mirrors/authelia
0
0 Fork 0
mirror of https://github.com/authelia/authelia.git synced 2026-10-28 09:34:52 +08:00
Code Activity
10,879 Commits 80 Branches 236 Tags
master
Commit Graph
1694 Commits
Author SHA1 Message Date
renovate[bot] 07d97f74c3 build(deps): update dependency vite to v8.3.5 (#13566) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`8.3.4` →
`8.3.5`](https://renovatebot.com/diffs/npm/vite/8.3.4/8.3.5) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.3.5?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.3.4/8.3.5?slim=true)
|

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

###
[`v8.3.5`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-835-2026-10-21-small)

[Compare
Source](https://redirect.github.com/vitejs/vite/compare/v8.3.4...v8.3.5)

##### Bug Fixes

- **build:** handle missing chunk import maps
([#&#8203;23777](https://redirect.github.com/vitejs/vite/issues/23777))
([8d7623d](https://redirect.github.com/vitejs/vite/commit/8d7623d9b5647714a5b20cbd787a5401ca846229))
- **build:** include preload dependencies to chunk import map hashing
([#&#8203;23793](https://redirect.github.com/vitejs/vite/issues/23793))
([4d16e7c](https://redirect.github.com/vitejs/vite/commit/4d16e7c14d5e1c361f148238b1e81131238ab8e9))
- **bundled-dev:** apply `server.origin` to asset URLs
([#&#8203;23683](https://redirect.github.com/vitejs/vite/issues/23683))
([52ba877](https://redirect.github.com/vitejs/vite/commit/52ba877693c8633458d163117504a8259beb3cf5))
- **bundled-dev:** declare utf-8 charset in fallback page
([#&#8203;23846](https://redirect.github.com/vitejs/vite/issues/23846))
([197daf6](https://redirect.github.com/vitejs/vite/commit/197daf6c4c7bfdaa005bebcc41dd2ff22fa3a5b6))
- **bundled-dev:** ignore build.chunkImportMap
([#&#8203;23685](https://redirect.github.com/vitejs/vite/issues/23685))
([cfe917d](https://redirect.github.com/vitejs/vite/commit/cfe917d67d279a13f20ae9449e3befa736b64b07))
- **bundled-dev:** include user `import.meta.env.*` defines in the
`import.meta.env` object
([#&#8203;23713](https://redirect.github.com/vitejs/vite/issues/23713))
([6019aa7](https://redirect.github.com/vitejs/vite/commit/6019aa79975465516da7c6f532d568422b019a25))
- **bundled-dev:** map forwarded error stacks through the bundle source
maps
([#&#8203;23741](https://redirect.github.com/vitejs/vite/issues/23741))
([11fe1e4](https://redirect.github.com/vitejs/vite/commit/11fe1e46ff0c136cb90fbe263ba03993bc94df18))
- **bundled-dev:** normalize served output files
([#&#8203;23684](https://redirect.github.com/vitejs/vite/issues/23684))
([df4e02c](https://redirect.github.com/vitejs/vite/commit/df4e02cc8317a62f21edefc79a9690571ffed1f3))
- **bundled-dev:** stop hmr propagation at modules that are no longer
imported
([#&#8203;23839](https://redirect.github.com/vitejs/vite/issues/23839))
([7471e8c](https://redirect.github.com/vitejs/vite/commit/7471e8c3b32d3d55243590bb7713e602c9fb0212))
- **css:** don't fail on a literal `%` in `url()`
([#&#8203;23676](https://redirect.github.com/vitejs/vite/issues/23676))
([50b382d](https://redirect.github.com/vitejs/vite/commit/50b382d31835b8b4bc8b6964738ac03146e44261))
- **deps:** update all non-major dependencies
([#&#8203;23731](https://redirect.github.com/vitejs/vite/issues/23731))
([cf80aa5](https://redirect.github.com/vitejs/vite/commit/cf80aa552cac02eac0293330ccd5fde3c7ae8d29))
- **deps:** update all non-major dependencies
([#&#8203;23826](https://redirect.github.com/vitejs/vite/issues/23826))
([77d8373](https://redirect.github.com/vitejs/vite/commit/77d8373510da1b26ce057eb2248e570b7f63fde9))
- **deps:** update rolldown-related dependencies
([#&#8203;23733](https://redirect.github.com/vitejs/vite/issues/23733))
([43f0d05](https://redirect.github.com/vitejs/vite/commit/43f0d052e514c3ad2dea2f7dc44b0720e1f62f48))
- **deps:** update rolldown-related dependencies
([#&#8203;23827](https://redirect.github.com/vitejs/vite/issues/23827))
([c2e0418](https://redirect.github.com/vitejs/vite/commit/c2e04187e49aab7ab809989f0537b4906653acab))
- **optimizer:** fall back to yarn.lock for lockfile hash
([#&#8203;23667](https://redirect.github.com/vitejs/vite/issues/23667))
([f206096](https://redirect.github.com/vitejs/vite/commit/f20609630faa93026924275115d1426fdc08629e))
- **optimizer:** scan `oxc.jsxInject` imports
([#&#8203;23758](https://redirect.github.com/vitejs/vite/issues/23758))
([38f3cb4](https://redirect.github.com/vitejs/vite/commit/38f3cb45b1490ed24775547ceafa677b91a57714))
- **optimizer:** skip patches dir check for yarn.lock fallback
([#&#8203;23725](https://redirect.github.com/vitejs/vite/issues/23725))
([8e890e1](https://redirect.github.com/vitejs/vite/commit/8e890e1ce438bfbc07ea4931ce332e40589940fa))
- **optimizer:** skip patches dir hash for nub lockfile
([#&#8203;23761](https://redirect.github.com/vitejs/vite/issues/23761))
([a7d5696](https://redirect.github.com/vitejs/vite/commit/a7d56967ef0050a09c0507e63a18164bc7a0d486))
- **resolve:** support subpath imports with multiple `#`
([#&#8203;23631](https://redirect.github.com/vitejs/vite/issues/23631))
([0d86b34](https://redirect.github.com/vitejs/vite/commit/0d86b3485fbbd0fcb9a1f70a14adedfcb7a1fff1))
- **resolve:** update resolve.exports to 2.0.4
([#&#8203;23739](https://redirect.github.com/vitejs/vite/issues/23739))
([4ea708a](https://redirect.github.com/vitejs/vite/commit/4ea708a3ae9a324c6aabca59fade4082bf72f3e5))
- **server:** handle socket errors on upgrade requests not taken by the
HMR server
([#&#8203;23728](https://redirect.github.com/vitejs/vite/issues/23728))
([c2c9ef4](https://redirect.github.com/vitejs/vite/commit/c2c9ef4dcd05b3e4d88844ea3a13dc23819ca2a5))
- **server:** only strip base when path matches a full segment
([#&#8203;23641](https://redirect.github.com/vitejs/vite/issues/23641))
([3dfde87](https://redirect.github.com/vitejs/vite/commit/3dfde87b90a9f80b125d710e3e5d4fc795662db6))

##### Performance Improvements

- **ssr:** extract inline source maps without a regexp
([#&#8203;23775](https://redirect.github.com/vitejs/vite/issues/23775))
([6a02780](https://redirect.github.com/vitejs/vite/commit/6a0278055d8501bbaf65b8d34ec094722b4e877a))

##### Miscellaneous Chores

- migrate to Oxlint
([#&#8203;23746](https://redirect.github.com/vitejs/vite/issues/23746))
([5b73935](https://redirect.github.com/vitejs/vite/commit/5b73935881424ed5919571036dd89d3868590f92))

##### Code Refactoring

- **deps:** replace `@vercel/detect-agent` with `std-env`
([#&#8203;23744](https://redirect.github.com/vitejs/vite/issues/23744))
([ce4293f](https://redirect.github.com/vitejs/vite/commit/ce4293f15cc5cd221c5ed60f5cd64e82ca5cbaf5))
- **dev:** consolidate moduleURL to file path utilities
([#&#8203;23828](https://redirect.github.com/vitejs/vite/issues/23828))
([df7b40e](https://redirect.github.com/vitejs/vite/commit/df7b40ee9d691e9f4e2413244f6665ef5482dce3))
- **dev:** separate import resolution from URL conversion
([#&#8203;23791](https://redirect.github.com/vitejs/vite/issues/23791))
([6116689](https://redirect.github.com/vitejs/vite/commit/611668983d4b717f5e5e66cf9f7125bd94f92bf7))
- **dev:** share ModuleURL and BrowserURL conversions
([#&#8203;23790](https://redirect.github.com/vitejs/vite/issues/23790))
([446954c](https://redirect.github.com/vitejs/vite/commit/446954c69c806795c83fe2f97c28ae8f9ef83731))
- **dev:** use ModuleURLs throughout HTML transforms
([#&#8203;23815](https://redirect.github.com/vitejs/vite/issues/23815))
([a162990](https://redirect.github.com/vitejs/vite/commit/a16299092c0f0f3f90e05d4bb5f0168b293c2b52))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-24 10:01:56 +00:00
renovate[bot] bf68f72c5b build(deps): update dependency postcss to v8.5.31 (#13539) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [postcss](https://postcss.org/)
([source](https://redirect.github.com/postcss/postcss)) | [`8.5.30` →
`8.5.31`](https://renovatebot.com/diffs/npm/postcss/8.5.30/8.5.31) |
![age](https://developer.mend.io/api/mc/badges/age/npm/postcss/8.5.31?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/postcss/8.5.30/8.5.31?slim=true)
|

---

### Release Notes

<details>
<summary>postcss/postcss (postcss)</summary>

###
[`v8.5.31`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8531)

[Compare
Source](https://redirect.github.com/postcss/postcss/compare/8.5.30...8.5.31)

- Fix better source map on `</style>` escaping (by
[@&#8203;firefoxic](https://redirect.github.com/firefoxic)).

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-21 04:35:43 +00:00
James Elliott 00ca2852c5 feat(authorization): support iana registered request methods (#13168) 
Access control rules accept every method in the IANA HTTP Method
Registry, and the authz endpoints reject methods longer than 32
characters. The authentication logs request method column is widened to
match, and several usages have been deduplicated.
 2026-10-20 22:42:12 +00:00
James Elliott fff1b984f7 feat(handlers): use fetch metadata to detect authz navigations (#13527) 
The authz endpoints now use the Sec-Fetch-Mode and Sec-Fetch-Dest
headers to decide whether a request is a top-level navigation, falling
back to the X-Requested-With and Accept headers when they are absent.
Requests made with fetch, subresource requests, websockets, and iframe
navigations now receive a 401 with the Location header instead of a
redirect the web application silently follows. All authz responses also
include the Cache-Control no-store and Pragma no-cache headers, and the
Envoy, Istio, and Envoy Gateway integration docs forward the headers
required for detection.
 2026-10-20 21:55:13 +00:00
HobbabobbaJames ElliottAuthelia[bot]
 		85e9006a24 docs(oidc): add ztnet integration guide (#13357) 
Add integration guide.

---------

Signed-off-by: Hobbabobba <Hobbabobba@users.noreply.github.com>
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
Co-authored-by: Authelia[bot] <59121742+autheliabot@users.noreply.github.com>
 2026-10-20 21:24:44 +00:00
James Elliott edc3633f0e docs: update nginx examples and tests (#13528) 
This updates the nginx, swag, and nginx proxy manager examples and the
nginx suite to use $host$is_request_port$request_port in place of
$http_host which is empty with h3, and documents the nginx 1.29.8
requirement this introduces. It also fixes several long standing issues
with the examples including the https redirect, the session cookie name,
the deprecated http2 listen parameter, the basic auth detection snippet,
and broken links, and adds guidance on resolvers, upstream tls
termination, npm access lists, and auth request errors.

Closes #11823
 2026-10-20 08:55:38 +00:00
renovate[bot] cc847db0eb build(deps): update dependency eslint to v10.13.0 (#13516) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [eslint](https://eslint.org)
([source](https://redirect.github.com/eslint/eslint)) | [`10.12.0` →
`10.13.0`](https://renovatebot.com/diffs/npm/eslint/10.12.0/10.13.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/eslint/10.13.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint/10.12.0/10.13.0?slim=true)
|

---

### Release Notes

<details>
<summary>eslint/eslint (eslint)</summary>

###
[`v10.13.0`](https://redirect.github.com/eslint/eslint/releases/tag/v10.13.0)

[Compare
Source](https://redirect.github.com/eslint/eslint/compare/v10.12.0...v10.13.0)

#### Features

-
[`48d5cc4`](https://redirect.github.com/eslint/eslint/commit/48d5cc47e43478670ccf95a74f7a73e8408152b5)
feat: report references inside IIFEs in `no-use-before-define`
([#&#8203;21238](https://redirect.github.com/eslint/eslint/issues/21238))
(Irfan fandi)
-
[`a39d9fb`](https://redirect.github.com/eslint/eslint/commit/a39d9fb1fdb5db546f6407580cac531ba3370450)
feat: add `globalThis` to `no-obj-calls`
([#&#8203;21382](https://redirect.github.com/eslint/eslint/issues/21382))
(synthex-byte)
-
[`66ac583`](https://redirect.github.com/eslint/eslint/commit/66ac58383e076940c11a5d7213ad079028d1140e)
feat: check `yield*` expressions in `no-unsafe-optional-chaining`
([#&#8203;21399](https://redirect.github.com/eslint/eslint/issues/21399))
(xbinaryx)

#### Bug Fixes

-
[`87bd2ce`](https://redirect.github.com/eslint/eslint/commit/87bd2cef7b2309739c29598fb2be335f4bed71a3)
fix: avoid redeclared `let` when `no-var` and `one-var` fix together
([#&#8203;21389](https://redirect.github.com/eslint/eslint/issues/21389))
(Daniel Pinto)

#### Documentation

-
[`4783a68`](https://redirect.github.com/eslint/eslint/commit/4783a6806fb73ea4843ac46c6ae3d8285f56c288)
docs: Update README (GitHub Actions Bot)
-
[`43f0ac9`](https://redirect.github.com/eslint/eslint/commit/43f0ac90e7858a834a0e68309e6397fb4cfa72dd)
docs: clarify parameter description in `getText`
([#&#8203;21287](https://redirect.github.com/eslint/eslint/issues/21287))
(lumir)

#### Chores

-
[`b59d889`](https://redirect.github.com/eslint/eslint/commit/b59d889c7c18d8c73144e6ba46e9e7f3e7da0196)
chore: update github/codeql-action action to v4.38.3
([#&#8203;21412](https://redirect.github.com/eslint/eslint/issues/21412))
(renovate\[bot])
-
[`95e51a0`](https://redirect.github.com/eslint/eslint/commit/95e51a0518b15015304eca9844b3f64c1fc167ca)
ci: re-enable `@typescript-eslint/typescript-eslint` in ecosystem tests
([#&#8203;21410](https://redirect.github.com/eslint/eslint/issues/21410))
(Francesco Trotta)
-
[`317fcb3`](https://redirect.github.com/eslint/eslint/commit/317fcb365f19e912a60d171a9d5a8d1f16fe4660)
chore: update ecosystem plugins
([#&#8203;21409](https://redirect.github.com/eslint/eslint/issues/21409))
(ESLint Bot)
-
[`b92decf`](https://redirect.github.com/eslint/eslint/commit/b92decf8ead7cc4082a18a4a0ab28f3c7c589887)
perf: skip no-redeclare scan for single-declaration variables
([#&#8203;21365](https://redirect.github.com/eslint/eslint/issues/21365))
(James Ross)
-
[`47b7063`](https://redirect.github.com/eslint/eslint/commit/47b7063b3f3f7bc7a5bcb87c082577e4e8b96e24)
chore: update dependency
[@&#8203;eslint/json](https://redirect.github.com/eslint/json) to ^2.1.1
([#&#8203;21398](https://redirect.github.com/eslint/eslint/issues/21398))
(renovate\[bot])
-
[`e5aea41`](https://redirect.github.com/eslint/eslint/commit/e5aea414cc00555ecd43f6e608bf80e0f9a6d4d6)
chore: update ecosystem plugins
([#&#8203;21390](https://redirect.github.com/eslint/eslint/issues/21390))
(ESLint Bot)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-18 00:30:30 +00:00
renovate[bot] 9d56c0749c build(deps): update dependency hugo-extended to v0.168.0 (#13497) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [hugo-extended](https://redirect.github.com/jakejarvis/hugo-extended)
| `0.167.0` → `0.168.0` |
![age](https://developer.mend.io/api/mc/badges/age/npm/hugo-extended/0.168.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/hugo-extended/0.167.0/0.168.0?slim=true)
|
| [hugo-extended](https://redirect.github.com/jakejarvis/hugo-extended)
| [`0.167.0` →
`0.168.0`](https://renovatebot.com/diffs/npm/hugo-extended/0.167.0/0.168.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/hugo-extended/0.168.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/hugo-extended/0.167.0/0.168.0?slim=true)
|

---

### Release Notes

<details>
<summary>jakejarvis/hugo-extended (hugo-extended)</summary>

###
[`v0.168.0`](https://redirect.github.com/jakejarvis/hugo-extended/compare/v0.167.0...v0.168.0)

[Compare
Source](https://redirect.github.com/jakejarvis/hugo-extended/compare/v0.167.0...v0.168.0)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-17 05:35:32 +00:00
renovate[bot] 38e3b7f353 build(deps): update dependency sass-embedded to v1.105.2 (#13496) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [sass-embedded](https://redirect.github.com/sass/embedded-host-node) |
`1.105.1` → `1.105.2` |
![age](https://developer.mend.io/api/mc/badges/age/npm/sass-embedded/1.105.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/sass-embedded/1.105.1/1.105.2?slim=true)
|
| [sass-embedded](https://redirect.github.com/sass/embedded-host-node) |
[`1.105.1` →
`1.105.2`](https://renovatebot.com/diffs/npm/sass-embedded/1.105.1/1.105.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/sass-embedded/1.105.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/sass-embedded/1.105.1/1.105.2?slim=true)
|

---

### Release Notes

<details>
<summary>sass/embedded-host-node (sass-embedded)</summary>

###
[`v1.105.2`](https://redirect.github.com/sass/embedded-host-node/blob/HEAD/CHANGELOG.md#11052)

[Compare
Source](https://redirect.github.com/sass/embedded-host-node/compare/1.105.1...1.105.2)

##### Node.js Embedded Host

- Fix a deadlock when the async compiler fails to start.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-17 05:22:31 +00:00
renovate[bot] c9da21a16b build(deps): update dependency @eslint/css to v2.0.1 (#13492) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@eslint/css](https://redirect.github.com/eslint/css) | [`2.0.0` →
`2.0.1`](https://renovatebot.com/diffs/npm/@eslint%2fcss/2.0.0/2.0.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/@eslint%2fcss/2.0.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@eslint%2fcss/2.0.0/2.0.1?slim=true)
|

---

### Release Notes

<details>
<summary>eslint/css (@&#8203;eslint/css)</summary>

###
[`v2.0.1`](https://redirect.github.com/eslint/css/blob/HEAD/CHANGELOG.md#201-2026-10-11)

[Compare
Source](https://redirect.github.com/eslint/css/compare/cb523536527359e5eb0a7aeaf2d3abc5d44032c2...c29255e6f9551360319c09470b406b03d2da31ca)

##### Bug Fixes

- allow additional properties in `CSSLanguageOptions`
([#&#8203;538](https://redirect.github.com/eslint/css/issues/538))
([471e568](https://redirect.github.com/eslint/css/commit/471e56813150cbfb5a1f27aa7602f0131dc56578))
- crash in `no-important` on non-standard important values
([#&#8203;541](https://redirect.github.com/eslint/css/issues/541))
([2985ad5](https://redirect.github.com/eslint/css/commit/2985ad5a79b33d355bafd8156e81bbe16921d7dd))
- handle `var()` and `env()` in `no-invalid-at-rules`
([#&#8203;570](https://redirect.github.com/eslint/css/issues/570))
([75050c3](https://redirect.github.com/eslint/css/commit/75050c315c3f3bed6bd399f7508d262cf2f59f43))
- preserve keyframe selector casing in error messages
([#&#8203;571](https://redirect.github.com/eslint/css/issues/571))
([6589273](https://redirect.github.com/eslint/css/commit/6589273acf49edd67f46bbb28e2c9d63da3a1395))
- preserve property casing in `use-baseline` messages
([#&#8203;573](https://redirect.github.com/eslint/css/issues/573))
([0f65765](https://redirect.github.com/eslint/css/commit/0f65765423b927fdce89d4499730c6d6fa9e20f4))
- prevent crashes on `[@supports](https://redirect.github.com/supports)`
queries in `use-baseline`
([#&#8203;576](https://redirect.github.com/eslint/css/issues/576))
([6ecf264](https://redirect.github.com/eslint/css/commit/6ecf264a402d47d17ff33cf1e5676729ab04f513))
- recognize `at-rule()` feature queries in `use-baseline`
([#&#8203;533](https://redirect.github.com/eslint/css/issues/533))
([ba65596](https://redirect.github.com/eslint/css/commit/ba655964e8d4bb424638ab1c56dcf50a24231130))
- recognize CSS whitespace in named grid areas
([#&#8203;556](https://redirect.github.com/eslint/css/issues/556))
([ea5407d](https://redirect.github.com/eslint/css/commit/ea5407ddd542955b820271db75b4fef73b9bf79e))
- report each disallowed attribute location in `selector-complexity`
([#&#8203;580](https://redirect.github.com/eslint/css/issues/580))
([2bf2350](https://redirect.github.com/eslint/css/commit/2bf2350be041912803ad4680f03f582bb6fb6587))
- support at-rules nested in `[@page](https://redirect.github.com/page)`
and
`[@font-feature-values](https://redirect.github.com/font-feature-values)`
([#&#8203;543](https://redirect.github.com/eslint/css/issues/543))
([12ec029](https://redirect.github.com/eslint/css/commit/12ec029258de03056d8533a6960de154d8fb7e76))
- update baseline data
([bcd705e](https://redirect.github.com/eslint/css/commit/bcd705e7536d47dd8aff8fb0b5dc9d6f3d72e276))
- update baseline data
([#&#8203;561](https://redirect.github.com/eslint/css/issues/561))
([94d79a4](https://redirect.github.com/eslint/css/commit/94d79a46c8249fc6d12e6c02132952e106a53b68))
- update baseline data
([#&#8203;566](https://redirect.github.com/eslint/css/issues/566))
([9856c3b](https://redirect.github.com/eslint/css/commit/9856c3b6f25f4ebaf2930b130159264b9d381628))
- update baseline data
([#&#8203;579](https://redirect.github.com/eslint/css/issues/579))
([c60193b](https://redirect.github.com/eslint/css/commit/c60193bbc365efe94fa4c908f73f630bb3ce90c4))
- update baseline data
([#&#8203;585](https://redirect.github.com/eslint/css/issues/585))
([7a2dc06](https://redirect.github.com/eslint/css/commit/7a2dc06e0b08b89af01767efd8ae3290c4060f94))
- update baseline data
([#&#8203;589](https://redirect.github.com/eslint/css/issues/589))
([38ac3ad](https://redirect.github.com/eslint/css/commit/38ac3ade993e0bd168a230c0ac8c583fc6978e0f))
- update dependency
[@&#8203;eslint/css-tree](https://redirect.github.com/eslint/css-tree)
to ^4.1.1
([#&#8203;568](https://redirect.github.com/eslint/css/issues/568))
([ae69b1a](https://redirect.github.com/eslint/css/commit/ae69b1ad922f0c96e11bd4421033a92209e6afed))
- update eslint
([#&#8203;554](https://redirect.github.com/eslint/css/issues/554))
([33e7314](https://redirect.github.com/eslint/css/commit/33e7314cf4127543f1863ebeab13a8b7ecc8f161))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-17 00:34:44 +00:00
renovate[bot] 7f3aad82ca build(deps): update pnpm to v12.14.0 (#13487) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`12.11.2` →
`12.14.0`](https://renovatebot.com/diffs/npm/pnpm/12.11.2/12.14.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/12.14.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/12.11.2/12.14.0?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v12.14.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.14.0):
pnpm 12.14.0

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.13.0...v12.14.0)

This release adds the `sideEffectsCache.exclude` setting, stops `pnpm
install` from waiting on the daily update check, and keeps pnpm from
aborting with a core dump when the reader of its output exits.

##### Minor Changes

- Added the `sideEffectsCache.exclude` setting for packages whose build
depends on something pnpm cannot include in the cache key, such as the
system libraries a native addon links against. pnpm builds the listed
packages in every project and never restores or saves their builds
through the side-effects cache, locally or on a `remoteCache` server.
Under the global virtual store, each project gets its own copy of these
packages and of the packages that depend on them. Entries use the same
`name`, `@scope/*`, and `name@version` patterns as
`minimumReleaseAgeExclude`
[#&#8203;5271](https://redirect.github.com/pnpm/pnpm/issues/5271).

- `pnpm login` now prints the `npm-notice` response header during
web-based login. Registries use it to show the verification code that
completes the sign-in in the browser.

