fix(deps): update non-major #17
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/non-major"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
^0.3.15→^0.5.024.11.0→24.19.25.5.5→5.5.75.2.1→5.3.02.1.1→2.5.03.3.11→3.3.208.19.0→8.23.110.33.4→10.34.93.8.1→3.10.16.1.3→6.1.47.2.2→7.3.229.4.6→29.4.159.5.4→9.6.2Release Notes
electric-sql/pglite (@electric-sql/pglite)
v0.5.16Compare Source
Patch Changes
4f9737a: Exportpglite.wasm,initdb.wasmandpglite.dataso they can be imported by package path (e.g.@electric-sql/pglite/pglite.wasm), and document Nitro/Nuxt support.26a6e21: Parseinfinityand-infinityindate,timestampandtimestamptzvalues asInfinityand-Infinityinstead ofInvalid Date, and serialize them back toinfinityand-infinity.10378a7: Escape embedded double quotes inidentifiertemplate helper so identifiers containing"produce valid SQL1cb5ca1: Serialize query descriptions and wait for database initialization so concurrent operations return the correct parameter and result metadata.3e94d9e: reset the stream callback after execProtocolRawStream so later execProtocolRaw/execProtocolRawSync calls are not routed to itv0.5.15Compare Source
Patch Changes
649dc0e: Reject withTransactionAbortedErrorwhen committing an aborted transaction rolls it back instead of silently resolving.fe8bdc2: Reduce initdb memory usage by passing a smaller WebAssembly.Memory object during initialization'7c62782: Upgrade tsup to 8.5.184ce5ae: Upgrade emsdk to 6.0.13v0.5.14Compare Source
Patch Changes
1cf7e86: Only build thepglite.wasm,initdb.wasmandpglite.dataURLs when PGlite has to load them. PassingpgliteWasmModule,initdbWasmModuleandfsBundlenow works in bundles whereimport.meta.urlis undefined, such as an esbuild IIFE build.48dd3fb: Use PROXYFS instead of dumping the data dir from the scratch PGlite used for initdb when the data dir is in memory.268929b: do not copy parsers on each queryv0.5.13Compare Source
Patch Changes
c7dc39e:close()now waits for queries, execs and transactions that were issued before it, so they complete instead of failing withCannot read properties of undefinedafter teardown.8364675: Added support for node-postgres through createPgConfig()a4cfd4d: Added MemfsFrontendFS which allows other filesystems be implemented on top of a MEMFS. Example: added Memfs2OpfsFS which is backed by an OPFS fs.2db5d2d: Upgrade emsdk to 6.0.5v0.5.12Compare Source
Patch Changes
0641b37: Fix custom filesystems not receiving times set withFS.utime. Emscripten'sFS.utimecallssetattrwithatimeandmtime, but theBaseFilesystembridge only handled the oldertimestampfield, soutimeswas never called on OPFS AHP or any otherBaseFilesystem. Files restored from a tarball kept the time they were written instead of the time stored in the tarball.e752dbe: Run initdb withTZ=UTC, like the backend, so a new database getstimezone = 'UTC'inpostgresql.conf. Before, initdb wrote the host's zone as a fixed offset without daylight saving (e.g.Etc/GMT+5for America/New_York), sotimestamptzinput without an offset was stored at a different instant on each non-UTC machine.c31130c: Start under the Node.js permission model (node --permission). Emscripten's NODEFS read the fs open flags withprocess.binding('constants'), which Node always denies in that mode, sonew PGlite()threwERR_ACCESS_DENIEDeven formemory://. The bundled build now reads them fromrequire('fs').constants, which holds the same values.0641b37: Fix files restored from a tarball getting a January 1970 modification time.loadTarpassed the tar header's time to Emscripten'sFS.utimein seconds, butFS.utimetakes milliseconds. This affected every new database (initdb's data dir is restored from a tarball) and everyloadDataDir. With the Node filesystem the files on disk got those dates too.v0.5.11Compare Source
Patch Changes
5573bb0: bug fix: check ready before close2372f39: Update submodule4321a41: Fix premature ReadyForQuery responses after extended-query errors, preventing PostgreSQL clients from desynchronizing before Sync.v0.5.10Compare Source
Patch Changes
367ee2f: Bug fix: wait for running queries to finish before doing a data dir dumpcb06c21: Wait for queries to finish before closing PGlite instance. See #112878012ca: Fix a windowedlive.query(one givenoffsetandlimit) leaking itslive_query_<id>_get_total_countprepared statement onunsubscribe. Onlylive_query_<id>_getwas deallocated, so the count statement survived every teardown while its backing view was dropped, accumulating dangling prepared statements for the lifetime of the database.v0.5.9Compare Source
