[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
pnpm (source)	11.15.1 → 11.28.11
tsdown (source)	^0.22.13 → ^0.23.0
tsdown-preset-sxzz	^0.6.0 → ^0.7.0

---

Release Notes

pnpm/pnpm (pnpm)

v11.28.11: pnpm 11.28.11

Compare Source

pnpm 11.28.11 fixes frozen installs with excludeLinksFromLockfile, pnpm link in workspaces, pnpm deploy with dangling symlinks, and verifyDepsBeforeRun starting needless installs.

Patch Changes

Installing packages

• pnpm deploy now keeps a symlink in the project whose target is missing from the source, such as a link into a node_modules directory that was removed after the build. Deploy used to fail with ENOENT on such a link #​17571.

• A package with bundledDependencies and a build script now keeps its bundled dependencies when it is restored from the side-effects cache #​17523.

• pnpm install now links the runtime that an earlier pnpm install --no-runtime skipped #​17542.

• Commands of a package whose bin paths contain excess parent directory segments, such as ../dist/cli.js, are no longer missing. Such paths now resolve inside the package #​17586.

• Generated POSIX shell shims now quote their paths, so shell special characters in a path stay literal.

• A repeat pnpm install now rewrites the bin shims after extendNodePath changes. Before, it reported "Already up to date" and the shims kept the NODE_PATH of the previous setting.

Lockfile and resolution

• pnpm install --frozen-lockfile now accepts the lockfile it wrote with excludeLinksFromLockfile and linkWorkspacePackages on, when a project depends on a workspace package through a plain version range or a catalog: entry. It used to fail with ERR_PNPM_OUTDATED_LOCKFILE.

• pnpm install --frozen-lockfile, pnpm approve-builds, and pnpm rebuild now accept a lockfile that resolves a * dependency to a prerelease latest version. pnpm wrote such a lockfile and then reported it as outdated #​17594.

• Packages from the default registry keep plain lockfile keys, even when a prefix such as npmjs points at the registry set as registry. A dependency written with such a prefix shares the plain entry of the same package. The next install rewrites keys that earlier versions qualified this way #​17575.

• Relative local paths in root overrides now resolve from the workspace root when each project has its own lockfile #​17691.

  Installing a local directory dependency no longer fails when another project's install is writing a lockfile in that directory.

• Peer deduplication no longer gives a project different copies of a dependency across direct and transitive paths when an optional peer has no provider #​17666.

• A Node.js version range such as >=26.13, for example in devEngines.runtime, now resolves to the newest stable release that satisfies it. pnpm picks a prerelease only when no stable release matches #​17516.

verifyDepsBeforeRun

• With verifyDepsBeforeRun, pnpm run and pnpm exec now report dependencies as out of date after a dependency is added to the package.json of a local directory dependency, such as "lib": "file:../lib". Before, the command ran without the new dependency installed.

• verifyDepsBeforeRun no longer reports dependencies as out of sync when only the version field of a single-project repository changed #​17560. The same holds for a workspace project that no dependency can resolve to. A script run after such a change no longer starts an install first.

pnpm link

• In a workspace, pnpm link <dir> now adds the link: dependency to the package.json of the project where the command runs, not to the workspace root's package.json. The link is created in that project's node_modules, as documented. The override is still written to the root pnpm-workspace.yaml.

• pnpm link with several paths now records every linked package in the overrides of pnpm-workspace.yaml. Some of them could be missing before.

• pnpm link now fails without changing package.json or pnpm-workspace.yaml when the linked package's name is not a valid npm package name. It used to write that name to both files, which made every later install fail #​17475.

pnpm update

• pnpm update with only negated selectors, such as pnpm update '!foo', now leaves the dependencies listed in update.ignoreDeps unchanged pnpm/tasks#243.

• pnpm update --depth 0 without selectors now does nothing when every direct dependency is listed in update.ignoreDeps. Before, it failed with ERR_PNPM_NO_PACKAGE_IN_DEPENDENCIES pnpm/tasks#251.

Store and self-update

• pnpm store prune now keeps packages linked from a configured modules directory pnpm/tasks#230.

• pnpm store status no longer reports untouched packages as modified when the global virtual store is enabled. If the installed global-store layout cannot be verified, the command reports ERR_PNPM_STORE_STATUS_UNVERIFIABLE and asks for a reinstall #​17631.

• pnpm store add now fails right away with ERR_PNPM_FROZEN_STORE_WRITE when frozenStore is enabled. It used to retry each download for minutes before failing, or fail with a SQLite error on an empty store.

