You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#11025 43d0f65
Thanks @BuddhaBing! - Widen Types.SchemaWithLoaderOptions['loader'] to accept a custom loader function
(CustomSchemaLoaderFn) in addition to a path string.
A per-entry schema custom loader ({ '<pointer>': { loader, ...options } }) is resolved by @graphql-tools/load's useCustomLoader, which already accepts either a path string (resolved
via require()) or a function value at runtime (typeof loaderPointer === 'function'). Only the
TypeScript type restricted loader to string, forcing consumers who pass an imported loader
function (or a class instance exposing a bound loader property) to cast the schema array to
bypass the type error, even though it worked correctly at runtime.
This is additive and backward compatible — loader: string continues to type-check exactly as
before.
Also fixes a schema-cache collision for function loaders in @graphql-codegen/cli: the cache key
is JSON.stringify(schemaPointerMap), and JSON.stringify drops functions, so two generates
targets using different loader functions for the same pointer
({ 'schema.graphql': { loader: fnA } } vs { loader: fnB }) both keyed as {"schema.graphql":{}} and the second silently reused the first's schema. Function values are now
keyed by object identity (via the existing getJsObjectId), so distinct loaders load separately
while one function reused across targets still loads once.
@graphql-codegen/cli: loadCodegenConfig returns Promise<LoadCodegenConfigResult | null>,
matching the null it resolves to when no config file is found. YamlCliFlags includes the
kebab-case ignore-no-documents, emit-legacy-common-js-imports and import-extension flags
that the CLI reads. CodegenContext.filepath is optional, and watch mode only watches the
config file when the context has a filepath. CodegenContext.getConfig() without an argument
returns Types.Config, and getConfig(extraConfig) returns T & Types.Config. CodegenContext.checkModeStaleFiles is typed as string[]. Adds @types/yargs, @types/babel__generator and @types/babel__template as dev dependencies.
@graphql-codegen/plugin-helpers: normalizeInstanceOrArray and normalizeConfig accept null and undefined, returning [].
#11025 43d0f65
Thanks @BuddhaBing! - Widen Types.SchemaWithLoaderOptions['loader'] to accept a custom loader function
(CustomSchemaLoaderFn) in addition to a path string.
A per-entry schema custom loader ({ '<pointer>': { loader, ...options } }) is resolved by @graphql-tools/load's useCustomLoader, which already accepts either a path string (resolved
via require()) or a function value at runtime (typeof loaderPointer === 'function'). Only the
TypeScript type restricted loader to string, forcing consumers who pass an imported loader
function (or a class instance exposing a bound loader property) to cast the schema array to
bypass the type error, even though it worked correctly at runtime.
This is additive and backward compatible — loader: string continues to type-check exactly as
before.
Also fixes a schema-cache collision for function loaders in @graphql-codegen/cli: the cache key
is JSON.stringify(schemaPointerMap), and JSON.stringify drops functions, so two generates
targets using different loader functions for the same pointer
({ 'schema.graphql': { loader: fnA } } vs { loader: fnB }) both keyed as {"schema.graphql":{}} and the second silently reused the first's schema. Function values are now
keyed by object identity (via the existing getJsObjectId), so distinct loaders load separately
while one function reused across targets still loads once.
@graphql-codegen/cli: loadCodegenConfig returns Promise<LoadCodegenConfigResult | null>,
matching the null it resolves to when no config file is found. YamlCliFlags includes the
kebab-case ignore-no-documents, emit-legacy-common-js-imports and import-extension flags
that the CLI reads. CodegenContext.filepath is optional, and watch mode only watches the
config file when the context has a filepath. CodegenContext.getConfig() without an argument
returns Types.Config, and getConfig(extraConfig) returns T & Types.Config. CodegenContext.checkModeStaleFiles is typed as string[]. Adds @types/yargs, @types/babel__generator and @types/babel__template as dev dependencies.
@graphql-codegen/plugin-helpers: normalizeInstanceOrArray and normalizeConfig accept null and undefined, returning [].
@graphql-codegen/plugin-helpers: ProfilerEvent.cat is optional, matching the Trace Event
format and Profiler.run's optional cat. FederationMeta's reference selection sets are
typed recursively ({ [field: string]: true | ReferenceSelectionSet }), matching the nested
selections @key/@requires/@provides produce. oldVisit's visitor param is typed as OldVisitor: enter and leave maps keyed by AST node kind, whose callbacks receive the typed
node plus graphql's key, parent, path and ancestors. Federation directives missing their fields argument, and operations whose root type is missing from the schema, throw a
descriptive error.
@graphql-codegen/typescript and @graphql-codegen/typescript-operations: the InputValueDefinition visitor methods take path and ancestors as required params, since the
visitor always passes them.
Generated output is unchanged.
#11009 1f7566f
Thanks @eddeee888! - Fix type errors in typescript-operations
under strict: true by widening the shared types it calls into:
@graphql-codegen/plugin-helpers: Types.ComplexPluginOutput's prepend and append now
accept null items. Core already skipped them.
@graphql-codegen/visitor-plugin-common: DeclarationBlock.withComment accepts undefined, parseEnumValues's mapOrStr is optional (it already defaulted to {}), ImportSource.namespace accepts null, and optimizeOperations's includeFragments is
optional.
