are still running.

##### Patch Changes

##### Installing packages

- pnpm no longer panics with "unexpected error when polling the I/O
driver" when it runs under QEMU user-mode emulation, such as a
`linux/amd64` container on an Apple Silicon Mac
[#&#8203;16696](https://redirect.github.com/pnpm/pnpm/issues/16696).

- `pnpm view`, `pnpm update`, and other commands that read registry
metadata now work behind proxies that end a response by closing the
connection without a TLS `close_notify` alert
[#&#8203;16704](https://redirect.github.com/pnpm/pnpm/issues/16704).

- pnpm now switches to the version a project pins in `packageManager` or
`devEngines.packageManager` even when `pnpm-workspace.yaml` has a
setting the running pnpm cannot read, such as a
`lockfile.includeResolutionSettings` section. If pnpm does not switch,
it still reports that setting
[#&#8203;16675](https://redirect.github.com/pnpm/pnpm/issues/16675).

- When the `pnpm` package has to download its native binary on first
run, it now uses the registry and credentials from `.npmrc` and from the
`npm_config_registry` and `pnpm_config_registry` environment variables.
`COREPACK_NPM_REGISTRY` still takes precedence. A project `.npmrc` is
not read when `COREPACK_INTEGRITY_KEYS` turns off the signature check
[#&#8203;16655](https://redirect.github.com/pnpm/pnpm/issues/16655).

- `pnpm install` and `pnpm add --config` now apply `minimumReleaseAge`
when they resolve a config dependency. A config dependency range
resolves to the newest version that is old enough, so a later clean
`pnpm install --frozen-lockfile` accepts the lockfile
[#&#8203;16660](https://redirect.github.com/pnpm/pnpm/issues/16660).

- `pnpm remove` with `catalogPrune` no longer removes catalog entries
that `pnpm-lock.yaml` still records for workspace projects missing from
disk. Before, a following frozen install failed with
`ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`
[#&#8203;16679](https://redirect.github.com/pnpm/pnpm/issues/16679).

- With `cargo.enabled`, `pnpm install` now writes the source replacement
for vendored crates into `.pnpm/crates/config.toml` and includes it as
optional from `.cargo/config.toml`. A checkout without `.pnpm` builds
with plain Cargo
[#&#8203;16659](https://redirect.github.com/pnpm/pnpm/issues/16659).

- With `nodeLinker.type` set to `loaded`, Node.js now stops with
`ERR_PNPM_LOADER_UNSUPPORTED_NODE` when it preloads the store loader on
a version the loader cannot serve. The supported versions are `^24.18.0
|| >=26.2.0`. On other versions, CommonJS packages imported from ESM
failed with `Cannot find module` on their first relative `require()`.

- On Windows, `pnpm install` no longer fails with "The filename,
directory name, or volume label syntax is incorrect" when a package
contains a file whose name is invalid on Windows, such as
`icon.svg?as=metadata.d.ts`. pnpm removes the invalid characters from
the name and prints a warning that lists the renamed files.

- On Windows, hoisting no longer fails intermittently with link errors
when a junction is created or replaced concurrently
[pnpm/tasks#53](https://redirect.github.com/pnpm/tasks/issues/53).

##### Resolving dependencies

- `pnpm install --no-optional` now installs the peer dependencies a
project declares when `autoInstallPeers` is on. The lockfile marked such
a peer `optional: true` when another dependency had it as an optional
peer.

- `pnpm install` and `pnpm dedupe` now link an optional peer to the
workspace package that the workspace root depends on when the picked
version matches it. They installed the registry package with the same
name and version
[#&#8203;16706](https://redirect.github.com/pnpm/pnpm/issues/16706).

- Removal overrides such as `"debug>supports-color": "-"` now also apply
to an optional peer that a package declares only in
`peerDependenciesMeta`
[#&#8203;16681](https://redirect.github.com/pnpm/pnpm/issues/16681).

- `pnpm add` and other installs that re-resolve dependencies now keep
the locked `devEngines.runtime` version while it still satisfies the
declared range
[#&#8203;16764](https://redirect.github.com/pnpm/pnpm/issues/16764).

