chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@types/node (source)	24.13.2 → 24.13.3			devDependencies	patch
charm.land/bubbles/v2	v2.1.0 → v2.1.1			require	patch
charm.land/bubbletea/v2	v2.0.7 → v2.0.8			require	patch
charm.land/lipgloss/v2	v2.0.4 → v2.0.5			require	patch
cloud.google.com/go/auth	v0.20.0 → v0.21.0			indirect	minor
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	v1.33.0 → v1.34.0			indirect	minor
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric	v0.57.0 → v0.58.0			indirect	minor
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping	v0.57.0 → v0.58.0			indirect	minor
github.com/aws/aws-sdk-go-v2	v1.42.0 → v1.42.1			indirect	patch
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.7.13 → v1.7.14			indirect	patch
github.com/aws/aws-sdk-go-v2/config	v1.32.26 → v1.32.29			indirect	patch
github.com/aws/aws-sdk-go-v2/credentials	v1.19.25 → v1.19.28			indirect	patch
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.18.29 → v1.18.30			indirect	patch
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.4.29 → v1.4.30			indirect	patch
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.7.29 → v2.7.30			indirect	patch
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.4.30 → v1.4.31			indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	v1.13.12 → v1.13.13			indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/checksum	v1.9.22 → v1.9.23			indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.13.29 → v1.13.30			indirect	patch
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	v1.19.30 → v1.19.31			indirect	patch
github.com/aws/aws-sdk-go-v2/service/s3	v1.104.1 → v1.105.0			indirect	minor
github.com/aws/aws-sdk-go-v2/service/signin	v1.2.1 → v1.4.0			indirect	minor
github.com/aws/aws-sdk-go-v2/service/sso	v1.31.4 → v1.32.0			indirect	minor
github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.36.7 → v1.37.0			indirect	minor
github.com/aws/aws-sdk-go-v2/service/sts	v1.43.4 → v1.44.0			indirect	minor
github.com/charmbracelet/ultraviolet	f39628c → f5a850f			indirect	digest
github.com/dlclark/regexp2/v2	v2.2.2 → v2.5.0			indirect	minor
github.com/elliotchance/orderedmap/v3	v3.1.0 → v3.1.1			require	patch
github.com/googleapis/enterprise-certificate-proxy	v0.3.17 → v0.3.18			indirect	patch
github.com/googleapis/gax-go/v2	v2.22.0 → v2.23.0			indirect	minor
github.com/klauspost/compress	v1.18.7 → v1.19.0			indirect	minor
github.com/planetscale/vtprotobuf	ba97887 → 8ae5a48			indirect	digest
go	1.26.4 → 1.26.5				patch
golang.org/x/crypto	v0.53.0 → v0.54.0			indirect	minor
golang.org/x/exp	c48552f → 9ea1abe			indirect	digest
golang.org/x/net	v0.56.0 → v0.57.0			indirect	minor
golang.org/x/sync	v0.21.0 → v0.22.0			require	minor
golang.org/x/sys	v0.46.0 → v0.47.0			indirect	minor
golang.org/x/term	v0.44.0 → v0.45.0			require	minor
golang.org/x/text	v0.38.0 → v0.40.0			indirect	minor
golang/govulncheck-action	v1.0.4 → v1.1.0			action	minor
google.golang.org/api	v0.287.0 → v0.288.0			indirect	minor
google.golang.org/genproto	925bb5d → f0a9213			indirect	digest
google.golang.org/genproto/googleapis/api	925bb5d → f0a9213			indirect	digest
google.golang.org/genproto/googleapis/rpc	925bb5d → f0a9213			indirect	digest
mvdan.cc/sh/moreinterp	19def06 → 2255122			require	digest
netlify-cli	26.1.0 → 26.2.0			devDependencies	minor
pnpm (source)	11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b → 11.12.0			packageManager	minor
pnpm (source)	11.9.0 → 11.12.0				minor
prettier (source)	3.9.4 → 3.9.5			devDependencies	patch
vitepress-plugin-tabs (source)	0.9.0 → 0.9.1			devDependencies	patch

---

Release Notes

charmbracelet/bubbles (charm.land/bubbles/v2)

v2.1.1

Compare Source

Lil’ Textarea Fix

This is a tiny patch to fix a bug in textarea where the prompt character could be missing styling on empty lines. That’s all for now!

