chore(deps): update pnpm to v10.26.0

[Infra-Workleap]

This PR contains the following updates:

Package	Change	Age	Confidence
pnpm (source)	10.19.0 → 10.26.0

---

Release Notes

pnpm/pnpm (pnpm)

v10.26.0: pnpm 10.26

Compare Source

Minor Changes

• Semi-breaking. Block git-hosted dependencies from running prepare scripts unless explicitly allowed in onlyBuiltDependencies #​10288.

• Semi-breaking. Compute integrity hash for HTTP tarball dependencies when fetching, storing it in the lockfile to prevent servers from serving altered content on subsequent installs #​10287.

• Added a new setting blockExoticSubdeps that prevents the resolution of exotic protocols in transitive dependencies.

  When set to true, direct dependencies (those listed in your root package.json) may still use exotic sources, but all transitive dependencies must be resolved from a trusted source. Trusted sources include the configured registry, local file paths, workspace links, trusted GitHub repositories (node, bun, deno), and custom resolvers.

  This helps to secure the dependency supply chain. Packages from trusted sources are considered safer, as they are typically subject to more reliable verification and scanning for malware and vulnerabilities.

  Exotic sources are dependency locations that bypass the usual trusted resolution process. These protocols are specifically targeted and blocked: Git repositories (git+ssh://...) and direct URL links to tarballs (https://.../package.tgz).

  Related PR: #​10265.

• Added support for allowBuilds, which is a new field that can be used instead of onlyBuiltDependencies and ignoredBuiltDependencies. The new allowBuilds field in your pnpm-workspace.yaml uses a map of package matchers to explicitly allow (true) or disallow (false) script execution. This allows for a single, easy-to-manage source of truth for your build permissions.

  Example Usage. To explicitly allow all versions of esbuild to run scripts and prevent core-js from running them:

  allowBuilds:
    esbuild: true
    core-js: false

  The example above achieves the same result as the previous configuration:

  onlyBuiltDependencies:
    - esbuild
  ignoredBuiltDependencies:
    - core-js

  Related PR: #​10311

• Added support for --dry-run to the pack command #​10301.

Patch Changes

• Show deprecation in table/list formats when latest version is deprecated #​8658.
• Remove the injectWorkspacePackages setting from the lockfile on the deploy command #​10294.
• Normalize the tarball URLs before saving them to the lockfile. URLs should not contain default ports, like :80 for http and :443 for https #​10273.
• When a dependency is installed via a direct URL that redirects to another URL and is immutable, the original URL is normalized and saved to package.json #​10197.

Platinum Sponsors

Gold Sponsors

v10.25.0: pnpm 10.25

Compare Source

Minor Changes

• Allow loading certificates from cert, ca, and key for specific registry URLs. E.g., //registry.example.com/:ca=-----BEGIN CERTIFICATE-----.... Previously this was only working via certfile, cafile, and keyfile.

  These properties are supported in .npmrc, but were ignored by pnpm, this will make pnpm read and use them as well.

  Related PR: #​10230.

• Added a new flag called --bare to pnpm init for creating a package.json with the bare minimum of required fields #​10226.

Patch Changes

• Improved reporting of ignored dependency scripts #​10276.
• pnpm install should build any dependencies that were added to onlyBuiltDependencies and were not built yet #​10256.
• pnpm publish -r --force should allow to run publish over already existing versions in the registry #​10272.
• Don't fail with a ERR_PNPM_MISSING_TIME error if a package that is excluded from trust policy checks is missing the time field in the metadata.

Platinum Sponsors

Gold Sponsors

v10.24.0: pnpm 10.24

Compare Source

Minor Changes

• Increased network concurrency on machines with many CPU cores. pnpm now automatically selects a network concurrency between 16 and 64, based on the number of pnpm workers (calculated as workers × 3). This improves performance on high-core systems #​10068.

