[khepri-bot]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vite-plugin (source)	1.64.0 → 1.65.0
@cloudflare/vitest-plugin (source)	1.4.5 → 1.4.8
@modelcontextprotocol/sdk (source)	1.32.1 → 1.32.2
@sentry/cloudflare (source)	11.8.0 → 11.9.0
@sentry/solid (source)	11.8.0 → 11.9.0
pnpm (source)	12.14.0 → 12.16.0
vite (source)	8.3.4 → 8.3.5
wrangler (source)	4.151.2 → 4.153.0

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.65.0

Compare Source

Minor Changes

• #​16363 d3240f2 Thanks @​jamesopstad! - Remove the experimental.newConfig option from Vite plugin v1

  Vite plugin v1 now supports Wrangler configuration files only. Projects using cloudflare.config.ts for configuration should upgrade to Vite plugin v2 beta.

Patch Changes

• #​16373 8cc5f87 Thanks @​petebacondarwin! - Report unsupported remote bindings under Bun instead of hanging

  Starting remote bindings now fails with an actionable error explaining Bun's unsupported request routing. Use Node.js or disable remote bindings to continue local development.

• #​16334 9cecd09 Thanks @​petebacondarwin! - Fix Container setup guidance in Vite development and preview

  Container registry instructions now show the Wrangler command and the configuration location, including Wrangler files and inline Vite configuration.

• #​16333 68d6eec Thanks @​petebacondarwin! - Update the local Workers runtime to the October 19 release

  Include the fix for nested asset paths during local development on Windows, together with the compatible Wrangler release.

  The runtime update also disposes Workflow step results and introspection modifiers after use, preventing undisposed RPC warnings and cancelled local Workflow requests.

• #​16379 160e655 Thanks @​petebacondarwin! - Update the local Workflow runtime to use native storage cleanup

  Consume the Miniflare fix that queues Workflow persistence deletion with instance recreation, including deletion through the local Explorer. This prevents storage cleanup from racing reuse of the same Workflow instance ID.

• #​16289 bbe822f Thanks @​petebacondarwin! - Retry remote preview token refreshes after transient failures

  Backport the retry fix to the private remote-bindings workspace package and require wrangler@4.151.1 so long-running remote development sessions recover after a network outage.

• #​16291 0262f7d Thanks @​petebacondarwin! - Use published SDK dependencies for Vite plugin v1 maintenance

  Pin the plugin's published SDK dependencies to their deployed npm versions. Keep private shared packages as workspace dependencies so their implementation and build tools remain available on the v1 maintenance branch.

cloudflare/workers-sdk (@​cloudflare/vitest-plugin)

v1.4.8

Patch Changes

• #​16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #​16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

  The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

• #​16335 28cca4c Thanks @​robingenz! - Fix Worker tests failing when CommonJS dependencies require packages with separate import and require entries on Vite 8. The fix needs Vite 8.2.1 or later; Vite 8.0.x, 8.1.x and 8.2.0 stay affected.

• Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, c0e915f, b7e762d, c709bff, 23ef63a, bcd618d]:

  • miniflare@5.20261023.0-beta
  • wrangler@​4.153.0

v1.4.7

Patch Changes

• Updated dependencies [80a9f96, 08f22d3, 2878645, a4eb57d, 182d6de]:
  • wrangler@​4.152.0
  • miniflare@5.20261019.2-beta

v1.4.6

Compare Source

Patch Changes

• #​15708 3464abc Thanks @​samstarling! - Dispose Workflow step results and introspection modifiers after use

  Release RPC resources deterministically during local Workflow execution and introspection. This prevents undisposed RPC warnings and requests being cancelled after their execution context has ended. Live step results retain their original data shape, including typed-array offsets and backing buffers. Callbacks that finish after a step times out also release their results, cancelling unused streams without delaying retries.

  Disposing an introspector still aborts the instance if modifier acquisition failed, without introducing a teardown error. Non-stream results containing function-valued array properties are rejected according to the serialisable-output contract, instead of silently discarding those properties during storage normalisation.

• #​15846 a88cac4 Thanks @​oddharsh! - Fail with an error instead of hanging when local dev requests can't work under Bun

  Bun's fetch() ignores the undici dispatcher that Miniflare routes requests through (oven-sh/bun#39247). Under Bun, createTestHarness()'s server.fetch() and server.getWorker()'s fetch(), email() and scheduled() now throw a UserError, requests to the dev server URL get a 503 naming the cause, and starting remote bindings throws a UserError. Each of these used to hang with no error. server.getWorker().getEnv() and getExport() keep working under Bun.