@graphql-codegen/typescript-operations: skips document files without a document, and no
longer throws when called without the plugin info argument.
@graphql-codegen/plugin-helpers: ProfilerEvent.cat is optional, matching the Trace Event
format and Profiler.run's optional cat. FederationMeta's reference selection sets are
typed recursively ({ [field: string]: true | ReferenceSelectionSet }), matching the nested
selections @key/@requires/@provides produce. oldVisit's visitor param is typed as OldVisitor: enter and leave maps keyed by AST node kind, whose callbacks receive the typed
node plus graphql's key, parent, path and ancestors. Federation directives missing their fields argument, and operations whose root type is missing from the schema, throw a
descriptive error.
@graphql-codegen/typescript and @graphql-codegen/typescript-operations: the InputValueDefinition visitor methods take path and ancestors as required params, since the
visitor always passes them.
Generated output is unchanged.
#11014 7a376ef
Thanks @eddeee888! - Fix type errors in typescript under strict: true by typing the shared visitor methods it overrides:
@graphql-codegen/visitor-plugin-common: adds NormalizedDeclarationKindConfig (every
declaration kind set), used by normalizeDeclarationKind, DEFAULT_DECLARATION_KINDS and ParsedTypesConfig.declarationKind. BaseTypesVisitor's NamedType, ListType, FieldDefinition, InputValueDefinition and UnionTypeDefinition have typed visitor params
(key and parent are required, since the visitor always passes them), and ObjectTypeDefinition, EnumTypeDefinition and DirectiveDefinition may return null.
@graphql-codegen/typescript: skips document files without a document when collecting
introspection types, types the TsVisitor visitor params, and TsVisitor.EnumTypeDefinition
may return null like the introspection visitor's override.
This release moves the WebContainer build into a separate @pnpm/wasm package, shrinks the pnpm package back to about 4 MB, and fixes pnpm publish with provenance from GitLab CI.
Patch Changes
The WebAssembly build for StackBlitz WebContainers now ships as a separate @pnpm/wasm package. The pnpm and @pnpm/exe packages no longer include it, which brings their unpacked size back from about 55 MB to about 4 MB. In a WebContainer, install @pnpm/wasm with npm to get the pnpm command.
pnpm publish with provenance from GitLab CI is no longer rejected by the npm registry with a 422 error. The provenance statement now includes the GitLab CI variables in invocation.parameters, as npm does #16551.
pnpm audit signatures now uses the TLS settings of the redirect target when a registry redirects its signing-keys request, for example to registry.npmjs.org. A cafile scoped to a private registry no longer makes the redirected request fail #16541.
Fixed pnpm install --frozen-lockfile rejecting an up-to-date lockfile when an injected workspace package uses a catalog entry in peerDependencies#16557.
The [<since>] filter selector works again with Git 2.24 through 2.27 #16561. With Git older than 2.24, the selector now fails with an error that names the required Git version.
It also detects changes in projects whose directory names contain non-ASCII characters. Such a change used to be credited to the parent project. changedFilesIgnorePattern and testPattern now match changed files whose names contain non-ASCII characters.
The pnpm executable is about 10% smaller. On macOS arm64 it went from 45.1 MB to 40.3 MB.
Sped up trust downgrade checks for packages with long release histories.
With optimisticRepeatInstall: false, pnpm install now runs the projects' own lifecycle scripts, such as prepare, even when node_modules is already up to date #16545.
pnpm self-update now fails for Homebrew-installed pnpm and prints the brew upgrade command for the installed formula, such as brew upgrade pnpm or brew upgrade pnpm@11. It used to install a second copy of pnpm that the Homebrew one kept shadowing #16547.
This release runs pnpm in StackBlitz WebContainers, adds a per-registry networkConcurrency setting, and records every installed project in the store. It also carries a security fix for pnpm login.
Minor Changes
pnpm now automatically uses WebAssembly in StackBlitz WebContainers, including when installation scripts are disabled. Native installations continue to use the native executable when installation scripts are enabled.
A registries entry can now set networkConcurrency, the most requests pnpm keeps in flight to that registry's origin. Requests to other registries keep the overall limit. The setting may live in pnpm-workspace.yaml or the global config.yaml.
pnpm install now records every project it installs in the store's projects directory, as a symlink to the project directory. A --frozen-store install without the global virtual store still records nothing. Only projects that used the global virtual store were recorded before #6929.
Patch Changes
pnpm login no longer forwards credentials in its request body to another origin during redirects.
Installing packages
Fixed pnpm install failing on Android with ERR_PNPM_STORE_DIR_ACQUIRE_OPERATION_LOCK#16508.
pnpm install --frozen-lockfile again succeeds when a workspace project recorded in pnpm-lock.yaml has no directory, such as a project left out of a Docker build context. It still fails if the project's directory exists without a package.json#16453.
pnpm install --frozen-lockfile no longer requires a pnpm-lock.yaml in a project that has no dependencies. It also succeeds when pnpm-lock.yaml records only the pinned pnpm version, as other commands write it when they run before the first install #16477.
Fixed pnpm install --frozen-lockfile rejecting a fresh lockfile when an injected workspace dependency has an optional peer supplied by another workspace project #16428.
