fix(deps): update frontend-app-runtime-tooling (major) by renovate[bot] · Pull Request #153 · CMLPlatform/relab

renovate · 2026-05-11T00:43:40Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@jest/globals (source)	`~29.7.0` → `~30.4.0`
@react-native-async-storage/async-storage (source)	`2.2.0` → `3.0.2`
@types/jest (source)	`^29.5.14` → `^30.0.0`
jest (source)	`~29.7.0` → `~30.4.0`
pnpm (source)	`10.33.0` → `11.1.1`
pnpm (source)	`10.x` → `11.x`
typescript (source)	`^5.9.3` → `^6.0.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

jestjs/jest (@jest/globals)

`v30.4.1`

Compare Source

Features

[jest-config, jest-core, jest-runner, jest-schemas, jest-types] Allow custom runner configuration options via tuple format ['runner-path', {options}] (#16141)

Fixes

[jest-runtime] Align CJS-from-ESM default export with Node: module.exports is always the ESM default, __esModule unwrapping is no longer applied (#16143)

`v30.4.0`

Compare Source

Features

[babel-jest] Support collecting coverage from .mts, .cts (and other) files (#15994)
[jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2, jest-types] Add --collect-tests flag to discover and list tests without executing them (#16006)
[jest-config, jest-runner, jest-worker] Add workerGracefulExitTimeout config option to control how long workers are given to exit before being force-killed (#15984)
[jest-config] Add support for jest.config.mts as a valid configuration file (#16005)
[jest-config, jest-core, jest-reporters, jest-runner] verbose and silent can now be set per-project; the project-level value overrides the global value for that project's tests (#16133)
[@jest/fake-timers] Accept Temporal.Duration in jest.advanceTimersByTime() and jest.advanceTimersByTimeAsync() (#16128)
[@jest/fake-timers] Accept Temporal.Instant and Temporal.ZonedDateTime in jest.setSystemTime() and useFakeTimers({now}) (#16128)
[@jest/fake-timers] Support faking Temporal.Now.* (#16131)
[jest-mock] Add clearMocksOnScope(scope) on ModuleMocker for clearing every mock function exposed on a scope object (#16088)
[jest-resolve] Add canResolveSync() on Resolver so callers can detect when a user-configured resolver only exports an async hook (#16064)
[jest-runtime] Use synchronous evaluate() for ES modules without top-level await on Node versions that support it (v24.9+), and prefer the synchronous transform path when a sync transformer is configured (#16062)
[jest-runtime] Support require() of ES modules on Node v24.9+ (#16074)
[jest-runtime] Validate TC39 import attributes (with { type: 'json' }) on ESM imports (#16127)
[@jest/transform] Add canTransformSync(filename) on ScriptTransformer so callers can pick the sync vs async transform path (#16062)
[jest-util] Add isError helper (#16076)
[pretty-format] Support React 19 (#16123)

Fixes

[expect-utils] Fix toStrictEqual failing on structuredClone results due to cross-realm constructor mismatch (#15959)
[@jest/expect-utils] Prevent toMatchObject/subset matching from throwing when encountering exotic iterables (#15952)
[fake-timers] Convert Date to milliseconds before passing to @sinonjs/fake-timers (#16029)
[jest] Export GlobalConfig and ProjectConfig TypeScript types (#16132)
[jest-circus] Prevent crash when asyncError is undefined for non-Error throws (#16003)
[jest-circus, jest-jasmine2] Include Error.cause in JSON failureMessages output (#15967)
[jest-config] Fix preset path resolution on Windows when the preset uses subpath exports (#15961)
[jest-config] Allow collectCoverage and coverageProvider in project config without a validation warning (#16132)
[jest-config] Project config validator now emits "is not supported in an individual project configuration" instead of "probably a typing mistake" for known global-only options (#16132)
[jest-environment-node] Fix --localstorage-file warning on Node 25+ (#16086)
[jest-reporters] Apply global coverage threshold to unmatched pattern files in addition to glob/path thresholds (#16137)
[jest-reporters, jest-runner, jest-runtime, jest-transform] Fix coverage report not showing correct code coverage when using projects config option (#16140)
[jest-runtime] Resolve expect and @jest/expect from the internal module registry so test-file imports share the same JestAssertionError as the global expect (#16130)
[jest-runtime] Improve CJS-from-ESM interop: __esModule/Babel default unwrap, broader named-export coverage, and shared CJS singleton across importers (#16050)
[jest-runtime] Load .js files with ESM syntax but no "type":"module" marker as native ESM (#16050)
[jest-runtime] Extend the .js-with-ESM-syntax fallback to require() on Node v24.9+ - falls back to require(esm) when the CJS parser rejects ESM syntax (#16078)
[jest-runtime] Fix deadlocks and double-evaluation in concurrent ESM and wasm imports (#16050)
[jest-runtime] Fix error when require() is called after the Jest environment has been torn down (#15951)
[jest-runtime] Fix missing error when import() is called after the Jest environment has been torn down (#16080)
[jest-runtime] Fix virtual unstable_mockModule registrations not respected in ESM (#16081)
[jest-runtime] Apply moduleNameMapper when resolving modules with require.resolve() and the paths option (#16135)

