chore(deps): update npm by renovate[bot] · Pull Request #205 · mathematic-inc/vscode-api-linter

renovate · 2026-08-04T19:13:14Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	`2.5.6` → `2.5.9`
@types/vscode (source)	`1.125.0` → `1.134.0`
oxfmt (source)	`^0.62.0` → `^0.64.0`
oxlint (source)	`1.77.0` → `1.79.0`
pnpm (source)	`11.20.0` → `11.22.0`
ultracite (source)	`7.10.0` → `7.10.6`

Release Notes

biomejs/biome (@biomejs/biome)

`v2.5.9`

Compare Source

Patch Changes

#11321 41386f3 Thanks @dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.
#11248 57b197e Thanks @yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.
#11377 a8798ea Thanks @Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.
```
@layer {
  a {
    color: red;
  }
}
```
#11327 6771cf5 Thanks @dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.
```
 <div>
   
+
   
 </div>
```
#10312 ba8aa18 Thanks @dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.
#11333 715e0cd Thanks @kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.
#11343 9b98211 Thanks @johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.
```
@variant @xl {
  div {
    background: red;
  }
}
```
#11220 3e8c488 Thanks @santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

For example, Biome no longer reports greet as undeclared in the following Svelte component:
```
<script module>
  export function greet() {
    console.log("Hello!");
  }
</script>

<script>
  greet();
</script>
```

#11300 36430eb Thanks @dyc3! - Fixed the HTML formatter's whitespace handling for marquee, noscript, video, audio, and object elements.

- <marquee behavior="alternate"> This text will bounce </marquee>
+ <marquee behavior="alternate">This text will bounce</marquee>

#11299 6559e6c Thanks @jp-knj! - Added the nursery rule useAstroClientOnlyDirectiveValue, which reports Astro client:only directives without an initializer.

For example, <Component client:only /> triggers the rule.
#11365 7529811 Thanks @MHJahanbakhsh! - Fixed #11229: The useGenericFontNames rule now treats math as a valid generic font family.

#11346 674f5f4 Thanks @Jayllyz! - Fixed #11335: noComponentHookFactories now reports a use-prefixed variable only when a function is assigned to it directly.

function factory() {
  const useColors = true; // no longer reported
  const useStore = createStore({ count: 0 }); // no longer reported
  const useData = () => useState(null); // still reported
  return useColors;
}

#11334 c87c46a Thanks @zkasuran! - Fixed #11317: noSvgWithoutTitle no longer reports an svg that uses the boolean shorthand aria-hidden (equivalent to aria-hidden={true} in React).
#11364 13853b1 Thanks @ematipico! - Fixed a bug where useJsxKeyInIterable incorrectly flagged Astro files.
#11321 41386f3 Thanks @dyc3! - Fixed #11315: Invalid CSS declarations in HTML style attributes now produce parser diagnostics instead of causing a panic.

#11325 67c3bf0 Thanks @dyc3! - Fixed HTML text wrapping to account for the width of an adjacent closing tag, avoiding lines that exceed the configured width when the final word and tag must move together.

 <a-long-long-long-element
-  >foo bar foo bar foo bar foo bar foo bar foo bar foo bar</a-long-long-long-element
+  >foo bar foo bar foo bar foo bar foo bar foo
+  bar</a-long-long-long-element
 >

#11367 fe5b5d4 Thanks @ematipico! - Fixed TypeScript compilerOptions.paths resolution when mapping targets omit ./. Biome now resolves these targets relative to their configured path base.
#11316 17e48d6 Thanks @wanxiankai! - Fixed #11289: the safe fix for noExtraBooleanCast now preserves parentheses around nested conditional expressions.
#11254 d25d113 Thanks @dyc3! - Fixed #11242: Biome no longer crashes with an access violation when analysing files on Windows ARM64.
#11221 85aac73 Thanks @freeatnet! - Added the nursery rule noUnsafeTypeAssertion, which disallows TypeScript type assertions while allowing const assertions.
```
const value = input as SomeType;
```
#11314 7ffb677 Thanks @ematipico! - Fixed #11310: Restored the performance of noMisusedPromises and noFloatingPromises when analyzed expressions share deep imported type paths.
#11356 6cd3263 Thanks @johncarmack1984! - The Tailwind parser now understands modifiers on bare utilities (@container/sidebar, shadow/50).
#11318 76059e9 Thanks @johncarmack1984! - The Tailwind parser now understands container-query variants (@sm:, @max-lg:, @min-[400px]:) and child and descendant variants (*:, **:).
#11357 faa2074 Thanks @johncarmack1984! - The Tailwind parser now accepts the legacy leading ! important marker (!flex, hover:!p-4).
#11344 f34e15c Thanks @johncarmack1984! - The Tailwind parser now understands combinator selectors in arbitrary variants (has-[>svg]:, has-[+p]:), modifiers on variants (group-hover/menu:, @sm/main:), and arbitrary container-query sizes (@[400px]:).
#11324 2f5d452 Thanks @dyc3! - Fixed HTML formatting that inserted rendered whitespace between an element and touching text when the line wrapped.
```
  <div>
-   before<meter value=".5"></meter>
-   after
+   before<meter value=".5"></meter
+   >after
  </div>
```
#11312 e65f07e Thanks @xosnos! - Added a new nursery rule useControlLabel for both HTML and JSX, which reports interactive control elements (button, menuitem) without an accessible label.
```
<button />
```
#11364 13853b1 Thanks @ematipico! - Fixed SVG parsing for files with an XML declaration followed by a PUBLIC doctype, such as <?xml version="1.0"?><!DOCTYPE svg PUBLIC "a" "b">.