With nodeLinker: hoisted, a filtered install now keeps the packages of the workspace projects an earlier install put in node_modules. This also covers the install that pnpm --filter <selector> run and pnpm --filter <selector> exec start before the command. Before, these installs removed every package that only the unselected projects needed #16483.
pnpm install with nodeLinker: hoisted now refreshes directories supplied by custom fetchers when reinstalling. pnpm also keeps the symlinks inside those directories.
With enableGlobalVirtualStore on, scripts can run entry points that a CommonJS require hook loads again, such as ts-node index.ts. They failed with ERR_UNKNOWN_FILE_EXTENSION on Node.js versions without built-in TypeScript support #16436.
pnpm now keeps each project's current lockfile and hidden hoisted dependencies in its own node_modules/.pnpm when virtualStoreDir points at a shared global virtual store. --virtual-store-dir now sets the global virtual store's location too pnpm/tasks#47.
pnpm clean no longer deletes the project when virtualStoreDir or globalVirtualStoreDir is set to the project directory. It also leaves a directory outside the project alone when the setting reaches it through a symlink. It now removes a global virtual store that globalVirtualStoreDir places inside the project, as it does for virtualStoreDir.
Optional dependencies
pnpm install no longer fails when a dependency of an optional dependency is missing from the registry. Like npm, pnpm now leaves out the nearest optional dependency above it, together with its subtree #16511.
When an optional dependency fails to build, pnpm now removes its link from node_modules. A repeat pnpm install then reports "Already up to date" and no longer reruns the failing build #16468.
pnpm install now prints a warning with the error when an optional dependency cannot be fetched and is skipped. The skipped package is no longer counted in the Packages: +N summary. The pnpm:skipped-optional-dependency log reports the skip with the fetch_failure reason #16514.
Resolving dependencies
Fixed pnpm install changing an unchanged project's direct dependency to a sibling workspace's pinned version when its dependency tree contains a cycle #16417.
With autoDedupe enabled, downgrading a dependency in one workspace project now moves the other projects to that version when it satisfies their ranges. This also applies to a filtered pnpm --filter <project> add#16432.
pnpm install and pnpm dedupe now move an optional peer to the version already in the dependency graph when no other package provides its locked version anymore. After a bump such as vue 3.5.40 to 3.5.43, the lockfile kept a second copy of @vue/server-renderer for @vue/test-utils#16443.
pnpm dedupe --check no longer fails right after pnpm install when a project's optional peer is satisfied by a package another workspace project installs. pnpm dedupe now picks the same versions for that package's dependencies as pnpm install#16447.
pnpm install no longer re-resolves an up-to-date lockfile on every run when a patched package is a peer in a peer cycle #16418.
With autoDedupe enabled, pnpm install --lockfile-only no longer resolves the dependency graph again when nothing changed since an earlier --lockfile-only install deduplicated the lockfile. Such an install keeps the lockfile even if versions were published since it was written, or if only a setting such as resolutionMode changed. Run pnpm dedupe to apply such a change #16458.
Speed and network
A repeat pnpm install in a large workspace reports "Already up to date" faster #16487.
Sped up dependency resolution of workspaces with many peer dependencies.
pnpm install sends fewer registry metadata requests when the lockfile already decides which version a range resolves to. This now also covers ranges that several locked versions satisfy when one of them outranks the others, and direct dependencies kept at their locked version. Packages that minimumReleaseAgeExclude lists without a version now reuse cached registry metadata the same way they do when minimumReleaseAge is not set #16458.
pnpm no longer downloads every packument again on each install from a registry whose metadata responses forbid caching, such as Cache-Control: no-store. pnpm revalidates the cached metadata with a conditional request, so a registry that supports conditional requests answers with a 304 when the package has not changed #16528.
Cached metadata for a package published within minimumReleaseAge is now revalidated with its ETag, so the npm registry can answer 304 Not Modified. Before, the next install that checked the cache downloaded the whole document again #16506.
A fetch timeout while other downloads from the same host are still running now lowers concurrency for that host to one connection. Retries of that request, and later downloads from that host, use the lower concurrency. Other hosts keep the configured concurrency #12791.
Sped up pnpm install --offline when the version a range picks is not in the store. While it looks for a version the store holds, pnpm now reads only the versions the range admits #16495.
pnpm install --offline now reuses config dependency tarballs that are already present in the store pnpm/tasks#46.
Running scripts
pnpm -s <script> runs the script again, with -s meaning --sequential as it does for pnpm run -s <script>. pnpm rejected it with "unexpected argument '-s' found" #16446.
pnpm run and pnpm exec now warn and run the command when the install that verifyDepsBeforeRun starts fails. This lets scripts run in sandboxes where pnpm cannot install, such as containers with a read-only store or no network #15173.
A filtered pnpm run or pnpm exec now finds dependencies out of date when a workspace dependency of a selected project has no node_modules directory, as after a filtered install. With verifyDepsBeforeRun: install, pnpm installs that dependency before running the command pnpm/tasks#45.
Scripts run without a terminal no longer start a second sh each. One watchdog per pnpm command now ends every script's process group if pnpm is killed, so pnpm -r run across many projects starts half as many processes #16489.