• Updated dependencies [4508172, 61fc739, 3464abc, a88cac4, 262021d]:

  • wrangler@​4.151.3
  • miniflare@5.20261019.1-beta

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.32.2

Compare Source

What's Changed

• fix: add explicit | undefined to Transport optional properties (v1.x backport of #​1766) by @​kishormorol in #​2814
• [v1.x] fix: allow registering after connect() when the capability was declared by @​claude[bot] in #​2958
• chore: bump version to 1.32.2 by @​claude[bot] in #​3089

New Contributors

• @​kishormorol made their first contribution in #​2814

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

getsentry/sentry-javascript (@​sentry/cloudflare)

v11.9.0

Compare Source

Important Changes

• feat: Rename diagnostic_channel, fetch and gRPC span origins (#​25601)

  Some span origins changed their names to match the other v11 origins:

  • auto.graphql.diagnostic_channel is now auto.graphql.graphql.
  • auto.db.redis.diagnostic_channel, auto.db.mysql2.diagnostic_channel and auto.db.mongoose.diagnostic_channel now end in .native_channel.
  • auto.http.wintercg_fetch is now auto.http.fetch, as on Bun, Deno and Cloudflare.
  • auto.grpc.serverless is now auto.grpc.google_cloud.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(deno): Add incoming request options to denoServeIntegration (#​25493)

  denoServeIntegration now accepts ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated and onSpanEnd, with the same meaning as in denoHttpIntegration. The callbacks receive the web Request.

  ignoreStaticAssets defaults to true, so Deno.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set denoServeIntegration({ ignoreStaticAssets: false }). Deno.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled.

• feat(deno): Record request sessions for Deno.serve (#​25496)

  denoServeIntegration now records a request session for each incoming request, as denoHttpIntegration does for node:http. This gives release health and crash-free rates for Deno.serve apps. Sessions are sent only when a release is set. To turn them off, set denoServeIntegration({ sessions: false }). sessionFlushingDelayMS sets how long the SDK waits before it sends the session aggregate.

• feat(deno): Register channel injection hooks from init() (#​25546)

  Sentry.init() in @sentry/deno now registers the diagnostics-channel injection hooks, as @sentry/node does. The channel integrations now record spans without --preload=npm:@sentry/deno/import, for modules that you import after init(). To also instrument modules that load before init(), such as static imports in your entry module, keep the preload. With debug: true, the SDK logs a warning when no injection is active.

  On Node.js, tracing-hooks messages now show with debug: true instead of with DEBUG=@apm-js-collab/*.

• feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#​25456)

  The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

  // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
  export { POST } from '@sentry/nextjs/tunnel';

  The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

  Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

• feat(nextjs): Never emit trace meta tags from a prerender (#​25141)

  Pageloads of apps with cacheComponents enabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell.

  If you set up OpenTelemetry yourself and register SentryPropagator, register NextSentryPropagator instead and pass your tracer provider to markPrerendersOnTracerProvider, so that your prerendered pages carry no trace information either.

• feat(nextjs): Send tunnel route requests with credentials: 'omit' (#​25509)

  With tunnelRoute and no tunnel route handler, @sentry/nextjs now sends events from the browser with credentials: 'omit', because the tunnel route does not need cookies.
  If a layer in front of your app checks cookies before it lets requests through (for example Vercel Deployment Protection), you can send them again in your browser Sentry.init call:

  // instrumentation-client.ts
  Sentry.init({
    transportOptions: { fetchOptions: { credentials: 'same-origin' } },
  });

• feat(nitro): Report a single http.server span per request (#​25295)

  A Nitro request now creates only one http.server span. The nested http.server spans with the origins auto.http.nitro.srvx and auto.http.nitro.h3 are removed. h3 route handlers now get a handler span, and middleware spans are direct children of the http.server span. If you have queries or alerts on the removed spans, change them to use the http.server span or the handler span.

• fix: Use auto.http.http_server origin for all node:http server spans (#​25604)

  On Bun and Deno, node:http server spans now have the origin auto.http.http_server instead of auto.http.server, as on Node.js. On Node.js, nothing changes. Bun.serve spans keep auto.http.bun.serve and Deno.serve spans keep auto.http.deno. If you have ignoreSpans or beforeSendSpan rules, queries or alerts on auto.http.server, change them to use auto.http.http_server.