Chore & Maintenance

[@jest/fake-timers] Upgrade @sinonjs/fake-timers (#16139)
[jest-runtime] Use synchronous linkRequests / instantiate for ESM linking on Node v24.9+ (#16063)

`v30.3.0`

Compare Source

Features

[jest-config] Add defineConfig and mergeConfig helpers for type-safe Jest config (#15844)
[jest-fake-timers] Add setTimerTickMode to configure how timers advance
[*] Reduce token usage when run through LLMs (3f17932)

Fixes

[jest-config] Keep CLI coverage output when using --json with --outputFile (#15918)
[jest-mock] Use Symbol from test environment (#15858)
[jest-reporters] Fix issue where console output not displayed for GHA reporter even with silent: false option (#15864)
[jest-runtime] Fix issue where user cannot utilize dynamic import despite specifying --experimental-vm-modules Node option (#15842)
[jest-test-sequencer] Fix issue where failed tests due to compilation errors not getting re-executed even with --onlyFailures CLI option (#15851)
[jest-util] Make sure process.features.require_module is false (#15867)

Chore & Maintenance

[*] Replace remaining micromatch uses with picomatch
[deps] Update to sinon/fake-timers v15
[docs] Update V30 migration guide to notify users on jest.mock() work with case-sensitive path (#15849)
Updated Twitter icon to match the latest brand guidelines (#15869)

`v30.2.0`

Compare Source

Chore & Maintenance

[*] Update example repo for testing React Native projects (#15832)
[*] Update jest-watch-typeahead to v3 (#15830)

`v30.1.2`

Compare Source

Fixes

[jest-snapshot-utils] Correct snapshot header regexp to work with newline across OSes (#15803)

`v30.1.1`

Compare Source

Fixes

[jest-snapshot-utils] Fix deprecated goo.gl snapshot warning not handling Windows end-of-line sequences (#15800)
[jest-snapshot-utils] Improve messaging about goo.gl snapshot link change (#15821)

`v30.1.0`

Compare Source

`v30.0.5`

Compare Source

Features

[jest-config] Allow testMatch to take a string value
[jest-worker] Let workerIdleMemoryLimit accept 0 to always restart worker child processes

Fixes

[expect] Fix bigint error (#15702)

`v30.0.4`

Compare Source

Features

[expect] The Inverse type is now exported (#15714)
[expect] feat: support async functions in toBe (#15704)

Fixes

[jest] jest --onlyFailures --listTests now correctly lists only failed tests (#15700)
[jest-snapshot] Handle line endings in snapshots (#15708)

`v30.0.3`

Compare Source

Fixes

[jest-config] Fix ESM TS config loading in a CJS project (#15694)
[jest-core] jest --onlyFailures --listTests now correctly lists only failed tests(#15700)

Features

[jest-diff] Show non-printable control characters to diffs (#15696)

`v30.0.2`

Compare Source

Fixes

[jest-matcher-utils] Make 'deepCyclicCopyObject' safer by setting descriptors to a null-prototype object (#15689)
[jest-util] Make garbage collection protection property writable (#15689)

`v30.0.1`

Compare Source

Features

[jest-resolver] Implement the defaultAsyncResolver (#15679)