- `pnpm audit --fix update` now updates only the dependencies whose
locked version is vulnerable
[#&#8203;14928](https://redirect.github.com/pnpm/pnpm/issues/14928).

- `pnpm outdated` and `pnpm update --interactive` now apply `overrides`
before they look up the latest version. Before, a dependency overridden
to an npm alias was compared with the latest version of the package the
override replaces
[#&#8203;16719](https://redirect.github.com/pnpm/pnpm/issues/16719).

##### Patched dependencies

- Patches saved with CRLF line endings now apply, including a patch that
creates or deletes a file. pnpm rejected the git headers of such a patch
with `ERR_PNPM_INVALID_PATCH` and the message `invalid file mode:
100644`
[#&#8203;16641](https://redirect.github.com/pnpm/pnpm/issues/16641).

- A patch that changes a file's mode, such as adding or removing the
executable bit, now applies the new mode on Unix
[pnpm/tasks#110](https://redirect.github.com/pnpm/tasks/issues/110).

##### Injected dependencies and deploy

- With `sharedWorkspaceLockfile: false`, an injected workspace package
installed in the same run as its dependent now holds only the files its
`files` field selects. The copy also held other files of the project,
such as `tsconfig.json`
[#&#8203;16683](https://redirect.github.com/pnpm/pnpm/issues/16683).

- A script listed in `syncInjectedDepsAfterScripts` no longer fails when
it rewrites `package.json` while pnpm is copying its edits into the
injected copies. The sync after the script now replaces a half-copied
manifest.

- `pnpm deploy` with a shared lockfile no longer fails with
`ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` for `settings.dedupeInjectedDeps` or
`settings.dedupePeerDependents` when
`lockfile.includeResolutionSettings` is enabled. The deployed lockfile
now records both settings as `false`, the values the deploy installs
with.

- `pnpm deploy` now writes the dependencies in the deployed
`package.json` sorted by name. It also sorts the `allowBuilds` entries
in the deployed `pnpm-workspace.yaml`. Repeated deploys of the same
lockfile now produce identical files
[#&#8203;16687](https://redirect.github.com/pnpm/pnpm/issues/16687).

##### Packing and publishing

- `pnpm pack` and `pnpm publish` now match `.npmignore` and `.gitignore`
rules the way npm does. A negation such as `!lib/**` or
`!lib/**/!(*.map)` re-includes files under a directory that an earlier
`*` rule excluded
[#&#8203;16743](https://redirect.github.com/pnpm/pnpm/issues/16743).

- `pnpm pack` and `pnpm publish` no longer always include root files
that merely start with `README`, `LICENSE`, or `LICENCE`, such as
`README_INTERNAL.md`. Only `README`, `LICENSE`, `LICENCE`, and
`COPYING`, with or without an extension, ship regardless of `files` and
`.npmignore`, as in npm
[#&#8203;16753](https://redirect.github.com/pnpm/pnpm/issues/16753).

- `pnpm publish --provenance=false` and `--no-provenance` now turn off
provenance under trusted publishing, so a package can be published from
a self-hosted runner. Setting `provenance: false` in
`pnpm-workspace.yaml` does the same
[#&#8203;16721](https://redirect.github.com/pnpm/pnpm/issues/16721).

##### Speed and resource use

- `pnpm install` hardlinks files from a group-writable or world-writable
store again. pnpm copied every file from such a store into
`node_modules`
[#&#8203;16677](https://redirect.github.com/pnpm/pnpm/issues/16677).

- A repeat `pnpm install` no longer imports patched packages and
packages with build scripts again when nothing changed. Their builds no
longer run again either. This happened when `recursiveInstall` was
`false` or the project had a `file:` dependency
[#&#8203;16705](https://redirect.github.com/pnpm/pnpm/issues/16705).

- Verifying the lockfile against `trustPolicy` and `minimumReleaseAge`
uses less memory. pnpm no longer keeps every published version's
manifest of each checked package in memory until the install ends
[#&#8203;16656](https://redirect.github.com/pnpm/pnpm/issues/16656).