Thanks for using Bubbles,
Charm 🌞

Changelog

Fixed

• d2b2217: fix(textarea): apply prompt style on all lines, including fillers (@​meowgorithm)

Docs

• a13f110: docs: fix typo in README (#​921) (@​Rohan5commit)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/bubbletea (charm.land/bubbletea/v2)

v2.0.8

Compare Source

Graphemes, schmraphemes

No terminal can render emojis perfectly, but we can try. This release improves some very specific edge cases around emoji rendering. Enjoy!

Changelog

• db569ad: fix(deps): bump ultraviolet for emoji-related rendering improvements

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/lipgloss (charm.land/lipgloss/v2)

v2.0.5

Compare Source

Changelog

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

googleapis/google-cloud-go (cloud.google.com/go/auth)

v0.21.0

Compare Source

• bigquery:

  • Add OpenCensus tracing.

• firestore:

  • BREAKING CHANGE: If a document does not exist, return a DocumentSnapshot
    whose Exists method returns false. DocumentRef.Get and Transaction.Get
    return the non-nil DocumentSnapshot in addition to a NotFound error.
    DocumentRef.GetAll and Transaction.GetAll return a non-nil
    DocumentSnapshot instead of nil.
  • Add DocumentIterator.Stop. Call Stop whenever you are done with a
    DocumentIterator.
  • Added Query.Snapshots and DocumentRef.Snapshots, which provide realtime
    notification of updates. See https://cloud.google.com/firestore/docs/query-data/listen.
  • Canceling an RPC now always returns a grpc.Status with codes.Canceled.

• spanner:

  • Add CommitTimestamp, which supports inserting the commit timestamp of a
    transaction into a column.

GoogleCloudPlatform/opentelemetry-operations-go (github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric)

v0.58.0

Compare Source

aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)

v1.42.1

Compare Source

Module Highlights

• github.com/aws/aws-sdk-go-v2/service/acm: v1.37.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/aiops: v1.6.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/appflow: v1.50.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/appsync: v1.51.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/athena: v1.55.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/autoscaling: v1.58.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/b2bi: v1.0.0-preview.79
  • Feature: Updated APIs to support custom validation rules.
• github.com/aws/aws-sdk-go-v2/service/bedrock: v1.45.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/bedrockagent: v1.50.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/bedrockdataautomation: v1.9.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/bedrockdataautomationruntime: v1.7.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/braket: v1.37.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/chatbot: v1.14.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/chimesdkmediapipelines: v1.26.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/chimesdkmessaging: v1.31.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/cloudcontrol: v1.28.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/cloudformation: v1.65.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/cloudsearch: v1.31.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/cloudtraildata: v1.16.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/cloudwatchevents: v1.32.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.57.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/codeartifact: v1.38.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/codegurusecurity: v1.16.3
  • Documentation: Documentation update to notify users of the discontinuation of Amazon CodeGuru Security.
• github.com/aws/aws-sdk-go-v2/service/codestarnotifications: v1.31.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/connectparticipant: v1.34.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/controltower: v1.26.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/costandusagereportservice: v1.33.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/datazone: v1.39.0
  • Feature: Releasing the following features - Asset classification that lets users use restricted terms for classifying assets if they have the right permissions. Also adding a new enum value "Moving" to project status.
• github.com/aws/aws-sdk-go-v2/service/dax: v1.28.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/devicefarm: v1.35.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/devopsguru: v1.39.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/directconnect: v1.37.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/docdbelastic: v1.19.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/ec2: v1.246.0
  • Feature: Added IPv6 support for AWS Client VPN.
• github.com/aws/aws-sdk-go-v2/service/eks: v1.72.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/emrcontainers: v1.39.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/finspacedata: v1.33.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/forecast: v1.41.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/fsx: v1.61.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/groundstation: v1.37.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/health: v1.34.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/iotdataplane: v1.32.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/iotfleethub: v1.29.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/iotsitewise: v1.51.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/kendra: v1.60.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/keyspaces: v1.23.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/kinesisanalytics: v1.30.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/kinesisvideoarchivedmedia: v1.32.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/lambda: v1.77.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/lexmodelsv2: v1.56.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/lexruntimeservice: v1.29.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/licensemanager: v1.36.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/lookoutequipment: v1.35.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/mailmanager: v1.17.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/marketplacecatalog: v1.36.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/mediaconvert: v1.82.0
  • Feature: This release adds support for input rendition selection for HLS input, adds new Share API to enable sharing jobs with AWS Support for support investigations, and adds INCLUDE_AS_TS to iFrameOnlyManifest setting for HLS outputs.
• github.com/aws/aws-sdk-go-v2/service/mediapackagevod: v1.39.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/mediastore: v1.29.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/migrationhubstrategy: v1.26.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/odb: v1.4.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/opensearchserverless: v1.25.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/opsworkscm: v1.32.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/outposts: v1.56.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/pcaconnectorad: v1.15.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/personalizeruntime: v1.32.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/qbusiness: v1.33.0
  • Feature: The Amazon Q Business GetDocumentContent operation now supports retrieval of the extracted text content in JSON format.
• github.com/aws/aws-sdk-go-v2/service/redshiftserverless: v1.31.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/repostspace: v1.14.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/resiliencehub: v1.34.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi: v1.30.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/sagemakeredge: v1.30.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/sagemakerfeaturestoreruntime: v1.34.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/sagemakerruntime: v1.37.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/serverlessapplicationrepository: v1.29.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/servicecatalog: v1.38.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/sfn: v1.39.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/shield: v1.34.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/snowball: v1.35.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/sqs: v1.42.1
  • Documentation: Documentation update for Amazon SQS Supports Large Payload Message feature
• github.com/aws/aws-sdk-go-v2/service/ssoadmin: v1.35.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/storagegateway: v1.42.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/support: v1.31.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/supportapp: v1.18.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/taxsettings: v1.16.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/timestreaminfluxdb: v1.16.0
  • Feature: Add MAINTENANCE status for DbInstance and DbCluster
• github.com/aws/aws-sdk-go-v2/service/transcribe: v1.52.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/transcribestreaming: v1.31.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/translate: v1.33.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/wellarchitected: v1.39.0
  • Feature: Remove incorrect endpoint tests
• github.com/aws/aws-sdk-go-v2/service/workspacesthinclient: v1.20.0
  • Feature: Remove incorrect endpoint tests