• pnpm self-update now reinstalls a cached engine if its executable cannot run. This repairs shared store entries damaged by an earlier install #​17582.

Platinum Sponsors

Gold Sponsors

v11.28.10: pnpm 11.28.10

Compare Source

pnpm 11.28.10 stops pnpm store prune from deleting other stores when cacheDir points to their parent directory. It also fixes globally installed commands that load hoisted dependencies, and repeat installs that missed changes to local dependencies.

Patch Changes

Installing packages

• pnpm store prune preserves other stores and global package data when cacheDir points to their parent directory.

• Commands installed with pnpm add --global now find the dependencies that pnpm hoists for their package. A package that loads a dependency it does not declare, such as a native addon's platform-specific package, failed with "Cannot find module". Reinstall such a package with pnpm add --global to update its existing command #​17503.

• pnpm prune --prod no longer fails with ERR_PNPM_EXDEV when node_modules was copied from an earlier Docker build stage #​17424.

• pnpm install now retries a Node.js runtime zip download when the connection drops partway through. A download that still fails names its URL. Before, a single dropped connection ended the install with terminated #​17411.

• With the global virtual store, a change to a dependency of one package in a dependency cycle now gives every package in that cycle a new directory. Before, the other packages kept their directories and still linked the old copy of the changed package, so the project could load two copies of it #​17466.

  Packages in a dependency cycle, and packages that depend on one, move to new global virtual store directories once after this update. Those that run a build miss the side-effects cache once.

• pnpm install and pnpm rebuild now refresh privately hoisted .bin shims in node_modules/.pnpm/node_modules/.bin after a dependency build replaces a script target with a native executable #​17402.

• The Node.js latest selector now chooses the newest stable release #​17490.

• The standalone @pnpm/exe builds now embed Node.js 26.13.0.

Repeat installs and lockfiles

• pnpm install now resolves a local directory again after its package.json changes when an override or a package extension adds it to the dependencies of a registry package. pnpm install --frozen-lockfile fails on a lockfile that still records the old dependencies of such a directory #​17486.

• With injectWorkspacePackages and per-project lockfiles, pnpm install now updates a project's lockfile when a local tarball that an injected workspace project depends on is replaced. The project's lockfile kept the old version and integrity before.

• pnpm install now detects a change to a local tarball or directory that only a pnpmfile readPackage hook depends on. A repeat install reported "Already up to date" and kept the old contents before pnpm/tasks#227.

• pnpm install now relinks a workspace: or link: dependency whose link was deleted from node_modules. It used to report "Already up to date" and leave the link missing #​17485.

• Merging git branch lockfiles now keeps a workspace project whose directory is named __proto__. It was dropped from the merged lockfile before pnpm/tasks#59.

Adding and publishing packages

• pnpm add no longer rewrites a catalog entry set to the dist-tag that the dependency resolves through. For example, an entry beta stays beta after pnpm add foo@beta or pnpm add foo. Before, the entry was replaced with the version the tag pointed to pnpm/tasks#225.

• pnpm pack and pnpm publish now always include the binary file declared by a string bin field in package.json, even when files or .npmignore would otherwise exclude it.

• When the version or range given to pnpm unpublish matches every published version, the error now says so and shows the same command with --force. It suggested running pnpm unpublish <pkg>@<version>, the command that had just failed.

Running commands

• Every command, including pnpm --version, pnpm self-update, and invocations with unknown flags, now applies the same packageManager and devEngines.packageManager settings when switching to the pinned pnpm version or recording it in pnpm-lock.yaml. --config.<key> flags and lockfileDir now reach the version switch and lockfile sync on every entry point. Unreadable settings in pnpm-workspace.yaml or the global config.yaml that do not affect the pin decision no longer block the version switch pnpm/tasks#222.

• On Windows, the shell shim of a .cmd or .bat bin now runs it under Git Bash when MSYS argument conversion is off, such as with MSYS_NO_PATHCONV=1 or MSYS2_ARG_CONV_EXCL='*'. The shim used to start an interactive cmd.exe prompt #​17480.

• pnx and pnpm create now run the command in the directory selected by --dir or --workspace-root. Without either flag, the command still runs in the directory pnpm was started in.

• The error for a dependency with an invalid name in a project's manifest now names the project's directory. It used to say only "The current package", which did not tell which workspace project to fix #​17475.

Platinum Sponsors

Gold Sponsors

v11.28.9: pnpm 11.28.9

Compare Source

This release fixes a crash on registry responses with too many content encodings (GHSA-xjj6-f33q-929c) and sizes the install worker pool by the container's CPU quota. A repeat pnpm install now acts on more setting changes.