Patch Changes
389b731: upgrade to PostgreSQL 18.6389b731: Export additional core symbols from the main WASM module required by the plpgsql_check extensionv0.5.8Compare Source
Patch Changes
c771db3: Do not set process.exitCode at allv0.5.7Compare Source
Patch Changes
2f9cf75: Fix convert_tov0.5.6Compare Source
Patch Changes
69b7d87: Apply the second options argument when callingPGlite.create(undefined, options).6c14380: fixes for process.exitCodev0.5.5Compare Source
Patch Changes
a290741: Reset retained protocol parser state after a malformed backend message so later queries can recover.6b6f28d: FixPGlite.create({ fs })on a fresh database calling the provided filesystem'sinit()twice: the inner initdb instance no longer inherits the user-providedfsand always runs on its own scratch filesystem. Previously any VFS holding exclusive resources (e.g. OPFS sync access handles) failed with a contention error on first create.354f4ae: FixformatQuery(used bylive.query/live.incrementalQueryto inline parameters) emitting%NLinstead of the positional%N$Lformat specifier. A bare%NLis "min width N" and consumesformat()arguments sequentially, so placeholders that are out of textual order silently bound the wrong values, and repeated placeholders failed withtoo few arguments for format().219af1e: Expose the fields node-postgres derives from the CommandComplete command tag onResults:command(e.g.SELECT,INSERT,CREATE), androwCount(the per-statement count from the tag). The tag was already received and parsed internally to computeaffectedRows, but these values were not surfaced. Matching node-postgres'command/rowCountresult fields lets pg-compatible adapters report them without re-parsing SQL.20839a7: Preserve the hostprocess.exitCodewhen closing a PGlite instance.close()calls_emscripten_force_exit(0), whose Emscripten runtime setsprocess.exitCode = 0, clobbering any exit code the host process had already set. This mirrors the existing save/restore guards in#init()andexecProtocolRaw(), so closing a database no longer silently resets the host process's exit code.7e784a4: Reject operations performed through transaction handles after the transaction has closed.v0.5.4Compare Source
Patch Changes
7e0d6d1: Detect the Node environment viaprocess.typeinstead ofprocess.versions.electron. The previous Electron guard (#951) also treated the Electron main and utility processes as non-Node, which broke PGlite's filesystem code path there.process.typeonly excludes Electron's web contexts (renderer, web worker, service worker), so PGlite keeps using the Node.js path in the Electron main and utility processes. Follow-up to #951 / #813.v0.5.3Compare Source
Patch Changes
2ccbb4c: Improve parsing/raw results handlingv0.5.2Compare Source
Patch Changes
21fc995: fix serializing arrays of BigInts0720cb6: Alow serializing untyped parameterse09535f: add pg_stat_statements.tar.gz to main packagea4e163a: fix process exit code set/restorev0.5.1Compare Source
Patch Changes
4f9737a: Exportpglite.wasm,initdb.wasmandpglite.dataso they can be imported by package path (e.g.@electric-sql/pglite/pglite.wasm), and document Nitro/Nuxt support.26a6e21: Parseinfinityand-infinityindate,timestampandtimestamptzvalues asInfinityand-Infinityinstead ofInvalid Date, and serialize them back toinfinityand-infinity.10378a7: Escape embedded double quotes inidentifiertemplate helper so identifiers containing"produce valid SQL1cb5ca1: Serialize query descriptions and wait for database initialization so concurrent operations return the correct parameter and result metadata.3e94d9e: reset the stream callback after execProtocolRawStream so later execProtocolRaw/execProtocolRawSync calls are not routed to itv0.5.0Minor Changes
93d50aa: Upgrade to Postgres 18.3; move other extensions to their own npm packages;v0.4.6Patch Changes
2aa4d1a: Allow parsing of nulls in arrays #9972095d4e: Add ICU support.e937669: Restore process.exitCode54ed6dc: new API method copyToFs() and new param postgresqlconf817d073: restore exit codev0.4.5Compare Source