Other Changes

• feat(browser): Add LoaderSentry type export (#​25357)
• feat(cloudflare): Add isStreamingResponse option and detect streamed RSC responses (#​24932)
• feat(core): Add dataCollection.mcp option (#​25553)
• feat(core): Limit the body size of tunnel requests (#​25515)
• feat(nextjs): Link use cache hits to their fill across instances (#​25448)
• feat(nextjs): Wait for the resumed part of a document before starting the pageload (#​25142)
• feat(nitro): Merge the nitro integrations into a single nitroIntegration (#​25349)
• feat(server-utils): Emit execute_tool spans for Anthropic's beta.messages.toolRunner() (#​25320)
• fix(astro): defer to @sentry/cloudflare/vite on Cloudflare Workers (#​25347)
• fix(aws-serverless): End the function.aws span when a callback-style handler calls back (#​25543)
• fix(browser): Skip profiling for unsampled active root spans (#​25498)
• fix(bundler-plugins): Check globalThis before global in the injected snippet (#​25365)
• fix(bundler-plugins): Inject the release only into chunks that load at startup (#​25541)
• fix(cloudflare): auto-instrument a re-exported default export (#​25345)
• fix(cloudflare): Deliver check-ins and events from forked isolation scopes (#​25374)
• fix(cloudflare): Don't hold Durable Object invocations open with the segment-end flush timer (#​25490)
• fix(cloudflare): keep default exports intact when auto-instrumenting (#​25372)
• fix(core): Use trace_metric data category for metrics rate limits and client reports (#​25606)
• fix(deps): Allow @opentelemetry/api 1.9 again (#​25684)
• fix(deno): Re-export portable helpers that Cloudflare exposes (#​25491)
• fix(elysia): Set SDK metadata on the options passed to init (#​24521)
• fix(elysia): use Node transport on Node runtimes (#​25015)
• fix(hono): Read connection info from the runtime instead of Hono helpers (#​25552)
• fix(nextjs): Only inject applicationKey metadata into browser bundles (#​25565)
• fix(nitro): Use forward slashes for resolved plugin paths on Windows (#​25023)
• fix(node,vercel-edge,bundler-plugins): Ignore commit env vars set to their own name (#​25244)
• fix(node): Guard user callbacks in the node:http server instrumentation (#​25592)
• fix(node): Only read JavaScript and TypeScript source files in ContextLines (#​25535)
• fix(node): restore tsx runtime instrumentation (#​25351)
• fix(nuxt): Delete Sentry-enabled source maps from Nitro output directories (#​25450)
• fix(nuxt): Keep sourcesContent in Nuxt 5 server source maps (#​25325)
• fix(react): Don't crash ErrorBoundary when error.cause is not an Error (#​25542)
• fix(react): Match React Router navigations against root routes only (#​25336)
• fix(server-runtime-injection): Load ESM hook without the build/esm package.json marker (#​25562)
• fix(server-utils): Bundle the CommonJS dependencies of instrumented packages on Vite 8 (#​25523)
• fix(server-utils): Keep OpenAI decision confidence on Vercel AI decide spans (#​25457)
• fix(server-utils): Nest LangChain run spans under their parent run (#​25364)
• fix(server-utils): Stop the orchestrion Vite plugin from bundling the CJS build of @​sentry/server-utils (#​25359)
• fix(solidstart): Read server action route from the request's root span (#​25513)
• fix(tanstackstart-react): Delete only the source maps that Sentry enabled (#​25362)
• fix(vercel-edge): expose portable tracing and feature flag helpers (#​25377)
• ref(bundler-plugins): Drop @​babel/core peer dependency (#​25406)
• ref(nitro): Move channel-based instrumentation into @​sentry/server-utils (#​24861)