Fixes

[jest-resolver] Resolve builtin modules correctly (#15683)
[jest-environment-node, jest-util] Avoid setting globals cleanup protection symbol when feature is off (#15684)

Chore & Maintenance

[*] Remove and deprecate jest-repl package (#15673)
[jest-resolver] Replace custom isBuiltinModule with node's isBuiltin (#15685)

`v30.0.0`

Compare Source

Features

[*] Renamed globalsCleanupMode to globalsCleanup and --waitNextEventLoopTurnForUnhandledRejectionEvents to --waitForUnhandledRejections
[expect] Add ArrayOf asymmetric matcher for validating array elements. (#15567)
[babel-jest] Add option excludeJestPreset to allow opting out of babel-preset-jest (#15164)
[expect] Revert #15038 to fix expect(fn).toHaveBeenCalledWith(expect.objectContaining(...)) when there are multiple calls (#15508)
[jest-circus, jest-cli, jest-config] Add waitNextEventLoopTurnForUnhandledRejectionEvents flag to minimise performance impact of correct detection of unhandled promise rejections introduced in #14315 (#14681)
[jest-circus] Add a waitBeforeRetry option to jest.retryTimes (#14738)
[jest-circus] Add a retryImmediately option to jest.retryTimes (#14696)
[jest-circus, jest-jasmine2] Allow setupFilesAfterEnv to export an async function (#10962)
[jest-circus, jest-test-result] Add startedAt timestamp in TestCaseResultObject within onTestCaseResult (#15145)
[jest-cli] Export buildArgv (#15310)
[jest-config] [BREAKING] Add mts and cts to default moduleFileExtensions config (#14369)
[jest-config] [BREAKING] Update testMatch and testRegex default option for supporting mjs, cjs, mts, and cts (#14584)
[jest-config] Loads config file from provided path in package.json (#14044)
[jest-config] Allow loading jest.config.cts files (#14070)
[jest-config] Show rootDir in error message when a preset fails to load (#15194)
[jest-config] Support loading TS config files using esbuild-register via docblock loader (#15190)
[jest-config] Allow passing TS config loader options via docblock comment (#15234)
[jest-config] If Node is running with type stripping enabled, do not require a TS loader (#15480)
[@jest/core] Group together open handles with the same stack trace (#13417, & #14789)
[@jest/core] Add perfStats to surface test setup overhead (#14622)
[@jest/core] [BREAKING] Changed --filter to accept an object with shape { filtered: Array<string> } to match documentation (#13319)
[@jest/core] Support --outputFile option for --listTests (#14980)
[@jest/core] Stringify Errors properly with --json flag (#15329)
[@jest/core, @jest/test-sequencer] [BREAKING] Exposes globalConfig & contexts to TestSequencer (#14535, & #14543)
[jest-each] Introduce %$ option to add number of the test to its title (#14710)
[@jest/environment] [BREAKING] Remove deprecated jest.genMockFromModule() (#15042)
[@jest/environment] [BREAKING] Remove unnecessary defensive code (#15045)
[jest-environment-jsdom] [BREAKING] Upgrade JSDOM to v22 (#13825)
[@jest/environment-jsdom-abstract] Introduce new package which abstracts over the jsdom environment, allowing usage of custom versions of JSDOM (#14717)
[jest-environment-node] Update jest environment with dispose symbols Symbol (#14888 & #14909)
[expect, @jest/expect] [BREAKING] Add type inference for function parameters in CalledWith assertions (#15129)
[@jest/expect-utils] Properly compare all types of TypedArrays (#15178)
[@jest/fake-timers] [BREAKING] Upgrade @sinonjs/fake-timers to v13 (#14544 & #15470)
[@jest/fake-timers] Exposing new modern timers function advanceTimersToFrame() which advances all timers by the needed milliseconds to execute callbacks currently scheduled with requestAnimationFrame (#14598)
[jest-matcher-utils] Add SERIALIZABLE_PROPERTIES to allow custom serialization of objects (#14893)
[jest-mock] Add support for the Explicit Resource Management proposal to use the using keyword with jest.spyOn(object, methodName) (#14895)
[jest-reporters] Add support for DEC mode 2026 (#15008)
[jest-resolver] Support file:// URLs as paths (#15154)
[jest-resolve,jest-runtime,jest-resolve-dependencies] Pass the conditions when resolving stub modules (#15489)
[jest-runtime] Exposing new modern timers function jest.advanceTimersToFrame() from @jest/fake-timers (#14598)
[jest-runtime] Support import.meta.filename and import.meta.dirname (available from Node 20.11) (#14854)
[jest-runtime] Support import.meta.resolve (#14930)
[jest-runtime] [BREAKING] Make it mandatory to pass globalConfig to the Runtime constructor (#15044)
[jest-runtime] Add unstable_unmockModule (#15080)
[jest-runtime] Add onGenerateMock transformer callback for auto generated callbacks (#15433 & #15482)
[jest-runtime] [BREAKING] Use vm.compileFunction over vm.Script (#15461)
[@jest/schemas] Upgrade @sinclair/typebox to v0.34 (#15450)
[@jest/types] test.each(): Accept a readonly (as const) table properly (#14565)
[@jest/types] Improve argument type inference passed to test and describe callback functions from each tables (#14920)
[jest-snapshot] [BREAKING] Add support for Error causes in snapshots (#13965)
[jest-snapshot] Support Prettier 3 (#14566)
[@jest/util-snapshot] Extract utils used by tooling from jest-snapshot into its own package (#15095)
[pretty-format] [BREAKING] Do not render empty string children ('') in React plugin (#14470)