Patch Changes
c6bddde: Fix caching of artifacts such that they are not downloaded multiple timesv0.4.4Compare Source
Patch Changes
b88c5c3: Disable checkpointerv0.4.3Compare Source
Patch Changes
2ae666f: Default database, user and role are now all "postgres"fb95e66: Allow setting initial memory size.65fc101: Disable background workers.v0.4.2Compare Source
Patch Changes
41632c4: Allow passing initdb.wasm asset for bundlers that need it.v0.4.1Patch Changes
37fb39e: clear timers on exit; remove pglite-socket dependency on pglite-postgisv0.4.0Minor Changes
d848955: New simplified PGlite with separate initdb.New included extension: pg_textsearch (experimental).
New package for postgis (experimental) as extension.
Breaking changes: 'postgres' is the default database instead of 'template1'.
v0.3.16Compare Source
Patch Changes
3dfa40f: Add Apache AGE graph database extension supportprettier/eslint-plugin-prettier (eslint-plugin-prettier)
v5.5.7Compare Source
Patch Changes
#796
7e53ecdThanks @OskarEichler! - Fix fallback diagnostic locations for all supported line endings.#805
1b7c433Thanks @JounQin! - Report a clear error when the sync worker fails to load, so a missingprettierdependency now fails fast withCannot find package 'prettier'instead of hanging ESLint indefinitely.v5.5.6Compare Source
Patch Changes
b5c96a3Thanks @JounQin! - chore: bump all (dev)Dependenciesexpressjs/express (express)
v5.3.0Compare Source
=====
🐞 Bug fixes
Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893
Fixed the behavior of
res.send()to prevent conflicts betweenContent-LengthandTransfer-EncodingHTTP headers in responses. TheContent-Lengthheader inres.send()is now only added when aTransfer-Encodingheader is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of aTransfer-Encodingheader - by @cuishuang in #7459Upgrade
qsto^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx):arrayLimitbypasses in comma parsing and a denial of service via an attacker-controlledisBuffer- by @davetashner in #7057 and #7478, and @cyphercodes in #7305Upgrade
proxy-addrto^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474🚀 Improvements
Allow conditional revalidation for QUERY requests.
req.freshpreviously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366Improve HTML structure in
res.redirect()responses when HTML format is accepted by adding<!DOCTYPE html>,<title>, and<body>tags for better browser compatibility - by @Bernice55231 in #5167When calling
app.renderwith options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903Upgrade
content-typeto^2.0.0, bringing a faster parser (~1.5x quickerContent-Typeparsing/formatting inres.send()) along with a behavior change:res.send()now keeps any existing parameters when adding the charset and no longer throws on aContent-Typethat fails to parse.type-isis upgraded to^2.1.0as part of the same change - by @blakeembrey in #7234The default error handler now logs the full error object instead of only its stack trace, so nested details such as
Error.causeand library-specific properties (e.g. Sequelize'sparent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464Upgrade
content-dispositionto^2.0.1, which changes theContent-Dispositionheader emitted byres.download(),res.attachment(), andres.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233Upgrade
body-parserto^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalidlimitoption value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalidlimitvalues now throw at parser initialization instead of being ignored - by @Mayvis in #7390⚡ Performance
res.send()when sending string responses without an explicit Content-Type header - by @bjohansebas in #6991expressjs/multer (multer)
v2.5.0Compare Source
limits.fieldSizebytes, soLIMIT_FIELD_VALUEfires only when the limit is exceeded. This also covers the defaultfieldSizeof 1MB, so a1048576byte value is no longer rejected when you set no limits. If you setfieldSizeone higher to work around this, you can drop the extra one (#1481)LIMIT_FILE_SIZEabort;DiskStorageno longer tries to unlink an undefined path (#1489)v2.4.0Compare Source