Internal Changes

• build(node): Bump Node to 24.22.1 (#​25634)
• chore: Add external contributor to CHANGELOG.md (#​25367)
• chore: Add external contributor to CHANGELOG.md (#​25468)
• chore: Add external contributor to CHANGELOG.md (#​25483)
• chore: Add external contributor to CHANGELOG.md (#​25485)
• chore: Add external contributor to CHANGELOG.md (#​25487)
• chore: Add external contributor to CHANGELOG.md (#​25500)
• chore: Add external contributor to CHANGELOG.md (#​25505)
• chore: Add external contributor to CHANGELOG.md (#​25596)
• chore: Add external contributor to CHANGELOG.md (#​25597)
• chore: Add external contributor to CHANGELOG.md (#​25611)
• chore: Move the monorepo from Yarn 1 to pnpm 12 (#​25354)
• chore: Update comments related to span links with latest info (#​25135)
• chore(bugbot): Flag new Cloudflare tests that wrap the worker by hand (#​25619)
• chore(deps-dev): Bump oxlint and oxfmt (#​25578)
• chore(deps-dev): Bump vue from 3.2.45 to 3.5.43 (#​25413)
• chore(deps): Bump @types/node to 20 (#​25501)
• chore(deps): Bump Playwright to 1.64.1 and pin it exactly (#​25382)
• chore(hono): Remove "ALPHA" from package.json description (#​25521)
• chore(size-limit): weekly auto-bump (#​25442)
• ci: Check bundle size increases per PR (#​24737)
• ci: Empty cached node_modules that have broken .bin scripts (#​25635)
• ci: Fail when a Playwright version drifts from the pinned one (#​25383)
• ci: Keep Namespace cache volumes complete and cache the pnpm binary (#​25569)
• ci: Move size check reruns into a local action (#​25600)
• ci: Read the Playwright version from package.json in install-playwright (#​25380)
• ci: Run GitHub Actions jobs on Namespace runners (#​25547)
• ci: Run optional E2E tests in a separate workflow (#​25548)
• ci: Run the Playwright install's npx outside the repo (#​25384)
• ci: Share the E2E test setup between build.yml and optional-e2e.yml (#​25616)
• ci: Stop uploading duplicate tarballs to the release artifact (#​25688)
• ci(cloudflare): Run the integration tests on the latest wrangler too (#​25508)
• ci(e2e): Run all E2E tests when CI config changes (#​25391)
• ci(e2e): Run E2E tests with pnpm 12 (#​25334)
• ci(e2e): Run E2E tests without restoring the monorepo's node_modules (#​25403)
• ci(e2e): Stop pnpm run from installing the workspace in E2E jobs (#​25514)
• ci(size-limit): Don't enforce size limits on release PRs (#​25631)
• docs: Add guide for testing SDK packages with pnpm link (#​25512)
• feat(deps): Bump @​actions/glob from 0.6.1 to 0.7.0 (#​25411)
• feat(deps): Bump @​anthropic-ai/sdk from 0.63.0 to 0.133.0 (#​25417)
• feat(deps): Bump recast from 0.20.5 to 0.24.0 (#​25416)
• ref(core): Share the commit env var list used for release detection (#​25478)
• test(browser): Use blocking scripts in loader integration tests (#​25395)
• test(deps): Upgrade TanStack Start, Router, and Nitro (#​25445)
• test(e2e): Add node-otel-sdk-node-v3 e2e app for OpenTelemetry JS v3 (#​25630)
• test(e2e): Align Playwright versions with the root version (#​25381)
• test(e2e): Cover Vercel AI decisions in node-openai-decisions-send-to-sentry (#​25458)
• test(e2e): Drop OpenRouter's [DONE] frame in the Anthropic test app (#​25594)
• test(e2e): Drop unused @​sentry/bundler-plugins dependency from bundler apps (#​25399)
• test(e2e): Fix peer dependency issues in hydrogen-react-router-7 (#​25400)
• test(e2e): Install test-utils from a tarball (#​25402)
• test(e2e): Move app port 38787 out of the ephemeral port range (#​25504)
• test(e2e): Remove event dumps and their normalization script (#​25404)
• test(e2e): Retry tests in all dev-mode variants (#​25640)
• test(e2e): Use nitro beta and Vite 8 in tanstackstart apps (#​25451)
• test(nestjs): Fix flaky schedule instrumentation error tests (#​25447)
• test(nextjs): Bump nextjs-16 E2E app to Next.js 16.4.2 (#​25686)
• test(nextjs): Fix flaky nextjs-16 metrics tests (#​25517)
• test(nextjs): Use React 19.3.1 in the vinext e2e variants (#​25449)
• test(nextjs): Warm the module graph before the tunnel route tests (#​25593)
• test(node): skip the Prisma 8 suite on Node 20 (#​25421)
• test(nuxt): Pin the nuxt-4 e2e MongoDB image to 8.0 (#​25557)
• test(nuxt): Pin the nuxt-5 e2e MongoDB image to 8.0 (#​25564)
• test(nuxt): Wait for hydration before clicking in error tests (#​25520)
• test(react): Fix flaky react-router-6 aborted SSE console assertion (#​25398)
• test(replay): Fix flaky bufferStalledRequests segmentId assertion (#​25394)