- `pnpm rebuild <pkg>` and `pnpm rebuild --pending` no longer read the
manifest of every installed package to find build scripts. Only the
selected packages are inspected and built. On a large `node_modules`
served lazily, such as over a network or FUSE mount, this turned a
rebuild of a few packages into a fetch of every package.

- `pnpm rebuild` no longer removes and recreates `node_modules` when the
settings recorded in `node_modules/.modules.yaml` differ from the
current configuration. The rebuild runs the build scripts against the
installed packages as they are.

- `pnpm store prune` now compacts the store's `index.db` after removing
package entries, so the file shrinks again
[#&#8203;16717](https://redirect.github.com/pnpm/pnpm/issues/16717).

##### Registry commands

- `pnpm whoami`, `pnpm bugs`, `pnpm docs`, `pnpm repo`, `pnpm star`,
`pnpm unstar`, and `pnpm stars` now honor the `--registry` option.

- `--registry` now takes precedence over a scope's configured registry
for scoped packages in `pnpm access`, `pnpm view`, `pnpm repo`, `pnpm
star`, `pnpm unstar`, `pnpm owner`, `pnpm deprecate`, `pnpm
undeprecate`, `pnpm unpublish`, `pnpm dist-tag`, `pnpm team`, and `pnpm
stage`. Without `--registry`, `pnpm access` now sends a scoped package
or scope to the registry configured for that scope.

- Registry commands now keep the path of a registry URL such as
`https://example.com/npm/` when they build request URLs. This applies to
`pnpm access`, `pnpm owner`, `pnpm ping`, `pnpm search`, `pnpm star`,
`pnpm stars`, `pnpm team`, `pnpm unstar`, and `pnpm whoami`.

- `pnpm view` now honors the network retry settings.

- `pnpm repo` now fetches the repository URLs of several packages in
parallel.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.10.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.10.1):
pnpm 12.10.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.10.0...v12.10.1)

This release fixes `pnpm install` failures after an `overrides` change
and on a filtered frozen install with `catalogPrune`. It also fixes
several bugs in the experimental `nodeLinker.type: loaded`, which now
keeps its generated files in `node_modules`.

##### Patch Changes

- With `nodeLinker.type: loaded`, pnpm now writes its generated files to
`node_modules`, which projects already ignore in git. The store manifest
and loader are `node_modules/.pnpm/.store-manifest.json` and
`node_modules/.pnpm/.store-loader.mjs`. Bin shims are in
`node_modules/.bin`.

Earlier versions wrote `.pnpm-store.json` and `.pnpm-store-loader.mjs`
to the project root, and a `.pnpm` directory to the root and to each
workspace package. Delete them after reinstalling.

- With `nodeLinker.type: loaded`, packages that ship their own
`node_modules` directory, such as `npm` with its bundled dependencies,
now load from the store. Before, one such package in the install stopped
every Node.js process from starting.

- With `nodeLinker.type: loaded`, scripts can now run a Node.js runtime
installed through `devEngines.runtime`. Before, every script that called
`node` re-ran its own shim until it failed with "Argument list too
long".

- With `nodeLinker.type: loaded`, Node.js processes start faster. In a
project with 13,000 stored files, the startup overhead per process
dropped from 67 ms to 18 ms.

- `pnpm install` no longer fails with `ERR_PNPM_NO_MATCHING_VERSION`
after a change to `overrides` when the lockfile resolves an optional
peer dependency to an npm alias of another package
[#&#8203;16654](https://redirect.github.com/pnpm/pnpm/issues/16654).

- A frozen install with `catalogPrune` no longer removes catalog entries
that `pnpm-lock.yaml` still records. Before, `pnpm install
--frozen-lockfile --filter` failed with
`ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` when some workspace projects were
missing from disk
[#&#8203;16638](https://redirect.github.com/pnpm/pnpm/issues/16638).

- `pnpm install --fix-lockfile` no longer removes the `deprecated` and
`hasBin` fields from lockfile entries
[#&#8203;6600](https://redirect.github.com/pnpm/pnpm/issues/6600).