Terminate batch job (Y/N)? no longer appears after pressing Ctrl+C in a script started with pnpm from PowerShell or cmd on Windows #16502.
pnpm rebuild and pnpm approve-builds refresh command launchers when a build changes a command's interpreter or replaces it with a native executable. Dependent packages' build scripts use the refreshed launchers.
When pnpm run <script> or pnpm <script> finds nothing to run and --filter follows the script name, the error now suggests putting the filter option before the script name #4655.
Package-name filters now support ? to match one character #2817.
The pinned pnpm and pnpm self-update
pnpm no longer downloads the project's pinned pnpm version again on every command when nodeVersion in pnpm-workspace.yaml names a different Node.js major than the node on PATH. Before, each of those commands took about a second longer and failed without network access #16497.
Several pnpm commands started at once in a project that pins packageManager no longer fail with The process cannot access the file because it is being used by another process on Windows while the pinned pnpm is being installed.
pnpm can now switch to a packageManager version below 11 on x64 musl Linux, such as Alpine #16467.
A devEngines.packageManager range no longer makes pnpm replace the version recorded in pnpm-lock.yaml with the running pnpm while the recorded version still satisfies the range. When pnpm does record a version, it records the running pnpm only if it meets minimumReleaseAge. Otherwise it records the newest version in the range that meets it, or the running pnpm if none does #16431.
On Windows, pnpm self-update now replaces a pnpm.exe left in PNPM_HOME or in PNPM_HOME\bin. Windows ran that executable in place of the updated pnpm.cmd shim, so pnpm --version kept printing the old version after a successful update. If the executable was in PNPM_HOME, self-update now asks you to run pnpm setup#9094.
pnpm self-update now checks that a version installed as the JavaScript pnpm can start before making it the global pnpm. If Node.js is missing, the update fails and the current pnpm stays in place.
Other commands
pnpm deploy now finds patches and local dependencies when the target directory sits under a symlink, such as /tmp on macOS. It failed with ERR_PNPM_PATCH_NOT_FOUND#16470.
pnpm deploy --legacy now resolves the deployed project's relative file:, link:, and path dependencies from the project's own directory #16475.
pnpm update --global now removes hard-linked executables from PNPM_HOME when migrating packages from the old global layout #16420.
pnpm store prune no longer fails on store index entries that pnpm 11 wrote for git-hosted packages without a package.json. Entries that still cannot be read are kept and counted in the prune summary.
pnpm store prune now aborts when an error other than a missing directory occurs while scanning project directories in the mark phase.
pnpm config get and pnpm config list now report a setting given on the command line with --config.<name>=<value>. Before, a value such as --config.node-linker=hoisted reached the install but was absent from the reported configuration #16276.
pnpm -r pkg get now reports every selected project when several share a package name. Projects with the same name are keyed by their directory relative to the workspace root. Before, only one of them appeared in the output.
The install summary shows a link: dependency as + name <- path, and the Node.js API's hideLinkedPkgsDiff reporter option leaves matching linked dependencies out of the summary.
The --force help text of pnpm install and pnpm add now says that --force keeps skipping optional dependencies built for other platforms. It points to forceIgnoresPlatform and the --os, --cpu, and --libc options for installing them #16435.
The homepage field of the published pnpm package points to https://pnpm.io again.
Platinum Sponsors
Gold Sponsors
Configuration
📅 Schedule: (UTC)
Branch creation
At any time (no schedule defined)
Automerge
At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
If you want to rebase/retry this PR, check this box
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^7.4.3→^7.4.47.4.0→7.4.1^6.1.0→^6.1.110.11.0→10.12.012.8.2→12.9.112.8.2→12.9.1Release Notes
dotansimha/graphql-code-generator (@graphql-codegen/cli)
v7.4.4Compare Source
Patch Changes
#11025
43d0f65Thanks @BuddhaBing! - Widen
Types.SchemaWithLoaderOptions['loader']to accept a custom loader function(
CustomSchemaLoaderFn) in addition to a path string.A per-entry
schemacustom loader ({ '<pointer>': { loader, ...options } }) is resolved by@graphql-tools/load'suseCustomLoader, which already accepts either a path string (resolvedvia
require()) or a function value at runtime (typeof loaderPointer === 'function'). Only theTypeScript type restricted
loadertostring, forcing consumers who pass an imported loaderfunction (or a class instance exposing a bound
loaderproperty) to cast theschemaarray tobypass the type error, even though it worked correctly at runtime.
This is additive and backward compatible —
loader: stringcontinues to type-check exactly asbefore.
Also fixes a schema-cache collision for function loaders in
@graphql-codegen/cli: the cache keyis
JSON.stringify(schemaPointerMap), andJSON.stringifydrops functions, so twogeneratestargets using different loader functions for the same pointer
(
{ 'schema.graphql': { loader: fnA } }vs{ loader: fnB }) both keyed as{"schema.graphql":{}}and the second silently reused the first's schema. Function values are nowkeyed by object identity (via the existing
getJsObjectId), so distinct loaders load separatelywhile one function reused across targets still loads once.
#11020
82ebbb5Thanks @eddeee888! - Fix type errors in
cliunderstrict: true:@graphql-codegen/cli:loadCodegenConfigreturnsPromise<LoadCodegenConfigResult | null>,matching the
nullit resolves to when no config file is found.YamlCliFlagsincludes thekebab-case
ignore-no-documents,emit-legacy-common-js-importsandimport-extensionflagsthat the CLI reads.