filenametoLIMIT_FILE_SIZEandLIMIT_UNEXPECTED_FILEerrors (#1416)limits, called with the request, to set limits per request (#1133)flushoption toDiskStorageto fsync files before the callback runs (#1458)defCharset,highWaterMarkandfileHwmoptions (#1465)streamHandleroption to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)multer.diskStorage()to be called without options (#1471)%0A,%0D,%22) in field names, matchingfile.originalnamesince 2.3.0:req.bodykeys,file.fieldnameanderr.fieldnow carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)err.filenameonLIMIT_FILE_SIZEerrors, matchingfile.originalname(#1478)limitsvalues at construction time; a float limit silently disabled the check (#1395, #1335)limits.partsparts;LIMIT_PART_COUNTnow fires only when the limit is exceeded. If you setpartsone higher to work around this, you can drop the extra one (#1446)fileFilterno longer count towardsmaxCount(#1426)LIMIT_UNEXPECTED_FILEmessage to "Unexpected file field" (#426)concat-streamdependency (#1356)v2.3.0Compare Source
MulterErrorcodesINVALID_FIELD_NAMEandSTREAM_DESTROYEDlimits.fieldArrayIndexLimitto bound numeric array indexes in field names (#1438)limits.fileSize(#1407)AsyncLocalStorage) when callingnext()(#1124)%0A,%0D,%22) infile.originalname(#1421)fileFilterinvokes its callback more than once (#1427)MulterErrorcodes without a mapping (#1448)preservePathandparts, usecrypto.randomBytesin theDiskStorageexample (#1414, #1430, #1436)v2.2.0Compare Source
ai/nanoid (nanoid)
v3.3.20Compare Source
v3.3.19Compare Source
v3.3.18Compare Source
v3.3.17Compare Source
v3.3.16Compare Source
v3.3.15Compare Source
v3.3.14Compare Source
v3.3.13Compare Source
v3.3.12Compare Source
brianc/node-postgres (pg)
v8.23.1Compare Source
v8.23.0Compare Source
pipelineing.v8.22.0Compare Source
v8.21.0Compare Source
scramMaxIterationsconfig option.client.getTransactionStatus()method.v8.20.0Compare Source
pnpm/pnpm (pnpm)
v10.34.9: pnpm 10.34.9Compare Source
Patch Changes
0bff20d: The pnpm version thatpackageManagerpins now records that pin in a freshpnpm-lock.yamlwhen pnpm 10 switched to it. A laterpnpm install --frozen-lockfilethen succeeds #17303.Platinum Sponsors
Gold Sponsors
v10.34.8: pnpm 10.34.8Compare Source
Patch Changes
7ced81e: Recompute hoisted dependencies when a frozen install removes packages, so public hoist links are handed over to retained versions #16861.debbb4c: When pnpm removes or replaces a direct dependency, it now finishes removing the dependency's bins before it deletes the dependency's directory. Packages that declare bins throughdirectories.binno longer leave broken shims innode_modules/.bin#16876.07becba: The standalone pnpm executables now embed Node.js 24.22.1. They embedded Node.js 20, which has reached end of life and still trusts the certificate authority intermediates that Node.js distrusted in October 2026.Platinum Sponsors
Gold Sponsors
v10.34.7: pnpm 10.34.7Compare Source
Patch Changes
97f550c: Switching to the pnpm version inpackageManagernow works through registry mirrors that strip npm's signatures or re-sign packages with their own key. pnpm then reads the signature fromhttps://registry.npmjs.org/and verifies it against the integrity of the downloaded pnpm #16778.b11d7bb: The update notification now suggests the standalone install script instead ofpnpm self-updatewhenPNPM_HOMEis not set, such as when another package manager installed pnpm.pnpm self-updateinstalls intoPNPM_HOME, so in that case it cannot replace the pnpm in use.Platinum Sponsors
Gold Sponsors
v10.34.6Compare Source
Patch Changes
e7888e5:pnpm self-updatenow resolves and verifies pnpm through registry, authentication, proxy, and TLS settings from trusted non-project configuration. Project configuration and the default project pnpmfile can no longer redirect the pnpm download or disable engine identity verification.46bc7c9: pnpm no longer tells you to update itself with Corepack or withpnpm add -g:pnpm self-update, or the standalone install script when pnpm is running under Corepack. It used to suggestcorepack use pnpm@<version>, orpnpm add -g pnpm/pnpm add -g @pnpm/exewhen pnpm was not installed by the standalone script — butpnpm add -grefuses to install pnpm and points atpnpm self-updateanyway, and@pnpm/exeis not published for pnpm v12 or newer, where the unscopedpnpmpackage is itself the native executable.pnpm self-updateunder Corepack now points at the standalone install script too, instead of telling you to update pnpm with Corepack.46bc7c9: Updatedadm-zipto v0.6.0, which fixes a memory-exhaustion vulnerability where a crafted ZIP file could make it allocate 4 GB of memory.adm-zipis used to extract the Node.js, Bun, and Deno archives that pnpm downloads on Windows.Updated the embedded Node.js release keys to the current canonical