dlclark/regexp2 (github.com/dlclark/regexp2/v2)

v2.5.0

Compare Source

v2.4.0

Compare Source

v2.3.0

Compare Source

elliotchance/orderedmap (github.com/elliotchance/orderedmap/v3)

v3.1.1

Compare Source

googleapis/enterprise-certificate-proxy (github.com/googleapis/enterprise-certificate-proxy)

v0.3.18

Compare Source

googleapis/gax-go (github.com/googleapis/gax-go/v2)

v2.23.0

Compare Source

Features

• v2: add http.response.status_code to TransportTelemetryData (#​513) (7d5554f)

Bug Fixes

• correct min go version (#​517) (fc62896)

klauspost/compress (github.com/klauspost/compress)

v1.19.0

Compare Source

What's Changed

• zstd: Add true concurrent stream encoding by @​klauspost in #​1136
• zstd: arm64 decoder asm by @​lizthegrey in #​1160
• zstd: avoid unused BuildDict encoder allocation by @​snissn in #​1147
• flate: Add inflate checkpoints by @​klauspost in #​1154
• snappy/s2: Limit length of varint in decodedLen by @​eustas in #​1148
• gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @​z9z in #​1149
• zip: add NameDecoder callback for legacy encoding rewrite by @​SAY-5 in #​1150
• huff0: Allow building tables from histogram. by @​klauspost in #​1155
• huff0: Allow building table from oversized histogram. by @​klauspost in #​1156
• s2sx: Clean symlink targets by @​klauspost in #​1163

New Contributors

• @​snissn made their first contribution in #​1147
• @​eustas made their first contribution in #​1148
• @​z9z made their first contribution in #​1149
• @​SAY-5 made their first contribution in #​1150
• @​HNO3Miracle made their first contribution in #​1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

golang/go (go)

v1.26.5

Compare Source

golang/govulncheck-action (golang/govulncheck-action)

v1.1.0

Compare Source

Full Changelog: golang/govulncheck-action@v1.0.4...v1.1.0

googleapis/google-api-go-client (google.golang.org/api)

v0.288.0

Compare Source

Features

• all: Auto-regenerate discovery clients (#​3647) (510a0c1)

v0.287.1

Compare Source

Documentation

• Remove old TODO file (#​3645) (9d7a6b8)

netlify/cli (netlify-cli)

v26.2.0

Compare Source

Features

• add watch-ignore flag (#​8271) (fc30bcc)