Patch Changes

• trustPolicy should ignore the trust evidences of prerelease versions, when installing a non-prerelease version.
• Handle ENOENT errors thrown by fs.linkSync(), which can occur in containerized environments (OverlayFS) instead of EXDEV. The operation now gracefully falls back to fs.copyFileSync() in these cases #​10217.
• Reverted: pnpm self-update should download pnpm from the configured npm registry #​10205.
• Packages that don't have a package.json file (like Node.js) should not be reimported from the store on every install. Another file from the package should be checked in order to verify its presence in node_modules.
• Correctly read auth tokens for URLs that contain underscores #​17.

Platinum Sponsors

Gold Sponsors

v10.23.0: pnpm 10.23

Compare Source

Minor Changes

• Added --lockfile-only option to pnpm list #​10020.

Patch Changes

• pnpm self-update should download pnpm from the configured npm registry #​10205.
• pnpm self-update should always install the non-executable pnpm package (pnpm in the registry) and never the @pnpm/exe package, when installing v11 or newer. We currently cannot ship @pnpm/exe as pkg doesn't work with ESM #​10190.
• Node.js runtime is not added to "dependencies" on pnpm add, if there's a engines.runtime setting declared in package.json #​10209.
• The installation should fail if an optional dependency cannot be installed due to a trust policy check failure #​10208.
• pnpm list and pnpm why now display npm: protocol for aliased packages (e.g., foo npm:[email protected]) #​8660.
• Don't add an extra slash to the Node.js mirror URL #​10204.
• pnpm store prune should not fail if the store contains Node.js packages #​10131.

Platinum Sponsors

Gold Sponsors

v10.22.0: pnpm 10.22

Compare Source

Minor Changes

• Added support for trustPolicyExclude #​10164.

  You can now list one or more specific packages or versions that pnpm should allow to install, even if those packages don't satisfy the trust policy requirement. For example:

  trustPolicy: no-downgrade
  trustPolicyExclude:
    - [email protected]
    - [email protected] || 5.102.1

• Allow to override the engines field on publish by the publishConfig.engines field.

Patch Changes

• Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #​10179.

Platinum Sponsors

Gold Sponsors

v10.21.0: pnpm 10.21

Compare Source

Minor Changes

• Node.js Runtime Installation for Dependencies. Added support for automatic Node.js runtime installation for dependencies. pnpm will now install the Node.js version required by a dependency if that dependency declares a Node.js runtime in the "engines" field. For example:

  {
    "engines": {
      "runtime": {
        "name": "node",
        "version": "^24.11.0",
        "onFail": "download"
      }
    }
  }

  If the package with the Node.js runtime dependency is a CLI app, pnpm will bind the CLI app to the required Node.js version. This ensures that, regardless of the globally installed Node.js instance, the CLI will use the compatible version of Node.js.

  If the package has a postinstall script, that script will be executed using the specified Node.js version.

  Related PR: #​10141

• Added a new setting: trustPolicy.

  When set to no-downgrade, pnpm will fail installation if a package’s trust level has decreased compared to previous releases — for example, if it was previously published by a trusted publisher but now only has provenance or no trust evidence.
  This helps prevent installing potentially compromised versions of a package.

  Related issue: #​8889.

• Added support for pnpm config get globalconfig to retrieve the global config file path #​9977.

Patch Changes

• When a user runs pnpm update on a dependency that is not directly listed in package.json, none of the direct dependencies should be updated #​10155.
• Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #​10160.
• Setting gitBranchLockfile and related settings via pnpm-workspace.yaml should work #​9651.

Platinum Sponsors

Gold Sponsors

v10.20.0

Compare Source

Minor Changes

• Support --all option in pnpm --help to list all commands #​8628.

Patch Changes

• When the latest version doesn't satisfy the maturity requirement configured by minimumReleaseAge, pick the highest version that is mature enough, even if it has a different major version #​10100.
• create command should not verify patch info.
• Set managePackageManagerVersions to false, when switching to a different version of pnpm CLI, in order to avoid subsequent switches #​10063.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[Infra-Workleap]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.