CodegenContext.filepathis optional, and watch mode only watches theconfig file when the context has a
filepath.CodegenContext.getConfig()without an argumentreturns
Types.Config, andgetConfig(extraConfig)returnsT & Types.Config.CodegenContext.checkModeStaleFilesis typed asstring[]. Adds@types/yargs,@types/babel__generatorand@types/babel__templateas dev dependencies.@graphql-codegen/plugin-helpers:normalizeInstanceOrArrayandnormalizeConfigacceptnullandundefined, returning[].Generated output is unchanged.
Updated dependencies
[
43d0f65,82ebbb5,e972b6d,eae0e62,1f7566f]:dotansimha/graphql-code-generator (@graphql-codegen/plugin-helpers)
v7.4.1Compare Source
Patch Changes
#11025
43d0f65Thanks @BuddhaBing! - Widen
Types.SchemaWithLoaderOptions['loader']to accept a custom loader function(
CustomSchemaLoaderFn) in addition to a path string.A per-entry
schemacustom loader ({ '<pointer>': { loader, ...options } }) is resolved by@graphql-tools/load'suseCustomLoader, which already accepts either a path string (resolvedvia
require()) or a function value at runtime (typeof loaderPointer === 'function'). Only theTypeScript type restricted
loadertostring, forcing consumers who pass an imported loaderfunction (or a class instance exposing a bound
loaderproperty) to cast theschemaarray tobypass the type error, even though it worked correctly at runtime.
This is additive and backward compatible —
loader: stringcontinues to type-check exactly asbefore.
Also fixes a schema-cache collision for function loaders in
@graphql-codegen/cli: the cache keyis
JSON.stringify(schemaPointerMap), andJSON.stringifydrops functions, so twogeneratestargets using different loader functions for the same pointer
(
{ 'schema.graphql': { loader: fnA } }vs{ loader: fnB }) both keyed as{"schema.graphql":{}}and the second silently reused the first's schema. Function values are nowkeyed by object identity (via the existing
getJsObjectId), so distinct loaders load separatelywhile one function reused across targets still loads once.
#11020
82ebbb5Thanks @eddeee888! - Fix type errors in
cliunderstrict: true:@graphql-codegen/cli:loadCodegenConfigreturnsPromise<LoadCodegenConfigResult | null>,matching the
nullit resolves to when no config file is found.YamlCliFlagsincludes thekebab-case
ignore-no-documents,emit-legacy-common-js-importsandimport-extensionflagsthat the CLI reads.
CodegenContext.filepathis optional, and watch mode only watches theconfig file when the context has a
filepath.CodegenContext.getConfig()without an argumentreturns
Types.Config, andgetConfig(extraConfig)returnsT & Types.Config.CodegenContext.checkModeStaleFilesis typed asstring[]. Adds@types/yargs,@types/babel__generatorand@types/babel__templateas dev dependencies.@graphql-codegen/plugin-helpers:normalizeInstanceOrArrayandnormalizeConfigacceptnullandundefined, returning[].Generated output is unchanged.
#11019
eae0e62Thanks @eddeee888! - Fix type errors in
plugin-helpersunderstrict: true:@graphql-codegen/plugin-helpers:ProfilerEvent.catis optional, matching the Trace Eventformat and
Profiler.run's optionalcat.FederationMeta's reference selection sets aretyped recursively (
{ [field: string]: true | ReferenceSelectionSet }), matching the nestedselections
@key/@requires/@providesproduce.oldVisit'svisitorparam is typed asOldVisitor:enterandleavemaps keyed by AST node kind, whose callbacks receive the typednode plus graphql's
key,parent,pathandancestors. Federation directives missing theirfieldsargument, and operations whose root type is missing from the schema, throw adescriptive error.
@graphql-codegen/typescriptand@graphql-codegen/typescript-operations: theInputValueDefinitionvisitor methods takepathandancestorsas required params, since thevisitor always passes them.
Generated output is unchanged.
#11009
1f7566fThanks @eddeee888! - Fix type errors in
typescript-operationsunder
strict: trueby widening the shared types it calls into:@graphql-codegen/plugin-helpers:Types.ComplexPluginOutput'sprependandappendnowaccept
nullitems. Core already skipped them.@graphql-codegen/visitor-plugin-common:DeclarationBlock.withCommentacceptsundefined,parseEnumValues'smapOrStris optional (it already defaulted to{}),ImportSource.namespaceacceptsnull, andoptimizeOperations'sincludeFragmentsisoptional.
@graphql-codegen/typescript-operations: skips document files without adocument, and nolonger throws when called without the plugin info argument.
Generated output is unchanged.
dotansimha/graphql-code-generator (@graphql-codegen/typescript)
v6.1.1Compare Source
Patch Changes
#11019
eae0e62Thanks @eddeee888! - Fix type errors in
plugin-helpersunderstrict: true:@graphql-codegen/plugin-helpers:ProfilerEvent.catis optional, matching the Trace Eventformat and
Profiler.run's optionalcat.FederationMeta's reference selection sets aretyped recursively (
{ [field: string]: true | ReferenceSelectionSet }), matching the nestedselections
@key/@requires/@providesproduce.oldVisit'svisitorparam is typed asOldVisitor:enterandleavemaps keyed by AST node kind, whose callbacks receive the typednode plus graphql's
key,parent,pathandancestors. Federation directives missing theirfieldsargument, and operations whose root type is missing from the schema, throw adescriptive error.