Patch Changes

Crashes and security

• A registry response with too many content encodings can no longer crash pnpm. pnpm now uses undici 7.30.1, which fixes GHSA-xjj6-f33q-929c.

• pnpm install now sizes its worker pool by the CPU quota of the container it runs in, such as a Kubernetes CPU limit, when that quota is smaller than the number of CPUs the container may run on. The default workspaceConcurrency respects the quota the same way. On a CI runner with a 4-CPU quota and hundreds of host CPUs, pnpm started hundreds of workers and ran out of memory #​17382.

Repeat installs and changed settings

• A repeat pnpm install now acts on a change to these settings. Before, it reported "Already up to date".

  • storeDir or virtualStoreDir: it recreates node_modules.
  • virtualStoreDirMaxLength: it renames the virtual store directories.
  • dangerouslyAllowAllBuilds turned on: it runs the builds it skipped.
  • trustLockfile turned off: it verifies the lockfile.

• pnpm add, pnpm remove, and pnpm update now fail when the node-linker setting differs from the one recorded in node_modules. A pnpm install of the whole workspace recreates node_modules with the new node-linker, and an install filtered to some projects fails pnpm/tasks#203.

• An install filtered to some workspace projects now fails if node_modules was installed with a different nodeLinker, hoistPattern, publicHoistPattern, store, or virtual store. Before, it recreated node_modules and left the projects it skipped without their dependencies. A pnpm install of the whole workspace still recreates node_modules pnpm/tasks#217.

• pnpm install now takes its fast path in a workspace with patchedDependencies when the previous install ran with another major version of pnpm.

• pnpm install now relinks the bins of a workspace package when its bin field changes, including with --frozen-lockfile and an unchanged lockfile. A filtered install relinks them in the selected projects, and the next install that covers the remaining projects relinks them there #​17324.

• pnpm install now removes command shims from node_modules/.bin when a workspace dependency renames or removes an entry from its bin field pnpm/tasks#211.

• With nodeLinker: hoisted, an install that stops partway no longer leaves the next install trusting the packages it was replacing. Before, reverting the change that started the stopped install, such as a patch edit, kept the half-replaced package in node_modules.

• pnpm run and pnpm exec no longer report the dependencies as out of date after a lockfile change when dedupePeers is true #​17322.

Resolving dependencies and the lockfile

• A package that a plain range and a <prefix>: specifier both resolve from one registry is now recorded once in pnpm-lock.yaml and installed once. The lockfile key names the registry a package resolved from. When that registry declares a prefix, through prefix in registries or through namedRegistries, the package is keyed <name>@<prefix>:<version> however its dependency was written: with the prefix, as a plain range its scope routes to that registry, or through the default registry. Before, the plain range was keyed <name>@<version>, so one tarball was installed twice and instanceof checks and module singletons broke between the two copies. The same name and version served by two registries still get separate entries. When several prefixes declare one registry, its packages are keyed by the lexicographically smallest prefix.

  If a scope you route reaches a registry that also declares a prefix, your next pnpm install re-keys those entries, which shows up as a lockfile diff. Commit it. pnpm install --frozen-lockfile installs the lockfile as recorded.

• pnpm install now resolves a scope's packages again when the scope is routed to another registry in registries. Before, the lockfile kept the versions and integrity resolved from the old registry, so the install failed when the new registry did not serve a locked version or served different content. pnpm records in the workspace state which registry each scope routed to, so a fresh clone without that record installs the lockfile as recorded. Changing the default registry resolves nothing again, and pnpm install --frozen-lockfile is unchanged.

• An optional dependency written with a named-registry prefix, such as work:^1.0.0, now fails the install when it cannot be resolved but the lockfile already has a matching entry from that registry. Such a dependency was skipped, which removed its entries from the lockfile.

• With injectWorkspacePackages: true, a workspace: dependency written as a relative path, such as workspace:../lib-a, in a workspace package now resolves from that package's directory #​17284.

• Fixed pnpm install failing with ERR_PNPM_UNSUPPORTED_PROTOCOL when a workspace package injected through a relative path, such as workspace:../lib, has catalog: dependencies. Their catalog entries now resolve the way they do for a package injected by name #​17280.

• pnpm install now applies the serverType registry setting when it updates the lockfile for an override or catalog change without a full resolution. pnpm wrote the tarball URLs of a declared registry into the lockfile in that case.

• Added the pnpr value to the serverType registry setting. pnpm leaves the tarball URLs of a pnpr registry out of pnpm-lock.yaml.

• A registries entry whose prefix is __proto__ is no longer ignored.