nodejs/release-keyslist.Updated the embedded npm registry signing keys to the set currently advertised by npm.
702ad5f: Update the embedded Node.js release keys with the new key added to nodejs/release-keys (Stewart X Addison,655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD).Platinum Sponsors
Gold Sponsors
v10.34.5: pnpm 10.34.5Compare Source
Patch Changes
78e29fe: Prevent a craftedpnpm-lock.yamlfrom writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g.../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshotversion: "../../x") is now rejected atiterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.78e29fe: Fixed a path traversal vulnerability where a dependency whose manifestnamewas a scoped path traversal (e.g.@x/../../../<path>) could be written outsidenode_modulesto an attacker-controlled location duringpnpm install, even with--ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as thepnpmand@pnpm/exenpm packages whose bins are placeholders replaced at install time by the host's native binary from a@pnpm/exe.<platform>-<arch>[-musl]optional dependency. Because pnpm installs its own engine with--ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the nativepnpmpackage), and verifies the native binary's npm registry signature before running it.36928be:${...}environment-variable placeholders in thehttpProxy,httpsProxy,noProxy,proxy, andnoproxysettings are no longer expanded when these settings come from a project'spnpm-workspace.yaml. They now receive the same protection already applied toregistry.Platinum Sponsors
Gold Sponsors
v10.34.4: pnpm 10.34.4Compare Source
Patch Changes
352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. Apnpm-workspace.yamlwith a traversal-shapedconfigDependenciesname (such as../../PWNED) or version (such as../../../PWNED) could previously causepnpm installto create symlinks or write package files outsidenode_modules/.pnpm-configand the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.352ae48: Reject path-traversal and reserved dependency aliases (such as../../../escape,.bin,.pnpm, ornode_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoistednode_modulesdirectory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.The
nodeLinker: hoistedgraph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.352ae48: Preventpnpm patch-removefrom removing files outside the configured patches directory.217fbe0: Hardened the warning printed when a project.npmrcuses environment variables in registry/auth settings: the suggestedpnpm config setcommand is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled.npmrcand a shell expands$(...), backticks, and$VAReven inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.Platinum Sponsors
Gold Sponsors
v10.34.3: pnpm 10.34.3Compare Source
⚠️ Security fix — environment variables in a project
.npmrc(action may be required)Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands
${ENV_VAR}placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:.npmrc—registry,@scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken,_auth,_password,username,tokenHelper,cert,key);pnpm-workspace.yaml.This release also closes a bypass where a project
.npmrccould setuserconfig,globalconfig, orprefixto make pnpm load a repo-supplied file as trusted config (via@pnpm/npm-conf@3.0.3).Environment variables are still expanded in trusted config: your user-level
~/.npmrc, the global config, CLI options, and environment config.If your authentication broke after upgrading, move the token out of the committed
.npmrc:Or keep the
${NPM_TOKEN}line but put it in your user-level~/.npmrcinstead of the repo. In GitHub Actions,actions/setup-nodewithregistry-urlalready writes a user-level.npmrc, soNODE_AUTH_TOKENkeeps working. For other CI where editing each pipeline is hard, setNPM_CONFIG_USERCONFIG=.npmrcin the CI environment to declare the project.npmrctrusted.See https://pnpm.io/npmrc for full migration details.