@graphql-codegen/typescriptand@graphql-codegen/typescript-operations: theInputValueDefinitionvisitor methods takepathandancestorsas required params, since thevisitor always passes them.
Generated output is unchanged.
#11014
7a376efThanks @eddeee888! - Fix type errors in
typescriptunderstrict: trueby typing the shared visitor methods it overrides:@graphql-codegen/visitor-plugin-common: addsNormalizedDeclarationKindConfig(everydeclaration kind set), used by
normalizeDeclarationKind,DEFAULT_DECLARATION_KINDSandParsedTypesConfig.declarationKind.BaseTypesVisitor'sNamedType,ListType,FieldDefinition,InputValueDefinitionandUnionTypeDefinitionhave typed visitor params(
keyandparentare required, since the visitor always passes them), andObjectTypeDefinition,EnumTypeDefinitionandDirectiveDefinitionmay returnnull.@graphql-codegen/typescript: skips document files without adocumentwhen collectingintrospection types, types the
TsVisitorvisitor params, andTsVisitor.EnumTypeDefinitionmay return
nulllike the introspection visitor's override.Generated output is unchanged.
Updated dependencies
[
43d0f65,82ebbb5,eae0e62,1f7566f,7a376ef,3caccd3,ccc0d5c]:eslint/eslint (eslint)
v10.12.0Compare Source
Features
4618052feat: handle astral letters innew-cap(#21357) (sary)4ec5168feat: allowSourceCode#getText()to accept tokens and comments (#21340) (electrohyun)Bug Fixes
bc51eeefix:prefer-arrow-callbackfalse positive in conditional test (#21373) (Daniel Pinto)bbff86cfix: skip lines with multiple comments inmax-lines-per-function(#21332) (xbinaryx)efc4d6bfix: astral letters inconsistent-return,no-eval,no-invalid-this(#21360) (lumir)93de066fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)02e34fffix: add missing space afterelseincurlyautofix (#21355) (Pixel)b14b8bcfix: correctid-lengthmessage for long private names (#21348) (Pixel)69aac01fix: supportTSFunctionTypeingetFunctionHeadLoc(#21335) (xbinaryx)686630efix:no-loss-of-precisionfalse positive with0.e5(#21337) (sethamus)Documentation
67eb586docs: Update README (GitHub Actions Bot)5370d7edocs: clarifyone-varseparateRequiresmatches anyrequire()call (#21192) (sethamus)8816c1ddocs: Update README (GitHub Actions Bot)3d2e7cedocs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)Chores
152067fchore: update ecosystem plugins (#21362) (ESLint Bot)b56d58echore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])bfaea12perf: cache normalized config globals per languageOptions (#21364) (James Ross)322209eci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)d166567chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])29585cechore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])39d79bachore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])182a6e9chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])f995127chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)b95fb6cchore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])3782dd4chore: update ecosystem plugins (#21342) (ESLint Bot)pnpm/pnpm (pnpm)
v12.9.1: pnpm 12.9.1Compare Source
This release moves the WebContainer build into a separate
@pnpm/wasmpackage, shrinks thepnpmpackage back to about 4 MB, and fixespnpm publishwith provenance from GitLab CI.Patch Changes
The WebAssembly build for StackBlitz WebContainers now ships as a separate
@pnpm/wasmpackage. Thepnpmand@pnpm/exepackages no longer include it, which brings their unpacked size back from about 55 MB to about 4 MB. In a WebContainer, install@pnpm/wasmwith npm to get thepnpmcommand.pnpm publishwith provenance from GitLab CI is no longer rejected by the npm registry with a 422 error. The provenance statement now includes the GitLab CI variables ininvocation.parameters, as npm does #16551.pnpm audit signaturesnow uses the TLS settings of the redirect target when a registry redirects its signing-keys request, for example to registry.npmjs.org. Acafilescoped to a private registry no longer makes the redirected request fail #16541.Fixed
pnpm install --frozen-lockfilerejecting an up-to-date lockfile when an injected workspace package uses a catalog entry inpeerDependencies#16557.The
[<since>]filter selector works again with Git 2.24 through 2.27 #16561. With Git older than 2.24, the selector now fails with an error that names the required Git version.It also detects changes in projects whose directory names contain non-ASCII characters. Such a change used to be credited to the parent project.
changedFilesIgnorePatternandtestPatternnow match changed files whose names contain non-ASCII characters.The
pnpmexecutable is about 10% smaller. On macOS arm64 it went from 45.1 MB to 40.3 MB.Sped up trust downgrade checks for packages with long release histories.