- With `enableGlobalVirtualStore`, an install that updates
`node_modules` now repairs a package in the global virtual store that an
interrupted install left without some of its dependency links or package
files. Before, such an install kept the incomplete package if the
project's `node_modules` already recorded it
[#&#8203;16642](https://redirect.github.com/pnpm/pnpm/issues/16642).

- `pnpm install` now skips the Cargo and Python projects inside a nested
directory that has its own `pnpm-workspace.yaml` or `.git` directory,
such as a git worktree of the same workspace or a separate clone.

- The `Request took` warning for package metadata now starts timing when
pnpm sends the request. Before, it also counted the time the request
waited for a free request slot, so large installs printed it for
requests the registry answered quickly.

<!-- sponsors -->

##### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

##### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.10.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.10.0):
pnpm 12.10.0

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.9.1...v12.10.0)

This release adds an experimental `loaded` node linker, lets
`pnpm-lock.yaml` record resolution settings, and reads cached registry
metadata faster. It also carries several security fixes, including one
that stops a dependency version from writing files outside the global
virtual store.

##### Minor Changes

- Added experimental `nodeLinker: { type: loaded }` installation.
Compatible dependencies load directly from the content-addressable store
through an automatically registered Node.js loader.
`nodeLinker.excluded` selects packages and their dependency trees to
install in the global virtual store.

- `lockfile.includeResolutionSettings: true` makes `pnpm-lock.yaml`
record `autoDedupe`, `dedupeInjectedDeps`, `dedupePeerDependents` and
`linkWorkspacePackages`. Installs then treat a lockfile that records
other values as outdated. A lockfile that records `autoDedupe` is reused
by later installs on any machine, so `pnpm run` after `pnpm install
--frozen-lockfile` no longer starts another install
[#&#8203;16583](https://redirect.github.com/pnpm/pnpm/issues/16583).

##### Patch Changes

##### Security

- `pnpm install` now prevents dependency versions with path traversal
from writing files outside the global virtual store.

- pnpm now verifies locked config dependencies against their registry
before installing them. Config dependencies must come from an npm
registry. The lockfile can no longer replace the integrity of a config
dependency pinned with `version+integrity`.

- Lockfile verification now checks the tarballs inside a `variations`
resolution against the registry. A `name@version` lockfile entry with an
empty `variations` resolution is now rejected.

- `pnpm audit signatures` now verifies signatures against the integrity
recorded in the lockfile. Packages without a recorded integrity cannot
pass signature verification.

- `pnpm install` and `pnpm publish` now reject archive metadata larger
than 64 MiB before reading it into memory. Publishing a pre-built
tarball also rejects manifests and README files larger than 64 MiB.

- Two URL or local path dependencies no longer share a virtual store
directory when one URL has `+`, `#`, `:`, or `?` where the other has
`/`. Such dependencies, including git dependencies pinned with `#`, now
get a hash suffix on their directory name.

- The warning about an ignored project `.npmrc` registry setting no
longer prints the username and password of a URL-scoped key such as
`//user:password@registry.example.com/${PATH}/:_authToken`.

##### Installing and resolving dependencies

- `pnpm install` now fails with `ERR_PNPM_UNSUPPORTED_PROTOCOL` when a
dependency uses a specifier with a protocol pnpm does not support, such
as Yarn's `patch:`. On Windows, such a specifier failed with `os error
123`. On other platforms, pnpm linked it to a directory that does not
exist. Reading a `package.json` that fails now names the file
[#&#8203;16590](https://redirect.github.com/pnpm/pnpm/issues/16590).

- `pnpm install` now fails with
`ERR_PNPM_PACKAGE_MANIFEST_INVALID_ATTRIBUTE` when a project declares a
dependency whose specifier is not a string, such as `"is-positive": 42`.
Before, the dependency was silently left out of the lockfile. A
`readPackage` hook can still correct the specifier.

- Fixed `pnpm install` failing with `ERR_PNPM_CMD_SHIM_RESOLVE_PATH`
when an executable's parent directory contains a dangling symlink.

- `pnpm install --frozen-lockfile` no longer fails with
`ERR_PNPM_RESOLUTION_SHAPE_MISMATCH` when a `name@version` lockfile
entry has a resolution served by a custom fetcher
[pnpm/tasks#108](https://redirect.github.com/pnpm/tasks/issues/108).