Patch Changes
.npmrcuses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by runningpnpm config set "<key>" <value>to store it in the global config, or by keeping the${...}line in the user-level~/.npmrc— with a link to https://pnpm.io/npmrc..npmrccan no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could setuserconfig,globalconfig, orprefixto point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to settokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace.npmrcfiles are read. Fixed by upgrading@pnpm/npm-confto3.0.3.Platinum Sponsors
Gold Sponsors
v10.34.2: pnpm 10.34.2Compare Source
⚠️ Security fix — environment variables in a project
.npmrc(action may be required)Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands
${ENV_VAR}placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:.npmrc—registry,@scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken,_auth,_password,username,tokenHelper,cert,key);pnpm-workspace.yaml.This release also closes a bypass where a project
.npmrccould setuserconfig,globalconfig, orprefixto make pnpm load a repo-supplied file as trusted config (via@pnpm/npm-conf@3.0.3).Environment variables are still expanded in trusted config: your user-level
~/.npmrc, the global config, CLI options, and environment config.If your authentication broke after upgrading, move the token out of the committed
.npmrc:Or keep the
${NPM_TOKEN}line but put it in your user-level~/.npmrcinstead of the repo. In GitHub Actions,actions/setup-nodewithregistry-urlalready writes a user-level.npmrc, soNODE_AUTH_TOKENkeeps working. For other CI where editing each pipeline is hard, setNPM_CONFIG_USERCONFIG=.npmrcin the CI environment to declare the project.npmrctrusted.See https://pnpm.io/npmrc for full migration details.
Patch Changes
packageManagerfield, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global.npmrc— defaulting to the public npm registry, instead of the repository's project/workspace settings.packageManagerfield (orpnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exactname@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip..npmrcandpnpm-workspace.yaml) can no longer expand${...}placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work.binnames ("",".","..", and scoped forms such as@scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.onlyBuiltDependencies(andallowBuilds) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.SHASUMS256.txtagainst the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (node-mirror:<channel>in.npmrc), and the integrity check previously trusted aSHASUMS256.txtfetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only thereleasechannel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.Platinum Sponsors
Gold Sponsors
v10.34.1: pnpm 10.34.1Compare Source
Patch Changes
pnpm-lock.yamlentries whose remote tarballresolution:block is missing theintegrityfield. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that stripsintegrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under--frozen-lockfile. pnpm now fails closed at lockfile-read time withERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: trueor a URL on codeload.github.com / bitbucket.org / gitlab.com) andfile:tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.Platinum Sponsors
Gold Sponsors
v10.34.0: pnpm 10.34Compare Source
Minor Changes
Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously,
pnpm install(non-frozen) would logERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.pnpm installnow exits withERR_PNPM_TARBALL_INTEGRITYand a hint pointing at the new opt-in flag.The only opt-in is
pnpm install --update-checksums— narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.--forceandpnpm updatedeliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide.--frozen-lockfilebehavior is unchanged.--fix-lockfilekeeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.Patch Changes