• Installs delegated to a pnpr server now resolve every prefix declared for a registry URL. A dependency or lockfile entry that used the second of two prefixes for the same registry, such as zeta: next to work: in namedRegistries, failed on the server pnpm/tasks#204.

Registries, proxies, and downloading pnpm

• The proxy settings httpProxy, httpsProxy, noProxy, proxy, and noproxy set in the global config.yaml, through PNPM_CONFIG_HTTPS_PROXY and the matching variables, or as --config.httpsProxy on the command line now apply to pnpm self-update and to the download of the pnpm version pinned in packageManager. Previously, these requests read the proxy only from .npmrc and the HTTPS_PROXY family of variables pnpm/tasks#215.

• When https-proxy is false, pnpm now downloads the pnpm version pinned by packageManager through the legacy proxy setting, as installs already do. Setting proxy to false now also stops that download from using the HTTP_PROXY environment variable. The signature check of the pinned pnpm now uses the same proxy and TLS settings as its download pnpm/tasks#193.

• strictSsl and localAddress set in the global config.yaml, through PNPM_CONFIG_STRICT_SSL and PNPM_CONFIG_LOCAL_ADDRESS, or on the command line now apply to pnpm self-update and to the download of the pnpm version pinned in packageManager. These requests read them from .npmrc only before. --config.localAddress now reaches them in the camelCase spelling too pnpm/tasks#201.

Commands

• pnpm audit --ignore and pnpm audit --ignore-unfixable now exit with a non-zero code when vulnerabilities at or above the audit level remain after ignoring. Before, these commands always exited with code 0.

• pnpm audit --fix and pnpm audit --interactive now fail with ERR_PNPM_AUDIT_FIX_WITH_IGNORE when combined with --ignore or --ignore-unfixable. Before, the fix ran and the ignore flags had no effect.

• pnpm ci --lockfile and pnpm ci --config.lockfile=true no longer delete pnpm-lock.yaml. pnpm ci now always keeps the lockfile and runs a frozen install from it.

• pnpm deploy now keeps a deployed symlink to a directory inside the project even if the directory is not among the deployed files, such as a link into node_modules #​17288.

• pnpm pack and pnpm publish again include the files of a publishConfig.directory that is reached through a symlink, together with its bundled dependencies #​17390.

• pnpm -r publish --batch now sends PUT /-/pnpr/v0/publish, the batch publish endpoint that pnpr serves.

• pnpm store prune now keeps the packages that a project still uses when pnpm copied or cloned them into node_modules. These include patched packages, built packages, and every package installed with packageImportMethod: copy. Before, the prune removed them, and the next install downloaded them again #​7192.

• pnpm store prune now keeps the packages of a project that was installed with a different symlinked spelling of the store path. Previously, prune dropped such a project from its list and removed the packages only that project used from the global virtual store.

Speed and output

• Sped up installs of projects whose local directory dependencies share transitive local directory dependencies. pnpm no longer checks a shared directory again for each direct dependency that reaches it #​17374.

• Output that fills the terminal, such as pnpm run --stream script output, is now written once. Before, every new line also rewrote all the lines already on screen #​17387.

• The warning about unrecognized settings now marks symlinkedLockfileTargetDirs as a setting of a newer pnpm version.

Platinum Sponsors

Gold Sponsors

v11.28.8: pnpm 11.28.8

Compare Source

Patch Changes

• The standalone @pnpm/exe builds now embed Node.js 26.12.1. The previously embedded Node.js 26.0.0 still trusted the certificate authority intermediates that Node.js distrusted in October 2026, so a standalone pnpm accepted TLS certificates issued under them.

Platinum Sponsors

Gold Sponsors

v11.28.7: pnpm 11.28.7

Compare Source

This release rejects registry metadata that names a different package than the one requested, applies trustPolicy to the pnpm version a project pins, and caps unpacked package size with maxTarballUnpackedSize. It also removes support for registry revisions, fixes verifyDepsBeforeRun after filtered installs, and finishes commands with their own exit code when a pipe reader exits early.

Patch Changes

Security

• pnpm now fails with ERR_PNPM_REGISTRY_NAME_MISMATCH if a registry returns metadata for a package other than the one requested. Before, pnpm installed the package under the name in the metadata, so allowBuilds rules for the requested package did not apply to it.

• pnpm now applies trustPolicy to the pnpm version a project pins in packageManager or devEngines.packageManager. A pinned version whose trust evidence was downgraded fails the command before pnpm switches to it or records it in the lockfile #​16319.

• minimumReleaseAgeExcludePrune and trustPolicyExcludePrune now keep exclusions for resolved configuration dependencies and their transitive dependencies #​17142.