##### Patch Changes

##### Installing packages

- `pnpm install` and `pnpm add` no longer wait for the daily update
check. If the command finishes first, pnpm skips the update notice and
checks again next time. On a registry that accepted the connection but
never answered, an install that had nothing to do used to take minutes
[#&#8203;16839](https://redirect.github.com/pnpm/pnpm/issues/16839).

- `pnpm install`, `pnpm add` and `pnpm update` now reuse
`pnpm-lock.yaml` when the workspace configures a catalog entry that no
dependency references, such as an unused entry or one whose package an
`overrides` entry replaces. Before, every resolution in such a workspace
resolved all dependencies again from the registry
[#&#8203;16923](https://redirect.github.com/pnpm/pnpm/issues/16923).

- `pnpm install` now looks up a git dependency's branch or tag once per
install, even when many workspace projects depend on it. With
`linkWorkspacePackages` enabled, it used to run `git ls-remote` once per
project
[#&#8203;16899](https://redirect.github.com/pnpm/pnpm/issues/16899).

- A filtered install, such as `pnpm install --filter <pkg>`, now keeps
the `pnpm-lock.yaml` entries of workspace projects that are missing from
disk, as in a sparse checkout. Their importers, packages, and catalog
entries stay even when the filter matches every project on disk
[#&#8203;16931](https://redirect.github.com/pnpm/pnpm/issues/16931).

- pnpm now decides whether a dependency that a package also declares as
an optional peer is linked as a dependency or as a peer from the
shallowest path that reaches the package. When an existing lockfile
records such a dependency as a regular dependency and a newly added
dependency now provides the peer, pnpm records it as a peer, as a fresh
install does. The lockfile entry of such a package can change on the
next install
[#&#8203;16901](https://redirect.github.com/pnpm/pnpm/issues/16901).

- An install that adds nothing to the store no longer changes the
modification time of the store directory. CI caches that check
modification times, such as GitLab's, no longer re-upload an unchanged
store
[#&#8203;16929](https://redirect.github.com/pnpm/pnpm/issues/16929).

##### Running commands and scripts

- pnpm no longer aborts with a core dump when the reader of its output
has exited, as in `pnpm list | head -1` or `pnpm start 2>&1 | head -1`.
The command finishes with its usual exit code, and a failing script's
exit code is kept. A write to stdout that fails for another reason, such
as a full disk, ends the command with exit code 1
[#&#8203;16904](https://redirect.github.com/pnpm/pnpm/issues/16904)
[pnpm/tasks#132](https://redirect.github.com/pnpm/tasks/issues/132).

- On Windows, `pnpm exec`, `pnpm run`, and commands such as `pnpm nx`
now return when the command they run exits, even if it left a detached
process running and pnpm's output is redirected or piped. Previously a
shell reading that output waited until the detached process, such as the
Nx daemon, exited
[#&#8203;16930](https://redirect.github.com/pnpm/pnpm/issues/16930).

- Commands that do not write the project manifest now leave a missing
`package.json` absent. This covers queries such as `pnpm why` and `pnpm
outdated`, `pnpm fetch`, `pnpm dedupe --check`, and commands that exit
with an error, such as `pnpm rt ls`. These commands used to create one
from the initialization template. `pnpm sbom` run from a lockfile alone
now reports the root component as `unknown` with version `0.0.0`
[#&#8203;16907](https://redirect.github.com/pnpm/pnpm/issues/16907).

- `pnpm run` now reports a failed script as a JSON record under
`--reporter=ndjson`. It printed a plain `[ELIFECYCLE]` line to stderr.

- `pnpm run` no longer prints `[ELIFECYCLE] Command failed with exit
code N.` to stderr when a script fails under `--reporter=silent`,
`--silent`, or `--loglevel=silent`.

- `pnpm pipeline --dry-run` no longer writes a run report when no
projects are selected. With `--json` it prints `{"tasks": []}`
[pnpm/tasks#126](https://redirect.github.com/pnpm/tasks/issues/126).

##### Packing and publishing

- `pnpm pack` and `pnpm publish` now ship the whole gitignored directory
that `main`, `browser`, or `bin` points into, as npm does. Previously
only the `main` and `bin` files themselves were packed, and a gitignored
`browser` file was left out
[#&#8203;16908](https://redirect.github.com/pnpm/pnpm/issues/16908).

- `pnpm pack` and `pnpm publish` now honor a `.npmignore` or
`.gitignore` inside a subdirectory when `package.json` has a `files`
field. The package root's ignore files and those inherited from the
workspace are still skipped
[#&#8203;16909](https://redirect.github.com/pnpm/pnpm/issues/16909).

##### Setting up pnpm and toolchains

- `--registry`, `--https-proxy`, `--http-proxy`, and `--no-proxy` now
apply when pnpm resolves and downloads the pnpm version a project pins
in `packageManager`. Before, these lookups went to
`https://registry.npmjs.org/`, which a firewall that only allows a
private registry blocks
[#&#8203;16911](https://redirect.github.com/pnpm/pnpm/discussions/16911).

- On Windows, `pnpm install` now installs the Rust toolchain for
rustup's default host, so a machine set up with `rustup set default-host
x86_64-pc-windows-gnu` gets the MinGW toolchain. Without a default host,
pnpm installs the MSVC toolchain for the machine's architecture, as
rustup does. This includes a pnpm built for MinGW, such as the MSYS2
package, which has installed the MinGW toolchain since 12.13.0. An x64
pnpm on ARM64 Windows now installs the ARM64 toolchain
[#&#8203;16854](https://redirect.github.com/pnpm/pnpm/issues/16854).

<!-- sponsors -->

##### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

##### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.13.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.13.0):
pnpm 12.13.0

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.12.1...v12.13.0)

This release adds the `pnpm profile` and `pnpm token` commands, the
`storeIndexFormat: files` setting for stores shared over a network
filesystem, and faster Python dependency resolution.

##### Minor Changes

- Added the `pnpm profile` command to view and update registry user
profile settings.

- Added `pnpm token` to list, create, and revoke authentication tokens
on the registry.

- Added the `storeIndexFormat` setting. Set it to `files` to keep a
store's package index as one file per package instead of the SQLite
`index.db`, for a store on a network filesystem that several machines
use at once. SQLite's locking does not work across machines, so
concurrent installs on such a store could corrupt `index.db`.

- Added the `nodePackageMap` setting, which groups the package-map
settings. `nodePackageMap.mode: write-only` writes
`node_modules/.package-map.json` for other tools without making Node.js
load it. `mode: load` also makes Node.js load the map, like
`nodeExperimentalPackageMap: true`. `nodePackageMap.type` replaces
`nodePackageMapType`. The old settings still work
[#&#8203;14937](https://redirect.github.com/pnpm/pnpm/issues/14937).

  ```yaml
  nodePackageMap:
    mode: write-only
    type: loose
  ```

##### Patch Changes

##### Setting up pnpm

- `pnpm setup` now works when pnpm was installed with npm on macOS. It
installed pnpm from npm's `bin` directory and left a
`$PNPM_HOME/bin/pnpm` that could not run
[#&#8203;16855](https://redirect.github.com/pnpm/pnpm/issues/16855).

- pnpm runs again after `pnpm setup` when `globalShims` enables pnpm.
Every command failed with "the global target of the pnpm shim points
back at the shim"
[#&#8203;16874](https://redirect.github.com/pnpm/pnpm/issues/16874).

- A pnpm built for the MinGW target on Windows, such as the MSYS2
package, now installs the MinGW Rust toolchain that
`rust-toolchain.toml` names. It used to install the MSVC toolchain.

##### Installing packages

- On macOS, `pnpm install` no longer fails with
`ERR_PNPM_LOCKFILE_WRITE_FILE` when the project is on a virtiofs or SMB
share. pnpm now falls back to a regular `fsync` when the file system
rejects a full sync
[#&#8203;16846](https://redirect.github.com/pnpm/pnpm/issues/16846).

- On macOS, `pnpm install`, `pnpm patch-commit`, and other commands that
load a pnpmfile no longer hang at random.

- `pnpm install` now puts the executables of a Python build backend's
requirements on the `PATH` while the backend runs. Projects built with
`uv_build` now install. Before, they failed with "uv-build was not
properly installed".

- Removing a `link:` dependency now also removes its symlink from
`node_modules` when `nodeLinker` is `hoisted`
[#&#8203;16884](https://redirect.github.com/pnpm/pnpm/issues/16884).

- `pnpm-lock.yaml` no longer records the tarball URL of a package
installed from a scoped registry, such as one set by `@types:registry=`,
when pnpm can rebuild the URL from that registry
[#&#8203;16866](https://redirect.github.com/pnpm/pnpm/issues/16866).

##### Packing, auditing, and pipelines

- `pnpm pack` and `pnpm publish` now pack only `package.json`, the
README, the license, and the files named in `main` and `bin` when
`files` is an empty array. They used to pack every file in the package
[#&#8203;16889](https://redirect.github.com/pnpm/pnpm/issues/16889).

- `pnpm audit` and `pnpm audit signatures` no longer check runtimes
installed through `devEngines.runtime`, such as `node@runtime:24.21.0`,
against the npm package of the same name. `pnpm audit signatures`
reported these runtimes as having an invalid registry signature
[#&#8203;16869](https://redirect.github.com/pnpm/pnpm/issues/16869).

- `pnpm pipeline` now runs the root's tasks when `pnpm-workspace.yaml`
lists only the root in `packages` or omits `packages`, as `pnpm -r run`
does. A change to a root file in such a workspace no longer triggers a
full-run warning. When a full run has no projects to run, `pnpm
pipeline` now reports that no projects are selected
[#&#8203;16849](https://redirect.github.com/pnpm/pnpm/issues/16849).

##### Performance

- `pnpm install` resolves Python dependencies faster. With
`--lockfile-only`, a project with 10 dependencies now resolves in about
4 seconds, down from about 40. When the index publishes a metadata file
beside each wheel (PEP 658), as PyPI does, pnpm downloads only the
wheels of the releases it selects.

- A repeat install against an existing lockfile no longer reads registry
metadata for the dependencies it takes from that lockfile. On a warm
store this removes thousands of metadata lookups from a repeat install
of a large workspace.

- `pnpm install` with `enableModulesDir: false` now verifies the
packages already in the store while the dependencies resolve, and checks
a package's files in parallel. On a 5,100-package install with the store
on a network filesystem, this removed a 19-second pause between
resolution and fetching.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.12.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.12.1):
pnpm 12.12.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.12.0...v12.12.1)

This release adds OIDC authentication to `pnpm dist-tag` and the `tool:`
protocol. `pnpm publish` now checks which registry an `NPM_ID_TOKEN` was
issued for before using it.

##### Patch Changes

- `pnpm publish` now uses an `NPM_ID_TOKEN` only if its `aud` claim
matches the selected registry, such as `npm:registry.npmjs.org`. A token
for another registry is skipped with a warning, and pnpm falls back to
the configured credentials.

- `pnpm dist-tag add`, `rm`, and `ls` now support OIDC authentication in
CI. Enable "Allow npm dist-tag" in the package's trusted publishing
settings to manage tags without a stored npm token.

- Added the `tool:` protocol for the tools pnpm downloads itself:
Node.js, Bun, Deno, and Yarn. `pnpm add bun@tool:1.3.0`, `pnx
node@tool:22`, and `pnx yarn@tool:4` work like the `runtime:` spelling,
which stays supported as an alias. A lockfile written for `runtime:`
stays up to date when `package.json` switches to `tool:`, and the other
way around.

  A named registry can no longer be called `tool`.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.12.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.12.0):
pnpm 12.12.0

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.11.2...v12.12.0)

This release shares task results and dependency builds through a remote
cache, adds the `addMissingPeerTypes` setting, and lets `pnpm add
--config` and `pnpm update` manage configuration dependencies. It also
fixes `dangerouslyAllowAllBuilds` running the build scripts of packages
that `allowBuilds` denies.

##### Minor Changes

- `pnpm pipeline` can share task results between machines. A result is a
signed artifact stored on a pnpr server or on a server that speaks the
Turborepo Remote Cache API, such as Vercel Remote Cache.

The remote side-effects cache can also store dependency builds on a
Turborepo Remote Cache server. Both caches read the new `remoteCache`
setting, which names the server and holds the signing keys. `pnpm
pipeline --report` records the run under the organization
`remoteCache.org` names.

- Added the `addMissingPeerTypes` setting, which links the `@types`
package of a peer dependency next to every package that peer-depends on
it. For example, a package that peer-depends on `react` gets the
project's `@types/react` linked next to it. This lets TypeScript find
the types of a peer dependency when the global virtual store is on
[#&#8203;15689](https://redirect.github.com/pnpm/pnpm/discussions/15689).

- `pnpm add --config` and `pnpm update` now handle configuration
dependencies the way they handle other dependencies
[#&#8203;16814](https://redirect.github.com/pnpm/pnpm/issues/16814).

`pnpm add --config` saves a version range in `pnpm-workspace.yaml` by
the same rules as `pnpm add`, so `pnpm add --config my-config@latest`
saves a range such as `^1.2.0`. It also resolves the package again when
`pnpm-lock.yaml` already locks an older version.

`pnpm update` updates configuration dependencies within their ranges,
and `pnpm update --latest` moves them to their latest version. A
selector such as `pnpm update my-config` updates only the configuration
dependencies it names.

##### Patch Changes

- A package set to `false` in `allowBuilds` no longer runs its build
scripts when `dangerouslyAllowAllBuilds` is `true`. The two settings
together now allow every build except the denied ones. Previously,
`dangerouslyAllowAllBuilds` ignored the denials.

- pnpm now switches to the pnpm version a project pins even when it
cannot read its configuration. Previously, a setting it rejected in the
global config file, an `.npmrc` file, or `_auth`, or a
`pnpm-workspace.yaml` it could not parse, stopped every command, `pnpm
--version` included.

- `pnpm update` and `pnpm why` accept `--depth Infinity` again. They
failed with `invalid value 'Infinity' for '--depth <DEPTH>'`
[#&#8203;16817](https://redirect.github.com/pnpm/pnpm/issues/16817).

- `pnpm deploy` without `injectWorkspacePackages` now binds a peer
dependency of a linked workspace package to the version its parent
provides, as an injected install does. Previously the deploy failed with
`ERR_PNPM_DEPLOY_AMBIGUOUS_PEER` whenever other packages in the deployed
graph depended on different versions of that peer
[#&#8203;16807](https://redirect.github.com/pnpm/pnpm/issues/16807).

- `pnpm deploy --legacy` no longer fails with
`ERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER` when a workspace
dependency of the deployed project declares a `workspace:` peer
dependency that the project does not depend on itself. pnpm now copies
that peer from the workspace into the deploy directory.

An auto-installed peer declared with `workspace:` now always resolves to
the workspace project. Previously, `workspace:*` and `workspace:^1.0.0`
peers could be installed from the registry
[#&#8203;16806](https://redirect.github.com/pnpm/pnpm/issues/16806).

- Repeat installs no longer resolve again when an injected workspace
package lists a dependency also as a peer dependency.

- Sped up frozen installs of unchanged injected workspace packages that
use hardlinks.

- Sped up workspace discovery with subtree exclusions such as
`!generated/**`.

- A key under a registry URL in the `_auth` setting that does not start
with `@` is now skipped with a warning, so a field a later pnpm version
adds there no longer breaks this one. A key that holds an `authToken`
object but lacks its `@`, such as `org` for `@org`, is still an error.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-16 20:20:51 +00:00
renovate[bot] 4c10b7a54e build(deps): update pnpm to v12.11.2 (#13483) 
> [!NOTE]
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`12.9.1` →
`12.11.2`](https://renovatebot.com/diffs/npm/pnpm/12.9.1/12.11.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/12.11.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/12.9.1/12.11.2?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v12.11.2`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.2):
pnpm 12.11.2

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.11.1...v12.11.2)

This release fixes `--workspace-concurrency=Infinity`, filters set by an
`updateConfig` hook, and store fetches with `enable-modules-dir=false`.

##### Patch Changes

- `--workspace-concurrency=Infinity` now runs workspace projects with no
concurrency limit. It used to fail with `invalid digit found in string`
[#&#8203;16793](https://redirect.github.com/pnpm/pnpm/issues/16793).

- `pnpm install` and other recursive commands now apply the `filter` and
`filterProd` that an `updateConfig` hook sets. They used to run on every
workspace project
[#&#8203;16792](https://redirect.github.com/pnpm/pnpm/issues/16792).

- `enable-modules-dir=false` now also fetches the packages an install
reuses from an existing lockfile, so the store holds every package the
lockfile lists.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.11.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.1):
pnpm 12.11.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.11.0...v12.11.1)

This release fixes two ways `pnpm install` could fail, runs tools of any
Rust release through `pnx`, and treats `registry.npmjs.com` as an alias
of the npm registry.

##### Patch Changes

- `pnpm install` no longer fails when `packageManager` pins the pnpm
version that is already running and the registry does not publish that
version. pnpm warns and continues. A registry mirror that has not synced
a release no longer blocks the commands of a project pinned to it.

- `pnpm install` no longer fails with `ERR_PNPM_CMD_SHIM_CHMOD` when
`node_modules/.bin` holds a shim that another user created, if everyone
can already execute it and it is not world-writable. This happens when
several users share one checkout.

- `enable-modules-dir=false` (`enableModulesDir: false` through the
Node.js addon) fetches the registry packages the host can install into
the store again, as pnpm v10 did, while still writing nothing under
`node_modules`. The setting exists for a `node_modules` that something
else mounts from the store, such as a FUSE daemon, and that consumer no
longer has to download each package on first access. A plain
`--lockfile-only` run still fetches nothing.

- `pnpm pack` and `pnpm publish` no longer put `.npmignore` and
`.gitignore` files in the tarball. A `files` entry that names one still
ships it.

- pnpm now treats `https://registry.npmjs.com/` as an alias of
`https://registry.npmjs.org/`. Registry requests, credentials, and
trusted publishing use the canonical hostname.

- `pnx --package=rust@<channel> <tool>` runs a tool of that Rust
release, for example `pnx --package=rust@nightly-2026-01-01 cargo
build`. pnpm installs the release with the components and targets from
`rust-toolchain.toml` and the target of each `--target` argument.

- `pnpm install` now links agent skills for more coding agents. It
detects the agent from `ANTIGRAVITY_AGENT`, `COPILOT_AGENT`,
`COPILOT_CLI`, `CODEX_THREAD_ID`, `CODEX_SANDBOX`, `AI_AGENT`, and
`CLAUDE_CODE`
[pnpm/tasks#116](https://redirect.github.com/pnpm/tasks/issues/116).

- When the registry rejects `pnpm stage publish`, the error message now
starts with "Failed to stage package".

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.11.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.11.0):
pnpm 12.11.0

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.10.1...v12.11.0)

This release adds Rust toolchain management, links the agent skills that
dependencies ship, adds the `permissions` setting, and keeps the colors
of streamed script output.

##### Minor Changes

- `pnpm install` now links the agent skills that direct dependencies
ship under `skills/<name>/SKILL.md` into the project's agent skill
directories, such as `.claude/skills`. A package's skills are linked
only after you approve them with `pnpm approve`. The `skills.dirs`
setting chooses the directories
[pnpm/rfcs#35](https://redirect.github.com/pnpm/rfcs/pull/35).

Added the `permissions` setting, which records what each dependency may
do. Its `build` capability works like `allowBuilds` and takes precedence
over it. `pnpm approve-builds` writes to `permissions` when
`pnpm-workspace.yaml` already has it, and to `allowBuilds` otherwise.

Added `pnpm permissions`, which lists the granted and denied permissions
and the packages awaiting approval. `pnpm approve` reviews build scripts
and agent skills in one prompt
[pnpm/rfcs#36](https://redirect.github.com/pnpm/rfcs/pull/36).

- pnpm now installs and runs Rust toolchains.

- With `cargo.enabled`, `pnpm install` installs the toolchain named in
`rust-toolchain.toml`. pnpm verifies the release signature, stores the
toolchain once per machine, and links it into `.pnpm/rust`. `pnpm run`
and `pnpm exec` put its `cargo` and `rustc` on the `PATH`.
- `pnpm add -g rust@<channel>` installs a toolchain globally. The
`cargo` and `rustc` commands run it outside projects that pin their own.
`pnpm update -g`, `pnpm ls -g`, and `pnpm remove -g` manage it like any
global package.
- In a project, `pnpm add rust@<channel>` pins the toolchain in
`rust-toolchain.toml`.
- `pnpm shim add rust` adds project-aware shims for `cargo`, `rustc`,
and the other Rust tools. In a project with a `rust-toolchain.toml`,
they run the toolchain the file names and install it on first use.
Elsewhere, the next command of the same name on `PATH` runs, such as
rustup's.

- `pnpm run` and `pnpm exec` now keep the colors of script output that
they print under the project's name, such as with `--stream`. pnpm sets
`FORCE_COLOR=1` for these scripts when its own output is in color,
unless `FORCE_COLOR` is already set.

  Script output is also rendered more cleanly:

- A line that a progress bar redraws with `\r` shows only its last
state.
  - Escape codes that move the cursor or clear the screen are dropped.
  - Long colored lines are cut at the terminal width.
- `pnpm -r run` no longer garbles its live output when a script fails
while other scripts are still running.

##### Patch Changes

##### Installing packages

- pnpm no longer panics with "unexpected error when polling the I/O
driver" when it runs under QEMU user-mode emulation, such as a
`linux/amd64` container on an Apple Silicon Mac
[#&#8203;16696](https://redirect.github.com/pnpm/pnpm/issues/16696).

- `pnpm view`, `pnpm update`, and other commands that read registry
metadata now work behind proxies that end a response by closing the
connection without a TLS `close_notify` alert
[#&#8203;16704](https://redirect.github.com/pnpm/pnpm/issues/16704).

- pnpm now switches to the version a project pins in `packageManager` or
`devEngines.packageManager` even when `pnpm-workspace.yaml` has a
setting the running pnpm cannot read, such as a
`lockfile.includeResolutionSettings` section. If pnpm does not switch,
it still reports that setting
[#&#8203;16675](https://redirect.github.com/pnpm/pnpm/issues/16675).

- When the `pnpm` package has to download its native binary on first
run, it now uses the registry and credentials from `.npmrc` and from the
`npm_config_registry` and `pnpm_config_registry` environment variables.
`COREPACK_NPM_REGISTRY` still takes precedence. A project `.npmrc` is
not read when `COREPACK_INTEGRITY_KEYS` turns off the signature check
[#&#8203;16655](https://redirect.github.com/pnpm/pnpm/issues/16655).

- `pnpm install` and `pnpm add --config` now apply `minimumReleaseAge`
when they resolve a config dependency. A config dependency range
resolves to the newest version that is old enough, so a later clean
`pnpm install --frozen-lockfile` accepts the lockfile
[#&#8203;16660](https://redirect.github.com/pnpm/pnpm/issues/16660).

- `pnpm remove` with `catalogPrune` no longer removes catalog entries
that `pnpm-lock.yaml` still records for workspace projects missing from
disk. Before, a following frozen install failed with
`ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`
[#&#8203;16679](https://redirect.github.com/pnpm/pnpm/issues/16679).

- With `cargo.enabled`, `pnpm install` now writes the source replacement
for vendored crates into `.pnpm/crates/config.toml` and includes it as
optional from `.cargo/config.toml`. A checkout without `.pnpm` builds
with plain Cargo
[#&#8203;16659](https://redirect.github.com/pnpm/pnpm/issues/16659).

- With `nodeLinker.type` set to `loaded`, Node.js now stops with
`ERR_PNPM_LOADER_UNSUPPORTED_NODE` when it preloads the store loader on
a version the loader cannot serve. The supported versions are `^24.18.0
|| >=26.2.0`. On other versions, CommonJS packages imported from ESM
failed with `Cannot find module` on their first relative `require()`.

- On Windows, `pnpm install` no longer fails with "The filename,
directory name, or volume label syntax is incorrect" when a package
contains a file whose name is invalid on Windows, such as
`icon.svg?as=metadata.d.ts`. pnpm removes the invalid characters from
the name and prints a warning that lists the renamed files.

- On Windows, hoisting no longer fails intermittently with link errors
when a junction is created or replaced concurrently
[pnpm/tasks#53](https://redirect.github.com/pnpm/tasks/issues/53).

##### Resolving dependencies

- `pnpm install --no-optional` now installs the peer dependencies a
project declares when `autoInstallPeers` is on. The lockfile marked such
a peer `optional: true` when another dependency had it as an optional
peer.

- `pnpm install` and `pnpm dedupe` now link an optional peer to the
workspace package that the workspace root depends on when the picked
version matches it. They installed the registry package with the same
name and version
[#&#8203;16706](https://redirect.github.com/pnpm/pnpm/issues/16706).

- Removal overrides such as `"debug>supports-color": "-"` now also apply
to an optional peer that a package declares only in
`peerDependenciesMeta`
[#&#8203;16681](https://redirect.github.com/pnpm/pnpm/issues/16681).