- `pnpm install --fix-lockfile` repairs a lockfile whose importer
references a package that has no snapshot entry, as left by a badly
merged lockfile. It failed with `ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY`
since 12.8.0
[#&#8203;16618](https://redirect.github.com/pnpm/pnpm/issues/16618).

- When a dependency moves an exact dependency of its own to an older
version, a peer dependency that pnpm installed automatically now moves
with it. Before, `pnpm install` and `pnpm dedupe` kept the newer locked
version of the peer, so the lockfile held two copies of it, for example
two copies of `vue`
[pnpm/tasks#61](https://redirect.github.com/pnpm/tasks/issues/61).

- `pnpm dedupe` now reads registry metadata for a dependency pinned to
an exact version, as `pnpm install` does. If the registry metadata
disagreed with the package's `package.json`, the lockfile it wrote
depended on whether `minimumReleaseAge` was set
[#&#8203;16615](https://redirect.github.com/pnpm/pnpm/issues/16615).

##### Speed and size

- Dependency resolution reads cached registry metadata faster. The
metadata cache moved to `<cache-dir>/v12/`, so the first install after
upgrading downloads registry metadata again. A damaged cache entry is
downloaded again, or reported as an error when `--offline` is set. `pnpm
cache prune` also removes the metadata cache that older pnpm versions
wrote under `<cache-dir>/v11/`
[#&#8203;13512](https://redirect.github.com/pnpm/pnpm/pull/13512).

- Package metadata requests no longer wait behind queued tarball
downloads when `maxSockets` or a proxy limits the connections to a
registry. Large installs resolve faster and print fewer `Request took`
warnings.

- Sped up installs in large workspaces on macOS when the dependency
links already exist. pnpm now keeps a link that already points at the
right package without trying to create it first. Relinking the direct
dependencies of 1,000 workspace projects took 45 ms, down from 116 ms
[pnpm/tasks#65](https://redirect.github.com/pnpm/tasks/issues/65).

- Commands in a project that pins a different pnpm version start about
13 ms faster on macOS. pnpm now runs the pinned version's binary
directly, without the shell script in front of it
[pnpm/tasks#66](https://redirect.github.com/pnpm/tasks/issues/66).

- The pnpm binary is about 0.9 MB smaller, and the arm64 Linux binary is
about 1 MB smaller still.

##### Running scripts and commands

- `pnpm run` no longer prints `[ELIFECYCLE] Command failed ...` after
Ctrl+C ends the script. pnpm still exits the way the script's shell did:
on Windows with the shell's exit code (`cmd` reports `-1073741510`,
PowerShell `1`), on Unix by re-raising `SIGINT`
[#&#8203;16579](https://redirect.github.com/pnpm/pnpm/issues/16579).

- `pnpm run "/<regex>/"` now accepts JavaScript regular expression
syntax such as lookahead and lookbehind. A selector like
`"/^hello:(?!b).*$/"` failed with `ERR_PNPM_NO_SCRIPT`
[#&#8203;16604](https://redirect.github.com/pnpm/pnpm/issues/16604).

- `pnpm run` and `pnpm exec` now forward `--config.*` command-line flags
to the install started by `verifyDepsBeforeRun`
[pnpm/tasks#60](https://redirect.github.com/pnpm/tasks/issues/60).

- On Windows, a process started by `pnpm run` or `pnpm exec` can again
start a child with `CREATE_BREAKAWAY_FROM_JOB`. That child keeps running
after pnpm exits, even if the command fails
[#&#8203;16628](https://redirect.github.com/pnpm/pnpm/issues/16628).

- Empty `nodeOptions` values from command-line flags and environment
variables now override lower-priority settings. Scripts retain
`NODE_OPTIONS` from the parent environment or `extraEnv` when
`nodeOptions` is empty.

- pnpm now reads the `failIfNoMatch` setting from `pnpm-workspace.yaml`,
so a filter that matches no workspace project exits with code 1 when the
setting is `true`. The new `--no-fail-if-no-match` flag turns the
setting off for one command
[#&#8203;16577](https://redirect.github.com/pnpm/pnpm/issues/16577).