#11301 610ee28 Thanks @dyc3! - Fixed parent tag wrapping when an HTML element starts or ends with a block-like or hidden child such as source, track, or param.

- <video src="brave.webm"><track kind="subtitles" src="brave.en.vtt"></video>
+ <video src="brave.webm">
+   <track kind="subtitles" src="brave.en.vtt">
+ </video>

`v2.5.8`

Compare Source

Patch Changes

#10710 0a0fbc1 Thanks @dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.
#11251 ea9dd8a Thanks @dyc3! - Improved performance of noImportCycles.

#11247 52b44d6 Thanks @dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

Invalid:

{#each boxes as box}
  {@const area = box.width * box.height}
  <p>{area}</p>
{/each}

Valid:

{#each boxes as box}
  {const area = $derived(box.width * box.height)}
  <p>{area}</p>
{/each}

#11252 d5f5704 Thanks @Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.
#11143 6be7be1 Thanks @vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.
#11234 caefe39 Thanks @subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.
```
 :root {
   --font-stack:
-/* comment */
+    /* comment */
     system-ui;
 }
```
#11285 bca1f73 Thanks @denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.
```
-:/* comment */ where(div) {}
+:where(/* comment */ div) {}
```
#11080 af16a0b Thanks @dyc3! - HTML style attribute values are now parsed as CSS. All Biome CSS lint rules are applied to the style attributes.
#11195 6a85588 Thanks @dyc3! - Fixed Svelte files failing to parse when an expression begins with an object literal.

Now the following snippet is correctly parsed:
```
<p>{{ a: true }}</p>
<div class={{ active: isActive }}></div>
```
#11173 481d008 Thanks @Austin1serb! - Fixed #10242: JavaScript GritQL patterns with multiple metavariables now match snippets consistently in WebAssembly.
#11187 23c0369 Thanks @ematipico! - Added the nursery rule noInvalidPropertyInitValue, which reports an @property whose initial-value does not match its syntax descriptor. For example, the following declaration triggers the rule because red is not a <length>:
```
@property --size {
  syntax: "<length>";
  inherits: false;
  initial-value: red;
}
```
#11272 73896e6 Thanks @ematipico! - Improved the diagnostic emitted by noRootType.
#11240 bd0b68d Thanks @ematipico! - Fixed #11223: Improved the
performance of noMisusedPromises
when analyzing async class methods that call other methods through this.
#11172 4a0bc5c Thanks @saberoueslati! - Fixed #10806: noUselessFragments no longer causes Biome to panic when its unsafe fix removes a fragment used as a JSX attribute value.
#11227 4d603b0 Thanks @saberoueslati! - Fixed #11178: noUndeclaredVariables no longer reports Vue's built-in instance properties, such as $slots and $attrs, in template expressions or $event in inline event-handler expressions. The instance properties are still reported inside <script setup>, where they are not defined.
#11187 23c0369 Thanks @ematipico! - Fixed CSS parsing of registered custom properties: Biome now correctly validates the syntax descriptor of @property rules.

`v2.5.7`

Compare Source

Patch Changes

#10822 c171b3b Thanks @pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.
#11136 e63354c Thanks @AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.
#10094 e007143 Thanks @THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.
#11184 135f476 Thanks @subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
#8239 a519f9d Thanks @cormacrelf! - Fixed #8233, where Biome CLI in
stdin mode didn't work correctly when handling files in projects with nested
configurations. For example, with the following structure,
--stdin-file-path=subdirectory/... would not use the nested configuration in
subdirectory/biome.json:
```
├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js
```
```
biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
```
Now, the nested configuration is correctly picked up and applied.