- `pnpm add` and other installs that re-resolve dependencies now keep
the locked `devEngines.runtime` version while it still satisfies the
declared range
[#&#8203;16764](https://redirect.github.com/pnpm/pnpm/issues/16764).

- `pnpm audit --fix update` now updates only the dependencies whose
locked version is vulnerable
[#&#8203;14928](https://redirect.github.com/pnpm/pnpm/issues/14928).

- `pnpm outdated` and `pnpm update --interactive` now apply `overrides`
before they look up the latest version. Before, a dependency overridden
to an npm alias was compared with the latest version of the package the
override replaces
[#&#8203;16719](https://redirect.github.com/pnpm/pnpm/issues/16719).

##### Patched dependencies

- Patches saved with CRLF line endings now apply, including a patch that
creates or deletes a file. pnpm rejected the git headers of such a patch
with `ERR_PNPM_INVALID_PATCH` and the message `invalid file mode:
100644`
[#&#8203;16641](https://redirect.github.com/pnpm/pnpm/issues/16641).

- A patch that changes a file's mode, such as adding or removing the
executable bit, now applies the new mode on Unix
[pnpm/tasks#110](https://redirect.github.com/pnpm/tasks/issues/110).

##### Injected dependencies and deploy

- With `sharedWorkspaceLockfile: false`, an injected workspace package
installed in the same run as its dependent now holds only the files its
`files` field selects. The copy also held other files of the project,
such as `tsconfig.json`
[#&#8203;16683](https://redirect.github.com/pnpm/pnpm/issues/16683).

- A script listed in `syncInjectedDepsAfterScripts` no longer fails when
it rewrites `package.json` while pnpm is copying its edits into the
injected copies. The sync after the script now replaces a half-copied
manifest.

- `pnpm deploy` with a shared lockfile no longer fails with
`ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` for `settings.dedupeInjectedDeps` or
`settings.dedupePeerDependents` when
`lockfile.includeResolutionSettings` is enabled. The deployed lockfile
now records both settings as `false`, the values the deploy installs
with.

- `pnpm deploy` now writes the dependencies in the deployed
`package.json` sorted by name. It also sorts the `allowBuilds` entries
in the deployed `pnpm-workspace.yaml`. Repeated deploys of the same
lockfile now produce identical files
[#&#8203;16687](https://redirect.github.com/pnpm/pnpm/issues/16687).

##### Packing and publishing

- `pnpm pack` and `pnpm publish` now match `.npmignore` and `.gitignore`
rules the way npm does. A negation such as `!lib/**` or
`!lib/**/!(*.map)` re-includes files under a directory that an earlier
`*` rule excluded
[#&#8203;16743](https://redirect.github.com/pnpm/pnpm/issues/16743).

- `pnpm pack` and `pnpm publish` no longer always include root files
that merely start with `README`, `LICENSE`, or `LICENCE`, such as
`README_INTERNAL.md`. Only `README`, `LICENSE`, `LICENCE`, and
`COPYING`, with or without an extension, ship regardless of `files` and
`.npmignore`, as in npm
[#&#8203;16753](https://redirect.github.com/pnpm/pnpm/issues/16753).

- `pnpm publish --provenance=false` and `--no-provenance` now turn off
provenance under trusted publishing, so a package can be published from
a self-hosted runner. Setting `provenance: false` in
`pnpm-workspace.yaml` does the same
[#&#8203;16721](https://redirect.github.com/pnpm/pnpm/issues/16721).

##### Speed and resource use

- `pnpm install` hardlinks files from a group-writable or world-writable
store again. pnpm copied every file from such a store into
`node_modules`
[#&#8203;16677](https://redirect.github.com/pnpm/pnpm/issues/16677).

- A repeat `pnpm install` no longer imports patched packages and
packages with build scripts again when nothing changed. Their builds no
longer run again either. This happened when `recursiveInstall` was
`false` or the project had a `file:` dependency
[#&#8203;16705](https://redirect.github.com/pnpm/pnpm/issues/16705).

- Verifying the lockfile against `trustPolicy` and `minimumReleaseAge`
uses less memory. pnpm no longer keeps every published version's
manifest of each checked package in memory until the install ends
[#&#8203;16656](https://redirect.github.com/pnpm/pnpm/issues/16656).

- `pnpm rebuild <pkg>` and `pnpm rebuild --pending` no longer read the
manifest of every installed package to find build scripts. Only the
selected packages are inspected and built. On a large `node_modules`
served lazily, such as over a network or FUSE mount, this turned a
rebuild of a few packages into a fetch of every package.

- `pnpm rebuild` no longer removes and recreates `node_modules` when the
settings recorded in `node_modules/.modules.yaml` differ from the
current configuration. The rebuild runs the build scripts against the
installed packages as they are.

- `pnpm store prune` now compacts the store's `index.db` after removing
package entries, so the file shrinks again
[#&#8203;16717](https://redirect.github.com/pnpm/pnpm/issues/16717).

##### Registry commands

- `pnpm whoami`, `pnpm bugs`, `pnpm docs`, `pnpm repo`, `pnpm star`,
`pnpm unstar`, and `pnpm stars` now honor the `--registry` option.

- `--registry` now takes precedence over a scope's configured registry
for scoped packages in `pnpm access`, `pnpm view`, `pnpm repo`, `pnpm
star`, `pnpm unstar`, `pnpm owner`, `pnpm deprecate`, `pnpm
undeprecate`, `pnpm unpublish`, `pnpm dist-tag`, `pnpm team`, and `pnpm
stage`. Without `--registry`, `pnpm access` now sends a scoped package
or scope to the registry configured for that scope.

- Registry commands now keep the path of a registry URL such as
`https://example.com/npm/` when they build request URLs. This applies to
`pnpm access`, `pnpm owner`, `pnpm ping`, `pnpm search`, `pnpm star`,
`pnpm stars`, `pnpm team`, `pnpm unstar`, and `pnpm whoami`.

- `pnpm view` now honors the network retry settings.

- `pnpm repo` now fetches the repository URLs of several packages in
parallel.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.10.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.10.1):
pnpm 12.10.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.10.0...v12.10.1)

This release fixes `pnpm install` failures after an `overrides` change
and on a filtered frozen install with `catalogPrune`. It also fixes
several bugs in the experimental `nodeLinker.type: loaded`, which now
keeps its generated files in `node_modules`.

##### Patch Changes

- With `nodeLinker.type: loaded`, pnpm now writes its generated files to
`node_modules`, which projects already ignore in git. The store manifest
and loader are `node_modules/.pnpm/.store-manifest.json` and
`node_modules/.pnpm/.store-loader.mjs`. Bin shims are in
`node_modules/.bin`.

Earlier versions wrote `.pnpm-store.json` and `.pnpm-store-loader.mjs`
to the project root, and a `.pnpm` directory to the root and to each
workspace package. Delete them after reinstalling.

- With `nodeLinker.type: loaded`, packages that ship their own
`node_modules` directory, such as `npm` with its bundled dependencies,
now load from the store. Before, one such package in the install stopped
every Node.js process from starting.

- With `nodeLinker.type: loaded`, scripts can now run a Node.js runtime
installed through `devEngines.runtime`. Before, every script that called
`node` re-ran its own shim until it failed with "Argument list too
long".

- With `nodeLinker.type: loaded`, Node.js processes start faster. In a
project with 13,000 stored files, the startup overhead per process
dropped from 67 ms to 18 ms.

- `pnpm install` no longer fails with `ERR_PNPM_NO_MATCHING_VERSION`
after a change to `overrides` when the lockfile resolves an optional
peer dependency to an npm alias of another package
[#&#8203;16654](https://redirect.github.com/pnpm/pnpm/issues/16654).

- A frozen install with `catalogPrune` no longer removes catalog entries
that `pnpm-lock.yaml` still records. Before, `pnpm install
--frozen-lockfile --filter` failed with
`ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` when some workspace projects were
missing from disk
[#&#8203;16638](https://redirect.github.com/pnpm/pnpm/issues/16638).

- `pnpm install --fix-lockfile` no longer removes the `deprecated` and
`hasBin` fields from lockfile entries
[#&#8203;6600](https://redirect.github.com/pnpm/pnpm/issues/6600).

- With `enableGlobalVirtualStore`, an install that updates
`node_modules` now repairs a package in the global virtual store that an
interrupted install left without some of its dependency links or package
files. Before, such an install kept the incomplete package if the
project's `node_modules` already recorded it
[#&#8203;16642](https://redirect.github.com/pnpm/pnpm/issues/16642).

- `pnpm install` now skips the Cargo and Python projects inside a nested
directory that has its own `pnpm-workspace.yaml` or `.git` directory,
such as a git worktree of the same workspace or a separate clone.

- The `Request took` warning for package metadata now starts timing when
pnpm sends the request. Before, it also counted the time the request
waited for a free request slot, so large installs printed it for
requests the registry answered quickly.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.10.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.10.0):
pnpm 12.10.0

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.9.1...v12.10.0)

This release adds an experimental `loaded` node linker, lets
`pnpm-lock.yaml` record resolution settings, and reads cached registry
metadata faster. It also carries several security fixes, including one
that stops a dependency version from writing files outside the global
virtual store.

##### Minor Changes

- Added experimental `nodeLinker: { type: loaded }` installation.
Compatible dependencies load directly from the content-addressable store
through an automatically registered Node.js loader.
`nodeLinker.excluded` selects packages and their dependency trees to
install in the global virtual store.

- `lockfile.includeResolutionSettings: true` makes `pnpm-lock.yaml`
record `autoDedupe`, `dedupeInjectedDeps`, `dedupePeerDependents` and
`linkWorkspacePackages`. Installs then treat a lockfile that records
other values as outdated. A lockfile that records `autoDedupe` is reused
by later installs on any machine, so `pnpm run` after `pnpm install
--frozen-lockfile` no longer starts another install
[#&#8203;16583](https://redirect.github.com/pnpm/pnpm/issues/16583).

##### Patch Changes

##### Security

- `pnpm install` now prevents dependency versions with path traversal
from writing files outside the global virtual store.

- pnpm now verifies locked config dependencies against their registry
before installing them. Config dependencies must come from an npm
registry. The lockfile can no longer replace the integrity of a config
dependency pinned with `version+integrity`.

- Lockfile verification now checks the tarballs inside a `variations`
resolution against the registry. A `name@version` lockfile entry with an
empty `variations` resolution is now rejected.

- `pnpm audit signatures` now verifies signatures against the integrity
recorded in the lockfile. Packages without a recorded integrity cannot
pass signature verification.

- `pnpm install` and `pnpm publish` now reject archive metadata larger
than 64 MiB before reading it into memory. Publishing a pre-built
tarball also rejects manifests and README files larger than 64 MiB.

- Two URL or local path dependencies no longer share a virtual store
directory when one URL has `+`, `#`, `:`, or `?` where the other has
`/`. Such dependencies, including git dependencies pinned with `#`, now
get a hash suffix on their directory name.

- The warning about an ignored project `.npmrc` registry setting no
longer prints the username and password of a URL-scoped key such as
`//user:password@registry.example.com/${PATH}/:_authToken`.

##### Installing and resolving dependencies

- `pnpm install` now fails with `ERR_PNPM_UNSUPPORTED_PROTOCOL` when a
dependency uses a specifier with a protocol pnpm does not support, such
as Yarn's `patch:`. On Windows, such a specifier failed with `os error
123`. On other platforms, pnpm linked it to a directory that does not
exist. Reading a `package.json` that fails now names the file
[#&#8203;16590](https://redirect.github.com/pnpm/pnpm/issues/16590).

- `pnpm install` now fails with
`ERR_PNPM_PACKAGE_MANIFEST_INVALID_ATTRIBUTE` when a project declares a
dependency whose specifier is not a string, such as `"is-positive": 42`.
Before, the dependency was silently left out of the lockfile. A
`readPackage` hook can still correct the specifier.

- Fixed `pnpm install` failing with `ERR_PNPM_CMD_SHIM_RESOLVE_PATH`
when an executable's parent directory contains a dangling symlink.

- `pnpm install --frozen-lockfile` no longer fails with
`ERR_PNPM_RESOLUTION_SHAPE_MISMATCH` when a `name@version` lockfile
entry has a resolution served by a custom fetcher
[pnpm/tasks#108](https://redirect.github.com/pnpm/tasks/issues/108).

- `pnpm install --fix-lockfile` repairs a lockfile whose importer
references a package that has no snapshot entry, as left by a badly
merged lockfile. It failed with `ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY`
since 12.8.0
[#&#8203;16618](https://redirect.github.com/pnpm/pnpm/issues/16618).

- When a dependency moves an exact dependency of its own to an older
version, a peer dependency that pnpm installed automatically now moves
with it. Before, `pnpm install` and `pnpm dedupe` kept the newer locked
version of the peer, so the lockfile held two copies of it, for example
two copies of `vue`
[pnpm/tasks#61](https://redirect.github.com/pnpm/tasks/issues/61).

- `pnpm dedupe` now reads registry metadata for a dependency pinned to
an exact version, as `pnpm install` does. If the registry metadata
disagreed with the package's `package.json`, the lockfile it wrote
depended on whether `minimumReleaseAge` was set
[#&#8203;16615](https://redirect.github.com/pnpm/pnpm/issues/16615).

##### Speed and size

- Dependency resolution reads cached registry metadata faster. The
metadata cache moved to `<cache-dir>/v12/`, so the first install after
upgrading downloads registry metadata again. A damaged cache entry is
downloaded again, or reported as an error when `--offline` is set. `pnpm
cache prune` also removes the metadata cache that older pnpm versions
wrote under `<cache-dir>/v11/`
[#&#8203;13512](https://redirect.github.com/pnpm/pnpm/pull/13512).

- Package metadata requests no longer wait behind queued tarball
downloads when `maxSockets` or a proxy limits the connections to a
registry. Large installs resolve faster and print fewer `Request took`
warnings.

- Sped up installs in large workspaces on macOS when the dependency
links already exist. pnpm now keeps a link that already points at the
right package without trying to create it first. Relinking the direct
dependencies of 1,000 workspace projects took 45 ms, down from 116 ms
[pnpm/tasks#65](https://redirect.github.com/pnpm/tasks/issues/65).

- Commands in a project that pins a different pnpm version start about
13 ms faster on macOS. pnpm now runs the pinned version's binary
directly, without the shell script in front of it
[pnpm/tasks#66](https://redirect.github.com/pnpm/tasks/issues/66).

- The pnpm binary is about 0.9 MB smaller, and the arm64 Linux binary is
about 1 MB smaller still.

##### Running scripts and commands

- `pnpm run` no longer prints `[ELIFECYCLE] Command failed ...` after
Ctrl+C ends the script. pnpm still exits the way the script's shell did:
on Windows with the shell's exit code (`cmd` reports `-1073741510`,
PowerShell `1`), on Unix by re-raising `SIGINT`
[#&#8203;16579](https://redirect.github.com/pnpm/pnpm/issues/16579).

- `pnpm run "/<regex>/"` now accepts JavaScript regular expression
syntax such as lookahead and lookbehind. A selector like
`"/^hello:(?!b).*$/"` failed with `ERR_PNPM_NO_SCRIPT`
[#&#8203;16604](https://redirect.github.com/pnpm/pnpm/issues/16604).

- `pnpm run` and `pnpm exec` now forward `--config.*` command-line flags
to the install started by `verifyDepsBeforeRun`
[pnpm/tasks#60](https://redirect.github.com/pnpm/tasks/issues/60).

- On Windows, a process started by `pnpm run` or `pnpm exec` can again
start a child with `CREATE_BREAKAWAY_FROM_JOB`. That child keeps running
after pnpm exits, even if the command fails
[#&#8203;16628](https://redirect.github.com/pnpm/pnpm/issues/16628).

- Empty `nodeOptions` values from command-line flags and environment
variables now override lower-priority settings. Scripts retain
`NODE_OPTIONS` from the parent environment or `extraEnv` when
`nodeOptions` is empty.

- pnpm now reads the `failIfNoMatch` setting from `pnpm-workspace.yaml`,
so a filter that matches no workspace project exits with code 1 when the
setting is `true`. The new `--no-fail-if-no-match` flag turns the
setting off for one command
[#&#8203;16577](https://redirect.github.com/pnpm/pnpm/issues/16577).

##### Configuration, setup, and pnpm versions

- `pnpm config get --global` and `pnpm config list --global` now show
only the global configuration, also when run inside a project. Settings
from the project's `pnpm-workspace.yaml` and `.npmrc` were included
before. The same applies to `--location=global`
[#&#8203;16598](https://redirect.github.com/pnpm/pnpm/issues/16598).

- pnpm now prints config warnings, such as an unset environment variable
in `.npmrc`, when loading the config fails.

- pnpm 11 releases older than 11.28.4 can run pnpm 12 again when the
`packageManager` field pins it. Since 12.9.0 they failed with
`SyntaxError: Invalid or unexpected token`
[#&#8203;16594](https://redirect.github.com/pnpm/pnpm/issues/16594).

- On Windows, `pnpm self-update` no longer runs the update a second time
when it replaces a `pnpm.cmd` linked by pnpm 12.8 or older. cmd.exe read
on in the replaced `pnpm.cmd`, printed an error about a command that is
not recognized, and ran the new pnpm once more
[#&#8203;16573](https://redirect.github.com/pnpm/pnpm/issues/16573).

- `pnpm setup` now puts `$PNPM_HOME/bin` first on `PATH` in login shells
that inherited it further down, such as the VS Code terminal on macOS.
Before, another `node` took precedence over the one installed by `pnpm
runtime set node -g`. Run `pnpm setup` again to update the block in your
shell config
[#&#8203;16635](https://redirect.github.com/pnpm/pnpm/issues/16635).

- `pnpm setup` now names the shell config file even if it is already up
to date
[#&#8203;16608](https://redirect.github.com/pnpm/pnpm/issues/16608).

##### Updating, auditing, and publishing

- `pnpm update --latest` now applies the `savePrefix` setting when it
rewrites a dependency whose range has no operator of its own, such as
`<2.0.0`.

- The interactive `pnpm audit --fix` picker now shows each patched
version with the `saveExact` and `savePrefix` style that the override is
written with
[#&#8203;13209](https://redirect.github.com/pnpm/pnpm/issues/13209).

- `pnpm unpublish <pkg>@<version>` now deletes the tarball under the
registry's path when the registry is served under one, such as Gitea's
npm registry. It used to send the delete to the host root and report
success without removing the version
[#&#8203;16568](https://redirect.github.com/pnpm/pnpm/issues/16568). It
also no longer mistakes a sibling path such as `/npm-mirror/` for the
registry path `/npm/`
[pnpm/tasks#94](https://redirect.github.com/pnpm/tasks/issues/94).

##### Output and messages

- A warning about a project's `devEngines` or `packageManager` pin is
now printed to stderr. A command such as `pnpm cache path` or `pnpm list
--json` keeps only its own output on stdout
[#&#8203;16584](https://redirect.github.com/pnpm/pnpm/issues/16584).

- `pnpm list` now reports the correct package paths when `nodeLinker` is
`hoisted`
[#&#8203;9593](https://redirect.github.com/pnpm/pnpm/issues/9593).

- Resolution errors now name the failing dependency and its parent
packages. Fatal errors appear as structured error records with their
error codes when using `--reporter=ndjson`.

- The error for an invalid git repository in the lockfile now has the
code `ERR_PNPM_INVALID_GIT_REPOSITORY`. Its message now lists every
rejected form of the value.

- `pnpm runtime --help` and `pnpm help runtime` now name the `set`
subcommand and the runtimes it accepts
[#&#8203;16580](https://redirect.github.com/pnpm/pnpm/issues/16580).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="Serp

> [!IMPORTANT]
> ✂ PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-16 10:03:44 +00:00
renovate[bot] a23c9db3cd build(deps): update dependency prettier to v3.9.10 (#13451) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [prettier](https://prettier.io)
([source](https://redirect.github.com/prettier/prettier)) | [`3.9.9` →
`3.9.10`](https://renovatebot.com/diffs/npm/prettier/3.9.9/3.9.10) |
![age](https://developer.mend.io/api/mc/badges/age/npm/prettier/3.9.10?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/prettier/3.9.9/3.9.10?slim=true)
|

---

### Release Notes

<details>
<summary>prettier/prettier (prettier)</summary>

###
[`v3.9.10`](https://redirect.github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#3910)

[Compare
Source](https://redirect.github.com/prettier/prettier/compare/3.9.9...3.9.10)


[diff](https://redirect.github.com/prettier/prettier/compare/3.9.9...3.9.10)

##### Markdown: Update `micromark-extension-gfm-table` to fix the table
parse issue on performance
([#&#8203;20266](https://redirect.github.com/prettier/prettier/pull/20266)
by [@&#8203;fisker](https://redirect.github.com/fisker))

See
[micromark/micromark-extension-gfm-table@`4f43ead`](https://redirect.github.com/micromark/micromark-extension-gfm-table/commit/4f43ead37b786bc531d924530d4ab4c714886267)
for details.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-14 20:48:28 +00:00
renovate[bot] 3863d84155 build(deps): update dependency eslint-plugin-prettier to v5.5.7 (#13452) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[eslint-plugin-prettier](https://redirect.github.com/prettier/eslint-plugin-prettier)
| [`5.5.6` →
`5.5.7`](https://renovatebot.com/diffs/npm/eslint-plugin-prettier/5.5.6/5.5.7)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/eslint-plugin-prettier/5.5.7?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint-plugin-prettier/5.5.6/5.5.7?slim=true)
|

---

### Release Notes

<details>
<summary>prettier/eslint-plugin-prettier
(eslint-plugin-prettier)</summary>

###
[`v5.5.7`](https://redirect.github.com/prettier/eslint-plugin-prettier/blob/HEAD/CHANGELOG.md#557)

[Compare
Source](https://redirect.github.com/prettier/eslint-plugin-prettier/compare/v5.5.6...v5.5.7)

##### Patch Changes

-
[#&#8203;796](https://redirect.github.com/prettier/eslint-plugin-prettier/pull/796)
[`7e53ecd`](https://redirect.github.com/prettier/eslint-plugin-prettier/commit/7e53ecd882fe6f0f74150cb0a539776b64182b3e)
Thanks [@&#8203;OskarEichler](https://redirect.github.com/OskarEichler)!
- Fix fallback diagnostic locations for all supported line endings.

-
[#&#8203;805](https://redirect.github.com/prettier/eslint-plugin-prettier/pull/805)
[`1b7c433`](https://redirect.github.com/prettier/eslint-plugin-prettier/commit/1b7c43322ce0eb3ee7495d91481613d39d97af52)
Thanks [@&#8203;JounQin](https://redirect.github.com/JounQin)! - Report
a clear error when the sync worker fails to load, so a missing
`prettier` dependency now fails fast with `Cannot find package
'prettier'` instead of hanging ESLint indefinitely.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-14 20:31:58 +00:00
renovate[bot] 92425402f4 build(deps): update dependency postcss to v8.5.30 (#13449) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [postcss](https://postcss.org/)
([source](https://redirect.github.com/postcss/postcss)) | [`8.5.29` →
`8.5.30`](https://renovatebot.com/diffs/npm/postcss/8.5.29/8.5.30) |
![age](https://developer.mend.io/api/mc/badges/age/npm/postcss/8.5.30?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/postcss/8.5.29/8.5.30?slim=true)
|

---

### Release Notes

<details>
<summary>postcss/postcss (postcss)</summary>

###
[`v8.5.30`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8530)

[Compare
Source](https://redirect.github.com/postcss/postcss/compare/8.5.29...8.5.30)

- Fix broken map on `</style>` escaping (by
[@&#8203;Rufflet](https://redirect.github.com/Rufflet)).