Bug Fixes

• add a stacktrace for monitoring (#​8301) (30ba6a1)
• add commandname to error reporting (#​8303) (004df96)
• deps: replace lodash with native utilities (#​8189) (137fbf0)
• deps: update dependency @​netlify/blobs to ^10.7.9 (#​8291) (419a749)
• deps: update dependency @​netlify/dev to ^4.18.7 (#​8292) (1985b3b)
• deps: update dependency @​netlify/dev-utils to ^4.4.6 (#​8293) (392af83)
• deps: update dependency @​netlify/edge-functions to ^3.0.8 (#​8295) (7d00215)
• deps: update dependency @​netlify/functions to ^5.3.0 (#​8296) (42393a4)
• deps: update dependency @​netlify/images to ^1.3.10 (#​8298) (20fb23d)
• dev: execute dev command with shell operators (&&, ||, etc.) (#​8234) (d07599e)
• silence zip output when creating source zips (#​8323) (e6fbebc)

pnpm/pnpm (pnpm)

v11.12.0

Compare Source

Minor Changes

• a897ef7: Custom fetchers exported from a pnpmfile can now delegate by returning a { delegate: <resolution> } envelope: pnpm rewrites the package's resolution to the delegated shape and runs the built-in fetcher on it. This is the portable delegation form that also works in pacquet, where cafs and fetchers cannot be passed to the hook. Related to pnpm/pnpm#11685.

Patch Changes

• 2b02764: The changed-packages filter (--filter "...[<since>]") no longer allows an option-like <since> value (such as --output=<path>) to be interpreted as a git option — git now rejects it as a bad revision. The repository root is also resolved to the nearest .git entry, so the filter works in a git worktree checked out inside another repository's tree.

• 43711ce: pnpm outdated no longer checks the registry for dependencies that are resolved from local link:, file:, or workspace: references in the lockfile #​12827.

• 3c6718b: Fixed a deadlock in peer dependency resolution: pnpm install hung forever when a peer dependency cycle spanned a project's own dependencies and auto-installed peer providers, for example when installing electron-builder@26.15.3 #​12921.

• 252f15e: Fixed peer dependency auto-install picking a version the peer range rejects. In a workspace with several projects, a package declaring a peer dependency with a semver range (for example ^1.0.0) could get the highest version found anywhere in the workspace (for example a 2.0.0 resolved for another project) instead of a version that satisfies the range. Peers are now deduplicated onto the highest preferred version that satisfies the declared range, and when none does, the range is resolved from the registry.

  Also fixed re-resolving with an existing lockfile hoisting a different peer version than a fresh install of the same manifest: root dependencies reused from the lockfile were invisible to peer hoisting, so a peer that a root dependency provides could be bound to another version.

• a38adda: pnpm self-update <version> now installs the requested pnpm version when it matches the currently running version but is missing from the global self-update directory.

• 6a85968: pnpm stage list now stops paginating after a fail-safe cap of 1000 pages, so a misbehaving registry cannot keep the command looping forever.

• eee7c9a: verify-deps-before-run no longer spawns a pnpm install when pnpm is executed in a directory that has no package.json. A mistyped command run outside a project (for example pnpm witch 10 login) used to crash with a confusing error from the spawned install; now it fails with the regular "no package.json found" error.

v11.11.0

Compare Source

Minor Changes

• 508b8c2: Added the pnpm access command for managing package access and visibility on the registry, supporting listing packages and collaborators, getting and setting package status and MFA requirements, and granting or revoking team access.

Patch Changes

• c70e33e: Allow allowBuilds entries for git-hosted packages to match by repository URL without pinning the resolved commit hash. This lets trusted git repositories keep running their build scripts after branch updates without approving each new commit, while package-name-only rules still do not approve git-hosted artifacts.
• 3067e4f: Reduced peak memory usage during cold-cache dependency resolution. The metadata fetch is memoized for the whole resolution phase, and it was retaining each package's raw registry response body (used only to mirror the response to disk) for that entire time. The memoized cache now holds a body-less copy, so the raw body only lives as long as the call that writes the disk mirror. On large graphs that fetch full metadata (e.g. with minimumReleaseAge or trustPolicy enabled) this cuts peak RSS by roughly 30%, back in line with pnpm 10. The resolved lockfile is unchanged.

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.10 -> 1.26.4