In addition, Biome now shows a warning if --stdin-file-path is provided but
that path is ignored and therefore not formatted or fixed.
#11138 8c2c6bd Thanks @ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
```
declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;

schedule(async () => {}) ?? "fallback";
```
The following code is also now invalid, because map(() => 42) returns 42:
```
type Mapper<T> = () => T;
declare function map<T>(mapper: Mapper<T>): T;

map(() => 42) || flag;
```
#11138 8c2c6bd Thanks @ematipico! - Fixed #11087: noUnnecessaryConditions no longer reports optional chains and nullish coalescing whose receiver can be nullish.

For example, the optional chain and fallback in the following code are no longer reported:
```
declare const usage: { range: { startDate: string } } | null;
const startDate = usage?.range.startDate ?? "N/A";
```
#11118 9c16840 Thanks @subotac! - Fixed #11098: The HTML formatter now preserves the configured trailing newline when a file ends with a comment.
```
-
\ No newline at end of file
+
```
#11201 0e80610 Thanks @Bishwas-py! - Fixed #11182: suppression comments for noPositiveTabindex now suppress the rule in HTML files when the attributes of the element span multiple lines.
#11079 607afd2 Thanks @dyc3! - The HTML formatter now lays out the srcset attribute of <img> and <source> as the list of candidates it is. Runs of whitespace between candidates collapse, and once the list no longer fits on one line each candidate goes on its own line with the descriptors aligned:
```
- <img srcset="/visual@0.5.png  400w, /visual.png 805w, /visual@2x.png 1610w, /visual@3x.png 2415w" />
+ <img
+   srcset="
+     /visual@0.5.png  400w,
+     /visual.png      805w,
+     /visual@2x.png  1610w,
+     /visual@3x.png  2415w
+   "
+ />
```
#11156 fed72c7 Thanks @saberoueslati! - Fixed #11129: noUnusedVariables no longer reports Vue bindings as unused when they are assigned through automatically unwrapped template refs.

#11124 d890b39 Thanks @denbezrukov! - Fixed CSS formatting of line comments between a declaration colon and value to preserve their source indentation.

 .test {
   background:
-  /////// foo
-  // bar
+        /////// foo
+        // bar
     radial-gradient(circle, #&#8203;000, transparent);
 }

#11113 3d8ab73 Thanks @denbezrukov! - Fixed CSS formatting of long block comments between comma-separated property values:

 .foo {
   box-shadow:
-    1000px /* long long long long long long long long long long long long comment */ 1000px /* long long long long long long long long long comment */ 2px color(srgb 0.555555555 0.555555555 0.555555555),
+    1000px
+      /* long long long long long long long long long long long long comment */
+      1000px /* long long long long long long long long long comment */ 2px
+      color(srgb 0.555555555 0.555555555 0.555555555),
     1px 1px black;
 }