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE1Ni4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-14 12:55:53 +00:00
renovate[bot]andAmir Zarrinkafsh d0d2d26dd1 build(deps): update dependency vite to v8.3.4 (#13429) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`8.3.3` →
`8.3.4`](https://renovatebot.com/diffs/npm/vite/8.3.3/8.3.4) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.3.4?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.3.3/8.3.4?slim=true)
|

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

###
[`v8.3.4`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-834-2026-10-08-small)

[Compare
Source](https://redirect.github.com/vitejs/vite/compare/v8.3.3...v8.3.4)

##### Features

- **bundled-dev:** support `import.meta.hot.acceptExports`
([#&#8203;23463](https://redirect.github.com/vitejs/vite/issues/23463))
([bc0f21c](https://redirect.github.com/vitejs/vite/commit/bc0f21c56a2e003a4d2dd23ccb9da3ec8c706c4e))

##### Bug Fixes

- avoid mutating hmr defaults (fix
[#&#8203;23575](https://redirect.github.com/vitejs/vite/issues/23575))
([#&#8203;23576](https://redirect.github.com/vitejs/vite/issues/23576))
([574d5e3](https://redirect.github.com/vitejs/vite/commit/574d5e351905fe99891364d03c2440531378f7fd))
- **build:** correct preloads when chunkImportMap is enabled with
non-root base
([#&#8203;23698](https://redirect.github.com/vitejs/vite/issues/23698))
([2a8c0f0](https://redirect.github.com/vitejs/vite/commit/2a8c0f05c76e35c43ab3560984a5103c8db8dbcd))
- **build:** wait for in-flight stylesheets in preload helper (fix
[#&#8203;23652](https://redirect.github.com/vitejs/vite/issues/23652))
([#&#8203;23662](https://redirect.github.com/vitejs/vite/issues/23662))
([036b745](https://redirect.github.com/vitejs/vite/commit/036b74599b2fe1d8c61475371b856ceb88d26963))
- **bundled-dev:** serve `/@vite/client` and stub `@vite/env`
([#&#8203;23664](https://redirect.github.com/vitejs/vite/issues/23664))
([5afc5a8](https://redirect.github.com/vitejs/vite/commit/5afc5a8876624888fc1e8f43fed1c85c4b0e830b))
- **client:** skip rewriting unchanged adopted styles
([#&#8203;23697](https://redirect.github.com/vitejs/vite/issues/23697))
([fa71469](https://redirect.github.com/vitejs/vite/commit/fa7146938b0ca703653c90c20907191a01c032ba))
- **css:** resolve imported preprocessors from their file path with
lightningcss
([#&#8203;23688](https://redirect.github.com/vitejs/vite/issues/23688))
([cf52011](https://redirect.github.com/vitejs/vite/commit/cf52011c46409a4a45f3d74bba631b8f005c4bc9))
- **deps:** update all non-major dependencies
([#&#8203;23648](https://redirect.github.com/vitejs/vite/issues/23648))
([8a4c19c](https://redirect.github.com/vitejs/vite/commit/8a4c19cfc035f2dd203f2fa6d00ab9256a5e77c9))
- **deps:** update rolldown-related dependencies
([#&#8203;23649](https://redirect.github.com/vitejs/vite/issues/23649))
([794516d](https://redirect.github.com/vitejs/vite/commit/794516d50cff80e405bc9b3e5faac1c82987566c))
- **dev:** a restart requested during a restart used to be dropped (fix
[#&#8203;23392](https://redirect.github.com/vitejs/vite/issues/23392))
([#&#8203;23484](https://redirect.github.com/vitejs/vite/issues/23484))
([70d56ea](https://redirect.github.com/vitejs/vite/commit/70d56ea1848909edab416934f3f68ce14343eb73))
- don't treat modules ending with js-like query as js
([#&#8203;23687](https://redirect.github.com/vitejs/vite/issues/23687))
([fcb6f12](https://redirect.github.com/vitejs/vite/commit/fcb6f1252a95857823d935f98554b938888d41a0))
- **html:** avoid adding filesystem root to watcher
([#&#8203;23689](https://redirect.github.com/vitejs/vite/issues/23689))
([3a7f2ae](https://redirect.github.com/vitejs/vite/commit/3a7f2aea757d59bae66ad6edf6b321d26a7e6778))
- **html:** skip caching CSS of chunks in a cycle (fix
[#&#8203;23628](https://redirect.github.com/vitejs/vite/issues/23628))
([#&#8203;23636](https://redirect.github.com/vitejs/vite/issues/23636))
([15d82f7](https://redirect.github.com/vitejs/vite/commit/15d82f7dc679ab9c18d5ce2c3711157c2365ddd1))
- **optimizer:** scan deep imports with custom extensions
([#&#8203;23678](https://redirect.github.com/vitejs/vite/issues/23678))
([8579189](https://redirect.github.com/vitejs/vite/commit/8579189bae8626b6ddab55a09325e209d62e027e))
- remove input option unescaping for now
([#&#8203;23694](https://redirect.github.com/vitejs/vite/issues/23694))
([facc2fb](https://redirect.github.com/vitejs/vite/commit/facc2fb1fffce03d9e2dd7011d0bd0eeddc7d0f6))
- **server:** match static aliases on path boundaries
([#&#8203;23643](https://redirect.github.com/vitejs/vite/issues/23643))
([b28db28](https://redirect.github.com/vitejs/vite/commit/b28db28e9e62d9866a9a0f1b22e74589cc180577))
- **watcher:** normalize file before root check in `ensureWatchedFile`
([#&#8203;23673](https://redirect.github.com/vitejs/vite/issues/23673))
([12bb28c](https://redirect.github.com/vitejs/vite/commit/12bb28c22379c8d2fe90088fa0eefbfa2ab3fb80))

##### Performance Improvements

- **module-runner:** skip cloning call sites that have no source map
([#&#8203;23646](https://redirect.github.com/vitejs/vite/issues/23646))
([3d67486](https://redirect.github.com/vitejs/vite/commit/3d674869a50a0bca84a8cc8dc55bd35d57100e37))

##### Code Refactoring

- **bundled-dev:** import CSS HMR helpers from `/@vite/client`
([#&#8203;23674](https://redirect.github.com/vitejs/vite/issues/23674))
([182f5b2](https://redirect.github.com/vitejs/vite/commit/182f5b2a65391da5bee05f9c3df1aeb3794e98d9))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
 2026-10-14 12:51:56 +00:00
James Elliott a3c3e1082e docs: fix branding vectors (#13438) 
This adjusts the branding logo SVG's to have the correct vectors as one
of the arcs was flattened.
 2026-10-14 02:44:09 +00:00
renovate[bot] 28f7e17755 build(deps): update dependency bootstrap-icons to v1.13.2 (#13427) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [bootstrap-icons](https://icons.getbootstrap.com/)
([source](https://redirect.github.com/twbs/icons)) | [`1.13.1` →
`1.13.2`](https://renovatebot.com/diffs/npm/bootstrap-icons/1.13.1/1.13.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/bootstrap-icons/1.13.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/bootstrap-icons/1.13.1/1.13.2?slim=true)
|

---

### Release Notes

<details>
<summary>twbs/icons (bootstrap-icons)</summary>

###
[`v1.13.2`](https://redirect.github.com/twbs/icons/releases/tag/v1.13.2)

[Compare
Source](https://redirect.github.com/twbs/icons/compare/v1.13.1...v1.13.2)

#### What's Changed

- Add literal ID for TypeScript by
[@&#8203;lihsai0](https://redirect.github.com/lihsai0) in
[#&#8203;2134](https://redirect.github.com/twbs/icons/pull/2134)
- Migrate the Icons documentation to Astro, BUI, and Bootstrap 6 Alpha 1
by [@&#8203;mdo](https://redirect.github.com/mdo) in
[#&#8203;2315](https://redirect.github.com/twbs/icons/pull/2315)

#### Dependencies

- Bump the development-dependencies group with 6 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2164](https://redirect.github.com/twbs/icons/pull/2164)
- Bump the development-dependencies group across 1 directory with 6
updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2176](https://redirect.github.com/twbs/icons/pull/2176)
- Bump actions/checkout from 4 to 5 in the github-actions group by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2196](https://redirect.github.com/twbs/icons/pull/2196)
- Bump the development-dependencies group across 1 directory with 4
updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2197](https://redirect.github.com/twbs/icons/pull/2197)
- Bump js-yaml from 3.14.1 to 3.14.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2216](https://redirect.github.com/twbs/icons/pull/2216)
- Bump the github-actions group across 1 directory with 4 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2220](https://redirect.github.com/twbs/icons/pull/2220)
- Bump minimatch by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2241](https://redirect.github.com/twbs/icons/pull/2241)
- Bump lodash from 4.17.21 to 4.17.23 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2236](https://redirect.github.com/twbs/icons/pull/2236)
- Bump svgo from 3.3.2 to 3.3.3 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2243](https://redirect.github.com/twbs/icons/pull/2243)
- Bump the github-actions group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2237](https://redirect.github.com/twbs/icons/pull/2237)
- Bump lodash from 4.17.23 to 4.18.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2253](https://redirect.github.com/twbs/icons/pull/2253)
- Bump handlebars from 4.7.8 to 4.7.9 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2250](https://redirect.github.com/twbs/icons/pull/2250)
- Bump flatted from 3.3.4 to 3.4.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2249](https://redirect.github.com/twbs/icons/pull/2249)
- Bump the github-actions group with 3 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2251](https://redirect.github.com/twbs/icons/pull/2251)
- Bump yauzl from 3.2.0 to 3.3.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2255](https://redirect.github.com/twbs/icons/pull/2255)
- Bump picomatch by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2256](https://redirect.github.com/twbs/icons/pull/2256)
- Bump the development-dependencies group across 1 directory with 5
updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2258](https://redirect.github.com/twbs/icons/pull/2258)
- Bump the development-dependencies group with 2 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2261](https://redirect.github.com/twbs/icons/pull/2261)
- Bump fast-uri from 3.1.0 to 3.1.2 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2265](https://redirect.github.com/twbs/icons/pull/2265)
- Bump ip-address from 10.1.0 to 10.2.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2264](https://redirect.github.com/twbs/icons/pull/2264)
- Update dependencies by
[@&#8203;XhmikosR](https://redirect.github.com/XhmikosR) in
[#&#8203;2268](https://redirect.github.com/twbs/icons/pull/2268)
- Bump the development-dependencies group across 1 directory with 7
updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2278](https://redirect.github.com/twbs/icons/pull/2278)
- Bump the github-actions group across 1 directory with 8 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2277](https://redirect.github.com/twbs/icons/pull/2277)
- Bump fast-uri from 3.1.2 to 3.1.4 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2282](https://redirect.github.com/twbs/icons/pull/2282)
- Bump fast-uri from 3.1.4 to 3.1.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2289](https://redirect.github.com/twbs/icons/pull/2289)
- Bump ip-address from 10.2.0 to 10.4.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2287](https://redirect.github.com/twbs/icons/pull/2287)
- Bump the github-actions group across 1 directory with 5 updates by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2284](https://redirect.github.com/twbs/icons/pull/2284)

#### New Contributors

- [@&#8203;lihsai0](https://redirect.github.com/lihsai0) made their
first contribution in
[#&#8203;2134](https://redirect.github.com/twbs/icons/pull/2134)

**Full Changelog**:
<https://github.com/twbs/icons/compare/v1.13.1...v1.13.2>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-10 04:01:50 +00:00
renovate[bot] 01e4345837 build(deps): update dependency @tabler/icons to v3.49.0 (#13417) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@tabler/icons](https://tabler.io/icons)
([source](https://redirect.github.com/tabler/tabler-icons)) | [`3.48.0`
→
`3.49.0`](https://renovatebot.com/diffs/npm/@tabler%2ficons/3.48.0/3.49.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@tabler%2ficons/3.49.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@tabler%2ficons/3.48.0/3.49.0?slim=true)
|

---

### Release Notes

<details>
<summary>tabler/tabler-icons (@&#8203;tabler/icons)</summary>

###
[`v3.49.0`](https://redirect.github.com/tabler/tabler-icons/releases/tag/v3.49.0):
Release 3.49.0

[Compare
Source](https://redirect.github.com/tabler/tabler-icons/compare/v3.48.0...v3.49.0)

<img width="584"
src="https://raw.githubusercontent.com/tabler/tabler-icons/v3.49.0/.github/tabler-icons-3.49.0@2x.png"
/>

##### 18 new icons:

- `outline/alphabet-chinese`
- `outline/alphabet-devanagari`
- `outline/alphabet-ethiopic`
- `outline/alphabet-georgian`
- `outline/alphabet-japanese`
- `outline/blob-dashed`
- `outline/circle-heart`
- `outline/circle-pause`
- `outline/circle-play`
- `outline/circle-stop`
- `outline/file-lock`
- `outline/folder-lock`
- `outline/lens-concave`
- `outline/lens-convex`
- `outline/memory`
- `outline/square-dashed-top-solid`
- `outline/square-dashed-x`
- `outline/triangle-dashed`

##### Fixes and improvements

- Add `alphabet`, `arabic`, `typography` and `character` tags to
`alphabet-arabic`
([#&#8203;1643](https://redirect.github.com/tabler/tabler-icons/issues/1643))
- Match `brand-instagram` size to other square brand icons
([#&#8203;1615](https://redirect.github.com/tabler/tabler-icons/issues/1615))
- Fix `square-dashed` icon drawn as a solid square
([#&#8203;1614](https://redirect.github.com/tabler/tabler-icons/issues/1614))
- Redraw `square-dashed` and `table-dashed` icons
([#&#8203;1640](https://redirect.github.com/tabler/tabler-icons/issues/1640))
- Add `squircle` tag to all `square-rounded` icons
([#&#8203;1641](https://redirect.github.com/tabler/tabler-icons/issues/1641))
- **Webfont:** Fix filled `home` webfont glyph having zero width in
Chrome
([#&#8203;1616](https://redirect.github.com/tabler/tabler-icons/issues/1616))
- **Webfont:** Fix `sass` and `style` fields in `package.json` to point
to `dist/`, and stop publishing the intermediate SVG fonts, which the
CSS never referenced
([#&#8203;1633](https://redirect.github.com/tabler/tabler-icons/issues/1633))
- **Webfont:** Make webfont builds reproducible, so font files no longer
change between builds of the same icons
([#&#8203;1624](https://redirect.github.com/tabler/tabler-icons/issues/1624))
- **Webfont:** Drop the unused `svgtofont` dependency
([#&#8203;1620](https://redirect.github.com/tabler/tabler-icons/issues/1620))
- **Astro, Preact, React, React Native, SolidJS, Vue:** Stop publishing
source maps, which made up about 70% of the package size
([#&#8203;1634](https://redirect.github.com/tabler/tabler-icons/issues/1634))
- **Svelte, Svelte Runes:** Add `default` export conditions and document
per-icon imports
([#&#8203;1630](https://redirect.github.com/tabler/tabler-icons/issues/1630))
- **React Native:** Stop passing extra props (`testID`, `style`,
`onPress`, …) to every node of the icon, only the root `Svg` gets them.
`title` is now exposed to screen readers via accessibility props
([#&#8203;1628](https://redirect.github.com/tabler/tabler-icons/issues/1628))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-10 00:18:43 +00:00
renovate[bot] 03854db2db build(deps): update dependency hugo-extended to v0.167.0 (#13419) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [hugo-extended](https://redirect.github.com/jakejarvis/hugo-extended)
| `0.166.0` → `0.167.0` |
![age](https://developer.mend.io/api/mc/badges/age/npm/hugo-extended/0.167.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/hugo-extended/0.166.0/0.167.0?slim=true)
|
| [hugo-extended](https://redirect.github.com/jakejarvis/hugo-extended)
| [`0.166.0` →
`0.167.0`](https://renovatebot.com/diffs/npm/hugo-extended/0.166.0/0.167.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/hugo-extended/0.167.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/hugo-extended/0.166.0/0.167.0?slim=true)
|

---

### Release Notes

<details>
<summary>jakejarvis/hugo-extended (hugo-extended)</summary>

###
[`v0.167.0`](https://redirect.github.com/jakejarvis/hugo-extended/compare/v0.166.0...v0.167.0)

[Compare
Source](https://redirect.github.com/jakejarvis/hugo-extended/compare/v0.166.0...v0.167.0)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-10 00:18:20 +00:00
renovate[bot] 4df4969aad build(deps): update dependency vite to v8.3.3 (#13399) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`8.3.2` →
`8.3.3`](https://renovatebot.com/diffs/npm/vite/8.3.2/8.3.3) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.3.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.3.2/8.3.3?slim=true)
|

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

###
[`v8.3.3`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small)

[Compare
Source](https://redirect.github.com/vitejs/vite/compare/v8.3.2...v8.3.3)

##### Bug Fixes

- **deps:** update launch-editor to v2.14.2
([#&#8203;23654](https://redirect.github.com/vitejs/vite/issues/23654))
([22fd1d5](https://redirect.github.com/vitejs/vite/commit/22fd1d5238cce2ee9db0eb4122f9e8feb6b06097))
- **html:** filename passed to transformIndexHtml should not include
queries
([#&#8203;23653](https://redirect.github.com/vitejs/vite/issues/23653))
([7dafd8e](https://redirect.github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17))
- **server:** check `fs.serve` for `?vite-wasm-instance`
([#&#8203;23655](https://redirect.github.com/vitejs/vite/issues/23655))
([ba8b7ab](https://redirect.github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73))
- **server:** store ids to `safeModulePaths` rather than URLs
([#&#8203;23656](https://redirect.github.com/vitejs/vite/issues/23656))
([c3e06f9](https://redirect.github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-08 05:03:44 +00:00
renovate[bot] 665ca9c077 build(deps): update dependency @eslint/json to v2.1.1 (#13395) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@eslint/json](https://redirect.github.com/eslint/json) | [`2.1.0` →
`2.1.1`](https://renovatebot.com/diffs/npm/@eslint%2fjson/2.1.0/2.1.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/@eslint%2fjson/2.1.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@eslint%2fjson/2.1.0/2.1.1?slim=true)
|

---

### Release Notes

<details>
<summary>eslint/json (@&#8203;eslint/json)</summary>

###
[`v2.1.1`](https://redirect.github.com/eslint/json/blob/HEAD/CHANGELOG.md#211-2026-10-06)

[Compare
Source](https://redirect.github.com/eslint/json/compare/1879a5bc6decd34f47dc1e5a695afae1df2d6371...412ad094b434a1795a1eef991915811b5ee8c6a6)

##### Bug Fixes

- escape normalized keys in `no-unnormalized-keys` autofix
([#&#8203;283](https://redirect.github.com/eslint/json/issues/283))
([35790d4](https://redirect.github.com/eslint/json/commit/35790d4e66a93406e585b8ca660dc7da62473787))
- handle empty and whitespace-only JSON inputs
([#&#8203;259](https://redirect.github.com/eslint/json/issues/259))
([85ca99b](https://redirect.github.com/eslint/json/commit/85ca99b6456f0c8c959d2fc09e7578768c58199a))
- preserve parsing error locations in Bun
([#&#8203;281](https://redirect.github.com/eslint/json/issues/281))
([bbaa18f](https://redirect.github.com/eslint/json/commit/bbaa18f076be8cef088e575944f3773dd220e102))
- update dependency
[@&#8203;eslint/plugin-kit](https://redirect.github.com/eslint/plugin-kit)
to ^0.7.3
([#&#8203;276](https://redirect.github.com/eslint/json/issues/276))
([780bfcd](https://redirect.github.com/eslint/json/commit/780bfcdb0e51ab406735c34007595706efff759f))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-08 03:24:15 +00:00
renovate[bot]andAmir Zarrinkafsh 22f746b6ec build(deps): update dependency @docsearch/css to v5.1.2 (#13384) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@docsearch/css](https://docsearch.algolia.com)
([source](https://redirect.github.com/algolia/docsearch/tree/HEAD/packages/docsearch-css))
| [`5.1.1` →
`5.1.2`](https://renovatebot.com/diffs/npm/@docsearch%2fcss/5.1.1/5.1.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@docsearch%2fcss/5.1.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@docsearch%2fcss/5.1.1/5.1.2?slim=true)
|

---

### Release Notes

<details>
<summary>algolia/docsearch (@&#8203;docsearch/css)</summary>

###
[`v5.1.2`](https://redirect.github.com/algolia/docsearch/blob/HEAD/packages/docsearch-css/CHANGELOG.md#512)

[Compare
Source](https://redirect.github.com/algolia/docsearch/compare/@docsearch/css@5.1.1...@docsearch/css@5.1.2)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
 2026-10-07 21:15:34 +00:00
renovate[bot] 1df68d77d5 build(deps): update dependency postcss to v8.5.29 (#13387) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [postcss](https://postcss.org/)
([source](https://redirect.github.com/postcss/postcss)) | [`8.5.28` →
`8.5.29`](https://renovatebot.com/diffs/npm/postcss/8.5.28/8.5.29) |
![age](https://developer.mend.io/api/mc/badges/age/npm/postcss/8.5.29?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/postcss/8.5.28/8.5.29?slim=true)
|

---

### Release Notes

<details>
<summary>postcss/postcss (postcss)</summary>

###
[`v8.5.29`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8529)

[Compare
Source](https://redirect.github.com/postcss/postcss/compare/8.5.28...8.5.29)

- Improved `</style>` escaping (by
[@&#8203;choudhryfrompak](https://redirect.github.com/choudhryfrompak)).
- Fixed comments support in `list.comma()` and `list.space()` (by
[@&#8203;00200200](https://redirect.github.com/00200200)).
- Fixed semicolon and custom property (by
[@&#8203;wahidrizka](https://redirect.github.com/wahidrizka)).

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-07 21:13:11 +00:00
renovate[bot] 9b696bf8f4 build(deps): update dependency @docsearch/js to v5.1.2 (#13385) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@docsearch/js](https://docsearch.algolia.com)
([source](https://redirect.github.com/algolia/docsearch/tree/HEAD/packages/docsearch-js))
| [`5.1.1` →
`5.1.2`](https://renovatebot.com/diffs/npm/@docsearch%2fjs/5.1.1/5.1.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@docsearch%2fjs/5.1.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@docsearch%2fjs/5.1.1/5.1.2?slim=true)
|

---

### Release Notes

<details>
<summary>algolia/docsearch (@&#8203;docsearch/js)</summary>

###
[`v5.1.2`](https://redirect.github.com/algolia/docsearch/blob/HEAD/packages/docsearch-js/CHANGELOG.md#512)

[Compare
Source](https://redirect.github.com/algolia/docsearch/compare/@docsearch/js@5.1.1...@docsearch/js@5.1.2)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-07 02:06:46 +00:00
renovate[bot] ae8f0e0420 build(deps): update pnpm to v12.9.1 (#13361) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [pnpm](https://redirect.github.com/pnpm/pnpm/tree/main/pnpm)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`12.9.0` →
`12.9.1`](https://renovatebot.com/diffs/npm/pnpm/12.9.0/12.9.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/12.9.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/12.9.0/12.9.1?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v12.9.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.9.1):
pnpm 12.9.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.9.0...v12.9.1)

This release moves the WebContainer build into a separate `@pnpm/wasm`
package, shrinks the `pnpm` package back to about 4 MB, and fixes `pnpm
publish` with provenance from GitLab CI.

##### Patch Changes

- The WebAssembly build for StackBlitz WebContainers now ships as a
separate `@pnpm/wasm` package. The `pnpm` and `@pnpm/exe` packages no
longer include it, which brings their unpacked size back from about 55
MB to about 4 MB. In a WebContainer, install `@pnpm/wasm` with npm to
get the `pnpm` command.

- `pnpm publish` with provenance from GitLab CI is no longer rejected by
the npm registry with a 422 error. The provenance statement now includes
the GitLab CI variables in `invocation.parameters`, as npm does
[#&#8203;16551](https://redirect.github.com/pnpm/pnpm/issues/16551).

- `pnpm audit signatures` now uses the TLS settings of the redirect
target when a registry redirects its signing-keys request, for example
to registry.npmjs.org. A `cafile` scoped to a private registry no longer
makes the redirected request fail
[#&#8203;16541](https://redirect.github.com/pnpm/pnpm/issues/16541).

- Fixed `pnpm install --frozen-lockfile` rejecting an up-to-date
lockfile when an injected workspace package uses a catalog entry in
`peerDependencies`
[#&#8203;16557](https://redirect.github.com/pnpm/pnpm/issues/16557).

- The `[<since>]` filter selector works again with Git 2.24 through 2.27
[#&#8203;16561](https://redirect.github.com/pnpm/pnpm/issues/16561).
With Git older than 2.24, the selector now fails with an error that
names the required Git version.

It also detects changes in projects whose directory names contain
non-ASCII characters. Such a change used to be credited to the parent
project. `changedFilesIgnorePattern` and `testPattern` now match changed
files whose names contain non-ASCII characters.

- The `pnpm` executable is about 10% smaller. On macOS arm64 it went
from 45.1 MB to 40.3 MB.

- Sped up trust downgrade checks for packages with long release
histories.

- With `optimisticRepeatInstall: false`, `pnpm install` now runs the
projects' own lifecycle scripts, such as `prepare`, even when
`node_modules` is already up to date
[#&#8203;16545](https://redirect.github.com/pnpm/pnpm/issues/16545).