With
optimisticRepeatInstall: false,pnpm installnow runs the projects' own lifecycle scripts, such asprepare, even whennode_modulesis already up to date #16545.pnpm self-updatenow fails for Homebrew-installed pnpm and prints thebrew upgradecommand for the installed formula, such asbrew upgrade pnpmorbrew upgrade pnpm@11. It used to install a second copy of pnpm that the Homebrew one kept shadowing #16547.Platinum Sponsors
Gold Sponsors
v12.9.0: pnpm 12.9Compare Source
This release runs pnpm in StackBlitz WebContainers, adds a per-registry
networkConcurrencysetting, and records every installed project in the store. It also carries a security fix forpnpm login.Minor Changes
pnpm now automatically uses WebAssembly in StackBlitz WebContainers, including when installation scripts are disabled. Native installations continue to use the native executable when installation scripts are enabled.
A
registriesentry can now setnetworkConcurrency, the most requests pnpm keeps in flight to that registry's origin. Requests to other registries keep the overall limit. The setting may live inpnpm-workspace.yamlor the globalconfig.yaml.pnpm installnow records every project it installs in the store'sprojectsdirectory, as a symlink to the project directory. A--frozen-storeinstall without the global virtual store still records nothing. Only projects that used the global virtual store were recorded before #6929.Patch Changes
pnpm loginno longer forwards credentials in its request body to another origin during redirects.Installing packages
Fixed
pnpm installfailing on Android withERR_PNPM_STORE_DIR_ACQUIRE_OPERATION_LOCK#16508.pnpm install --frozen-lockfileagain succeeds when a workspace project recorded inpnpm-lock.yamlhas no directory, such as a project left out of a Docker build context. It still fails if the project's directory exists without apackage.json#16453.pnpm install --frozen-lockfileno longer requires apnpm-lock.yamlin a project that has no dependencies. It also succeeds whenpnpm-lock.yamlrecords only the pinned pnpm version, as other commands write it when they run before the first install #16477.Fixed
pnpm install --frozen-lockfilerejecting a fresh lockfile when an injected workspace dependency has an optional peer supplied by another workspace project #16428.With
nodeLinker: hoisted, a filtered install now keeps the packages of the workspace projects an earlier install put innode_modules. This also covers the install thatpnpm --filter <selector> runandpnpm --filter <selector> execstart before the command. Before, these installs removed every package that only the unselected projects needed #16483.pnpm installwithnodeLinker: hoistednow refreshes directories supplied by custom fetchers when reinstalling. pnpm also keeps the symlinks inside those directories.With
enableGlobalVirtualStoreon, scripts can run entry points that a CommonJS require hook loads again, such asts-node index.ts. They failed withERR_UNKNOWN_FILE_EXTENSIONon Node.js versions without built-in TypeScript support #16436.pnpm now keeps each project's current lockfile and hidden hoisted dependencies in its own
node_modules/.pnpmwhenvirtualStoreDirpoints at a shared global virtual store.--virtual-store-dirnow sets the global virtual store's location too pnpm/tasks#47.pnpm cleanno longer deletes the project whenvirtualStoreDirorglobalVirtualStoreDiris set to the project directory. It also leaves a directory outside the project alone when the setting reaches it through a symlink. It now removes a global virtual store thatglobalVirtualStoreDirplaces inside the project, as it does forvirtualStoreDir.Optional dependencies
pnpm installno longer fails when a dependency of an optional dependency is missing from the registry. Like npm, pnpm now leaves out the nearest optional dependency above it, together with its subtree #16511.When an optional dependency fails to build, pnpm now removes its link from
node_modules. A repeatpnpm installthen reports "Already up to date" and no longer reruns the failing build #16468.pnpm installnow prints a warning with the error when an optional dependency cannot be fetched and is skipped. The skipped package is no longer counted in thePackages: +Nsummary. Thepnpm:skipped-optional-dependencylog reports the skip with thefetch_failurereason #16514.Resolving dependencies
Fixed
pnpm installchanging an unchanged project's direct dependency to a sibling workspace's pinned version when its dependency tree contains a cycle #16417.With
autoDedupeenabled, downgrading a dependency in one workspace project now moves the other projects to that version when it satisfies their ranges. This also applies to a filteredpnpm --filter <project> add#16432.pnpm installandpnpm dedupenow move an optional peer to the version already in the dependency graph when no other package provides its locked version anymore. After a bump such asvue3.5.40 to 3.5.43, the lockfile kept a second copy of@vue/server-rendererfor@vue/test-utils#16443.pnpm dedupe --checkno longer fails right afterpnpm installwhen a project's optional peer is satisfied by a package another workspace project installs.pnpm dedupenow picks the same versions for that package's dependencies aspnpm install#16447.pnpm installno longer re-resolves an up-to-date lockfile on every run when a patched package is a peer in a peer cycle #16418.With
autoDedupeenabled,pnpm install --lockfile-onlyno longer resolves the dependency graph again when nothing changed since an earlier--lockfile-onlyinstall deduplicated the lockfile. Such an install keeps the lockfile even if versions were published since it was written, or if only a setting such asresolutionModechanged. Runpnpm dedupeto apply such a change #16458.Speed and network
A repeat
pnpm installin a large workspace reports "Already up to date" faster #16487.Sped up dependency resolution of workspaces with many peer dependencies.
pnpm installsends fewer registry metadata requests when the lockfile already decides which version a range resolves to. This now also covers ranges that several locked versions satisfy when one of them outranks the others, and direct dependencies kept at their locked version. Packages thatminimumReleaseAgeExcludelists without a version now reuse cached registry metadata the same way they do whenminimumReleaseAgeis not set #16458.pnpm no longer downloads every packument again on each install from a registry whose metadata responses forbid caching, such as
Cache-Control: no-store. pnpm revalidates the cached metadata with a conditional request, so a registry that supports conditional requests answers with a 304 when the package has not changed #16528.Cached metadata for a package published within
minimumReleaseAgeis now revalidated with its ETag, so the npm registry can answer304 Not Modified. Before, the next install that checked the cache downloaded the whole document again #16506.A fetch timeout while other downloads from the same host are still running now lowers concurrency for that host to one connection. Retries of that request, and later downloads from that host, use the lower concurrency. Other hosts keep the configured concurrency #12791.