Work in this release was contributed by @​4ktLuffy, @​adityareddy-dev, @​dasilvaluis, @​faizansaiyed123, @​jpdefo, @​Jxxunnn, @​mikamikasuki, @​philipatkinson, @​rubas, and @​Shubham-Padkonde. Thank you for your contributions!

pnpm/pnpm (pnpm)

v12.16.0: pnpm 12.16

Compare Source

This release adds a global --env-file flag, updates to a symlinked pnpm-lock.yaml, and pnpm setup --no-modify-path. It also fixes two security issues, in zstd decompression and in signing.

Minor Changes

• Added a repeatable global --env-file <path> flag to load environment variables from dotenv-style files before running a command. Later files override earlier files, variables already in the environment are preserved, and loaded variables are visible to user-level .npmrc interpolation and lifecycle scripts #​7111.

• pnpm can now update a pnpm-lock.yaml that is a symlink. List the directories the lockfile may link into in the symlinkedLockfileTargetDirs setting, in the global config or with PNPM_CONFIG_SYMLINKED_LOCKFILE_TARGET_DIRS. pnpm writes the update to the file the symlink points to if that file is inside one of these directories. The symlink stays in place. pnpm ignores this setting in pnpm-workspace.yaml #​17222.

• Added a --no-modify-path option to pnpm setup. It installs pnpm without adding it to PATH, leaving the shell config file, the Windows registry, and the GitHub Actions environment files unchanged. pnpm setup then prints the lines to add yourself get.pnpm.io#37.

Patch Changes

Security

• Fixed memory exposure and allocation handling vulnerabilities when processing zstd-compressed data #​17388.

• Signing in pnpm and pnpr no longer uses arithmetic that may leak the private key through timing. This covers shared artifacts, OCI registry tokens, and OIDC login state advisory.

Installing packages

• A dependency symlink that pnpm cannot point at the wanted target now fails the install with an error that names the link. This happens when the filesystem still serves the old link after pnpm removed it, as a node_modules served by a virtual filesystem does. pnpm used to remove the link again without end and crashed with a segmentation fault once the thread ran out of stack.

• Concurrent workspace installs no longer lose store-index rows when initializing the shared SQLite index #​17388.

• Agent skill links now keep the same target across installs when a package version is installed with several sets of peer dependencies. An install no longer fails with ERR_PNPM_AGENT_SKILL_PATH_OCCUPIED on a skill link that pnpm created for another of those copies #​17319.

• pnpm now fails at once, without retrying, when a downloaded package archive contains a rejected entry path #​17205.

• pnpm now builds a git-hosted dependency in every new location it links the dependency into, such as a new global virtual store slot or a fresh node_modules. When the side-effects cache holds the build output, pnpm restores it from there. Before, only the install that fetched the dependency built it. This also fixes dependencies that are already in the store #​17224.

• Changes a preResolution hook makes to the lockfiles now take effect. The hook now also runs when pnpm installs from an up-to-date lockfile. An error thrown by the hook now fails the install.

• A custom fetcher in the pnpmfile can now call fetchers.directory to fetch a package from a local directory. The call rejects with ERR_PNPM_TARBALL_INTEGRITY if the lockfile pins an archive integrity for the package. Previously, calling fetchers.directory failed with a TypeError.

• packageImportMethod: copy now also applies to packages that have lifecycle scripts or patches. On a filesystem that supports block cloning, such as ReFS or a Dev Drive on Windows, these packages were cloned #​17195.

• With nodeLinker: hoisted and autoInstallPeers: false, a package that workspace projects use with different peer versions is now installed once per peer variant, so each project's copy resolves that project's peer #​17395.

• Under nodeLinker: hoisted, pnpm install now leaves a patched package that is already in place alone. The same holds for a package whose peers include a patched package, such as every package peering on a patched react-native #​17188.