_authToken,_auth,username/_password,tokenHelper, inlinecert/key) to the registry declared in the same config source at load time, so a later layer overridingregistry=(workspace.npmrc,pnpm-workspace.yaml, CLI--registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.minimumReleaseAgehandling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-versiontimefield) by default, which made the maturity check throwERR_PNPM_MISSING_TIMEwhenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch whenminimumReleaseAgeis active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and letsERR_PNPM_MISSING_TIMEfrom the cache fast-path fall through to the network fetch even under strict mode.commitfield is not a 40-character hexadecimal SHA before invokinggit. A malicious lockfile could otherwise smuggle a value such as--upload-pack=<command>throughgit fetch/git checkout, which on SSH or local-file transports executes the supplied command.diff --githeaders reference paths outside the patched package directory. Previously a malicious.patchfile added via a pull request could write, delete, or rename arbitrary files reachable by the user runningpnpm install.--prefix=<dir>not being honored when locating the workspace root. The--prefix → dirrename was applied after workspace detection, so workspace settings declared in<dir>/pnpm-workspace.yamlwere not loaded when pnpm was invoked from outside<dir>#11535.@x/../../../../../.git/hooks) when reading them from a package manifest or symlinking them intonode_modules. A malicious registry package could otherwise use a transitive dependency key to makepnpm installcreate symlinks at attacker-chosen paths outside the intendednode_modulesdirectory.Platinum Sponsors
Gold Sponsors
prettier/prettier (prettier)
v3.10.1Compare Source
diff
GraphQL: Fix empty selection set with comments (#20504 by @fisker)
v3.10.0Compare Source
diff
🔗 Release Notes
v3.9.10Compare Source
diff
Markdown: Update
micromark-extension-gfm-tableto fix the table parse issue on performance (#20266 by @fisker)See micromark/micromark-extension-gfm-table@
4f43eadfor details.v3.9.9Compare Source
diff
Markdown: Fix text with
$been incorrectly parsed as math syntax (#20140 by @fisker)v3.9.8Compare Source
diff
Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @seiyab)
v3.9.7Compare Source
diff
Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @Austin1serb, @giaBaoJS)
JavaScript: Fix embedded template literal idempotency (#19725 by @fisker)
Markdown: Preserve Liquid blocks after Markdown tables (#19730 by @wanxiankai, @seiyab)
Markdown: Preserve single tildes in Markdown (#19739 by @lazerg)
Since 3.9.0, single-tilde spans like
H~2~Owere rewritten to double tildes, turning subscript syntax into strike-through. Only double tildes are treated that way now, matching GitHub.Markdown: Fix Markdown blockquote containing
>characters (#19802 by @seiyab)Markdown: Strip blockquote markers from a setext heading's continuation lines (#19878 by @Kjubikstronk)
A setext heading spanning multiple lines inside a blockquote kept the
>marker of its continuation lines as literal text.Markdown: Fix HTML block indentation drift in markdown list items (#19987 by @lazerg)
Angular: Support
@boundaryerror boundaries (#20014 by @Yahiro025)v3.9.6Compare Source
diff
TypeScript: Preserve quotes for methods named
new(#19621 by @kovsu)TypeScript: Support
import defer(#19624, #19675 by @fisker)JavaScript: Added a new official plugin
@prettier/plugin-yuku(#19628, #19629 by @fisker)@prettier/plugin-yukuis powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).This plugin includes two new parsers:
yuku(JavaScript syntax) andyuku-ts(TypeScript syntax).To use this plugin:
Install the plugin:
Add it to your
.prettierrc:Due to package size limitations, this plugin is not bundled with the main prettier package and must be installed separately.
For more information, check the package homepage.
Big thanks to @arshad-yaseen for his excellent work.
v3.9.5Compare Source
diff
Markdown: Cap ordered list mark at 999,999,999 (#19351 by @tats-u)
CommonMark parsers only support ordered list item numbers up to 999,999,999.