- `pnpm self-update` now fails for Homebrew-installed pnpm and prints
the `brew upgrade` command for the installed formula, such as `brew
upgrade pnpm` or `brew upgrade pnpm@11`. It used to install a second
copy of pnpm that the Homebrew one kept shadowing
[#&#8203;16547](https://redirect.github.com/pnpm/pnpm/issues/16547).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-05 01:53:36 +00:00
renovate[bot] 8be3b5d0b7 build(deps): update dependency thulite to v3.0.3 (#13348) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [thulite](https://redirect.github.com/thuliteio/thulite) | [`3.0.2` →
`3.0.3`](https://renovatebot.com/diffs/npm/thulite/3.0.2/3.0.3) |
![age](https://developer.mend.io/api/mc/badges/age/npm/thulite/3.0.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/thulite/3.0.2/3.0.3?slim=true)
|

---

### Release Notes

<details>
<summary>thuliteio/thulite (thulite)</summary>

###
[`v3.0.3`](https://redirect.github.com/thuliteio/thulite/blob/HEAD/CHANGELOG.md#303)

[Compare
Source](https://redirect.github.com/thuliteio/thulite/compare/v3.0.2...v3.0.3)

##### Patch Changes

- [#&#8203;570](https://redirect.github.com/thuliteio/thulite/pull/570)
[`57437d4`](https://redirect.github.com/thuliteio/thulite/commit/57437d409fd4a6be8c9870b6ea81fc052bfda7d8)
Thanks [@&#8203;h-enk](https://redirect.github.com/h-enk)! - fix: update
[@&#8203;thulite/core](https://redirect.github.com/thulite/core) to
^2.0.4, bump portless to ^0.15.7, and upgrade vite to ^8.3.2

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-05 01:50:11 +00:00
renovate[bot] be1d24f6d9 build(deps): update pnpm to v12.9.0 (#13355) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [pnpm](https://redirect.github.com/pnpm/pnpm/tree/main/pnpm)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`12.8.2` →
`12.9.0`](https://renovatebot.com/diffs/npm/pnpm/12.8.2/12.9.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/12.9.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/12.8.2/12.9.0?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v12.9.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.9.0):
pnpm 12.9

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.8.2...v12.9.0)

This release runs pnpm in StackBlitz WebContainers, adds a per-registry
`networkConcurrency` setting, and records every installed project in the
store. It also carries a security fix for `pnpm login`.

##### Minor Changes

- pnpm now automatically uses WebAssembly in StackBlitz WebContainers,
including when installation scripts are disabled. Native installations
continue to use the native executable when installation scripts are
enabled.

- A `registries` entry can now set `networkConcurrency`, the most
requests pnpm keeps in flight to that registry's origin. Requests to
other registries keep the overall limit. The setting may live in
`pnpm-workspace.yaml` or the global `config.yaml`.

  ```yaml
  registries:
    https://npm.corp.example.com/:
      scopes: ["@acme"]
      networkConcurrency: 4
  ```

- `pnpm install` now records every project it installs in the store's
`projects` directory, as a symlink to the project directory. A
`--frozen-store` install without the global virtual store still records
nothing. Only projects that used the global virtual store were recorded
before
[#&#8203;6929](https://redirect.github.com/pnpm/pnpm/issues/6929).

##### Patch Changes

- `pnpm login` no longer forwards credentials in its request body to
another origin during redirects.

##### Installing packages

- Fixed `pnpm install` failing on Android with
`ERR_PNPM_STORE_DIR_ACQUIRE_OPERATION_LOCK`
[#&#8203;16508](https://redirect.github.com/pnpm/pnpm/issues/16508).

- `pnpm install --frozen-lockfile` again succeeds when a workspace
project recorded in `pnpm-lock.yaml` has no directory, such as a project
left out of a Docker build context. It still fails if the project's
directory exists without a `package.json`
[#&#8203;16453](https://redirect.github.com/pnpm/pnpm/issues/16453).

- `pnpm install --frozen-lockfile` no longer requires a `pnpm-lock.yaml`
in a project that has no dependencies. It also succeeds when
`pnpm-lock.yaml` records only the pinned pnpm version, as other commands
write it when they run before the first install
[#&#8203;16477](https://redirect.github.com/pnpm/pnpm/issues/16477).

- Fixed `pnpm install --frozen-lockfile` rejecting a fresh lockfile when
an injected workspace dependency has an optional peer supplied by
another workspace project
[#&#8203;16428](https://redirect.github.com/pnpm/pnpm/issues/16428).

- With `nodeLinker: hoisted`, a filtered install now keeps the packages
of the workspace projects an earlier install put in `node_modules`. This
also covers the install that `pnpm --filter <selector> run` and `pnpm
--filter <selector> exec` start before the command. Before, these
installs removed every package that only the unselected projects needed
[#&#8203;16483](https://redirect.github.com/pnpm/pnpm/issues/16483).

- `pnpm install` with `nodeLinker: hoisted` now refreshes directories
supplied by custom fetchers when reinstalling. pnpm also keeps the
symlinks inside those directories.

- With `enableGlobalVirtualStore` on, scripts can run entry points that
a CommonJS require hook loads again, such as `ts-node index.ts`. They
failed with `ERR_UNKNOWN_FILE_EXTENSION` on Node.js versions without
built-in TypeScript support
[#&#8203;16436](https://redirect.github.com/pnpm/pnpm/issues/16436).

- pnpm now keeps each project's current lockfile and hidden hoisted
dependencies in its own `node_modules/.pnpm` when `virtualStoreDir`
points at a shared global virtual store. `--virtual-store-dir` now sets
the global virtual store's location too
[pnpm/tasks#47](https://redirect.github.com/pnpm/tasks/issues/47).

- `pnpm clean` no longer deletes the project when `virtualStoreDir` or
`globalVirtualStoreDir` is set to the project directory. It also leaves
a directory outside the project alone when the setting reaches it
through a symlink. It now removes a global virtual store that
`globalVirtualStoreDir` places inside the project, as it does for
`virtualStoreDir`.

##### Optional dependencies

- `pnpm install` no longer fails when a dependency of an optional
dependency is missing from the registry. Like npm, pnpm now leaves out
the nearest optional dependency above it, together with its subtree
[#&#8203;16511](https://redirect.github.com/pnpm/pnpm/issues/16511).

- When an optional dependency fails to build, pnpm now removes its link
from `node_modules`. A repeat `pnpm install` then reports "Already up to
date" and no longer reruns the failing build
[#&#8203;16468](https://redirect.github.com/pnpm/pnpm/issues/16468).

- `pnpm install` now prints a warning with the error when an optional
dependency cannot be fetched and is skipped. The skipped package is no
longer counted in the `Packages: +N` summary. The
`pnpm:skipped-optional-dependency` log reports the skip with the
`fetch_failure` reason
[#&#8203;16514](https://redirect.github.com/pnpm/pnpm/issues/16514).

##### Resolving dependencies

- Fixed `pnpm install` changing an unchanged project's direct dependency
to a sibling workspace's pinned version when its dependency tree
contains a cycle
[#&#8203;16417](https://redirect.github.com/pnpm/pnpm/issues/16417).

- With `autoDedupe` enabled, downgrading a dependency in one workspace
project now moves the other projects to that version when it satisfies
their ranges. This also applies to a filtered `pnpm --filter <project>
add`
[#&#8203;16432](https://redirect.github.com/pnpm/pnpm/issues/16432).

- `pnpm install` and `pnpm dedupe` now move an optional peer to the
version already in the dependency graph when no other package provides
its locked version anymore. After a bump such as `vue` 3.5.40 to 3.5.43,
the lockfile kept a second copy of `@vue/server-renderer` for
`@vue/test-utils`
[#&#8203;16443](https://redirect.github.com/pnpm/pnpm/issues/16443).

- `pnpm dedupe --check` no longer fails right after `pnpm install` when
a project's optional peer is satisfied by a package another workspace
project installs. `pnpm dedupe` now picks the same versions for that
package's dependencies as `pnpm install`
[#&#8203;16447](https://redirect.github.com/pnpm/pnpm/issues/16447).

- `pnpm install` no longer re-resolves an up-to-date lockfile on every
run when a patched package is a peer in a peer cycle
[#&#8203;16418](https://redirect.github.com/pnpm/pnpm/issues/16418).

- With `autoDedupe` enabled, `pnpm install --lockfile-only` no longer
resolves the dependency graph again when nothing changed since an
earlier `--lockfile-only` install deduplicated the lockfile. Such an
install keeps the lockfile even if versions were published since it was
written, or if only a setting such as `resolutionMode` changed. Run
`pnpm dedupe` to apply such a change
[#&#8203;16458](https://redirect.github.com/pnpm/pnpm/issues/16458).

##### Speed and network

- A repeat `pnpm install` in a large workspace reports "Already up to
date" faster
[#&#8203;16487](https://redirect.github.com/pnpm/pnpm/issues/16487).

- Sped up dependency resolution of workspaces with many peer
dependencies.

- `pnpm install` sends fewer registry metadata requests when the
lockfile already decides which version a range resolves to. This now
also covers ranges that several locked versions satisfy when one of them
outranks the others, and direct dependencies kept at their locked
version. Packages that `minimumReleaseAgeExclude` lists without a
version now reuse cached registry metadata the same way they do when
`minimumReleaseAge` is not set
[#&#8203;16458](https://redirect.github.com/pnpm/pnpm/issues/16458).

- pnpm no longer downloads every packument again on each install from a
registry whose metadata responses forbid caching, such as
`Cache-Control: no-store`. pnpm revalidates the cached metadata with a
conditional request, so a registry that supports conditional requests
answers with a 304 when the package has not changed
[#&#8203;16528](https://redirect.github.com/pnpm/pnpm/issues/16528).

- Cached metadata for a package published within `minimumReleaseAge` is
now revalidated with its ETag, so the npm registry can answer `304 Not
Modified`. Before, the next install that checked the cache downloaded
the whole document again
[#&#8203;16506](https://redirect.github.com/pnpm/pnpm/issues/16506).

- A fetch timeout while other downloads from the same host are still
running now lowers concurrency for that host to one connection. Retries
of that request, and later downloads from that host, use the lower
concurrency. Other hosts keep the configured concurrency
[#&#8203;12791](https://redirect.github.com/pnpm/pnpm/issues/12791).

- Sped up `pnpm install --offline` when the version a range picks is not
in the store. While it looks for a version the store holds, pnpm now
reads only the versions the range admits
[#&#8203;16495](https://redirect.github.com/pnpm/pnpm/issues/16495).

- `pnpm install --offline` now reuses config dependency tarballs that
are already present in the store
[pnpm/tasks#46](https://redirect.github.com/pnpm/tasks/issues/46).

##### Running scripts

- `pnpm -s <script>` runs the script again, with `-s` meaning
`--sequential` as it does for `pnpm run -s <script>`. pnpm rejected it
with "unexpected argument '-s' found"
[#&#8203;16446](https://redirect.github.com/pnpm/pnpm/issues/16446).

- `pnpm run` and `pnpm exec` now warn and run the command when the
install that `verifyDepsBeforeRun` starts fails. This lets scripts run
in sandboxes where pnpm cannot install, such as containers with a
read-only store or no network
[#&#8203;15173](https://redirect.github.com/pnpm/pnpm/issues/15173).

- A filtered `pnpm run` or `pnpm exec` now finds dependencies out of
date when a workspace dependency of a selected project has no
`node_modules` directory, as after a filtered install. With
`verifyDepsBeforeRun: install`, pnpm installs that dependency before
running the command
[pnpm/tasks#45](https://redirect.github.com/pnpm/tasks/issues/45).

- Scripts run without a terminal no longer start a second `sh` each. One
watchdog per pnpm command now ends every script's process group if pnpm
is killed, so `pnpm -r run` across many projects starts half as many
processes
[#&#8203;16489](https://redirect.github.com/pnpm/pnpm/issues/16489).

- `Terminate batch job (Y/N)?` no longer appears after pressing Ctrl+C
in a script started with `pnpm` from PowerShell or cmd on Windows
[#&#8203;16502](https://redirect.github.com/pnpm/pnpm/issues/16502).

- `pnpm rebuild` and `pnpm approve-builds` refresh command launchers
when a build changes a command's interpreter or replaces it with a
native executable. Dependent packages' build scripts use the refreshed
launchers.

- When `pnpm run <script>` or `pnpm <script>` finds nothing to run and
`--filter` follows the script name, the error now suggests putting the
filter option before the script name
[#&#8203;4655](https://redirect.github.com/pnpm/pnpm/issues/4655).

- Package-name filters now support `?` to match one character
[#&#8203;2817](https://redirect.github.com/pnpm/pnpm/issues/2817).

##### The pinned pnpm and `pnpm self-update`

- pnpm no longer downloads the project's pinned pnpm version again on
every command when `nodeVersion` in `pnpm-workspace.yaml` names a
different Node.js major than the `node` on `PATH`. Before, each of those
commands took about a second longer and failed without network access
[#&#8203;16497](https://redirect.github.com/pnpm/pnpm/issues/16497).

- Several `pnpm` commands started at once in a project that pins
`packageManager` no longer fail with `The process cannot access the file
because it is being used by another process` on Windows while the pinned
pnpm is being installed.

- pnpm can now switch to a `packageManager` version below 11 on x64 musl
Linux, such as Alpine
[#&#8203;16467](https://redirect.github.com/pnpm/pnpm/issues/16467).

- A `devEngines.packageManager` range no longer makes pnpm replace the
version recorded in `pnpm-lock.yaml` with the running pnpm while the
recorded version still satisfies the range. When pnpm does record a
version, it records the running pnpm only if it meets
`minimumReleaseAge`. Otherwise it records the newest version in the
range that meets it, or the running pnpm if none does
[#&#8203;16431](https://redirect.github.com/pnpm/pnpm/issues/16431).

- On Windows, `pnpm self-update` now replaces a `pnpm.exe` left in
`PNPM_HOME` or in `PNPM_HOME\bin`. Windows ran that executable in place
of the updated `pnpm.cmd` shim, so `pnpm --version` kept printing the
old version after a successful update. If the executable was in
`PNPM_HOME`, `self-update` now asks you to run `pnpm setup`
[#&#8203;9094](https://redirect.github.com/pnpm/pnpm/issues/9094).

- `pnpm self-update` now checks that a version installed as the
JavaScript `pnpm` can start before making it the global `pnpm`. If
Node.js is missing, the update fails and the current `pnpm` stays in
place.

##### Other commands

- `pnpm deploy` now finds patches and local dependencies when the target
directory sits under a symlink, such as `/tmp` on macOS. It failed with
`ERR_PNPM_PATCH_NOT_FOUND`
[#&#8203;16470](https://redirect.github.com/pnpm/pnpm/issues/16470).

- `pnpm deploy --legacy` now resolves the deployed project's relative
`file:`, `link:`, and path dependencies from the project's own directory
[#&#8203;16475](https://redirect.github.com/pnpm/pnpm/issues/16475).

- `pnpm update --global` now removes hard-linked executables from
`PNPM_HOME` when migrating packages from the old global layout
[#&#8203;16420](https://redirect.github.com/pnpm/pnpm/issues/16420).

- `pnpm store prune` no longer fails on store index entries that pnpm 11
wrote for git-hosted packages without a `package.json`. Entries that
still cannot be read are kept and counted in the prune summary.

- `pnpm store prune` now aborts when an error other than a missing
directory occurs while scanning project directories in the mark phase.

- `pnpm config get` and `pnpm config list` now report a setting given on
the command line with `--config.<name>=<value>`. Before, a value such as
`--config.node-linker=hoisted` reached the install but was absent from
the reported configuration
[#&#8203;16276](https://redirect.github.com/pnpm/pnpm/issues/16276).

- `pnpm -r pkg get` now reports every selected project when several
share a package name. Projects with the same name are keyed by their
directory relative to the workspace root. Before, only one of them
appeared in the output.

- The install summary shows a `link:` dependency as `+ name <- path`,
and the Node.js API's `hideLinkedPkgsDiff` reporter option leaves
matching linked dependencies out of the summary.

- The `--force` help text of `pnpm install` and `pnpm add` now says that
`--force` keeps skipping optional dependencies built for other
platforms. It points to `forceIgnoresPlatform` and the `--os`, `--cpu`,
and `--libc` options for installing them
[#&#8203;16435](https://redirect.github.com/pnpm/pnpm/issues/16435).

- The `homepage` field of the published `pnpm` package points to
<https://pnpm.io> again.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-04 03:41:29 +00:00
renovate[bot] 3abbc62c2f build(deps): update dependency eslint to v10.12.0 (#13352) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [eslint](https://eslint.org)
([source](https://redirect.github.com/eslint/eslint)) | [`10.11.0` →
`10.12.0`](https://renovatebot.com/diffs/npm/eslint/10.11.0/10.12.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/eslint/10.12.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint/10.11.0/10.12.0?slim=true)
|

---

### Release Notes

<details>
<summary>eslint/eslint (eslint)</summary>

###
[`v10.12.0`](https://redirect.github.com/eslint/eslint/releases/tag/v10.12.0)

[Compare
Source](https://redirect.github.com/eslint/eslint/compare/v10.11.0...v10.12.0)

#### Features

-
[`4618052`](https://redirect.github.com/eslint/eslint/commit/4618052eed6bb3ef420cf0db0490bbda2fd835a5)
feat: handle astral letters in `new-cap`
([#&#8203;21357](https://redirect.github.com/eslint/eslint/issues/21357))
(sary)
-
[`4ec5168`](https://redirect.github.com/eslint/eslint/commit/4ec5168d6d6888e3f7b163eb82963d40e45a75fa)
feat: allow `SourceCode#getText()` to accept tokens and comments
([#&#8203;21340](https://redirect.github.com/eslint/eslint/issues/21340))
(electrohyun)

#### Bug Fixes

-
[`bc51eee`](https://redirect.github.com/eslint/eslint/commit/bc51eee6e3e816622b2dd1bc08acb9cfb2d3a6a7)
fix: `prefer-arrow-callback` false positive in conditional test
([#&#8203;21373](https://redirect.github.com/eslint/eslint/issues/21373))
(Daniel Pinto)
-
[`bbff86c`](https://redirect.github.com/eslint/eslint/commit/bbff86c41521cc435e20754e26007f657a843038)
fix: skip lines with multiple comments in `max-lines-per-function`
([#&#8203;21332](https://redirect.github.com/eslint/eslint/issues/21332))
(xbinaryx)
-
[`efc4d6b`](https://redirect.github.com/eslint/eslint/commit/efc4d6bdc4c4d1dfba8bdab6a8f44f27a1b1d00a)
fix: astral letters in `consistent-return`, `no-eval`, `no-invalid-this`
([#&#8203;21360](https://redirect.github.com/eslint/eslint/issues/21360))
(lumir)
-
[`93de066`](https://redirect.github.com/eslint/eslint/commit/93de066d4125f8df013d40305e8009f4634a5cba)
fix: prefer-exponentiation-operator autofix for async function base
([#&#8203;21322](https://redirect.github.com/eslint/eslint/issues/21322))
(Vladimir Babin)
-
[`02e34ff`](https://redirect.github.com/eslint/eslint/commit/02e34ffba6adbed72365177c7caee71d950834e5)
fix: add missing space after `else` in `curly` autofix
([#&#8203;21355](https://redirect.github.com/eslint/eslint/issues/21355))
(Pixel)
-
[`b14b8bc`](https://redirect.github.com/eslint/eslint/commit/b14b8bc213ccfc19d3edcfa9ce6af62622661160)
fix: correct `id-length` message for long private names
([#&#8203;21348](https://redirect.github.com/eslint/eslint/issues/21348))
(Pixel)
-
[`69aac01`](https://redirect.github.com/eslint/eslint/commit/69aac01d898837a934c9e735e0b7881cc1df09e8)
fix: support `TSFunctionType` in `getFunctionHeadLoc`
([#&#8203;21335](https://redirect.github.com/eslint/eslint/issues/21335))
(xbinaryx)
-
[`686630e`](https://redirect.github.com/eslint/eslint/commit/686630eb34ec1cddf399a4e6eaeebb080116a532)
fix: `no-loss-of-precision` false positive with `0.e5`
([#&#8203;21337](https://redirect.github.com/eslint/eslint/issues/21337))
(sethamus)

#### Documentation

-
[`67eb586`](https://redirect.github.com/eslint/eslint/commit/67eb586e2eda290813b329d4f40e605ad696bc4f)
docs: Update README (GitHub Actions Bot)
-
[`5370d7e`](https://redirect.github.com/eslint/eslint/commit/5370d7ee35a6523873f798e87f3ccc73779d5d21)
docs: clarify `one-var` `separateRequires` matches any `require()` call
([#&#8203;21192](https://redirect.github.com/eslint/eslint/issues/21192))
(sethamus)
-
[`8816c1d`](https://redirect.github.com/eslint/eslint/commit/8816c1ddfcfa31318ad17cddcfb68acffa30940f)
docs: Update README (GitHub Actions Bot)
-
[`3d2e7ce`](https://redirect.github.com/eslint/eslint/commit/3d2e7cedb7409d8a2c5f2c2fafb14fa22790e40e)
docs: fix typo in no-unused-expressions documentation
([#&#8203;21346](https://redirect.github.com/eslint/eslint/issues/21346))
(bytedoe)

#### Chores

-
[`152067f`](https://redirect.github.com/eslint/eslint/commit/152067f0f81f08b6cce9cf8eeaddb8558731b4f6)
chore: update ecosystem plugins
([#&#8203;21362](https://redirect.github.com/eslint/eslint/issues/21362))
(ESLint Bot)
-
[`b56d58e`](https://redirect.github.com/eslint/eslint/commit/b56d58e0b1f3c919a6b7661254af760cdd909d6e)
chore: update github/codeql-action action to v4.38.2
([#&#8203;21376](https://redirect.github.com/eslint/eslint/issues/21376))
(renovate\[bot])
-
[`bfaea12`](https://redirect.github.com/eslint/eslint/commit/bfaea12ddc30b458fe4cfbb6c306a62b5299c177)
perf: cache normalized config globals per languageOptions
([#&#8203;21364](https://redirect.github.com/eslint/eslint/issues/21364))
(James Ross)
-
[`322209e`](https://redirect.github.com/eslint/eslint/commit/322209ef164e8a00a25ec7ca166969ddc853355c)
ci: avoid Nx cache in ecosystem tests and disable failing test
([#&#8203;21369](https://redirect.github.com/eslint/eslint/issues/21369))
(Francesco Trotta)
-
[`d166567`](https://redirect.github.com/eslint/eslint/commit/d166567901e09940c1de4ad0e95d572eeab5c927)
chore: update dependency prettier to v3.9.9
([#&#8203;21371](https://redirect.github.com/eslint/eslint/issues/21371))
(renovate\[bot])
-
[`29585ce`](https://redirect.github.com/eslint/eslint/commit/29585ceba7ad35368d1b763bd1e80d899f28842c)
chore: update dependency eslint-plugin-expect-type to ^0.7.0
([#&#8203;21359](https://redirect.github.com/eslint/eslint/issues/21359))
(renovate\[bot])
-
[`39d79ba`](https://redirect.github.com/eslint/eslint/commit/39d79ba9650542ac66d585d1899304abd630c07d)
chore: update github/codeql-action action to v4.38.1
([#&#8203;21354](https://redirect.github.com/eslint/eslint/issues/21354))
(renovate\[bot])
-
[`182a6e9`](https://redirect.github.com/eslint/eslint/commit/182a6e993a8a5dbdad5a628b69ad7382d48bf24f)
chore: update dependency prettier to v3.9.8
([#&#8203;21352](https://redirect.github.com/eslint/eslint/issues/21352))
(renovate\[bot])
-
[`f995127`](https://redirect.github.com/eslint/eslint/commit/f995127230dad258069c29b7f51971681bd53f00)
chore: remove CLAUDE.md in favor of AGENTS.md
([#&#8203;21339](https://redirect.github.com/eslint/eslint/issues/21339))
(Jarren)
-
[`b95fb6c`](https://redirect.github.com/eslint/eslint/commit/b95fb6cb335f82a0ccabb0944ac3b89c703bd947)
chore: update dependency prettier to v3.9.7
([#&#8203;21347](https://redirect.github.com/eslint/eslint/issues/21347))
(renovate\[bot])
-
[`3782dd4`](https://redirect.github.com/eslint/eslint/commit/3782dd458fdfbe492e600d9a54b295a9721ed815)
chore: update ecosystem plugins
([#&#8203;21342](https://redirect.github.com/eslint/eslint/issues/21342))
(ESLint Bot)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-04 00:19:54 +00:00
renovate[bot] 354724ad55 build(deps): update pnpm to v12.8.2 (#13351) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [pnpm](https://redirect.github.com/pnpm/pnpm/tree/main/pnpm)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`12.8.1` →
`12.8.2`](https://renovatebot.com/diffs/npm/pnpm/12.8.1/12.8.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/12.8.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/12.8.1/12.8.2?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v12.8.2`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.8.2):
pnpm 12.8.2

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.8.1...v12.8.2)

pnpm 12.8.2 fixes a startup crash on Linux ppc64le and `UnknownIssuer`
errors on systems without CA certificates. `pnpm run` no longer installs
before every script on CI when `autoDedupe` is enabled, and resolution
and hoisted installs on macOS are faster.

##### Patch Changes

##### Platforms and environments

- Fixed pnpm crashing on startup on Linux ppc64le
[#&#8203;16380](https://redirect.github.com/pnpm/pnpm/issues/16380).

- Fixed installs failing with `UnknownIssuer` on Linux systems without
CA certificates, such as `node:24-slim`, when `NODE_EXTRA_CA_CERTS` is
set. The extra certificates now extend the bundled CA roots
[#&#8203;16365](https://redirect.github.com/pnpm/pnpm/issues/16365).

- pnpm now creates its store operation locks and other per-user lock
files in `$XDG_RUNTIME_DIR` when it points to a directory only the user
can write to. Otherwise, pnpm still uses `/tmp` on Linux and macOS.
Sandboxes that block writes to `/tmp` can point `XDG_RUNTIME_DIR` at a
writable directory
[#&#8203;16390](https://redirect.github.com/pnpm/pnpm/issues/16390).