#11127 da5c1a5 Thanks @dyc3! - The HTML formatter now picks the quote character for an attribute by counting the quotes in the value rather than looking only for a double quote. ' and " count as the characters they stand for, and only the character that ends up as the delimiter stays escaped:
```
- <div title='123 &apos;&quot; 456'></div>
+ <div title="123 '&quot; 456"></div>
```
Entities that are not quotes, such as & or &[#39](https://redirect.github.com/biomejs/biome/issues/39);, are left exactly as written.
#11193 77035bb Thanks @dyc3! - Fixed the HTML formatter collapsing the blank line between an element and the text that follows it. A blank line before text is now kept, the way one before another element already was:
```
  <div>foo</div>
-
  text
```
#11106 ad80f57 Thanks @dyc3! - The HTML formatter now writes the HTML5 doctype in lowercase, matching Prettier:
```
- <!DOCTYPE html>
+ <!doctype html>
```
This only applies to a plain .html file whose doctype stands alone. A doctype that names a DTD keeps the case it was written with, since the rest of the declaration is not lowercased either:
```
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
```
A .vue, .svelte, or .astro file keeps whatever the author wrote.
#11188 60679db Thanks @dyc3! - Fixed the HTML formatter printing a comment twice when it ended the line of the last element in a document:
```
- text
+ text
```
#11077 4dcd0d9 Thanks @dyc3! - Fixed a bug where the HTML formatter collapsed the whitespace inside <textarea>, <xmp> and <plaintext>, changing what the page renders.
```
- <textarea>
-  line one
- line two </textarea>
+ <textarea>line one line two</textarea>
```
Biome now prints the content of these elements exactly as it appears in the source, matching the existing behavior for <pre>.
#11194 abfbb11 Thanks @dyc3! - Fixed the HTML formatter refusing to format a Svelte file containing an array pattern that skips a position:
```
{#each animals as [, value]}
	<p>{value}</p>
{/each}
```
#10094 e007143 Thanks @THEjacob1000! - Fixed useSortedClasses to correctly detect unsorted classes in static member expression tagged templates (e.g. tw.div\...``). Previously, these were silently skipped due to surrounding whitespace trivia not being stripped from the tag name.
#11078 10da30e Thanks @dyc3! - Fixed Vue single-file components failing to parse when they contain a custom block such as <i18n> or <docs>, or a <template> written in another language. Their content is no longer read as HTML, so a block may hold whatever its own tooling expects:
```
<docs>
This block is prose, and it may mention a `<my-component>` without closing it.
</docs>

<template lang="pug">
  .test
    #foo
</template>
```
Previously both blocks produced a parse error and the whole file was left unformatted. Biome now prints their content unchanged while still formatting the opening tag.
#11231 4afd901 Thanks @ematipico! - Improved the performance of the following lint rules:
- noArguments.
- noGlobalAssign.
- noUndeclaredVariables.
- noRestrictedGlobals.
- noInvalidUseBeforeDeclaration.
- noShadow.
- noRedeclare.
#11134 2fa0a62 Thanks @yanthomasdev! - Clarified the warning emitted when using the experimental json and json-pretty reporters.
#11198 ed88b13 Thanks @saberoueslati! - Fixed #11171: variables referenced only inside a Svelte attachment ({@attach ...}) are no longer reported as unused by noUnusedVariables and noUnusedImports.
#11155 6ee17ea Thanks @dyc3! - Improved performance when printing diagnostics to the console.
#11160 217f8ad Thanks @dyc3! - Improved the performance of noFloatingPromises by skipping type inference for assignment statements, which are always considered handled.
#11159 26c23d9 Thanks @saberoueslati! - Fixed #11144: noFloatingPromises no longer reports already-awaited optional Promise values.
#11138 8c2c6bd Thanks @ematipico! - Fixed #11121: noUnnecessaryConditions no longer reports conditions based on an inapplicable function overload.

For example, the condition in the following code is no longer reported because query({}) selects the overload that returns boolean:
```
declare function query(options: { initial: string }): { isPending: false };
declare function query(options: { initial?: string }): { isPending: boolean };

const { isPending } = query({});
isPending || fallback;
```
#11152 c4fc6a9 Thanks @dyc3! - Improved the performance of collecting rule timings with --profile-rules in heavily multithreaded environments.
#11128 4d3ff76 Thanks @ematipico! - Fixed #7635: noDeprecatedImports now detects deprecated ambient declarations that are exported separately.
#11117 01f7ef5 Thanks @subotac! - Fixed #11014: noDelete no longer reports process.env["FOO"] style property deletions.
#11168 9847e68 Thanks @saberoueslati! - Added the nursery rule noNonScalableViewport, which reports viewport metadata that disables user scaling with user-scalable=no.

For example:
```
<meta name="viewport" content="width=device-width, user-scalable=no" />
```
#11154 a1d6b1f Thanks @dyc3! - Improved the performance of noImportCycles by skipping graph traversals for imports that cannot be part of a cycle.
#11175 d96d6dd Thanks @ematipico! - Fixed CSS parsing of registered custom properties: Biome now correctly validates the syntax descriptor of @property rules.

oxc-project/oxc (oxfmt)

`v0.64.0`

Compare Source

🚀 Features

c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

`v0.63.0`

Compare Source

oxc-project/oxc (oxlint)

`v1.79.0`

Compare Source

💥 BREAKING CHANGES

8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

`v1.78.0`

Compare Source

🚀 Features

ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

pnpm/pnpm (pnpm)

`v11.22.0`

Compare Source

`v11.21.0`: pnpm 11.21

Compare Source

Minor Changes

Added interactive group selection to pnpm update --global --interactive.
Running pnpm setup, pnpm self-update, or a command that modifies the global installation (such as pnpm add --global) through sudo now prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail with ERR_PNPM_SUDO_NOT_SUPPORTED in pnpm v12. Read-only global commands (such as pnpm bin --global) are unaffected.