Fixes

[expect] Show AggregateError to display (#15346)
[*] Replace exit with exit-x (#15399)
[babel-plugin-jest-hoist] Use denylist instead of the deprecated blacklist for Babel 8 support (#14109)
[babel-plugin-jest-hoist] Do not rely on buggy Babel behaviour (#15415)
[expect] Check error instance type for toThrow/toThrowError (#14576)
[expect] Improve diff for failing expect.objectContaining (#15038)
[expect] Use Array.isArray to check if an array is an Array (#15101)
[expect] Fix Error cause assertion errors (#15339)
[jest-changed-files] Print underlying errors when VCS commands fail (#15052)
[jest-changed-files] Abort sl root call if output resembles a steam locomotive (#15053)
[jest-circus] [BREAKING] Prevent false test failures caused by promise rejections handled asynchronously (#14315)
[jest-circus] Replace recursive makeTestResults implementation with iterative one (#14760)
[jest-circus] Omit expect.hasAssertions() errors if a test already has errors (#14866)
[jest-circus, jest-expect, jest-snapshot] Pass test.failing tests when containing failing snapshot matchers (#14313)
[jest-circus] Concurrent tests now emit jest circus events at the correct point and in the expected order. (#15381)
[jest-cli] [BREAKING] Validate CLI flags that require arguments receives them (#14783)
[jest-config] Make sure to respect runInBand option (#14578)
[jest-config] Support testTimeout in project config (#14697)
[jest-config] Support coverageReporters in project config (#14697)
[jest-config] Allow reporters in project config (#14768)
[jest-config] Allow Node16/NodeNext/Bundler moduleResolution in project's tsconfig (#14739)
[@jest/create-cache-key-function] Correct the return type of createCacheKey (#15159)
[jest-each] Allow $keypath templates with null or undefined values (#14831)
[@jest/expect-utils] Fix comparison of DataView (#14408)
[@jest/expect-utils] [BREAKING] exclude non-enumerable in object matching (#14670)
[@jest/expect-utils] Fix comparison of URL (#14672)
[@jest/expect-utils] Check Symbol properties in equality (#14688)
[@jest/expect-utils] Catch circular references within arrays when matching objects (#14894)
[@jest/expect-utils] Fix not addressing to Sets and Maps as objects without keys (#14873)
[jest-haste-map] Fix errors or clobbering with multiple hasteImplModulePaths (#15522)
[jest-leak-detector] Make leak-detector more aggressive when running GC (#14526)
[jest-runtime] Properly handle re-exported native modules in ESM via CJS (#14589)
[jest-runtime] Refactor _importCoreModel so required core module is consistent if modified while loading (#15077)
[jest-schemas, jest-types] [BREAKING] Fix type of testFailureExitCode config option(#15232)
[jest-util] Make sure isInteractive works in a browser (#14552)
[pretty-format] [BREAKING] Print ArrayBuffer and DataView correctly (#14290)
[pretty-format] Fixed a bug where "anonymous custom elements" were not being printed as expected. (#15138)
[jest-cli] When specifying paths on the command line, only match against the relative paths of the test files (#12519)
- [BREAKING] Changes testPathPattern configuration option to testPathPatterns, which now takes a list of patterns instead of the regex.
- [BREAKING] --testPathPattern is now --testPathPatterns
- [BREAKING] Specifying testPathPatterns when programmatically calling watch must be specified as new TestPathPatterns(patterns), where TestPathPatterns can be imported from @jest/pattern
[jest-reporters, jest-runner] Unhandled errors without stack get correctly logged to console (#14619)
[jest-util] Always load mjs files with import (#15447)
[jest-worker] Properly handle a circular reference error when worker tries to send an assertion fails where either the expected or actual value is circular (#15191)
[jest-worker] Properly handle a BigInt when worker tries to send an assertion fails where either the expected or actual value is BigInt (#15191)
[expect] Resolve issue where ObjectContaining matched non-object values. #15463.
- Adds a conditional/check to ensure the argument passed to expect is an object.
- Add unit tests for new ObjectContaining behavior.
- Remove invalid/wrong test case assertions for ObjectContaining.
[jest-worker] Addresses incorrect state on exit (#15610)