- POSIX bin shims and the `pnpm`, `pn`, `pnpx`, and `pnx` launchers now
run inside a Nix build, where the system default path holds none of the
utilities they call. Installing again replaces the shims already in
`node_modules`
[#&#8203;16377](https://redirect.github.com/pnpm/pnpm/issues/16377).

- In a project that pins another pnpm version, pnpm now passes a command
with an option it does not know to the pinned version. Before, pnpm
rejected the option before switching, so `pnpm install --auto-dedupe`
failed with "Unknown option" even though the pinned pnpm supports it
[#&#8203;16353](https://redirect.github.com/pnpm/pnpm/issues/16353).

##### Installing and resolving dependencies

- `pnpm install --frozen-lockfile` now fails when `Cargo.lock` does not
satisfy a dependency requirement in `Cargo.toml`. The error names the
crate and the version the lockfile holds
[#&#8203;16355](https://redirect.github.com/pnpm/pnpm/issues/16355).

- `pnpm install` returns "Already up to date" again in a workspace with
injected workspace dependencies and a shared lockfile. Since 12.7.0
every repeat install in such a workspace ran the full install and copied
the injected projects again.

- With `injectWorkspacePackages: true`, a fresh `pnpm install` now
records a workspace dependency as `link:` when its injected copy differs
from the project only by an optional peer that peer-dependent dedupe
merges. It was recorded as a peer-suffixed `file:` copy
[#&#8203;16354](https://redirect.github.com/pnpm/pnpm/issues/16354).

- `pnpm dedupe --check` now passes right after `pnpm dedupe` when
deduplication merges variants of a package that differ only in their
peers. A lockfile key whose peer suffix named a merged variant now names
the variant that replaced it
[#&#8203;16356](https://redirect.github.com/pnpm/pnpm/issues/16356).

- When `minimumReleaseAge` hides the version that `latest` points to,
pnpm now falls back to a prerelease of the same major before a stable
version of an older major. A stable version of the same major is still
preferred. Before, while a new `1.0.0` was too new, `latest` fell back
to an old `0.0.1` even though `1.0.0-beta.4` had been `latest` until
then
[#&#8203;16388](https://redirect.github.com/pnpm/pnpm/issues/16388).

- Git-hosted dependencies now respect `pmOnFail`. If it is set to
anything other than `download`, a git-hosted dependency that pins a pnpm
version is prepared by the running pnpm, and pnpm does not download the
pinned version
[#&#8203;16376](https://redirect.github.com/pnpm/pnpm/issues/16376).

- pnpmfile hooks such as `readPackage` now run once for a dependency
that several packages request at the same time. They could run twice for
it before.

- `childConcurrency` now defaults to 5, the documented value. It used to
be capped at 4 and to follow the host's CPU count.

##### Running scripts

- `pnpm run` and `pnpm exec` no longer install dependencies before every
script on CI when `autoDedupe` is enabled. `pnpm install
--frozen-lockfile` now keeps the deduplication record left by an earlier
install
[#&#8203;16374](https://redirect.github.com/pnpm/pnpm/issues/16374).

- On macOS and Linux, lifecycle scripts and `pnpm run` now always get
`PATH` from the `PATH` variable. When the environment also held a `Path`
variable, a script sometimes got `Path`'s value, and failed with `node:
not found`
[#&#8203;16308](https://redirect.github.com/pnpm/pnpm/issues/16308).

- `pnpm run` now exits after a `SIGTERM` in a container where pnpm is
PID 1 and the script runs pnpm again, as `"start": "pnpm serve"` does.
Since 12.6.0 it kept waiting after the script had shut down, until the
container runtime killed it.

##### Other commands and settings

- `pnpm config get globalShims`, `pnpm shim list`, and global installs
no longer read `globalShims` from a project's `pnpm-workspace.yaml`.
Only the global config file, the pnpm home's own `pnpm-workspace.yaml`,
and `PNPM_CONFIG_GLOBAL_SHIMS` set it, so a repository cannot choose
which globally installed packages get project-aware shims.

- `pnpm config set --location=project` refuses a machine-level setting
such as `stateDir` or `scope` with
`ERR_PNPM_CONFIG_SET_NOT_A_PROJECT_SETTING`, which names where the
setting belongs. `pnpm config delete` still clears such a key from a
project's `pnpm-workspace.yaml`.

- `pnpm deploy` no longer fails with `ERR_PNPM_DEPLOY_AMBIGUOUS_PEER` in
a workspace with `injectWorkspacePackages: true` when a workspace
package lists its peer dependency as a dev dependency too
[#&#8203;16375](https://redirect.github.com/pnpm/pnpm/issues/16375).

- `pnpm deploy` no longer copies the workspace root's `packageManager`
and `devEngines.packageManager` fields into the deployed `package.json`
[#&#8203;16403](https://redirect.github.com/pnpm/pnpm/issues/16403).

- `pnpm publish` now includes bare `README` files and README files with
Markdown extensions such as `readme.markdown` in registry metadata
[#&#8203;12704](https://redirect.github.com/pnpm/pnpm/issues/12704).

- `pnpm store prune` now removes the packages that only expired `pnpm
dlx` cache entries used. They were left in the store until the next
`pnpm store prune`
[#&#8203;16383](https://redirect.github.com/pnpm/pnpm/discussions/16383).

##### Performance

- Sped up dependency resolution in large workspaces, and when many
dependencies request different ranges of the same package. Resolution
also uses less memory.

- Sped up `pnpm install` with `nodeLinker: hoisted` on macOS when the
lockfile is re-resolved, such as with `autoDedupe` enabled
[#&#8203;16397](https://redirect.github.com/pnpm/pnpm/issues/16397).

- Sped up extracting package tarballs.

- `pnpm install` without `--frozen-lockfile` is faster on some machines
in projects with a `pnpm-workspace.yaml`. Those installs linked with one
worker thread per core, half of what a frozen install uses.

- On Windows, warm `pnpm install --frozen-lockfile` runs are 4-5% faster
on 4- and 8-core machines. pnpm now links with one worker thread per
core on Windows, between 4 and 16. This changes frozen installs and
installs in projects without a `pnpm-workspace.yaml` on machines with 3
to 15 cores.

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-03 22:34:39 +00:00
renovate[bot] 1113c3e20e build(deps): update dependency @thulite/core to v2.0.4 (#13345) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@thulite/core](https://redirect.github.com/thuliteio/core) | [`2.0.3`
→
`2.0.4`](https://renovatebot.com/diffs/npm/@thulite%2fcore/2.0.3/2.0.4)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@thulite%2fcore/2.0.4?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@thulite%2fcore/2.0.3/2.0.4?slim=true)
|

---

### Release Notes

<details>
<summary>thuliteio/core (@&#8203;thulite/core)</summary>

###
[`v2.0.4`](https://redirect.github.com/thuliteio/core/blob/HEAD/CHANGELOG.md#204)

[Compare
Source](https://redirect.github.com/thuliteio/core/compare/v2.0.3...v2.0.4)

##### Patch Changes

- [#&#8203;61](https://redirect.github.com/thuliteio/core/pull/61)
[`f33ff27`](https://redirect.github.com/thuliteio/core/commit/f33ff27585725447387a0cfa03b7afc1650ed026)
Thanks [@&#8203;h-enk](https://redirect.github.com/h-enk)! - fix: add
comment to clarify PostCSS processing in production

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-03 14:50:08 +00:00
renovate[bot] ea6b066a8f build(deps): update dependency vite to v8.3.2 (#13336) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`8.3.1` →
`8.3.2`](https://renovatebot.com/diffs/npm/vite/8.3.1/8.3.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.3.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.3.1/8.3.2?slim=true)
|

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

###
[`v8.3.2`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-832-2026-10-01-small)

[Compare
Source](https://redirect.github.com/vitejs/vite/compare/v8.3.1...v8.3.2)

##### Bug Fixes

- **build:** preload CSS correctly when `renderBuiltUrl` returns URLs
with queries
([#&#8203;23611](https://redirect.github.com/vitejs/vite/issues/23611))
([64e0a21](https://redirect.github.com/vitejs/vite/commit/64e0a215c24f0522b27b91f93cfd93e317b94481))
- **bundled-dev:** serve lazy chunk sourcemaps
([#&#8203;23026](https://redirect.github.com/vitejs/vite/issues/23026))
([eb7aa9a](https://redirect.github.com/vitejs/vite/commit/eb7aa9a8816a1e926d5d9b4cbe7e796b61314ce2))
- **bundled-dev:** serve the rolldown runtime from the installed
rolldown
([#&#8203;23568](https://redirect.github.com/vitejs/vite/issues/23568))
([bc598a6](https://redirect.github.com/vitejs/vite/commit/bc598a6a8a6b7d6e157e9f19c16911cff8d2360c))
- **deps:** update all non-major dependencies
([#&#8203;23601](https://redirect.github.com/vitejs/vite/issues/23601))
([9944fa6](https://redirect.github.com/vitejs/vite/commit/9944fa6033873f13ae88f59e023ab642c50fee2b))
- **deps:** update rolldown-related dependencies
([#&#8203;23602](https://redirect.github.com/vitejs/vite/issues/23602))
([88c1741](https://redirect.github.com/vitejs/vite/commit/88c17415af221b3a13e778f4f2c0e907c8287baf))
- **html:** resolve percent-encoded srcset urls
([#&#8203;23609](https://redirect.github.com/vitejs/vite/issues/23609))
([53f1ce7](https://redirect.github.com/vitejs/vite/commit/53f1ce7bfe38426861f6da572ef0e3359f6a80cd))
- limit size of object and array printing via `forwardConsole`
([#&#8203;23565](https://redirect.github.com/vitejs/vite/issues/23565))
([e64a587](https://redirect.github.com/vitejs/vite/commit/e64a5877dd3e552843a545749ccc257568917d28))
- merge `build.rolldownOptions.output.minify` correctly
([#&#8203;23536](https://redirect.github.com/vitejs/vite/issues/23536))
([bba3bb8](https://redirect.github.com/vitejs/vite/commit/bba3bb8beedd185948956e02667d450672632d79))
- **optimize-deps:** avoid "unsupported" warnings for browser:false
mappings
([#&#8203;23590](https://redirect.github.com/vitejs/vite/issues/23590))
([5e4b9ca](https://redirect.github.com/vitejs/vite/commit/5e4b9ca3dcb24b51f58a765fd2d852614bbf3574))
- **optimizer:** preserve excluded optional peer require fallbacks
([#&#8203;23600](https://redirect.github.com/vitejs/vite/issues/23600))
([a2bd6fa](https://redirect.github.com/vitejs/vite/commit/a2bd6fa897c35c8a691671a7d70061c1cdd5c688))
- pass queries to `renderBuiltUrl`
([#&#8203;23586](https://redirect.github.com/vitejs/vite/issues/23586))
([744269e](https://redirect.github.com/vitejs/vite/commit/744269e5b2a155074910ddd275aecf2b83938496))
- **server:** handle file watcher errors without crashing
([#&#8203;23503](https://redirect.github.com/vitejs/vite/issues/23503))
([6894f5c](https://redirect.github.com/vitejs/vite/commit/6894f5cbceac589536a0efb476d881a47f5ab1c5))
- **server:** release previous environments after initialization
([#&#8203;23499](https://redirect.github.com/vitejs/vite/issues/23499))
([5a3a010](https://redirect.github.com/vitejs/vite/commit/5a3a010eea4c9ebbdcc080819f93068d4e035bd4))
- **ssr:** encode whitespace in module runner sourceURL
([#&#8203;23513](https://redirect.github.com/vitejs/vite/issues/23513))
([bbc8812](https://redirect.github.com/vitejs/vite/commit/bbc88129c967a8b8eedebd93acc82bee63b86b2a))
- **worker:** align worker urls in client and server when using terser
([#&#8203;23614](https://redirect.github.com/vitejs/vite/issues/23614))
([24bd331](https://redirect.github.com/vitejs/vite/commit/24bd3316f3b2503d04a49361e365532bdb335e19))

##### Performance Improvements

- avoid encoding intermediate source maps
([#&#8203;23461](https://redirect.github.com/vitejs/vite/issues/23461))
([89574f6](https://redirect.github.com/vitejs/vite/commit/89574f6d940a7273a53c5122a4477285801a696a))
- **build:** avoid quadratic link scan in the preload helper
([#&#8203;23510](https://redirect.github.com/vitejs/vite/issues/23510))
([cf5c028](https://redirect.github.com/vitejs/vite/commit/cf5c0288d526824aead1b24e977400f13c527927))
- only register time middleware when debug logging is enabled
([#&#8203;23621](https://redirect.github.com/vitejs/vite/issues/23621))
([94d0080](https://redirect.github.com/vitejs/vite/commit/94d0080345e23d63d4cd02df2f7fa2afae775c26))

##### Documentation

- fix dead og-image PNG links in vite6/vite7 changelog entries
([#&#8203;23594](https://redirect.github.com/vitejs/vite/issues/23594))
([1929b4c](https://redirect.github.com/vitejs/vite/commit/1929b4cc5f38ad53781e3b07b8bdaa32cf18da07))

##### Miscellaneous Chores

- **deps:** update vitest monorepo to v5
([#&#8203;23604](https://redirect.github.com/vitejs/vite/issues/23604))
([24339f4](https://redirect.github.com/vitejs/vite/commit/24339f4339d64fd8b5bc37654ac14ccff5aee584))

##### Code Refactoring

- use `tinyexec` instead of `cross-spawn`
([#&#8203;23583](https://redirect.github.com/vitejs/vite/issues/23583))
([db915e5](https://redirect.github.com/vitejs/vite/commit/db915e5c0edbe1359dcf0cea340c9571dc7f4ad9))

##### Tests

- **bundled-dev:** accept a rolldown dev runtime with no helper imports
([#&#8203;23606](https://redirect.github.com/vitejs/vite/issues/23606))
([634745d](https://redirect.github.com/vitejs/vite/commit/634745dcc5648912bc32cb4de72ed8dd2230efa0))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-02 12:39:55 +00:00
renovate[bot] 05dd5550d2 build(deps): update dependency sass-embedded to v1.105.1 (#13321) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [sass-embedded](https://redirect.github.com/sass/embedded-host-node) |
`1.105.0` → `1.105.1` |
![age](https://developer.mend.io/api/mc/badges/age/npm/sass-embedded/1.105.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/sass-embedded/1.105.0/1.105.1?slim=true)
|
| [sass-embedded](https://redirect.github.com/sass/embedded-host-node) |
[`1.105.0` →
`1.105.1`](https://renovatebot.com/diffs/npm/sass-embedded/1.105.0/1.105.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/sass-embedded/1.105.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/sass-embedded/1.105.0/1.105.1?slim=true)
|

---

### Release Notes

<details>
<summary>sass/embedded-host-node (sass-embedded)</summary>

###
[`v1.105.1`](https://redirect.github.com/sass/embedded-host-node/blob/HEAD/CHANGELOG.md#11051)

[Compare
Source](https://redirect.github.com/sass/embedded-host-node/compare/1.105.0...1.105.1)

- Improve error messages for `@extend`s across different media queries.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-01 06:51:15 +00:00
James Elliott d6996052a6 build(deps): update doks to v2 (#13303) 
Doks v2 requires Dart Sass. It is provided locally via the sass-embedded
optional dependency and on Netlify by tool/build, which installs the
pinned DART_SASS_VERSION before building.
 2026-09-30 12:41:11 +00:00
renovate[bot] d57455803e build(deps): update pnpm to v12.8.1 (#13305) 
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [pnpm](https://redirect.github.com/pnpm/pnpm/tree/main/pnpm)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`12.6.0` →
`12.8.1`](https://renovatebot.com/diffs/npm/pnpm/12.6.0/12.8.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/12.8.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/12.6.0/12.8.1?slim=true)
|

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v12.8.1`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.8.1):
pnpm 12.8.1

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/pnpm@12.8.0...v12.8.1)

pnpm 12.8.1 fixes `pnpm install --frozen-lockfile` rejecting lockfiles
with injected workspace packages that have peers, restores the
executable bit on files of local directory dependencies, makes `pnpm
dedupe` converge, and uses less CPU on many-core machines.

##### Patch Changes

- `pnpm install --frozen-lockfile` no longer rejects a freshly generated
lockfile when an injected workspace package has peer dependencies
[#&#8203;16332](https://redirect.github.com/pnpm/pnpm/issues/16332).

- Executable files in a `file:` directory dependency or an injected
workspace package keep their executable bit again. Since 12.8.0, pnpm
installed these files without the permissions they have in their
project.

- `pnpm dedupe` now reaches a stable lockfile when a package's peer
suffix is long enough to be hashed. Before, each run could switch that
package's key between the hashed and the spelled-out suffix, so `pnpm
dedupe --check` always failed
[#&#8203;16331](https://redirect.github.com/pnpm/pnpm/issues/16331).

- `pnpm install --frozen-lockfile`, the default in CI, now uses less CPU
on machines with more than 8 cores. Warm installs on many-core Windows
machines got up to 10% faster. Frozen installs now link with at most 16
worker threads.

- `verifyDepsBeforeRun` no longer reports dependencies as outdated after
a filtered install just because `pnpm-lock.yaml` has a newer
modification time. It checks the lockfile against the packages that
install put in place. Before, `pnpm run` reinstalled the whole workspace
with lifecycle scripts on, for example after a Docker `COPY` brought in
a lockfile with a newer mtime
[#&#8203;16322](https://redirect.github.com/pnpm/pnpm/issues/16322).

After a filtered install, `verifyDepsBeforeRun` now also checks that the
install put the selected projects' dependencies in place. A
`node_modules` directory alone no longer counts as proof.

- `pnpm run` and `pnpm exec` no longer install a project that has never
been installed and has nothing to install. Such a project declares no
dependencies, no peer dependencies that `autoInstallPeers` would fetch,
and no install lifecycle scripts. The command now runs without writing
`node_modules` or `pnpm-lock.yaml`
[#&#8203;16313](https://redirect.github.com/pnpm/pnpm/issues/16313).

- `pnpm update -g --latest` now upgrades globally installed packages
beyond their saved version ranges
[#&#8203;16320](https://redirect.github.com/pnpm/pnpm/issues/16320).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.8.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.8.0):
pnpm 12.8

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.7.0...pnpm@12.8.0)

pnpm 12.8.0 warns when `pnpm pack` or `pnpm publish` would ship a `.env`
file that `files` does not list, installs `sharedWorkspaceLockfile:
false` workspaces concurrently, applies every setting passed as
`--config.<name>=<value>`, and no longer leaves the Windows terminal
stuck after Ctrl+C in a script.

##### Minor Changes

- `pnpm pack` and `pnpm publish` now warn when the tarball includes a
`.env` or `.env.*` file that the `files` field of `package.json` does
not list. Templates such as `.env.example` are not reported. List the
file in `files` to publish it on purpose, or exclude it in `.npmignore`
or `.gitignore`
[#&#8203;7826](https://redirect.github.com/pnpm/pnpm/issues/7826).

- `pnpm pack` now honors `--silent`, `--reporter=silent`, and
`--loglevel=silent` to hide the tarball contents and summary. With
`--json`, lifecycle script output and the final JSON output remain
visible
[#&#8203;10297](https://redirect.github.com/pnpm/pnpm/issues/10297).

##### Patch Changes

##### Installing packages

- Installing through a `pnpr` server now records the pnpmfile checksum
in the lockfile, so a later `pnpm install --frozen-lockfile` accepts
that lockfile
[#&#8203;14460](https://redirect.github.com/pnpm/pnpm/issues/14460). A
frozen install through the pnpr server now fails if the pnpmfile
changed. If the pnpmfile defines a `readPackage`, `afterAllResolved` or
`preResolution` hook or custom resolvers, pnpm resolves dependencies
locally and prints a warning that the pnpr server was not used.

Installing through a `pnpr` server also links a workspace project at the
directory its `publishConfig.directory` names. A server that does not
forward the setting makes the install fail with
`ERR_PNPM_PNPR_PUBLISH_DIRECTORY_MISMATCH`, so pnpm never writes a
lockfile that points at the wrong directory. The server rejects a
`publishConfig.directory` that points outside its project.

- Installing a git-hosted dependency that has to be built no longer
fails when that dependency's own dependencies have build scripts nobody
approved. pnpm skips those builds while preparing the dependency, as it
does without `strictDepBuilds`
[#&#8203;9764](https://redirect.github.com/pnpm/pnpm/issues/9764).

- A git-hosted dependency that is a pnpm workspace with no committed
lockfile is now detected as a pnpm project
[#&#8203;14011](https://redirect.github.com/pnpm/pnpm/issues/14011).

- `pnpm install --dev` and `pnpm fetch --dev` now install the optional
dependencies of devDependencies, such as the platform binaries of Biome
and oxlint. The project's own `optionalDependencies` are still skipped
[#&#8203;9678](https://redirect.github.com/pnpm/pnpm/issues/9678).

- `pnpm install --offline` and `pnpm add --offline` now resolve a
version range to the newest matching version whose tarball is already in
the store. They used to pick the newest version in the cached metadata
and fail with `ERR_PNPM_NO_OFFLINE_TARBALL` when its tarball was missing
[#&#8203;10715](https://redirect.github.com/pnpm/pnpm/issues/10715).

- If an offline install fails because the registry metadata cache uses
the layout from before pnpm 11.27 and 12.4, the error now names the
older mirror on disk and explains that one online install repopulates
the cache. The error also carries the `ERR_PNPM_NO_OFFLINE_META` code.
`pnpm cache prune --help` now says that pnpm 11.26 and earlier, and pnpm
12.3 and earlier, depend on the directories it removes
[#&#8203;15656](https://redirect.github.com/pnpm/pnpm/issues/15656).

- Running `pnpm install` now refreshes dependencies when a package
declared with a local `file:` directory changes its dependencies
[#&#8203;4623](https://redirect.github.com/pnpm/pnpm/issues/4623).

- A repeat `pnpm install` now keeps its fast up-to-date check when an
override replaces a declared local `file:` dependency
[#&#8203;12892](https://redirect.github.com/pnpm/pnpm/issues/12892).

- `pnpm install` now removes an optional dependency from `node_modules`
if its install script fails. Code that checks whether the package is
installed no longer finds a package that cannot load
[#&#8203;8756](https://redirect.github.com/pnpm/pnpm/issues/8756).

- With `nodeLinker: hoisted`, `pnpm install` now restores a workspace
project's `node_modules` after it was deleted. Before, the install
printed "Already up to date" and left the project without the
dependencies nested under it. On Windows, the install also no longer
fails with "Access is denied" when another project's copy of a shared
dependency links to the deleted directory.

- Under `nodeLinker: hoisted`, `pnpm install` now clears orphaned
package directories that an interrupted or failed install leaves in a
project's `node_modules`. A directory recorded by the previous install
is removed, while an unrecorded directory is moved to
`node_modules/.ignored`. A copy already in `.ignored` is never
overwritten
[#&#8203;13676](https://redirect.github.com/pnpm/pnpm/issues/13676).

- Concurrent installs no longer fail when they replace the same stale
hoisted dependency link. Virtual store cleanup now keeps the temporary
lockfiles that concurrent installs write.

##### Resolving and linking dependencies

- `pnpm install` no longer aborts on a failed allocation of many
gigabytes when peer dependency ranges combine overlapping `||`
alternatives
[#&#8203;15867](https://redirect.github.com/pnpm/pnpm/issues/15867).

- `pnpm install` no longer fails when a package from the registry
declares a `file:` dependency on a directory inside itself, such as
`"@types/css-tree": "file:./typings/css-tree"`. pnpm links that
dependency to the directory inside the package, as npm and Yarn do. The
lockfile records it as `link:<root>/typings/css-tree`
[#&#8203;9141](https://redirect.github.com/pnpm/pnpm/issues/9141).

- An `npm:` alias written by `overrides` now stays in place when a
change elsewhere makes pnpm re-resolve the aliased dependency. Before,
pnpm could look up the alias name at the aliased version, which failed
with `ERR_PNPM_NO_MATCHING_VERSION` or locked an unrelated package
[#&#8203;16309](https://redirect.github.com/pnpm/pnpm/issues/16309).

- A peer dependency no longer resolves to two different versions for one
package. This happened when the package peer-depends on another package
and on one of that package's peers, and it is installed deeper than a
direct dependency of the package that provides them
[#&#8203;12098](https://redirect.github.com/pnpm/pnpm/issues/12098).

- An optional peer dependency is no longer resolved from another
workspace project's package when the project provides one of that
package's own peers at a version it rejects. This avoids bogus unmet
peer errors
[#&#8203;13989](https://redirect.github.com/pnpm/pnpm/issues/13989).

- `pnpm dedupe` no longer changes the lockfile on every run when a
nested peer dependency is provided through an npm alias
[#&#8203;15709](https://redirect.github.com/pnpm/pnpm/issues/15709).