• With nodeLinker: hoisted, an install that stops partway no longer leaves the next install trusting the packages it was replacing. Before, reverting the change that started the stopped install, such as a patch edit, kept the half-replaced package in node_modules.

Repeat installs and changed settings

• A repeat pnpm install now acts on a change to these settings. Before, it reported "Already up to date".

  • storeDir or virtualStoreDir: it recreates node_modules.
  • globalVirtualStoreDir: it links the packages from the new directory.
  • virtualStoreDirMaxLength: it renames the virtual store directories.
  • dangerouslyAllowAllBuilds turned on: it runs the builds it skipped.
  • trustLockfile turned off: it verifies the lockfile.

• pnpm add, pnpm remove, and pnpm update now fail if node_modules does not match the current settings. Run pnpm install to recreate it. Previously, these commands removed and reinstalled node_modules without asking. They report:

  • ERR_PNPM_UNEXPECTED_STORE if node_modules was linked from a different store.
  • ERR_PNPM_UNEXPECTED_VIRTUAL_STORE if it was linked from a different virtual store directory.
  • ERR_PNPM_MODULES_BREAKING_CHANGE if it was installed by an incompatible pnpm version, or if node_modules/.modules.yaml cannot be read.
  • ERR_PNPM_NODE_LINKER_DIFF if it was installed with a different nodeLinker.

  pnpm update now also fails with ERR_PNPM_HOIST_PATTERN_DIFF and the other errors pnpm add reports for a changed hoist pattern or virtualStoreDirMaxLength.

• An install filtered to some workspace projects now fails if node_modules was installed with a different nodeLinker, hoistPattern, publicHoistPattern, store, or virtual store. Before, it recreated node_modules and left the projects it skipped without their dependencies. A pnpm install of the whole workspace still recreates node_modules pnpm/tasks#217.

• pnpm install and the verifyDepsBeforeRun check now notice an edited patch file when sharedWorkspaceLockfile is false.

• pnpm install now takes its fast path in a workspace with patchedDependencies when the previous install ran with another major version of pnpm.

• pnpm install now relinks the bins of a workspace package when its bin field changes, including with --frozen-lockfile and an unchanged lockfile. A filtered install relinks them in the selected projects, and the next install that covers the remaining projects relinks them there #​17324.

• pnpm install now removes command shims from node_modules/.bin when a workspace dependency renames or removes an entry from its bin field pnpm/tasks#211.

Resolving dependencies and the lockfile

• A package that a plain range and a <prefix>: specifier both resolve from one registry is now recorded once in pnpm-lock.yaml and installed once. The lockfile key names the registry a package resolved from. When that registry declares a prefix, through prefix in registries or through namedRegistries, the package is keyed <name>@<prefix>:<version> however its dependency was written: with the prefix, as a plain range its scope routes to that registry, or through the default registry. Before, the plain range was keyed <name>@<version>, so one tarball was installed twice and instanceof checks and module singletons broke between the two copies. The same name and version served by two registries still get separate entries. When several prefixes declare one registry, its packages are keyed by the lexicographically smallest prefix.

  If a scope you route reaches a registry that also declares a prefix, your next pnpm install re-keys those entries, which shows up as a lockfile diff. Commit it. pnpm install --frozen-lockfile installs the lockfile as recorded.

• pnpm install now resolves a scope's packages again when the scope is routed to another registry in registries. Before, the lockfile kept the versions and integrity resolved from the old registry, so the install failed when the new registry did not serve a locked version or served different content. pnpm records in the workspace state which registry each scope routed to, so a fresh clone without that record installs the lockfile as recorded. Changing the default registry resolves nothing again, and pnpm install --frozen-lockfile is unchanged.

• When autoDedupe is off, a workspace project's dependencies now resolve from its own ranges, like they do with sharedWorkspaceLockfile: false. Previously, another project's narrower range could hold them back. For example, ajv: "*" now resolves to the latest Ajv even if another project depends on ajv@^6. Packages that a project lists in peerDependencies still follow the versions other projects use. pnpm dedupe and installs with autoDedupe: true still pick one version that satisfies every range. Set autoDedupe: true if CI runs pnpm dedupe --check #​17235.

• An optional dependency written with a named-registry prefix, such as work:^1.0.0, now fails the install when it cannot be resolved but the lockfile already has a matching entry from that registry. Such a dependency was skipped, which removed its entries from the lockfile.