Performance

[*] [BREAKING] Bundle all of Jest's modules into index.js (#12348, #14550 & #14661)
[jest-haste-map] Only spawn one process to check for watchman installation (#14826)
[jest-runner] Better cleanup source-map-support after test to resolve (minor) memory leak (#15233)
[jest-resolver] Migrate resolve and resolve.exports to unrs-resolver (#15619)
[jest-circus, jest-environment-node, jest-repl, jest-runner, jest-util] Cleanup global variables on environment teardown to reduce memory leaks (#15215 & #15636 & #15643)

Chore & Maintenance

[jest-environment-jsdom, jest-environment-jsdom-abstract] Increased version of jsdom to ^26.0.0 (#15325 CVE-2024-37890)
[*] Increase version of micromatch to ^4.0.7 (#15082)
[*] [BREAKING] Drop support for Node.js versions 14, 16, 19, 21 and 23 (#14460, #15118, #15623, #15640)
[*] [BREAKING] Drop support for typescript@4.3, minimum version is now 5.4 (#14542, #15621)
[*] Depend on exact versions of monorepo dependencies instead of ^ range (#14553)
[*] [BREAKING] Add ESM wrapper for all of Jest's modules (#14661)
[*] [BREAKING] Upgrade to glob@10 (#14509)
[*] Use TypeError over Error where appropriate (#14799)
[docs] Fix typos in CHANGELOG.md and packages/jest-validate/README.md (#14640)
[docs] Don't use alias matchers in docs (#14631)
[babel-jest, babel-preset-jest] [BREAKING] Increase peer dependency of @babel/core to ^7.11 (#14109)
[babel-jest, @jest/transform] Update babel-plugin-istanbul to v6 (#15156)
[babel-plugin-jest-hoist] Move unnecessary dependencies to devDependencies (#15010)
[expect] [BREAKING] Remove .toBeCalled(), .toBeCalledTimes(), .toBeCalledWith(), .lastCalledWith(), .nthCalledWith(), .toReturn(), .toReturnTimes(), .toReturnWith(), .lastReturnedWith(), .nthReturnedWith() and .toThrowError() matcher aliases (#14632)
[jest-cli, jest-config, @jest/types] [BREAKING] Remove deprecated --init argument (#14490)
[jest-config, @jest/core, jest-util] Upgrade ci-info (#14655)
[jest-mock] [BREAKING] Remove MockFunctionMetadataType, MockFunctionMetadata and SpyInstance types (#14621)
[@jest/reporters] Upgrade istanbul-lib-source-maps (#14924)
[jest-schemas] Upgrade @sinclair/typebox (#14775)
[jest-transform] Upgrade write-file-atomic (#14274)
[jest-util] Upgrade picomatch to v4 (#14653 & #14885)
[docs] Append to NODE_OPTIONS, not overwrite ([#14730](https://redirect.github.com/jestjs/jest/pull/14730))
[docs] Updated .toHaveBeenCalled() documentation to correctly reflect its functionality (#14842)
[docs] Link NestJS documentation on testing with Jest (#14940)
[docs] Revised documentation for .toHaveBeenCalled() to accurately depict its functionality. (#14853)
[docs] Removed ExpressJS reference link from documentation due to dead link (#15270)
[docs] Correct broken links in docs (#15359)

react-native-async-storage/async-storage (@react-native-async-storage/async-storage)