- With `resolutionMode: time-based` and `minimumReleaseAge` both set,
`pnpm install` no longer reports a subdependency as too new when only
the time-based cutoff excludes it. Such subdependencies used to fail a
strict install with `ERR_PNPM_NO_MATURE_MATCHING_VERSION`, or were added
to `minimumReleaseAgeExclude`
[#&#8203;13569](https://redirect.github.com/pnpm/pnpm/issues/13569). A
transitive dependency that has no matching version published before the
time-based cutoff now resolves to the lowest matching version allowed by
`minimumReleaseAge`. pnpm picks a version younger than
`minimumReleaseAge` only if no older version matches
[#&#8203;16298](https://redirect.github.com/pnpm/pnpm/issues/16298).

- `pnpm install` retries registry metadata fetches that fail with a
timeout, a dropped connection, or an interrupted response body before it
applies `trustPolicy` or `minimumReleaseAge`. A transient fetch failure
is not reported as `TRUST_DOWNGRADE` or `MINIMUM_RELEASE_AGE_VIOLATION`
[#&#8203;12031](https://redirect.github.com/pnpm/pnpm/issues/12031).

- pnpm's built-in package compatibility database no longer applies to a
project's own manifest. A project named like a published package, such
as `vue-loader`, no longer gains dependencies on `pnpm install` or `pnpm
update`. User-configured `packageExtensions` still apply to project
manifests
[#&#8203;11700](https://redirect.github.com/pnpm/pnpm/issues/11700).

- Packages in an external `virtualStoreDir` can resolve the project's
direct dependencies selected by `hoistPattern`. Run `pnpm install
--force` to repair an existing installation
[#&#8203;5652](https://redirect.github.com/pnpm/pnpm/issues/5652).

- `pnpm install` now links the executables of auto-installed peer
dependencies into the workspace root's `node_modules/.bin`, including
after a frozen-lockfile reinstall
[#&#8203;8511](https://redirect.github.com/pnpm/pnpm/issues/8511).

##### Lockfiles and frozen installs

- `pnpm install --frozen-lockfile` now works on a detached HEAD when
`gitBranchLockfile` is enabled. The install reads the lockfiles of the
local and remote-tracking branches that contain the checked-out commit.
It still writes the shared `pnpm-lock.yaml`
[#&#8203;7672](https://redirect.github.com/pnpm/pnpm/issues/7672).

- `pnpm install --frozen-lockfile` now accepts a lockfile that has no
importer entry for a workspace package without dependencies. Such a
package added after the lockfile was written made the install fail with
`ERR_PNPM_PACKAGE_MANAGER_NO_IMPORTER`
[#&#8203;15875](https://redirect.github.com/pnpm/pnpm/issues/15875).

- `pnpm install` now fails with `ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY`
when an importer references a dependency version that has no snapshot
entry. Before, the install succeeded and left a `node_modules` symlink
pointing at a missing virtual-store directory
[#&#8203;14764](https://redirect.github.com/pnpm/pnpm/issues/14764).

- `pnpm install` on CI now fails on an outdated lockfile when
`preferFrozenLockfile` is explicitly set to `true`. Setting it to `true`
used to let CI update the lockfile
[#&#8203;9072](https://redirect.github.com/pnpm/pnpm/pull/9072).

- With `gitBranchLockfile` enabled, each emoji or other character
outside the Basic Multilingual Plane in a branch name now becomes `!!`
in the lockfile name. Before, each such character became one `!`.

##### Workspaces and filtering

- `pnpm install` in a workspace with `sharedWorkspaceLockfile: false`
now installs projects concurrently, up to `workspaceConcurrency` at a
time
[#&#8203;14480](https://redirect.github.com/pnpm/pnpm/issues/14480). A
project is resolved, fetched, and written to its virtual store without
waiting for the workspace projects it depends on. It waits for them only
before it links its dependencies and runs its lifecycle scripts, so its
scripts still run after theirs. A project with a `preinstall` or
`pnpm:devPreinstall` script, or with an injected or `file:` workspace
dependency, waits for its workspace dependencies before it starts.

The installs of the projects also share their package metadata, lockfile
verification, and store caches, so they use less CPU and memory when
several projects depend on the same packages. An install with a pnpmfile
no longer starts an extra Node.js process when the pnpmfile has no
`preResolution` hook.

- With `enableGlobalVirtualStore` and `sharedWorkspaceLockfile: false`,
each project now keeps its current lockfile and its hidden hoisted
dependencies in its own `node_modules/.pnpm`. Before, every project
wrote them to the workspace root's `node_modules/.pnpm`, so each repeat
install treated the other projects' packages as its own and relinked
them
[#&#8203;14480](https://redirect.github.com/pnpm/pnpm/issues/14480).

- `pnpm rebuild`, `pnpm approve-builds`, and `pnpm ignored-builds` now
work on the current project's `node_modules` when they run inside a
project of a workspace with `sharedWorkspaceLockfile: false`. They used
to read the workspace root's `node_modules`, so `pnpm rebuild` did not
rebuild the project's dependencies and created a second virtual store at
the workspace root
[#&#8203;9402](https://redirect.github.com/pnpm/pnpm/issues/9402).

- `pnpm install` no longer creates a `node_modules` symlink inside the
`publishConfig.directory` of a workspace package linked with
`linkDirectory`. A build tool that cleaned its output directory through
that symlink deleted the files of the package's dependencies. `pnpm
install` also removes a symlink that an earlier install left there
[#&#8203;16226](https://redirect.github.com/pnpm/pnpm/issues/16226). It
also no longer fails with `ERR_PNPM_CMD_SHIM_RESOLVE_PATH` when such a
package has a `bin` field and its `publishConfig.directory` does not
exist yet.

- `pnpm install` no longer fails for an injected workspace dependency
whose package publishes from a `publishConfig.directory` that its own
`prepare` script builds. The injected copy now picks up that directory
once `prepare` finishes building it. `pnpm install --frozen-lockfile` no
longer reports the dependency as outdated while the directory has not
been built yet
[#&#8203;7811](https://redirect.github.com/pnpm/pnpm/issues/7811).

- An in-place edit to the source of an injected workspace package now
shows up in its injected copy, unless a build writes to that package or
`packageImportMethod` is set. pnpm hardlinks such packages under the
default import method
[#&#8203;4410](https://redirect.github.com/pnpm/pnpm/issues/4410).
Scripts listed in `syncInjectedDepsAfterScripts` now update injected
dependencies while they run, so a watcher on the injected package, such
as a dev server, sees each change before the script exits.

- With `sharedWorkspaceLockfile: false`, an injected workspace package
that has lifecycle scripts is now hard linked into the projects that
depend on it. Before, pnpm left a plain copy, so later edits to the
package did not reach those projects
[#&#8203;9828](https://redirect.github.com/pnpm/pnpm/issues/9828).

- `injectWorkspacePackages` now hard links a workspace dependency
declared with a relative path, such as `workspace:../foo`, the same way
it already does for `workspace:*`
[#&#8203;10446](https://redirect.github.com/pnpm/pnpm/issues/10446).

- Workspace discovery prunes dot-prefixed directories, so a `packages`
pattern such as `**` no longer matches projects inside `.cache` and
other hidden directories
[#&#8203;16250](https://redirect.github.com/pnpm/pnpm/issues/16250).

- `pnpm import` in a workspace now keeps the versions pinned by a
`yarn.lock` inside a workspace project
[#&#8203;4385](https://redirect.github.com/pnpm/pnpm/issues/4385).

##### Store and caches

- Files imported from the store now follow the umask of the install that
writes them. Installing with a umask of `077` no longer leaves imported
files readable by the group and others
[#&#8203;3807](https://redirect.github.com/pnpm/pnpm/issues/3807).

- `pnpm install` keeps the owner, group, and mode of files already in a
shared store, including `index.db`. New store files and directories
inherit the store directory's group-write bit. When that directory is
setgid, new files inherit its group. pnpm does not change a file's owner
or group
[#&#8203;12765](https://redirect.github.com/pnpm/pnpm/issues/12765).

- When `pnpm install` repairs a store file that was modified through a
hard link in `node_modules`, the repair now keeps the file's inode on
Linux and macOS, so hard-linked copies in other projects are healed at
the same time. On Windows the repair still replaces the file, so other
projects are healed on their next install
[#&#8203;3445](https://redirect.github.com/pnpm/pnpm/issues/3445).

- `pnpm install` now reports a full store at once when writing package
files fails. It no longer retries the tarball
[#&#8203;8581](https://redirect.github.com/pnpm/pnpm/issues/8581).

- pnpm now warns when it cannot hard link packages from an existing
store in the pnpm home directory and falls back to a store on the
project's filesystem. This can happen when the project is on another
filesystem, such as a bind-mounted workspace in a container. The warning
names both stores and suggests setting `storeDir`
[#&#8203;14505](https://redirect.github.com/pnpm/pnpm/issues/14505).

- The side-effects cache now restores the symlinks that a build script
creates inside a package. A warm install used to replace each of them
with a copy of its target
[#&#8203;12859](https://redirect.github.com/pnpm/pnpm/issues/12859).

  After upgrading, every package with a build script is built once more.

- The global virtual store and the side-effects cache now key built
packages by the Node.js version that the root project's
`devEngines.runtime` or `engines.runtime` pins. That is the Node.js
their build scripts run with. A dependency that declares its own
`engines.runtime` no longer changes the key for every other package.

- With `enableGlobalVirtualStore`, an install into a fresh
`node_modules` no longer runs the build scripts of a dependency whose
global virtual store slot an earlier install already built. `pnpm
rebuild` still runs them
[#&#8203;14480](https://redirect.github.com/pnpm/pnpm/issues/14480).

- Concurrent installs that share a global virtual store now run a
package's build in its shared slot one at a time. A failed build leaves
the slot in place and marks it for the next install to rebuild
[#&#8203;15568](https://redirect.github.com/pnpm/pnpm/issues/15568).

- A warm `pnpm install` reuses on-disk package metadata for five minutes
when the registry does not send an ETag. Registries that send an ETag,
including the public npm registry, still revalidate with a conditional
request. `pnpm update` still fetches current metadata
[#&#8203;13976](https://redirect.github.com/pnpm/pnpm/issues/13976).

- pnpm no longer revalidates cached registry metadata when the registry
sends `Cache-Control: max-age=0`, `no-cache`, or `no-store`. It
downloads the metadata again, so a version newly published to such a
registry is visible on the next install
[#&#8203;13487](https://redirect.github.com/pnpm/pnpm/issues/13487).

- `pnpm install` honors `Cache-Control` for dependencies named with an
`http:` or `https:` tarball URL. A fresh response is taken from the
store with no request, and a stale one is revalidated with
`If-None-Match`
[#&#8203;15648](https://redirect.github.com/pnpm/pnpm/issues/15648).

##### Patched dependencies

- `pnpm install` now repairs a `pnpm-lock.yaml` whose
`(patch_hash=<hash>)` dependency paths disagree with its
`patchedDependencies` map, including paths that lack the hash their
patch calls for. Before, pnpm accepted such a lockfile as up to date and
kept the old patched files. `pnpm install --frozen-lockfile` now fails
on such a lockfile with `ERR_PNPM_INCONSISTENT_PATCH_HASH`. It fails
with `ERR_PNPM_UNCHECKABLE_PATCH_HASH` when a patch hash in the lockfile
is malformed, or when the lockfile lacks the package version or patch
entry that the check needs
[#&#8203;15336](https://redirect.github.com/pnpm/pnpm/pull/15336).

- `pnpm install` with `nodeLinker: hoisted` now applies a patch once to
each copy of a patched dependency in a workspace. Before, a copy that
several workspace projects shared could receive the patch twice and end
up with the patched content duplicated
[#&#8203;7565](https://redirect.github.com/pnpm/pnpm/issues/7565).

- `pnpm install` and `pnpm fetch` now fail with
`ERR_PNPM_PATCH_NOT_FOUND` when a patch file listed in
`patchedDependencies` does not exist
[#&#8203;5268](https://redirect.github.com/pnpm/pnpm/issues/5268).

- `engineStrict` now checks the patched `package.json` when a
`patchedDependencies` entry changes `engines`. A patch that relaxes
`engines.node` no longer fails the install against the published range
[#&#8203;9603](https://redirect.github.com/pnpm/pnpm/issues/9603).

- `pnpm patch` now applies the existing patch file to the edit directory
of a git-hosted dependency, as it already does for packages from the
registry
[#&#8203;9699](https://redirect.github.com/pnpm/pnpm/issues/9699).

##### Adding, updating, and removing dependencies

- `pnpm add <dir>` now warns when the added directory declares peer
dependencies, as `pnpm link` does. The directory is saved as a `link:`
dependency, and its peers are not resolved from the project that adds
it. Use the `file:` protocol to have them resolved
[#&#8203;5523](https://redirect.github.com/pnpm/pnpm/issues/5523).

- `pnpm add --save-types` no longer adds a `@types/*` package whose
resolved version is deprecated. DefinitelyTyped publishes such stubs for
packages that ship their own types, such as `@types/typescript` for
`typescript`
[#&#8203;15636](https://redirect.github.com/pnpm/pnpm/issues/15636).

- `pnpm version`, `pnpm add`, and `pnpm pkg set` keep JSON5 style when
they update `package.json5`. ASCII identifier keys stay unquoted,
strings keep JSON5 quotes, and indented files keep trailing commas
[#&#8203;15717](https://redirect.github.com/pnpm/pnpm/issues/15717).

##### Running scripts and commands

- `pnpm run` and `pnpm exec` no longer install dependencies
automatically when the root `package.json` still keeps `overrides`,
`packageExtensions`, `patchedDependencies`, or
`ignoredOptionalDependencies` in its `pnpm` field. pnpm no longer reads
that field, so the install rewrote the lockfile without those settings.
The command now fails and asks to move the settings to
`pnpm-workspace.yaml`
[#&#8203;16278](https://redirect.github.com/pnpm/pnpm/issues/16278).

- When `verifyDepsBeforeRun` triggers an install before a filtered `pnpm
run` or `pnpm exec`, pnpm now installs only the selected projects and
their dependencies. A later filtered command also installs a selected
project that an earlier filtered install skipped
[#&#8203;11865](https://redirect.github.com/pnpm/pnpm/issues/11865).

- `pnpm -r run /regexp/` now honors the `tasks` `dependsOn` declared for
each script the selector matches, like running the script by name does.
Matched scripts that depend on each other run in order. Each matched
script runs once
[#&#8203;15596](https://redirect.github.com/pnpm/pnpm/issues/15596).

- `pnpm run` exits with the code of a script that handles Ctrl+C and
shuts down. A script that finished cleanly is not reported as a
lifecycle failure. The commands after it in the same script still run
[#&#8203;9945](https://redirect.github.com/pnpm/pnpm/issues/9945).

- pnpm no longer hangs after a lifecycle script exits while a process it
started in the background keeps the script's output open. pnpm stops
reading that output one second after the script exits
[#&#8203;5730](https://redirect.github.com/pnpm/pnpm/issues/5730).

- `pnpm run` and lifecycle scripts use the configured `scriptShell`,
including Git Bash on Windows, when `shellEmulator` is also enabled.
`shellEmulator` still runs scripts when `scriptShell` is not set. Extra
arguments passed to `pnpm run` are quoted for the shell that runs the
script, so a Windows path stays intact
[#&#8203;14719](https://redirect.github.com/pnpm/pnpm/issues/14719).

- With `enableGlobalVirtualStore`, dependency build scripts now see the
workspace root's `node_modules/.bin`, as they do with a local virtual
store. A `postinstall` script that runs `node` finds the Node.js
installed by `devEngines.runtime` and no longer fails with "command not
found" on machines without a system Node.js
[#&#8203;15652](https://redirect.github.com/pnpm/pnpm/issues/15652).
Dependency build scripts also see the bins of privately hoisted
dependencies.

- Dependency install scripts now find the node-gyp bundled with pnpm
when pnpm runs through a symlink, such as `node_modules/.bin/pnpm` or
the `pnpm` that `npm install -g pnpm` links. They used to fail with
`node-gyp: command not found` on macOS
[#&#8203;15694](https://redirect.github.com/pnpm/pnpm/issues/15694).

- `pnpm run` and lifecycle scripts now set `npm_config_node_gyp` to the
bundled `node-gyp` entry point. Tools that read the variable resolve the
same `node-gyp` pnpm builds with. An `npm_config_node_gyp` value the
environment already sets is kept as is
[#&#8203;16270](https://redirect.github.com/pnpm/pnpm/issues/16270).

- Scripts now see the `npm_command` environment variable that npm sets.
It holds `run-script` when the command runs a script, and the command's
own name otherwise
[#&#8203;16265](https://redirect.github.com/pnpm/pnpm/issues/16265).

- Commands run from a POSIX shell through a dependency's own
`node_modules/.bin`, such as
`node_modules/vite/node_modules/.bin/esbuild`, no longer fail with
`MODULE_NOT_FOUND`
[#&#8203;10189](https://redirect.github.com/pnpm/pnpm/issues/10189).

- `pnpx --version` and `pnpm dlx --version` now print the pnpm version.
Other unknown options before the command are reported as errors. Before,
pnpm tried to download a package named after the option
[#&#8203;16259](https://redirect.github.com/pnpm/pnpm/issues/16259).

- `pnpm dlx` now keeps the virtual store of its cached installs in
`node_modules/.pnpm`, like every other install
[#&#8203;13955](https://redirect.github.com/pnpm/pnpm/issues/13955).
`pnpm pack-app` now names the manifest of its runtime install directory
`pnpm-pack-app-<target>`.

##### Publishing, packing, and deploying

- `pnpm pack` and `pnpm publish` now ship a file that the `files` field
names even when another entry excludes the directory holding it. For
example, `["**", "!dist", "dist/index.d.ts"]` ships `dist/index.d.ts`
[#&#8203;16213](https://redirect.github.com/pnpm/pnpm/issues/16213).

- `pnpm pack` prunes a directory that a `files` field exclusion names,
such as `!**/test`, excluding the directory and its contents from the
packed package
[#&#8203;15738](https://redirect.github.com/pnpm/pnpm/issues/15738).

- `pnpm publish` now waits at least 5 minutes for the registry to answer
a publish request, like npm. This fixes "409 Conflict - Failed to save
packument" errors when the registry is slow to answer
[#&#8203;11454](https://redirect.github.com/pnpm/pnpm/issues/11454).

- `pnpm deploy --prod` no longer fails with `ERR_PNPM_OUTDATED_LOCKFILE`
when the deployed project declares a `devEngines.runtime` with `onFail:
download`. The runtime stays out of the deployed `node_modules` with the
rest of the dev dependencies
[#&#8203;15703](https://redirect.github.com/pnpm/pnpm/issues/15703).

- `pnpm deploy` with a shared lockfile now copies workspace dependencies
into the deploy directory, even when `packageImportMethod` is set to
`hardlink`. Before, their files were hard-linked to the workspace
sources, so editing a source file also changed the deployed copy
[#&#8203;12176](https://redirect.github.com/pnpm/pnpm/issues/12176).

- `pnpm deploy --legacy` no longer leaves broken links to nested local
dependencies of workspace packages
[#&#8203;9575](https://redirect.github.com/pnpm/pnpm/issues/9575).

##### Configuration and pnpmfile hooks

- Every setting pnpm supports can now be set with
`--config.<name>=<value>` on the command line, not only the ones whose
command also carries a matching flag. Before, `pnpm install
--config.frozen-lockfile=true` dropped the setting and rewrote
`pnpm-lock.yaml` as though the install had not been frozen
[#&#8203;16276](https://redirect.github.com/pnpm/pnpm/issues/16276).

- Settings given on the command line, such as `--registry` and
`--store-dir`, now take precedence over the values a pnpmfile
`updateConfig` hook sets
[#&#8203;14063](https://redirect.github.com/pnpm/pnpm/issues/14063).

- `pnpm config set --location=project` and `pnpm config delete
--location=project`, run from a package inside a workspace, now write
settings that belong in `pnpm-workspace.yaml` to the workspace root's
`pnpm-workspace.yaml`. Before, they created a new `pnpm-workspace.yaml`
in the current package, which made that package the workspace root.
Settings stored in `.npmrc` are still written to the current directory
[#&#8203;13757](https://redirect.github.com/pnpm/pnpm/issues/13757).

- pnpm now reads the workspace directory override from
`PNPM_CONFIG_WORKSPACE_DIR`, like other settings.
`NPM_CONFIG_WORKSPACE_DIR` still works as a fallback
[#&#8203;16275](https://redirect.github.com/pnpm/pnpm/issues/16275).

- pnpm now fails with `ERR_PNPM_AUTH_INVALID_BASE64` when a registry's
`_password` in `.npmrc` is not valid base64. Before, it sent the value
as the raw password. A `username` or `_password` left empty, for example
by an unset environment variable, now supplies no credential
[#&#8203;16273](https://redirect.github.com/pnpm/pnpm/issues/16273).

- `proxy=false` now turns proxying off even when `HTTP_PROXY`,
`HTTPS_PROXY`, or `ALL_PROXY` is set. pnpm no longer sends requests
through a proxy named only in `ALL_PROXY`.

- `pnpm install` now runs the install hooks of a config dependency
plugin's pnpmfile, including `readPackage`, `afterAllResolved`, and
custom resolvers. Its pnpmfile is also counted in `pnpmfileChecksum`.
Before, only the plugin's `updateConfig` hook ran, so a plugin could not
change the resolved dependencies.

- A pnpmfile `fetchers` hook now runs once per package on a fresh
install when it handles a resolution with a custom `type` or delegates a
git-hosted one to the same subdirectory
[#&#8203;15584](https://redirect.github.com/pnpm/pnpm/issues/15584).
These packages were fetched a second time for installation, so the
installed files could come from a different archive than the one their
dependencies were read from. The hook also no longer runs twice when a
`resolvers` hook returns a tarball resolution without a manifest
[#&#8203;15025](https://redirect.github.com/pnpm/pnpm/issues/15025).

- `pnpm install` now re-fetches a package from a custom resolver when
the `integrity` of its resolution changes, with or without
`enableGlobalVirtualStore`. It used to update the lockfile but keep the
old files in `node_modules`
[#&#8203;15670](https://redirect.github.com/pnpm/pnpm/issues/15670).

- `pnpm install` now rejects invalid results from a `readPackage` hook.
A hook that returns a non-object value fails with
`ERR_PNPM_BAD_READ_PACKAGE_HOOK_RESULT`
[#&#8203;15730](https://redirect.github.com/pnpm/pnpm/issues/15730). A
hook that sets a dependency range to a value other than a string, such
as `undefined`, fails with an error that names the dependency, the
package and the pnpmfile. Delete the property to remove a dependency
[#&#8203;15705](https://redirect.github.com/pnpm/pnpm/issues/15705).

##### Global packages, pnpm versions, and runtimes

- `pnpm update --global` now reinstalls the global packages that pnpm 10
installed into the previous global directory, `<global-dir>/5`, so their
commands are linked into the pnpm home `bin` directory again and `pnpm
list --global` lists them. Once every package is migrated, pnpm deletes
the previous directory and the commands pnpm 10 linked into the pnpm
home
[#&#8203;11528](https://redirect.github.com/pnpm/pnpm/issues/11528).

- A signal sent to pnpm, such as `SIGTERM`, now reaches the pnpm that
pnpm switches to because of `packageManager` or
`devEngines.packageManager`, and the one that `pnpm with` runs. The
signal used to be dropped, so scripts running under that pnpm never got
to shut down
[#&#8203;9948](https://redirect.github.com/pnpm/pnpm/issues/9948).

- On arm64 musl Linux, such as Alpine on ARM, switching to a pinned pnpm
older than 12 now runs the JavaScript `pnpm` package. The standalone
executable of those versions crashed at startup on that platform
[#&#8203;10443](https://redirect.github.com/pnpm/pnpm/issues/10443).

- Global shims such as `node` now work when pnpm runs through a relative
symlink, as with a Homebrew install. They were copies of that symlink
and did not resolve from the global bin directory
[#&#8203;15691](https://redirect.github.com/pnpm/pnpm/issues/15691).

- `pnpm env remove --global` deletes Node.js versions that pnpm
installed into its own store, including when another tool installed pnpm
[#&#8203;8357](https://redirect.github.com/pnpm/pnpm/issues/8357).

- `pnpm self-update` no longer suggests a downgrade when
`minimumReleaseAge` holds back the registry's `latest` release. It now
says that release is still within the cutoff
[#&#8203;12006](https://redirect.github.com/pnpm/pnpm/issues/12006).

##### Windows

- Interrupting a script with Ctrl+C on Windows no longer leaves the
terminal stuck
[#&#8203;14860](https://redirect.github.com/pnpm/pnpm/issues/14860). A
script that runs through a batch shim, as `vite dev` does through
`vite.CMD`, made cmd.exe wait forever on its "Terminate batch job
(Y/N)?" answer, and every following keystroke went to that prompt. pnpm
now ends a cmd.exe script shell once it has sat for a second after the
interrupt with nothing running under it. A script that takes longer to
shut down is still waited for. A second Ctrl+C ends the script's shell
at once.