• With injectWorkspacePackages: true, a workspace: dependency written as a relative path, such as workspace:../lib-a, in a workspace package now resolves from that package's directory #​17284.

• Fixed pnpm install failing with ERR_PNPM_UNSUPPORTED_PROTOCOL when a workspace package injected through a relative path, such as workspace:../lib, has catalog: dependencies. Their catalog entries now resolve the way they do for a package injected by name #​17280.

• pnpm dedupe now refreshes cached registry metadata while re-resolving locked versions #​17208.

• pnpm dedupe --check no longer fails when the only difference is a deprecated notice that the registry added or removed after the lockfile was written #​17198.

• Installs delegated to a pnpr server now resolve every prefix declared for a registry URL. A dependency or lockfile entry that used the second of two prefixes for the same registry, such as zeta: next to work: in namedRegistries, failed on the server pnpm/tasks#204.

• Registry revisions are now addressed at <registry>/<name>@<version>+r<revision> pnpm/tasks#208.

Adding packages and global packages

• pnpm add <pkg>@<tag> and pnpm add <pkg>@<range> now install the version the tag or range resolves to, even when the saved range allows a newer one #​17234.

• pnpm add <pkg> without a version now installs the version under the dist-tag set by the tag setting. An npm: alias or a jsr: dependency without a version resolves that tag too. The setting is read from pnpm-workspace.yaml, the global config, PNPM_CONFIG_TAG, and --config.tag, and defaults to latest.

• pnpm add now accepts the lowercase short options -p, -d, -o, and -e as aliases of --save-prod, --save-dev, --save-optional, and --save-exact.

• pnpm -D install <pkg> now saves the package to devDependencies. An add option such as -D or -E written before install <pkg> was rejected as an unexpected argument.

• pnpm add -T now reports that the short option is ambiguous and points to --save-types and --tilde.

• Global packages installed with pnpm add -g are now linked from the global virtual store, so global packages that share dependencies share one copy. Set virtualStoreType: project to give each global install its own virtual store.

• pnpm add -g and the other --global commands now fail with ERR_PNPM_CONFIG_CONFLICT_VIRTUAL_STORE_DIR_WITH_GLOBAL when --virtual-store-dir is passed. A custom --hoist-pattern fails with ERR_PNPM_CONFIG_CONFLICT_HOIST_PATTERN_WITH_GLOBAL. Passing --link-workspace-packages, --shared-workspace-lockfile, or --config.lockfile-dir with --global also fails, with the matching ERR_PNPM_CONFIG_CONFLICT_*_WITH_GLOBAL code.

Registries, proxies, and login

• pnpm now reads the strictSsl and localAddress settings from pnpm-workspace.yaml, the global config.yaml, PNPM_CONFIG_* environment variables, and --config.* options. This includes pnpm self-update and the download of the pnpm version pinned in packageManager. Before, pnpm read them only from .npmrc as strict-ssl and local-address and ignored the other sources pnpm/tasks#201.

• When Corepack runs pnpm and the native binary has to be downloaded, the download now uses the proxy from pnpm's config. That proxy comes from PNPM_CONFIG_HTTPS_PROXY and the matching variables, the global config.yaml, and the user .npmrc. Previously, the download read the proxy only from HTTPS_PROXY, HTTP_PROXY, and NO_PROXY pnpm/tasks#215.

• When the pnpm package downloads its native binary on first run, as it does under Corepack, it now trusts the CA certificates from the ca, ca[], and cafile settings of .npmrc, including the ones scoped to the registry. A registry behind a private CA failed with fetch failed before, unless NODE_EXTRA_CA_CERTS named the CA. A project .npmrc is used only while the download is checked against npm's signature. Node.js versions that cannot add CA certificates after startup still need NODE_EXTRA_CA_CERTS.

• pnpm login saves the token in <pnpm config>/auth.ini again. Since v12.1.0, an unscoped login had made its registry the default for every project that did not name a registry. A login now also removes the token an earlier login saved for that registry or scope under _auth in the global config.yaml. pnpm login --scope still routes the scope through the global registries setting.

• pnpm no longer warns that a registries entry routed through the @ scope matches no configured registry. pnpm applied such an entry and its options such as serverType while reporting it as ignored [v12: "registries entries do not match any configured registry" is a false positive for an entry routed through "@" pnpm/tasks#184](https://redirect.github.com/pnpm/tasks/issues

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 08:59 AM, only on Monday (* 0-8 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.