Sped up
pnpm install --offlinewhen the version a range picks is not in the store. While it looks for a version the store holds, pnpm now reads only the versions the range admits #16495.pnpm install --offlinenow reuses config dependency tarballs that are already present in the store pnpm/tasks#46.Running scripts
pnpm -s <script>runs the script again, with-smeaning--sequentialas it does forpnpm run -s <script>. pnpm rejected it with "unexpected argument '-s' found" #16446.pnpm runandpnpm execnow warn and run the command when the install thatverifyDepsBeforeRunstarts fails. This lets scripts run in sandboxes where pnpm cannot install, such as containers with a read-only store or no network #15173.A filtered
pnpm runorpnpm execnow finds dependencies out of date when a workspace dependency of a selected project has nonode_modulesdirectory, as after a filtered install. WithverifyDepsBeforeRun: install, pnpm installs that dependency before running the command pnpm/tasks#45.Scripts run without a terminal no longer start a second
sheach. One watchdog per pnpm command now ends every script's process group if pnpm is killed, sopnpm -r runacross many projects starts half as many processes #16489.Terminate batch job (Y/N)?no longer appears after pressing Ctrl+C in a script started withpnpmfrom PowerShell or cmd on Windows #16502.pnpm rebuildandpnpm approve-buildsrefresh command launchers when a build changes a command's interpreter or replaces it with a native executable. Dependent packages' build scripts use the refreshed launchers.When
pnpm run <script>orpnpm <script>finds nothing to run and--filterfollows the script name, the error now suggests putting the filter option before the script name #4655.Package-name filters now support
?to match one character #2817.The pinned pnpm and
pnpm self-updatepnpm no longer downloads the project's pinned pnpm version again on every command when
nodeVersioninpnpm-workspace.yamlnames a different Node.js major than thenodeonPATH. Before, each of those commands took about a second longer and failed without network access #16497.Several
pnpmcommands started at once in a project that pinspackageManagerno longer fail withThe process cannot access the file because it is being used by another processon Windows while the pinned pnpm is being installed.pnpm can now switch to a
packageManagerversion below 11 on x64 musl Linux, such as Alpine #16467.A
devEngines.packageManagerrange no longer makes pnpm replace the version recorded inpnpm-lock.yamlwith the running pnpm while the recorded version still satisfies the range. When pnpm does record a version, it records the running pnpm only if it meetsminimumReleaseAge. Otherwise it records the newest version in the range that meets it, or the running pnpm if none does #16431.On Windows,
pnpm self-updatenow replaces apnpm.exeleft inPNPM_HOMEor inPNPM_HOME\bin. Windows ran that executable in place of the updatedpnpm.cmdshim, sopnpm --versionkept printing the old version after a successful update. If the executable was inPNPM_HOME,self-updatenow asks you to runpnpm setup#9094.pnpm self-updatenow checks that a version installed as the JavaScriptpnpmcan start before making it the globalpnpm. If Node.js is missing, the update fails and the currentpnpmstays in place.Other commands
pnpm deploynow finds patches and local dependencies when the target directory sits under a symlink, such as/tmpon macOS. It failed withERR_PNPM_PATCH_NOT_FOUND#16470.pnpm deploy --legacynow resolves the deployed project's relativefile:,link:, and path dependencies from the project's own directory #16475.pnpm update --globalnow removes hard-linked executables fromPNPM_HOMEwhen migrating packages from the old global layout #16420.pnpm store pruneno longer fails on store index entries that pnpm 11 wrote for git-hosted packages without apackage.json. Entries that still cannot be read are kept and counted in the prune summary.pnpm store prunenow aborts when an error other than a missing directory occurs while scanning project directories in the mark phase.pnpm config getandpnpm config listnow report a setting given on the command line with--config.<name>=<value>. Before, a value such as--config.node-linker=hoistedreached the install but was absent from the reported configuration #16276.pnpm -r pkg getnow reports every selected project when several share a package name. Projects with the same name are keyed by their directory relative to the workspace root. Before, only one of them appeared in the output.The install summary shows a
link:dependency as+ name <- path, and the Node.js API'shideLinkedPkgsDiffreporter option leaves matching linked dependencies out of the summary.The
--forcehelp text ofpnpm installandpnpm addnow says that--forcekeeps skipping optional dependencies built for other platforms. It points toforceIgnoresPlatformand the--os,--cpu, and--libcoptions for installing them #16435.The
homepagefield of the publishedpnpmpackage points to https://pnpm.io again.Platinum Sponsors
Gold Sponsors
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.