Patch Changes

Fixed pnpm failing to start under asynchronous Node.js module loaders when no .pnpmfile.mjs exists pnpm/pnpm#11701.
Fixed minimumReleaseAge fallback for custom dist-tags so the selected version does not exceed the registry’s original tag target.
Removing a dependency from package.json and reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped from pnpm-lock.yaml, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune.
Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in pnpm-lock.yaml directly, reusing the same check the pnpm.overrides fast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions.
Fixed a CI regression where github:owner/repo dependencies (and other shorthand Git specifiers) would fail to install with Permission denied (publickey) on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. git+ssh:// or git@host:...):
- The repository visibility probe (an HTTP HEAD request) now retries transient failures such as 429 Too Many Requests, so host throttling of CI runners is no longer mistaken for a private repository.
- For non-SSH specifiers, anonymous HTTPS git ls-remote access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured.
- When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL.
- A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. codeload.github.com, which would fail to download for a private repository); it stays a regular git resolution so installs can use ambient Git credentials such as credential helpers and tokens.
Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL.

Fixes pnpm/pnpm#13276.
ng build and nuxt build now work under the global virtual store: pnpm's built-in compatibility extensions add the tslib dependency that @angular/build uses without declaring and the unplugin dependency that @nuxt/vite-builder v4 uses without declaring.
Fixed link: dependencies under enableGlobalVirtualStore so linked children are materialized and slots remain isolated by their resolved link targets.
An install that skips resolution because pnpm-lock.yaml is already up to date now reacts fully to packages the lockfile removed — for example after pulling a lockfile in which a dependency was deleted. The hoist layer is recomputed, so a package that became hoistable when a direct dependency was removed is hoisted, and pendingBuilds entries for removed packages are dropped instead of staying pending forever.
The held-back-update warning printed by pnpm update no longer fires when minimumReleaseAge is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See #13071.
Checking whether ignoredOptionalDependencies is up to date no longer reorders the configured patterns. The check sorted them in place, which could move an ! exclusion ahead of the pattern it excludes from and flip which optional dependencies were ignored.
Changing autoInstallPeers, dedupePeers, peersSuffixMaxLength, excludeLinksFromLockfile, or injectWorkspacePackages no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it: no package or project declares a peer dependency for the peer settings, and no project depends on a directory or on another workspace project for the link and injection settings. The new setting is recorded in pnpm-lock.yaml and the install proceeds from the existing resolution. Every other case still falls back to a full resolution.
Adding, editing, or removing an entry in patchedDependencies no longer re-resolves the dependency graph. Resolution never reads a patch — it only records the patch file's hash against the package it matches — so the install now rewrites the affected entries in pnpm-lock.yaml and materializes the patched package from the store instead. Installs still fall back to a full resolution when the patched package is reachable as a peer dependency, and when the new configuration would leave a patch unused while allowUnusedPatches is off, so ERR_PNPM_UNUSED_PATCH is still reported.
Resolving a private git repository no longer blocks on an interactive credential prompt: git ls-remote now fails fast with an authentication error when git has no credentials for the repository #13522.
Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same ERR_PNPM_NO_OFFLINE_META condition used by offline resolution.
POSIX shell shims now follow symbolic links before computing basedir, preventing execution failures when a shim is invoked via an external symlink on PATH #13405.
The automatic packageManager version switch works again on registries whose tarball URLs point at a different host than the registry itself (load-balanced feed proxies,

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot enabled auto-merge (squash) August 4, 2026 19:13

renovate Bot force-pushed the renovate/npm branch from 85602b1 to d5bd576 Compare August 5, 2026 09:37

renovate Bot changed the title ~~chore(deps): update dependency @biomejs/biome to v2.5.7~~ chore(deps): update npm Aug 5, 2026

renovate Bot force-pushed the renovate/npm branch 7 times, most recently from 00d2bd7 to efe6e43 Compare August 15, 2026 06:06

renovate Bot force-pushed the renovate/npm branch 4 times, most recently from bfe1a3b to 3e68864 Compare August 19, 2026 20:41

chore(deps): update npm

0352f46

renovate Bot force-pushed the renovate/npm branch from 3e68864 to 0352f46 Compare August 20, 2026 05:15

Navigation Menu

Uh oh!

chore(deps): update npm - #205

chore(deps): update npm#205
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm

renovate Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

Patch Changes

🚀 Features

📚 Documentation

💥 BREAKING CHANGES

🐛 Bug Fixes

🚀 Features

🐛 Bug Fixes

v11.21.0: pnpm 11.21

Minor Changes

Patch Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 4, 2026 •

edited

Loading

`v11.21.0`: pnpm 11.21