`v3.0.2`

Compare Source

Patch Changes

1d1867f: include jest mock

`v3.0.1`

Compare Source

Patch Changes

7b64ea4: missing build step from CI added

`v3.0.0`

Compare Source

Major Changes

f100276: Initial release of upcoming version v3.
Please visit Async Storage docs to learn more

pnpm/pnpm (pnpm)

`v11.1.1`

Compare Source

Patch Changes

Skip installability validation when scanning workspace projects in checkDepsStatus (run by verifyDepsBeforeRun). Previously the status check called findWorkspaceProjects, which validates each project's engines and os/cpu/libc and warns about useless fields in non-root manifests — work that the install pipeline already performs. With no nodeVersion threaded through, the engine check also fell back to the system Node from PATH and emitted spurious "Unsupported engine" warnings before scripts ran. Status-only callers now use findWorkspaceProjectsNoCheck; install paths continue to validate.
Fixed pnpm add <alias>:@scope/pkg for named registries. The local resolver was claiming any specifier containing / as a local directory, so pnpm add bit:@teambit/bit (with bit configured under namedRegistries) installed a bogus link to bit:@teambit/bit/ instead of resolving from the configured registry. The local resolver now runs after the named-registry resolver in the resolution chain.
Updated @zkochan/cmd-shim to 9.0.3. The sh shim it writes for .cmd / .bat targets now escapes the /C switch as //C, so it survives the path translation Git Bash applies when launching cmd.exe. Without this, a bare /C was rewritten to C:\ before reaching cmd.exe — the switch was dropped, cmd started interactively, and the calling script saw the cmd banner instead of the wrapped command's output. Affects any cmd-shim-wrapped batch script invoked from Git Bash / MSYS / Cygwin on Windows. See pnpm/cmd-shim#55.

`v11.1.0`

Compare Source

Minor Changes

Added pnpm audit signatures to verify ECDSA registry signatures for installed packages against keys from /-/npm/v1/keys #7909. Scoped registries are respected, and registries without signing keys are skipped.
Added support for installing packages from the GitHub Packages npm registry via a built-in gh: prefix (e.g. pnpm add gh:@acme/private), and, more broadly, for arbitrary named registries in the style of vlt's named-registry aliases. Authentication is picked up from the existing per-URL .npmrc entries (e.g. //npm.pkg.github.com/:_authToken=...), so no separate auth mechanism is required.

Additional aliases — or an override for the built-in gh alias, for GitHub Enterprise Server — can be configured under namedRegistries in pnpm-workspace.yaml:
```
namedRegistries:
  gh: https://npm.pkg.github.example.com/
  work: https://npm.work.example.com/
```
With this, work:@corp/lib@^2.0.0 resolves against https://npm.work.example.com/. #8941.
Allow setting sbom spec version using --sbom-spec-version #11389.
Add --no-runtime flag (config: runtime=false) to skip installing runtime entries (e.g. Node.js downloaded via devEngines.runtime) without modifying the lockfile. The lockfile keeps the runtime entry so frozen-lockfile validation still passes; only the runtime fetch and .bin linking are skipped. Useful in CI matrices where the runtime is provisioned externally (e.g. via pnpm runtime -g set node <version>) before pnpm install runs.
Added the pnpm bugs command that opens a package's bug tracker URL in the browser. With no arguments, it reads the current project's package.json; with one or more package names, it fetches each package's metadata from the registry and opens its bug tracker. Falls back to <repository>/issues when the bugs field is missing #11279.
Added pnpm owner command to manage package owners on the registry.

Patch Changes

Added "published X ago by Y" information to the pnpm view command output, similar to npm view. This is useful when comparing against minimumReleaseAge.

