chore: bump pnpm to 12.4.1 - #678
Conversation
|
Warning Review limit reachedNext included review available in 34 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe package manager requirement changes from pnpm 11.7.0 to 12.4.1. The contributing guide documents the same pnpm version. Changespnpm Version Alignment
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Other Suggested reviewers: Merge Risk: ⚪ Minimal · up to The pnpm upgrade remains compatible with the repository’s documented setup and CI installation path, with no confirmed merge-blocking risk. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
🟡 Changes recommended
pnpm-lock.yaml appears to contain two YAML documents (duplicated lockfile), which will likely break pnpm installs/CI until regenerated into a single valid lockfile.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
This PR upgrades the repository’s pinned package manager to pnpm 12.4.1 (via packageManager) and updates contributor documentation accordingly, alongside an intended lockfile regeneration.
Changes:
- Bumped
packageManagerinpackage.jsonfrom pnpm 11.7.0 to 12.4.1. - Updated
CONTRIBUTING.mdto reflect pnpm 12.4.1 in developer prerequisites. - Regenerated
pnpm-lock.yaml, intending to include pnpm 12’spackageManagerDependenciesmetadata (but the current lockfile content appears to be malformed / duplicated).
File summaries
| File | Description |
|---|---|
| pnpm-lock.yaml | Regenerated lockfile content; currently appears to include two YAML documents (likely breaking installs). |
| package.json | Updates the pinned packageManager version to pnpm 12.4.1. |
| CONTRIBUTING.md | Updates contributor prerequisites to reference pnpm 12.4.1 (and should align Node minimum with engines). |
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (1)
pnpm-lock.yaml:162
pnpm-lock.yamlappears to contain two YAML documents (a standalone pnpm 12packageManagerDependenciesdoc, then a second full lockfile starting at the second---). pnpm’s lockfile reader expects a single document; this will likely cause installs to read only the first doc and ignore the real dependency graph.
- Files reviewed: 2/3 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Clears the high-severity advisories that fail CI's pnpm audit: GHSA-2883-xcg3-v3hh (js-yaml <4.3.2) and, where present, the fast-uri <3.1.6 advisories. Claude-Session: https://claude.ai/code/session_01JqjTCSDPsbgreJKHcRABi9
Bumps
packageManagerfrom pnpm 11.7.0 to 12.4.1 (major).pnpm install --lockfile-only: the only change is pnpm 12's newpackageManagerDependenciesdocument pinning pnpm's own integrity. Dependency graph unchanged.pnpm-workspace.yamlsettings now error,--frozen-lockfile falseremoved (use--no-frozen-lockfile), stricterengineStrict.https://claude.ai/code/session_01JqjTCSDPsbgreJKHcRABi9
Summary by CodeRabbit
Documentation
Chores