• Added the maxTarballUnpackedSize setting. pnpm install fails with ERR_PNPM_TARBALL_TOO_LARGE when the files of one package unpack to more than this many bytes, 4 GiB by default pnpm/tasks#81.

Resolving dependencies

• Registry revisions are no longer supported. pnpm now fails with ERR_PNPM_REGISTRY_REVISIONS_UNSUPPORTED on registry metadata that selects a revision, on a +rN version specifier, and on a lockfile entry with a revision field. pnpm update --patches is removed.

• When pnpm install resolves a dependency again, it now reuses a version that the install already resolved for the same package, as a fresh install does. Before, it kept the version the lockfile pinned and added a second copy of the package. A locked version still stays when nothing else in the install prefers another version. To pin a transitive dependency on purpose, use overrides #​17084.

• When another workspace project adds a different version of a package, a project's auto-installed peer on that package now moves to the version a fresh install picks. It used to stay on its locked version while any other project still accepted that version #​17058.

• An optional peer that pnpm adds to a project now keeps the version the lockfile recorded for that project only while the dependency graph still holds it. Otherwise it follows its provider to a version the graph holds. Before, pnpm kept a higher version that only the lockfile held, which left two copies of the peer #​16443.

• A package that lists the same dependency in dependencies and as an optional peer now gets the peer bound when a project adds a provider for it later. The lockfile now records every peer a package declares, including one its own dependency supplies #​17056.

• pnpm install --prod no longer drops a dependency that a package declares both as an optional peer and as its own dependency, when the package resolved it as its own dependency and a dev dependency provides the same package under another alias.

• pnpm now measures a pnpm.overrides entry written as a workspace: path, such as workspace:./packages/foo, from the directory holding pnpm-workspace.yaml. It used to be measured from each package the override rewrote. The install then linked a directory that does not exist, or failed if workspace packages were injected #​17010.

• pnpm install now removes config dependencies that are no longer declared, including when the entire configDependencies setting is removed. Frozen installs reject a lockfile that still records removed config dependencies.

• pnpm add now reads the package name correctly from a tarball URL under a registry URL that has a path, such as https://example.com/npm/. Before, the registry path became part of the name, so a scoped package failed with ERR_PNPM_INVALID_PACKAGE_NAME.

• pnpm add no longer warns that a gist dependency was replaced from a different source when the new specifier names the same gist in another form, such as gist:<id> and https://gist.github.com/<user>/<id>.

• With minimumReleaseAge set, pnpm now revalidates a package's cached full metadata with a single ETag request so an unchanged registry answers with 304, and keeps using the cached copy once the registry confirms it is current, even when the metadata does not list a publish time for every version. Previously, pnpm downloaded that metadata again whenever the cached copy was older than minimumReleaseAge. Packages listed in minimumReleaseAgeExclude also resolve from cached metadata without a registry request when the lockfile already has the version their range picks.

Linking node_modules and workspaces

• Concurrent installs that import the same package into one project now all complete. One of them used to fail with ENOTEMPTY when its copy of the package collided with the copy another install had already placed pnpm/tasks#48.

• pnpm install no longer fails on macOS with EISDIR when it creates store directories in a group-writable store under a umask that removes owner read, such as 0o477.

• pnpm install now succeeds when node_modules is a symlink to an existing directory. Dependency hoisting previously rejected a symlinked node_modules as an invalid destination #​17157.

• A filtered pnpm install --no-lockfile with hoistWorkspacePackages now hoists every workspace project into node_modules/.pnpm/node_modules. It used to hoist only the selected projects pnpm/tasks#168.

• Filtered installs remove obsolete dependencies from the installed lockfile while preserving dependencies still needed by unselected projects.

• With sharedWorkspaceLockfile: false, pnpm install now runs the preResolution hooks and custom resolvers and fetchers of the workspace root's pnpmfile for every project, next to the project's own. A global pnpmfile now runs once per project, and each project's lockfile records the checksum of the root pnpmfile when the project has none of its own. Before, a project's own pnpmfile replaced these root hooks, the global hooks ran twice, and edits to the root pnpmfile could go unnoticed.

• pnpm prune now removes extraneous direct packages from node_modules when package.json and pnpm-lock.yaml are already in sync. pnpm prune also accepts --filter and --recursive to prune selected workspa

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/unplugin-lightningcss@39

commit: 33a29db

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tsdown-preset-sxzz@​0.6.0 ⏵ 0.7.1	+1
	tsdown@​0.22.13 ⏵ 0.23.5	+1		+1

View full report