For example, pnpm view pnpm now shows:
```
published 17 hours ago by GitHub Actions
```
pnpm publish now honors the configured HTTP/HTTPS proxy (including https_proxy/http_proxy/no_proxy environment variables) when polling the registry's doneUrl during the web-based authentication flow. Previously the poll bypassed the proxy, causing the registry to respond 403 from a different source IP and the login to never complete #11561.
pnpm add -g now installs each space-separated package into its own isolated directory by default. To bundle multiple packages into the same isolated install (so that they share dependencies and are removed together), pass them as a comma-separated list. For example:
- pnpm add -g foo bar installs foo and bar as two independent globals — removing one does not affect the other.
- pnpm add -g foo,bar qar bundles foo and bar into a single isolated install while qar is installed on its own.
Related: #11587.
pnpm runtime set <name> <version> no longer fails in the root of a multi-package workspace with the ADDING_TO_ROOT error. Installing the workspace root is a valid target for a runtime, so the command now bypasses that safety check.
Fix pnpm --version hanging for the lifetime of the worker pool after the version was printed. main.ts's --version short-circuit returned before reaching the command-handler finally that calls finishWorkers(), so the worker pool that switchCliVersion had spawned during integrity resolution stayed alive and held the Node event loop open. The CLI entry now runs finishWorkers() from its own finally, so every exit path tears the pool down.

Repro: pnpm --version in a workspace whose devEngines.packageManager version already matches the running pnpm + onFail: "download". switchCliVersion resolves the integrity (spawning workers), finds nothing to swap, returns. The version prints, then the process hangs.

`v11.0.9`

Compare Source

Patch Changes

Fixed installation of GitLab-hosted dependencies. pnpm now downloads the tarball from https://gitlab.com/<user>/<project>/-/archive/<sha>/<project>-<sha>.tar.gz instead of the GitLab API endpoint that contained an encoded slash (%2F) between user and project. The encoded slash both triggered 406 Not Acceptable responses from GitLab and produced virtual store directory names that Node refused to import (ERR_INVALID_MODULE_SPECIFIER) #11533.
Honor NPM_CONFIG_USERCONFIG (and its lowercase npm_config_userconfig form) as a low-priority fallback when locating the user-level .npmrc. This restores compatibility with environments that point npm at a custom auth file via that env var — most notably actions/setup-node, which writes registry credentials to ${runner.temp}/.npmrc and exports NPM_CONFIG_USERCONFIG to reference it. Without this, GitHub Actions workflows using actions/setup-node to authenticate to private registries broke after upgrading to pnpm v11. PNPM-prefixed env vars and npmrcAuthFile from the global config.yaml continue to take precedence #11539.
Fix pnpm pack not bundling dependencies listed in bundleDependencies (or bundledDependencies). The npm-packlist upgrade in pnpm 11 changed its API to require the caller to pre-populate the dependency tree, which the wrapper was not doing — bundleDependencies were silently dropped from the tarball #11519.
Fixed the pnpm CLI crashing with a confusing SyntaxError: Invalid regular expression flags instead of printing a clear "requires Node.js v22.13" error when launched on an unsupported Node.js version. The Node.js version check in bin/pnpm.mjs was effectively dead code because the static import of the bundled dist/pnpm.mjs was hoisted by the ES module loader and parsed before the check could run #11546.
Fixed pnpm --prefix=<dir> install overwriting the existing pnpm-workspace.yaml in <dir> with set this to true or false placeholders. The renamed --prefix option (which maps to dir) was not honored when locating the workspace root, so the workspace manifest's allowBuilds settings were not loaded into config and got clobbered when ignored builds were auto-populated #11535.
Fixed pnpm publish --provenance failing with a 422 from the registry when the package version contained semver build metadata (e.g. 1.0.0-canary.0+abc1234). The +<build> segment is now stripped before packing so that the version embedded in the tarball, the metadata sent to the registry, and the sigstore provenance subject all agree #11518.