With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:
Markdown: Avoid corrupting empty link with title (#19487 by @andersk)
Do not remove
<>from an inline link or image with an empty URL and a title, as this removal would change its interpretation.Less: Remove extra spaces after
[in map lookups (#19503 by @kovsu)CSS: Prevent addition space in
type()with+(#19516 by @bigandy)This fixes the addition space before
+in CSStype()declaration. For exampletype(<number>+)was being converted intotype(<number> +)which is invalid CSS and does not work.Less: Remove spaces between merge markers and colons (#19517 by @kovsu)
Markdown: Preserve wiki links with aliases (#19527 by @kovsu)
TypeScript: Fix comments being dropped on shorthand
typeimport/export specifiers (#19565 by @kirkwaiblinger)Miscellaneous: Preserving comments'
placementproperty (#19567 by @Janther)Prettier@3.9.0 deleted an undocumented property on comments, which was already used by plugins,
comment.placementis now available again after comment attach.Flow: Stop enforcing empty module declaration to break (#19568 by @fisker)
Angular: Support expression for exhaustive typechecking (#19571 by @fisker)
TypeScript: Ignore comments inside mapped type when checking type parameter comments (#19572 by @fisker)
Less: Fix adjacent block comments being corrupted (#19574 by @kovsu)
JavaScript: Handle dangling comments in
SwitchStatement(#19581 by @fisker)TypeScript: Remove space in comment-only object type (#19583 by @fisker)
v3.9.4Compare Source
diff
Angular: Format
@content(name)->@content (name)to align with other block syntax (#19499 by @fisker)v3.9.3Compare Source
diff
Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @seiyab)
TypeScript: Allow decorators to be used with declare on class fields (#19492 by @evoactivity)
Extensively used within the Ember ecosystem, decorators with
declareon class fields will ignore the babel parser error and allow Prettier to format the code without breaking it.v3.9.2Compare Source
v3.9.1Compare Source
diff
Markdown: Update
micromark-extension-gfm-tableto fix the table parse issue on performance (#20266 by @fisker)See micromark/micromark-extension-gfm-table@
4f43eadfor details.v3.9.0Compare Source
diff
🔗 Release Notes
v3.8.5Compare Source
diff
Flow: Support
readonlyas a variance annotation (#19022 by @marcoww6)Flow now accepts
readonlyas a property variance annotation, equivalent to+(covariant/read-only).v3.8.4Compare Source
diff
Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @byplayer)
Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.
v3.8.3Compare Source
diff
SCSS: Prevent trailing comma in
if()function (#18471 by @kovsu)v3.8.2Compare Source
diff
Angular: Support Angular v21.2 (#18722, #19034 by @fisker)
Exhaustive typechecking with
@default never;arrow functionandinstanceofexpressions.isaacs/rimraf (rimraf)
v6.1.4Compare Source
ladjs/supertest (supertest)
v7.3.2Compare Source
2a5e96fv7.3.1Compare Source
884cd26e74a1e0v7.3.0Compare Source
71dc5fb3b5ba5cc3419b27e409dbb55a7f97a5deaaa75f6eec2cb33e7fb34e7c3575842a01b57343394d6b203e9d40ca7eb6f599581766ca985ac7c58baa5fc406e82kulshekhar/ts-jest (ts-jest)
v29.4.15Compare Source
Bug Fixes
.cjsconfig files inconfig:migrate(4001b4e), closes #4485v29.4.14Compare Source
Reverts
v29.4.13Compare Source
Features
Performance Improvements
v29.4.12Compare Source
Features
v29.4.11Compare Source
Bug Fixes
v29.4.10Compare Source
Bug Fixes
resolutionModetots.resolveModuleNamefor hybrid module support (b557a85)Programwhen consecutive compiles need different module kinds (a82a2b3), closes #4774moduleResolutioninstead of forcingNode10(1bffffc)mjsfiles fromnode_modulesfor CJS mode (96d025d)v29.4.9Compare Source
Bug Fixes
v29.4.8Compare Source
Bug Fixes
v29.4.7Compare Source
Features
TypeStrong/ts-loader (ts-loader)
v9.6.2Compare Source
Officially ts-loader has supported 3.6.3+ versions of TypeScript. This change means that certain scenarios with older versions of TS will now certainly fail. If anyone is actually using these versions it would be surprising.
v9.6.1Compare Source
v9.6.0Compare Source
v9.5.7Compare Source
Skipping 9.5.5-9.5.6 due to publishing issues
Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: pnpm-lock.yaml
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.