##### Configuration, setup, and pnpm versions

- `pnpm config get --global` and `pnpm config list --global` now show
only the global configuration, also when run inside a project. Settings
from the project's `pnpm-workspace.yaml` and `.npmrc` were included
before. The same applies to `--location=global`
[#&#8203;16598](https://redirect.github.com/pnpm/pnpm/issues/16598).

- pnpm now prints config warnings, such as an unset environment variable
in `.npmrc`, when loading the config fails.

- pnpm 11 releases older than 11.28.4 can run pnpm 12 again when the
`packageManager` field pins it. Since 12.9.0 they failed with
`SyntaxError: Invalid or unexpected token`
[#&#8203;16594](https://redirect.github.com/pnpm/pnpm/issues/16594).

- On Windows, `pnpm self-update` no longer runs the update a second time
when it replaces a `pnpm.cmd` linked by pnpm 12.8 or older. cmd.exe read
on in the replaced `pnpm.cmd`, printed an error about a command that is
not recognized, and ran the new pnpm once more
[#&#8203;16573](https://redirect.github.com/pnpm/pnpm/issues/16573).

- `pnpm setup` now puts `$PNPM_HOME/bin` first on `PATH` in login shells
that inherited it further down, such as the VS Code terminal on macOS.
Before, another `node` took precedence over the one installed by `pnpm
runtime set node -g`. Run `pnpm setup` again to update the block in your
shell config
[#&#8203;16635](https://redirect.github.com/pnpm/pnpm/issues/16635).

- `pnpm setup` now names the shell config file even if it is already up
to date
[#&#8203;16608](https://redirect.github.com/pnpm/pnpm/issues/16608).

##### Updating, auditing, and publishing

- `pnpm update --latest` now applies the `savePrefix` setting when it
rewrites a dependency whose range has no operator of its own, such as
`<2.0.0`.

- The interactive `pnpm audit --fix` picker now shows each patched
version with the `saveExact` and `savePrefix` style that the override is
written with
[#&#8203;13209](https://redirect.github.com/pnpm/pnpm/issues/13209).

- `pnpm unpublish <pkg>@<version>` now deletes the tarball under the
registry's path when the registry is served under one, such as Gitea's
npm registry. It used to send the delete to the host root and report
success without removing the version
[#&#8203;16568](https://redirect.github.com/pnpm/pnpm/issues/16568). It
also no longer mistakes a sibling path such as `/npm-mirror/` for the
registry path `/npm/`
[pnpm/tasks#94](https://redirect.github.com/pnpm/tasks/issues/94).

##### Output and messages

- A warning about a project's `devEngines` or `packageManager` pin is
now printed to stderr. A command such as `pnpm cache path` or `pnpm list
--json` keeps only its own output on stdout
[#&#8203;16584](https://redirect.github.com/pnpm/pnpm/issues/16584).

- `pnpm list` now reports the correct package paths when `nodeLinker` is
`hoisted`
[#&#8203;9593](https://redirect.github.com/pnpm/pnpm/issues/9593).

- Resolution errors now name the failing dependency and its parent
packages. Fatal errors appear as structured error records with their
error codes when using `--reporter=ndjson`.

- The error for an invalid git repository in the lockfile now has the
code `ERR_PNPM_INVALID_GIT_REPOSITORY`. Its message now lists every
rejected form of the value.

- `pnpm runtime --help` and `pnpm help runtime` now name the `set`
subcommand and the runtimes it accepts
[#&#8203;16580](https://redirect.github.com/pnpm/pnpm/issues/16580).

<!-- sponsors -->

##### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

##### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt=

> ❗ **Important**
> 
> ✂ PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 05:59 AM, only on Tuesday (`* 0-5 * * 2`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/apify/apify-sdk-python).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

website/package.json

@@ -51,5 +51,5 @@
         "rimraf": "^6.1.3",
         "typescript": "^6.0.3"
     },
-    "packageManager": "pnpm@12.9.1"
+    "packageManager": "pnpm@12.11.2"
 }