`v11.0.8`

Compare Source

Patch Changes

Restored the heuristic that preserves tarball URLs in pnpm-lock.yaml when they cannot be derived from name+version+registry, even with the default lockfileIncludeTarballUrl: false. Without this, pnpm install --frozen-lockfile from an empty store fails with ERR_PNPM_FETCH_404 for packages on registries that serve tarballs from a non-standard path — most notably GitHub Packages (https://npm.pkg.github.com/download/<scope>/<name>/<version>/<hash>) and JSR. lockfileIncludeTarballUrl: true continues to force the URL into the lockfile for every package #11276.
Run preversion, version, and postversion lifecycle scripts for pnpm version.
Fixed ERR_PNPM_BAD_TARBALL_SIZE when a registry serves tarballs with an end-to-end Content-Encoding (e.g. gzip). Tarballs are already compressed, so the fetcher now requests them with Accept-Encoding: identity (matching pnpm v10's effective behavior) and, as defense in depth against misbehaving servers, no longer enforces the strict Content-Length check when the response declares a Content-Encoding — Content-Length in that case refers to the encoded payload, not the decoded bytes the fetch implementation yields #11506.

`v11.0.7`

Compare Source

Patch Changes

Restore the execute bit on the node-gyp shims packed inside @pnpm/exe (dist/node-gyp-bin/node-gyp, dist/node-gyp-bin/node-gyp.cmd, and dist/node_modules/node-gyp/bin/node-gyp.js). Without this, pnpm/action-setup's standalone path (used on runners with Node.js < 22.13) failed any install whose lifecycle script invoked node-gyp rebuild with sh: 1: node-gyp: Permission denied #11483.
Fixed the pn, pnpx, and pnx aliases failing in Git Bash / MSYS2 on Windows when pnpm was installed via @pnpm/exe (or after pnpm self-update) #11486. Running pnpx (or pnx) printed the cmd.exe banner and dropped the user into an interactive command prompt instead of running pnpm dlx. The bin field rewrite on Windows was pointing those aliases at .cmd files; cmd-shim's Bash shim for a .cmd target wraps it in exec cmd /C ..., and MSYS2 mangles /C into a Windows path before cmd.exe sees it. The aliases are now .exe hardlinks of the SEA binary, which detects which name it was launched as via process.execPath and prepends dlx for pnpx / pnx.
Fix pnpm install recreating node_modules after pnpm fetch. pnpm fetch records empty hoistPattern and publicHoistPattern in .modules.yaml; since v11 removed the explicit-config gate, the follow-up install treated those as a hoist-pattern change and purged the modules directory. The fetch step now flags the modules manifest with virtualStoreOnly: true so the next install skips the hoist-pattern comparison and completes the missing post-import linking in place #11488.
Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.
Allow user-level preferences in the global config.yaml. The following settings can now be set in ~/.config/pnpm/config.yaml (or via pnpm config set --location global) instead of being restricted to pnpm-workspace.yaml: agent, globalVirtualStoreDir, initPackageManager, initType, registrySupportsTimeField, scriptShell, shellEmulator, sideEffectsCache, sideEffectsCacheReadonly, stateDir, strictDepBuilds, trustPolicy, trustPolicyExclude, trustPolicyIgnoreAfter, updateNotifier, useStderr, verifyDepsBeforeRun, verifyStoreIntegrity, virtualStoreDir, virtualStoreDirMaxLength #11474.
Make trusted publishing (OIDC) take pre

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added dependencies renovate labels May 11, 2026

renovate Bot force-pushed the renovate/major-frontend-app-runtime-tooling branch 2 times, most recently from a992601 to 794db0d Compare May 14, 2026 18:44

fix(deps): update frontend-app-runtime-tooling

595fcc6

renovate Bot force-pushed the renovate/major-frontend-app-runtime-tooling branch from 794db0d to 595fcc6 Compare May 15, 2026 13:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update frontend-app-runtime-tooling (major)#153

fix(deps): update frontend-app-runtime-tooling (major)#153
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-frontend-app-runtime-tooling

renovate Bot commented May 11, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features

Fixes

Features

Fixes

Chore & Maintenance

Features

Fixes

Chore & Maintenance

Chore & Maintenance

Fixes

Fixes

Features

Fixes

Features

Fixes

Fixes

Features

Fixes

Features

Fixes

Chore & Maintenance

Features

Fixes

Performance

Chore & Maintenance

Patch Changes

Patch Changes

Major Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 11, 2026 •

edited

Loading