- On Windows, `pnpm run` now passes the arguments after the script name
to the script as typed. Before, `cmd` expanded `%VAR%` in them and
backslashes arrived doubled. Line breaks still arrive as the two
characters `\n`, because `cmd` cannot pass them. The command line pnpm
prints for the script quotes the arguments the same way on every
platform
[#&#8203;16257](https://redirect.github.com/pnpm/pnpm/issues/16257).

- The Windows `pnpm.exe` runs on a clean Windows install that does not
have the Visual C++ Redistributable. It used to exit immediately on
startup because that runtime was missing
[#&#8203;15723](https://redirect.github.com/pnpm/pnpm/issues/15723).

- On Windows, the `.cmd` command shims in `node_modules/.bin` now keep a
`%` in the project path. Before, cmd.exe expanded it as a variable
reference, so the command received a mangled `NODE_PATH`
[#&#8203;15716](https://redirect.github.com/pnpm/pnpm/issues/15716).
Command shims also run tools whose paths contain non-ASCII characters
[#&#8203;6999](https://redirect.github.com/pnpm/pnpm/issues/6999),
including the PowerShell shims in Windows PowerShell 5.1
[#&#8203;16217](https://redirect.github.com/pnpm/pnpm/issues/16217).

- Bin shims in `node_modules/.bin` run from Cygwin on Windows again. The
shims passed a `/cygdrive/c/...` path to the Windows `node` found on
`PATH`, so Node.js failed with `Cannot find module 'C:\cygdrive\c\...'`
[#&#8203;12845](https://redirect.github.com/pnpm/pnpm/issues/12845).

- On Windows, installing pnpm with npm inside a project now writes
`node_modules/.bin` shims that run `pnpm.exe`. A global install with
`npm install --location=global` now gets the same shims as `npm install
-g` [#&#8203;15688](https://redirect.github.com/pnpm/pnpm/issues/15688).

- `pnpm install` no longer fails with `ERR_PNPM_WORKSPACE_INVALID_GLOB`
on Windows for a wildcard pattern such as `plugins/*/*` in
`pnpm-workspace.yaml` when the workspace is on a different drive than
the pnpm cache or state directory
[#&#8203;16239](https://redirect.github.com/pnpm/pnpm/issues/16239).

- On Windows, `pnpm install` no longer skips a dependency's build script
on a later install when the package ships an executable file and the
script changes nothing inside the package directory
[#&#8203;15667](https://redirect.github.com/pnpm/pnpm/issues/15667).

- `pnpm setup` no longer writes the `pn.ps1`, `pnpx.ps1`, and `pnx.ps1`
PowerShell wrappers. It also removes the ones an earlier setup wrote.
PowerShell now runs `pn`, `pnpx`, and `pnx` through their `.cmd`
wrappers, like `pnpm` itself. Before, these aliases failed with a "not
digitally signed" error wherever the execution policy blocks unsigned
scripts
[#&#8203;8444](https://redirect.github.com/pnpm/pnpm/issues/8444).

- `pnpm setup` on Windows no longer panics when an unrelated environment
variable has a name containing a non-ASCII character. It skips that
variable
[#&#8203;15684](https://redirect.github.com/pnpm/pnpm/issues/15684).

- On Windows, `pnpm setup` repairs the `PNPM_HOME` registry type left by
older pnpm versions, even when the configured directory has not changed.

- On Windows, the `ERR_PNPM_BAD_ENV_FOUND` error of `pnpm setup` now
shows the value `PNPM_HOME` is currently set to. Before, it showed the
directory pnpm wanted to set.

- On Windows, pnpm expands nested `%VAR%` references in `PNPM_HOME` and
the other directory environment variables it uses for its home, store,
cache, state, and config directories. pnpm fails with an error when a
`%VAR%` reference remains after expansion
[#&#8203;13236](https://redirect.github.com/pnpm/pnpm/issues/13236).

- On Windows, if the global bin directory is not in `PATH` and a `PATH`
entry still contains an unexpanded variable such as `%PNPM_HOME%`, the
error now names that entry. A variable referenced from the user `Path`
must be set to a full path and stored as a plain string (`REG_SZ`) for
the entry to expand
[#&#8203;5283](https://redirect.github.com/pnpm/pnpm/issues/5283).

##### Inspecting dependencies

- `pnpm audit` and `pnpm audit signatures` now fail with an error when
the lockfile contains unresolvable dependency references
[#&#8203;13638](https://redirect.github.com/pnpm/pnpm/issues/13638).

- `pnpm licenses list` now reports the actual on-disk package locations
when using `nodeLinker: hoisted` or `shamefully-hoist: true`
[#&#8203;8589](https://redirect.github.com/pnpm/pnpm/issues/8589). With
`--json`, its `paths` array now includes every installed copy of a
package, including hoisted copies and isolated installations with
different peer dependencies.

- `pnpm root` now prints the configured `modulesDir`. It used to print
`node_modules` regardless of the setting. A project's own `modulesDir`
from `packageConfigs` is printed too
[#&#8203;9113](https://redirect.github.com/pnpm/pnpm/issues/9113).

##### Output and messages

- With the default and append-only reporters, installs with `--loglevel
warn` or `--loglevel error` now print the full output of a failed
install script. The output of successful scripts, including the root
project's own install hooks, stays hidden. With `--loglevel warn`, pnpm
also prints ignored build script warnings.

- When a dependency fails to resolve, the error now shows the cause. For
example, a Node.js runtime download behind a proxy that re-signs TLS now
reports `invalid peer certificate: UnknownIssuer`
[#&#8203;9556](https://redirect.github.com/pnpm/pnpm/issues/9556).

- When installing a git dependency over SSH fails with `Permission
denied (publickey)`, pnpm suggests checking the loaded keys with
`ssh-add -l`. Resolving an SSH URL that refuses the key also shows a
local HTTPS rewrite that leaves the recorded URL alone
[#&#8203;13743](https://redirect.github.com/pnpm/pnpm/issues/13743).

- Lockfile verification now fails with `ERR_PNPM_TARBALL_URL_MISMATCH`,
`ERR_PNPM_TARBALL_REVISION_MISMATCH`, or
`ERR_PNPM_MISSING_NAMED_REGISTRY` when every rejected entry failed that
check. These failures were reported as the generic
`ERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION`.

- The lockfile verification error now suggests relaxing the policy that
flagged an entry only if a fresh resolution still fails and you trust
the affected packages. Errors from checks that no policy controls, such
as a missing tarball integrity, no longer suggest relaxing a policy
[#&#8203;14411](https://redirect.github.com/pnpm/pnpm/issues/14411).

- `pnpm install` no longer prints an extra `Progress:` line after the
progress line is marked `done`
[#&#8203;16184](https://redirect.github.com/pnpm/pnpm/issues/16184).

<!-- sponsors -->

#### Platinum Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a>
      </td>
      <td align="center" valign="middle">
<a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/openai_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/openai_light.svg" />
<img src="https://pnpm.io/img/users/openai_dark.svg" width="160"
alt="OpenAI" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a
href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/coderabbit.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/coderabbit_light.svg" />
<img src="https://pnpm.io/img/users/coderabbit.svg" width="220"
alt="CodeRabbit" />
          </picture>
        </a>
      </td>
    </tr>
  </tbody>
</table>

#### Gold Sponsors

<table>
  <tbody>
    <tr>
      <td align="center" valign="middle">
<a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/sanity.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/sanity_light.svg" />
<img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity"
/>
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/discord.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/discord_light.svg" />
<img src="https://pnpm.io/img/users/discord.svg" width="220"
alt="Discord" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/serpapi_dark.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/serpapi_light.svg" />
<img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160"
alt="SerpApi" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a
href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/stackblitz.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/stackblitz_light.svg" />
<img src="https://pnpm.io/img/users/stackblitz.svg" width="190"
alt="Stackblitz" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/workleap.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/workleap_light.svg" />
<img src="https://pnpm.io/img/users/workleap.svg" width="190"
alt="Workleap" />
          </picture>
        </a>
      </td>
    </tr>
    <tr>
      <td align="center" valign="middle">
<a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer">
          <picture>
<source media="(prefers-color-scheme: light)"
srcset="https://pnpm.io/img/users/nx.svg" />
<source media="(prefers-color-scheme: dark)"
srcset="https://pnpm.io/img/users/nx_light.svg" />
<img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" />
          </picture>
        </a>
      </td>
      <td align="center" valign="middle">
<a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes"
target="_blank" rel="noopener noreferrer"><img
src="https://pnpm.io/img/users/latitude.svg" width="160"
alt="Latitude"></a>
      </td>
    </tr>
  </tbody>
</table>

<!-- sponsors end -->

###
[`v12.7.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v12.7.0):
pnpm 12.7

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v12.6.0...v12.7.0)

pnpm 12.7.0 ships with `.nvmrc` and `.node-version` support in the
global `node` shim, `pnpm install --allow-build`, `pnpm publish
--publish-wait-timeout`, and `pnpm-workspace.yaml` created from the
`workspaces` field. `pnpm install --force` no longer installs optional
dependencies built for other platforms. This release also carries
security fixes for bin shims on Nix, for lifecycle scripts of packages
in a `storeDir` inside the workspace, and for `userAgent` placeholders
in `pnpm-workspace.yaml`.

##### Minor Changes

- `pnpm install --force` now keeps skipping optional dependencies whose
`os`, `cpu` or `libc` do not match the host. It still refetches every
package and lifts `engineStrict`. The new `forceIgnoresPlatform` setting
restores the previous behaviour, installing optional dependencies of
every platform under `--force`
[#&#8203;6133](https://redirect.github.com/pnpm/pnpm/issues/6133).

- The global `node` shim created by pnpm now uses the Node.js version
from the nearest `.nvmrc` or `.node-version` file when the project does
not declare a Node.js runtime in `devEngines.runtime` or
`engines.runtime`
[#&#8203;4471](https://redirect.github.com/pnpm/pnpm/issues/4471). The
nearest directory with a Node.js runtime declaration decides the
version. Within one directory, `package.json` takes precedence over
`.node-version`, which takes precedence over `.nvmrc`. An `.nvmrc` value
that only nvm can act on, such as `system` or a custom alias, is
ignored.

- `pnpm install` now supports the `--allow-build` option to selectively
allow or deny package lifecycle scripts and record them in
`pnpm-workspace.yaml`
[#&#8203;15388](https://redirect.github.com/pnpm/pnpm/issues/15388).

- Added `pnpm publish --publish-wait-timeout <milliseconds>` to wait for
published versions and their tarballs to become available from the
registry. Set `publishWaitTimeout` in `pnpm-workspace.yaml` to configure
a default. A value of `0` disables the check.

Recursive publishing confirms availability before publishing dependent
packages. If confirmation times out, the command fails.

When `pnpm publish -r --report-summary` fails after some uploads were
accepted, the summary file now lists those packages.

- `pnpm install` now creates `pnpm-workspace.yaml` from the `workspaces`
field of the root `package.json` when the repository has no
`pnpm-workspace.yaml`. The projects the field lists are linked on that
same install. An existing `pnpm-workspace.yaml` is never changed. With
`--ignore-workspace`, no file is created. If the `workspaces` field
later differs from `packages` in `pnpm-workspace.yaml`, pnpm prints a
warning
[#&#8203;2255](https://redirect.github.com/pnpm/pnpm/issues/2255).

- When a project pins a pnpm version or a runtime t

> ❗ **Important**
> 
> ✂ PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-30 03:16:47 +00:00
James ElliottandAmir Zarrinkafsh 3837cffa88 feat(handlers): derive authz response headers from user attributes (#9346) 
Each authz endpoint takes a headers option mapping a response header
name to a user attribute, so any standard, extended, or custom attribute
can be sent to the proxy. Remote-User, Remote-Groups, Remote-Name and
Remote-Email remain the default for every implementation except legacy.

Extended user details are only retrieved when a configured attribute
requires them, which is determined when the endpoint is built. Header
names and the attributes they resolve are validated at startup.

---------

Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
 2026-09-27 22:51:40 +00:00
James ElliottandAmir Zarrinkafsh eced48ac4a feat(configuration): template delimiters (#11907) 
Adds the `--config.filters.template.delimiter.left` and
`--config.filters.template.delimiter.right` options which customize the
delimiters used by the template file filter, allowing configuration
files to remain valid for their own file type so they can be linted.
This does not address validation against a schema.

In addition the `--config.experimental.filters` flag is renamed to
`--config.filters`, and the deprecated `expand-env` filter is removed in
favor of the `template` filter.

---------

Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
 2026-09-27 11:15:40 +00:00
Iacopo BenesperiandJames Elliott 93df65c242 docs: update smtp.md (#12791) 
Modified the information regarding the sender field by adding quotes to
the name before the email address to make it generally valid. Fixed a
typo and some punctuation.

Signed-off-by: Iacopo Benesperi <registrazioni@iacchi.org>
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
 2026-09-27 06:11:13 +00:00
Aram AkhavanandJames Elliott 98489d22b4 docs(oidc): update gitea (#13145) 
Signed-off-by: Aram Akhavan <1147328+kaysond@users.noreply.github.com>
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
 2026-09-27 06:05:02 +00:00
Andrew Best 25ac626d1e docs(oidc): update vault (#13188) 
I recently integrated my Vault instance with Authelia via OIDC. My Vault
instance configuration is managed as code via the Terraform Vault
Provider. Sharing my code here in case it helps the next person that
comes along.

---------

Signed-off-by: Andrew Best <40222285+ausfestivus@users.noreply.github.com>
 2026-09-27 06:01:29 +00:00
Danylo 9274f54766 docs(oidc): update mastodon (#13241) 
This updates the mastodon integration guide.
 2026-09-27 05:57:26 +00:00
Samuele b5b900f154 docs(oidc): update owncloud (#13277) 
Updated openCloud version from v7.2.2 to v7.2.4 and added notes
regarding desktop client integration and necessary customizations.

Signed-off-by: Samuele <25508578+sa20001@users.noreply.github.com>
 2026-09-26 13:44:51 +00:00
renovate[bot] 7c42bb95ad build(deps): update dependency @thulite/seo to v2.4.4 (#13270) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@thulite/seo](https://redirect.github.com/thuliteio/seo) | [`2.4.3` →
`2.4.4`](https://renovatebot.com/diffs/npm/@thulite%2fseo/2.4.3/2.4.4) |
![age](https://developer.mend.io/api/mc/badges/age/npm/@thulite%2fseo/2.4.4?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@thulite%2fseo/2.4.3/2.4.4?slim=true)
|

---

### Release Notes

<details>
<summary>thuliteio/seo (@&#8203;thulite/seo)</summary>

###
[`v2.4.4`](https://redirect.github.com/thuliteio/seo/blob/HEAD/CHANGELOG.md#244)

[Compare
Source](https://redirect.github.com/thuliteio/seo/compare/v2.4.3...v2.4.4)

##### Patch Changes

- [#&#8203;36](https://redirect.github.com/thuliteio/seo/pull/36)
[`5414c51`](https://redirect.github.com/thuliteio/seo/commit/5414c51d888e3317350b2abba3239be1f7b0e579)
Thanks [@&#8203;h-enk](https://redirect.github.com/h-enk)! - Refactor
SEO templates for improved localization and sitemap structure

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-26 13:44:06 +00:00
James Elliott 1eaa8d7899 feat(configuration): template filter values files (#9230) 
Adds the config.filters.values option and
X_AUTHELIA_CONFIG_FILTERS_VALUES environment variable to load YAML,
JSON, or TOML values files which are deep-merged in order and exposed to
the template filter as .Values, similar to Helm.
 2026-09-26 01:30:14 +00:00
renovate[bot] 84235d33ba build(deps): update dependency vite to v8.3.1 (#13271) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`8.3.0` →
`8.3.1`](https://renovatebot.com/diffs/npm/vite/8.3.0/8.3.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.3.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.3.0/8.3.1?slim=true)
|

---

### Release Notes

<details>
<summary>vitejs/vite (vite)</summary>

###
[`v8.3.1`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-831-2026-09-24-small)

[Compare
Source](https://redirect.github.com/vitejs/vite/compare/v8.3.0...v8.3.1)

##### Bug Fixes

- **deps:** update all non-major dependencies
([#&#8203;23482](https://redirect.github.com/vitejs/vite/issues/23482))
([3c752c8](https://redirect.github.com/vitejs/vite/commit/3c752c8932bc0599465ba4a6d8f44aaf1e934c3d))
- **deps:** update all non-major dependencies
([#&#8203;23537](https://redirect.github.com/vitejs/vite/issues/23537))
([e8990c4](https://redirect.github.com/vitejs/vite/commit/e8990c4d6101dfaca2654ed8ab4d0574ee920248))
- **deps:** update rolldown-related dependencies
([#&#8203;23483](https://redirect.github.com/vitejs/vite/issues/23483))
([9aecbbf](https://redirect.github.com/vitejs/vite/commit/9aecbbfa5fb5da4b9981c099cb9746a9fd210806))
- handle `server.ws: false` in mergeConfig
([#&#8203;23511](https://redirect.github.com/vitejs/vite/issues/23511))
([f68c0d5](https://redirect.github.com/vitejs/vite/commit/f68c0d5a28c96555431413e3e2cbe644337b087f))
- merge `build.rolldownOptions.output.comments` correctly
([#&#8203;23514](https://redirect.github.com/vitejs/vite/issues/23514))
([4aba8d8](https://redirect.github.com/vitejs/vite/commit/4aba8d8720e82e4c5b694a4b7877755a3f84fc57))
- **optimizer:** don't skip imports whose binding starts with type
([#&#8203;23540](https://redirect.github.com/vitejs/vite/issues/23540))
([39330f4](https://redirect.github.com/vitejs/vite/commit/39330f489a0ae08923557f0ce10a307d6662a3f5))
- **optimizer:** resolve pending discovered dep processing on close
before init
([#&#8203;23567](https://redirect.github.com/vitejs/vite/issues/23567))
([5f89433](https://redirect.github.com/vitejs/vite/commit/5f894339d27882fedc86bf6b1076fa6d92e404f3))
- **server:** avoid reinitializing watcher when adding file after server
close
([#&#8203;23572](https://redirect.github.com/vitejs/vite/issues/23572))
([6f831f9](https://redirect.github.com/vitejs/vite/commit/6f831f9b58ebda77638b514042ad8d160edfb928))
- **sourcemap:** skip URL source roots when injecting sources content
([#&#8203;23519](https://redirect.github.com/vitejs/vite/issues/23519))
([04fc30a](https://redirect.github.com/vitejs/vite/commit/04fc30a4b91870e65a436b3420620a2e02a94a41))

##### Miscellaneous Chores

- merge prereleases in changelog
([#&#8203;23466](https://redirect.github.com/vitejs/vite/issues/23466))
([99bd9d1](https://redirect.github.com/vitejs/vite/commit/99bd9d1d46153fa939f4a304cc0177db42e28776))
- **optimizer:** add debug log when waiting for dep before init
([#&#8203;23566](https://redirect.github.com/vitejs/vite/issues/23566))
([63567c7](https://redirect.github.com/vitejs/vite/commit/63567c73ac132e6384fef384e6b9f7e8d5a37fff))
- update `optimizeDeps.include` comment
([#&#8203;23489](https://redirect.github.com/vitejs/vite/issues/23489))
([6a84c72](https://redirect.github.com/vitejs/vite/commit/6a84c72100da4e4be4badb2d9a0026279b4df136))

##### Code Refactoring

- assets regexp use non-capture
([#&#8203;23491](https://redirect.github.com/vitejs/vite/issues/23491))
([f4b4431](https://redirect.github.com/vitejs/vite/commit/f4b4431a2f9097fd9bbb7aaebbf1b63c4b54dea1))
- remove duplicate configurations
([#&#8203;23532](https://redirect.github.com/vitejs/vite/issues/23532))
([9abd99b](https://redirect.github.com/vitejs/vite/commit/9abd99bfdd3117149d6faf87fc37bc9899b1c998))
- replace `find` with `some`
([#&#8203;23554](https://redirect.github.com/vitejs/vite/issues/23554))
([af7cdf6](https://redirect.github.com/vitejs/vite/commit/af7cdf6964f124f58d66037e808fe687654948e2))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-25 13:59:28 +00:00
James ElliottautheliabotAmir Zarrinkafsh
 		ee1353725f feat(configuration): add support for toml and json (#9223) 
This adds support for TOML and JSON across various areas of the Authelia
application. The format of a file is
determined by its extension, with '.toml' handled as TOML, '.json' as
JSON, and everything else as YAML which
preserves the existing behavior.

This applies to the configuration (including directories which mix
formats), the file user provider database which is
now written back in the same format it was read in, and the storage user
identifier, TOTP, and WebAuthn exports and
imports which are encoded via their existing data models so every format
produces the documented shape.

---------

Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
Co-authored-by: autheliabot <autheliabot@users.noreply.github.com>
Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
 2026-09-25 13:48:12 +00:00
James Elliott 27926195b0 docs: fix missing headers and additional providers (#13266) 
This fixes the required headers for the pretty modules.
 2026-09-25 10:33:43 +00:00
James ElliottandAmir Zarrinkafsh d8a1429114 docs: update descriptions (#11746) 
Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
Co-authored-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
 2026-09-25 10:33:15 +00:00
Amir Zarrinkafsh 767463ae82 ci(buildkite): group pipeline steps (#13258) 
Organises the dynamic pipeline into four Buildkite group steps so the
build page reads as stages rather than one flat list:
`:hammer_and_wrench: Lint, Unit Test and Build` (Linting, Unit Test,
Build Image [coverage]), `:test_tube: Tests` (Integration Tests),
`:test_tube: External Tests` (External Tests) and `:rocket: Deploy`
(Deploy Manifest, Deploy Artifacts, Deploy AUR, Deploy APT).
`Vulnerability Scanning` and the `Trigger Pipeline` steps stay at the
top level.

Buildkite appends dynamically uploaded steps to the group containing the
uploading step only when the uploaded pipeline's first step is a group
whose name matches, so `e2etests.sh`, `e2epackages.sh` and
`aurpackages.sh` now emit their steps beneath a matching `group` key.
The suites therefore land inside `:test_tube: Tests`, `:test_tube:
External Tests` and `:rocket: Deploy` alongside the step that spawned
them instead of at the end of the pipeline. The group names, emoji
included, are byte-identical on both sides of the upload for that
reason.

Retires the `:selenium:` emoji, which has been wrong since the suites
moved to `github.com/go-rod/rod`: the suite steps are now `:chrome:`,
which is what go-rod actually drives over CDP. That emoji is a selector
rather than decoration, so the six `BUILDKITE_LABEL` conditions in
`post-checkout`, `pre-command` and `post-command` that gate `go mod
download`, the coverage image load, the codecov and Test Engine uploads,
the screenshot annotations and the container cleanup move with it.
`Integration Tests`, `External Tests` and `Deploy AUR` take
`:buildkite:`, both because it describes what those steps do — they only
run `buildkite-agent pipeline upload` — and because leaving the first
two on `:chrome:` would make them match the suite conditions. The AUR
package steps they upload move from `:linux:` to `:arch:`, which is the
distribution they actually publish to. The set of labels selected by
each condition is unchanged.

Also corrects the two documentation pages that still described the
suites as Selenium and chromedriver.

No step attribute changes: every `command`, `key`, `depends_on`,
`agents`, `retry`, `concurrency` and `if` is carried over untouched, and
keys remain globally unique so the existing cross-step dependencies
(`unit-test`, `build-docker-linux`, `build-docker-linux-coverage`,
`artifacts`) resolve across group boundaries.

Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
 2026-09-25 10:09:21 +00:00
renovate[bot] 3cf4d513b2 build(deps): update dependency prettier to v3.9.9 (#13262) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [prettier](https://prettier.io)
([source](https://redirect.github.com/prettier/prettier)) | [`3.9.8` →
`3.9.9`](https://renovatebot.com/diffs/npm/prettier/3.9.8/3.9.9) |
![age](https://developer.mend.io/api/mc/badges/age/npm/prettier/3.9.9?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/prettier/3.9.8/3.9.9?slim=true)
|

---

### Release Notes

<details>
<summary>prettier/prettier (prettier)</summary>

###
[`v3.9.9`](https://redirect.github.com/prettier/prettier/blob/HEAD/CHANGELOG.md#399)

[Compare
Source](https://redirect.github.com/prettier/prettier/compare/3.9.8...3.9.9)


[diff](https://redirect.github.com/prettier/prettier/compare/3.9.8...3.9.9)

##### Markdown: Fix text with `$` been incorrectly parsed as math syntax
([#&#8203;20140](https://redirect.github.com/prettier/prettier/pull/20140)
by [@&#8203;fisker](https://redirect.github.com/fisker))

<!-- prettier-ignore -->

```md
<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

<!-- Prettier 3.9.8 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here.

<!-- Prettier 3.9.9 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
```

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImphdmFzY3JpcHQiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-25 06:32:02 +00:00