Skip to content

build(deps): bump pnpm from 8.9.2 to 10.32.1#956

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/pnpm-10.32.1
Open

build(deps): bump pnpm from 8.9.2 to 10.32.1#956
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/pnpm-10.32.1

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 11, 2026

Bumps pnpm from 8.9.2 to 10.32.1.

Release notes

Sourced from pnpm's releases.

pnpm 10.32.1

Patch Changes

  • Fix a regression where pnpm-workspace.yaml without a packages field caused all directories to be treated as workspace projects. This broke projects that use pnpm-workspace.yaml only for settings (e.g. minimumReleaseAge) without defining workspace packages #10909.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.32.1

Patch Changes

  • Fix a regression where pnpm-workspace.yaml without a packages field caused all directories to be treated as workspace projects. This broke projects that use pnpm-workspace.yaml only for settings (e.g. minimumReleaseAge) without defining workspace packages #10909.

10.32.0

Minor Changes

  • Added --all flag to pnpm approve-builds that approves all pending builds without interactive prompts #10136.

Patch Changes

  • Reverted change related to setting explicitly the npm config file path, which caused regressions.
  • Reverted fix related to lockfile-include-tarball-url. Fixes #10915.

10.31.0

Minor Changes

  • When pnpm updates the pnpm-workspace.yaml, comments, string formatting, and whitespace will be preserved.

Patch Changes

  • Added -F as a short alias for the --filter option in the help output.

  • Handle undefined pkgSnapshot in pnpm why -r #10700.

  • Fix headless install not being used when a project has an injected self-referencing file: dependency that resolves to link: in the lockfile.

  • Fixed a race condition when multiple worker threads import the same package to the global virtual store concurrently. The rename operation now tolerates ENOTEMPTY/EEXIST errors if another thread already completed the import.

  • When lockfile-include-tarball-url is set to false, tarball URLs are now always excluded from the lockfile. Previously, tarball URLs could still appear for packages hosted under non-standard URLs, making the behavior flaky and inconsistent #6667.

  • Fixed optimisticRepeatInstall skipping install when overrides, packageExtensions, ignoredOptionalDependencies, patchedDependencies, or peersSuffixMaxLength changed.

  • Fixed pnpm patch-commit failing with "unable to access '/.config/git/attributes': Permission denied" error in environments where HOME is unset or non-standard (Docker containers, CI systems).

    The issue occurred because pnpm was setting HOME and the Windows user profile env var to empty strings to suppress user git configuration when running git diff. This caused git to resolve the home directory (~) as root (/), leading to permission errors when attempting to access /.config/git/attributes.

    Now uses GIT_CONFIG_GLOBAL: os.devNull instead, which is git's proper mechanism for bypassing user-level configuration without corrupting the home directory path resolution.

    Fixes #6537

  • Fix pnpm why -r --parseable missing dependents when multiple workspace packages share the same dependency #8100.

  • Fix link-workspace-packages=true incorrectly linking workspace packages when the requested version doesn't match the workspace package's version. Previously, on fresh installs the version constraint is overridden to * in the fallback resolution paths, causing any workspace package with a matching name to be linked regardless of version #10173.

  • Fixed pnpm update --interactive table breaking with long version strings (e.g., prerelease versions like 7.0.0-dev.20251209.1) by dynamically calculating column widths instead of using hardcoded values #10316.

  • Explicitly tell npm the path to the global rc config file.

  • The parameter set by the --allow-build flag is written to allowBuilds.

  • Fix a bug in which specifying filter on pnpm-workspace.yaml would cause pnpm to not detect any projects.

  • Print help message on running pnpm dlx without arguments and exit.

10.30.3

Patch Changes

... (truncated)

Commits
  • eaae772 chore(release): 10.32.1
  • cda9b1d fix: update dependencies
  • 5163697 fix: restore default workspace package patterns when packages field is missin...
  • 49d249b chore(release): 10.32.0
  • f733456 revert: "fix: explicitly tell npm the config file path (#10154)"
  • 229c244 chore(release): 10.31.0
  • 80be7f5 chore: update sponsors list to match main branch
  • 733447a fix(test): use npm_config_ prefix for env var override test
  • 9c7b3ca fix(dlx): print help message when no arguments are provided (#10690)
  • 6899966 fix: allow env vars and updateConfig hook to override frozen-lockfile in CI (...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for pnpm since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) from 8.9.2 to 10.32.1.
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/v10.32.1/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v10.32.1/pnpm)

---
updated-dependencies:
- dependency-name: pnpm
  dependency-version: 10.32.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 11, 2026
@vercel
Copy link

vercel bot commented Mar 11, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
devs-in-tech Ready Ready Preview, Comment Mar 11, 2026 8:46pm

@netlify
Copy link

netlify bot commented Mar 11, 2026

Deploy Preview for devsintech failed. Why did it fail? →

Name Link
🔨 Latest commit db07e54
🔍 Latest deploy log https://app.netlify.com/projects/devsintech/deploys/69b1d42ae0d8970008d2b9b6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants