[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
pnpm (source)	11.25.0 → 12.4.1

---

Release Notes

pnpm/pnpm (pnpm)

v12.4.1: pnpm 12.4.1

Compare Source

pnpm 12.4.1 fixes installs that failed on filesystems refusing hard links or clones, on Android, and under nodeLinker: hoisted. Repeat installs are faster.

Patch Changes

Installing packages

• pnpm install no longer fails with Operation not permitted when the filesystem refuses a hard link or a copy-on-write clone #​14722. Under packageImportMethod: auto and clone-or-copy, pnpm copies the file instead. EdenFS checkouts, which have no hard links, and rootless containers, which refuse the clone syscall, both hit this. An explicit packageImportMethod: hardlink or clone still reports the error.

  pnpm also copies a package file whose store entry has reached the filesystem's limit on names for one file, 1024 on NTFS and 65000 on ext4. Such a file failed the install under packageImportMethod: hardlink, and under auto it stopped pnpm hard linking for the rest of the install.

• pnpm install no longer writes a package file through a symlink left at the path it is importing to. Copying such a file overwrote whatever the link pointed at, and created that file when the link pointed nowhere. An executable package file also made the link's target executable.

• Fixed pnpm install and pnpm dlx on Android. Registry requests crashed because pnpm found no system CA certificates, so pnpm uses bundled ones there #​14777. Imports also failed with "Permission denied" on filesystems that deny hard links and reflinks, and now fall back to copying #​14780.

• pnpm install no longer fails with "Invalid cross-device link" while preserving a package's nested node_modules directory during a Docker build #​14758.

• pnpm install no longer fails on a package tarball that carries a file at the archive root, such as the ._* entries macOS tar adds #​14701. The file is installed at the root of the package.

  A file: tarball packed without the usual package/ directory is now recorded under the name and version from its own package.json. It was recorded under the alias the dependency was given, at version 0.0.0.

• Under nodeLinker: hoisted, pnpm install no longer re-imports packages that are already in place. A repeat install replaced the whole node_modules tree and reported Packages: +N. A package is still imported when its directory is missing, when its package.json no longer carries the installed version, when it is a file: dependency, and when it is patched. Lifecycle scripts no longer run again for a package left in place, and pnpm rebuild and a change to allowBuilds still reach it.

• pnpm install now runs a dependency's build scripts again when its side-effects cache entry has no files to restore #​14717. Such builds were skipped and nothing was put in their place, so a script whose whole effect lands outside its own package directory, such as a git hook installer, never took effect. pnpm no longer publishes empty artifacts to the shared side-effects cache either.

Resolving and linking dependencies

• pnpm install, pnpm add, and pnpm dedupe now apply ignoredOptionalDependencies #​14729. Matching optional dependencies are left out of the lockfile and are not installed. pnpm 12 installed them whenever it resolved dependencies from scratch.

• pnpm install no longer links a transitive dependency to a workspace package when linkWorkspacePackages is true and the dependency is declared with a plain version range #​14781. Enabling preferWorkspacePackages does not change this. Set linkWorkspacePackages: deep to link them.

• pnpm install no longer leaves dangling dependency links in workspace packages located above the workspace root #​14726.

• pnpm install and pnpm add no longer leave a dangling symlink in node_modules when a project starts depending directly on a package that the lockfile holds only as a transitive dependency with resolved peer dependencies #​14714.

• pnpm dedupe now keeps a compatible auto-installed peer when another workspace project depends on a newer major #​14697. Repeated runs alternated between compatible and incompatible peer versions.

• pnpm peers check no longer reports a peer dependency declared as workspace:^, workspace:~, or a bare workspace: as unmet #​14770. pnpm reported these as unmet whatever version the linked workspace project supplied.

Performance

• Sped up repeat installs #​14540. pnpm checks the store's files only for the packages it links into node_modules, instead of every package in the lockfile. Creating the command shims in node_modules/.bin makes about 1,500 fewer filesystem calls in a 76 project workspace. Installs that use the global virtual store read their slot paths from the cache directory instead of deriving them every time. Verifying a large lockfile also allocates less memory.

• Sped up pnpm install in Cargo workspaces with many member crates. Repeated installs reuse verified Cargo checksum metadata.

• Installing several packages from the same Git repository and commit now downloads the source once per install #​14725. Each package still runs its prepare scripts in its own copy of the checkout.

Running scripts and tasks

• pnpm now passes Ctrl+C on to the script or command it started and waits for it to shut down #​14723. pnpm exited first, so a script that was still writing landed on the shell prompt.

• pnpm run "/pattern/" --no-bail now lets every matched script finish after one of them fails #​14718. The command exits with ERR_PNPM_RUN_FAILED, and its message lists the scripts that failed in the order they were selected.

• pnpm pipeline no longer fails on a project that tracks a symlink, such as a CLAUDE.md pointing at AGENTS.md #​14692. Changing a symlinked input's target invalidates that task's cache, and pnpm pipeline --no-cache no longer hashes task inputs.

Commands

• pnpm add -g, pnpm update -g, and pnpm remove -g no longer change global bins or install directories after reading only part of an installed package group #​13796. If any declared package manifest is missing, malformed, or unreadable, pnpm now fails before it activates or removes anything and leaves the existing global installation intact.

• pnpm dedupe now processes every workspace project by default, including workspaces that keep a separate lockfile per project #​14732. Workspace filters select which projects it processes, and --fail-if-no-match exits with an error when no project matches.

• pnpm update <name>@<version> now keeps the range operator the manifest declares #​14745. Running pnpm update react@19.3.0 on "react": "^19.2.8" writes "react": "^19.3.0". A jsr: entry keeps its jsr: prefix, and a plain pnpm update now moves a jsr: range the way it moves an npm range.

• pnpm --filter directory selectors now support ? wildcards and character classes such as [ab]. A * or ? wildcard no longer selects a directory whose name starts with a dot, as on pnpm 11.

• pnpm deploy --legacy now prefers the dependency versions pinned in the source workspace lockfile when they still satisfy the deployed project's range #​13857.

• pnpm sbom now leaves out a package's author field when the manifest author name is empty or contains only whitespace #​14685. In a filtered or split workspace run, only a project with no author field inherits the workspace root's author.

  pnpm sbom --sbom-format spdx now writes creationInfo.created with whole seconds, such as 2026-09-08T10:38:21Z #​14684. The fractional seconds it carried were rejected by strict SPDX consumers.

Configuration

• The updateConfig pnpmfile hook now receives the resolved configuration, including settings that came from .npmrc, the command line, or a default #​14676. Scoped registries are reported under registriesByScope, and a hook may rewrite that map to change where packages are fetched from. Registry credentials are reported under configByUri, as pnpm 11 reports them. An unset setting is left out rather than reported as null.

• pnpm audit --fix and the minimumReleaseAgeStrict approval prompt now keep the comments in minimumReleaseAgeExclude when they append an entry to it in pnpm-workspace.yaml. The rest of the list is left as written, and the trustPolicyExcludePrune and minimumReleaseAgeExcludePrune cleanups keep the comments of the entries they retain.

  pnpm install and pnpm dedupe now run those cleanups too #​14759. Only pnpm add, pnpm update, and pnpm remove pruned the entries that the freshly written lockfile no longer resolves.

• pnpm config set --global node-download-mirrors no longer rejects the key #​13611. The global config file already accepted nodeDownloadMirrors, but the command refused to write it.

• NO_PROXY entries that start with a dot, such as .npmjs.org, now bypass the proxy for the domain and its subdomains #​14686.

• pnpm no longer creates a project pnpm-lock.yaml when devEngines.packageManager.onFail is download and lockfile writing is off through lockfile: false or --no-lockfile #​14728. pnpm still switches to the pinned version.

• pnpm now writes node_modules/.package-map.json only when nodeExperimentalPackageMap is enabled. Nothing reads the file without that setting, and an install that stops writing the map removes the one a previous install left.

Windows

• pnpm pipeline no longer fails with intermittent access denied errors when concurrent tasks save their cache entries on Windows.

• Windows filesystem operations now retry permission errors for up to one second #​14682. A permanent permission error delayed the failure by a minute. Sharing and lock violations keep their one minute retry budget.

Messages and output

• pnpm now warns when the root package.json declares a non-empty workspaces array and the project has no pnpm-workspace.yaml #​2255. Such an install linked no project and said nothing about why.

• ERR_PNPM_PACKAGE_MANAGER_REMOVE_MODULES_DIR now names the file or directory in node_modules that pnpm could not clean up. It reported only the underlying OS error, such as "Access is denied (os error 5)".

• pnpm --help no longer describes pnpm as experimental.

Platinum Sponsors

Gold Sponsors

v12.4.0: pnpm 12.4

Compare Source

Minor Changes

• pnpm can now manage npm, Python, and Cargo dependencies in the same workspace. Enable python.enabled or cargo.enabled in pnpm-workspace.yaml, then use pnpm install to install them together.

  • Add Python packages with pnpm add pypi:<package>. pnpm uses pyproject.toml, pylock.toml, and a managed .venv. Frozen and offline installs are supported, and pnpm run and pnpm exec make the environment's executables available #​14566.
  • Add Rust crates with pnpm add crate:<package>. pnpm supports crates.io and custom sparse registries configured with cargo.indexUrl. Registry authentication supports pnpm credentials and, for crates.io, CARGO_REGISTRY_TOKEN or $CARGO_HOME/credentials.toml.

  Both ecosystems support faster dependency resolution through pnprServer, with local resolution as a fallback when the server does not support it.

• Added pnpm pipeline [name] to install frozen dependencies and run workspace tasks declared in pipelines. It selects affected projects, runs their task graph, and continues running tasks after a task fails.

  Tasks support inputs, outputs, env, and cache settings. Cached results restore task outputs and replay logs. Cargo tasks can reuse local build state between worktrees with tasks.<name>.cargoTargetDir. Set includeWorkspaceRoot: true to include root tasks.

  Use pnpm pipeline --dry-run to preview the task graph without installing configuration dependencies or running workspace hooks.

• Added support for Android on arm64 and x64, FreeBSD on x64, and Linux on ppc64le, s390x, and RISC-V (riscv64 with glibc) #​14431, #​14597, #​7582.

• Added trustPolicyExcludePrune to automatically remove unused versions and packages from trustPolicyExclude when running pnpm add, pnpm update, or pnpm remove. It is disabled by default. Package name patterns such as @scope/* are kept, and cleanup is skipped when sharedWorkspaceLockfile is false.

• Added pnpm change check for CI validation of package versions against the versioning.epics bands and versioning.fixed groups in pnpm-workspace.yaml. It reports all violations, including packages that are not part of the current release.

Patch Changes

• Registry metadata is now kept separate for registries with different URL paths or schemes. This prevents installs from using another registry's package versions or tarball URLs, and keeps metadata fetched over HTTP from being reused for HTTPS #​13558.

  The first install after upgrading refetches registry metadata. The package store is unchanged. pnpm cache view now shows full registry URLs. Scripts that parse the directory names from pnpm cache list-registries or pnpm cache list need updating.

• Patches that add build scripts or a binding.gyp now trigger a build, subject to build approval. Unapproved builds appear under "Ignored build scripts" #​14648.

• Build scripts can now be rejected before installing a package with pnpm add --allow-build=!<pkg>, including global installs. pnpm approve-builds <pkg> and pnpm approve-builds !<pkg> also save decisions when no packages are awaiting approval. They warn if the named package is not awaiting approval #​14067.

• A registry configured in .npmrc now takes precedence over registry settings saved by pnpm login in the global config.yaml. This fixes installs using the wrong registry after login #​14614.

• Large downloads over slow connections no longer time out while data is still arriving. fetch-timeout now limits how long a request can go without making progress #​14604.

• Sped up installs in workspaces with many projects when reusing a warm global virtual store #​14540.

• pnpm deploy is faster in large workspaces and no longer fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH when the project includes a .pnpmfile.mjs #​14539, #​14671.

• pnpm add --workspace <pkg> works again. It saves the dependency with the workspace: protocol and links it from the workspace. The command fails if no workspace project provides the package #​14602.

• pnpm add and pnpm install now accept protocol-prefixed selectors such as jsr:@scope/pkg, npm:pkg@^1.0.0, and workspace:pkg@* #​14590. Installs with JSR dependencies in the lockfile also no longer fail with ERR_PNPM_META_FETCH_FAIL #​14649.

• Boolean flags now accept explicit inline values. For example, pnpm install --prod=false installs devDependencies, while --prod=true skips them #​14553.

• pnpm install <pkg> now accepts --offline and --prefer-offline, as pnpm add <pkg> already did #​14194.

• Fixed pnpm install --frozen-lockfile rejecting a freshly generated lockfile when overrides use relative file: or link: paths in a workspace #​14555.

• Fixed installs with config dependencies failing on symlinked lockfiles, such as those used by Bazel and Nix, when the config dependencies have not changed. Updates that would write through a symlink remain disallowed. Updating config dependencies also preserves lockfiles that start with a byte order mark #​14372.

• Fixed package manager version pins being written to the wrong lockfile when lockfileDir is set. The pins also remain consistent across commands when version switching is disabled, avoiding unnecessary lockfile changes #​14633, #​14575.

• pnpm import now respects lockfileDir and branch lockfiles without modifying other lockfiles. Failed imports restore the destination lockfile #​14563.

• pnpm patch-commit now produces valid patches when files are added or deleted. pnpm install also accepts patches that delete files without listing their contents, and patch files with CRLF line endings #​14559, #​14557.

• Fixed version ranges with partial upper bounds. For example, <=16 now includes all 16.x versions, and >=0.11 <=3 correctly accepts 3.0.1 #​14419.

• Workspace package patterns now support . and .. segments and repeated slashes. Patterns such as ./packages/* and exclusions such as !./packages/foo now match correctly #​14571.

• packageConfigs settings now apply to the specified projects when sharedWorkspaceLockfile is false, including overrides, hoist, modulesDir, saveExact, and savePrefix. Workspaces with a shared lockfile report which entries were ignored #​14556.

• pnpm run and pnpm exec no longer report a changed workspace structure after a successful install when sharedWorkspaceLockfile is false and verifyDepsBeforeRun is enabled #​14588.

• Commands run from a project's subdirectory now find the nearest ancestor with a manifest. This fixes commands such as pnpm bin returning paths under the wrong directory. pnpm init still creates its manifest in the current directory, and pnpm exec still runs there #​14622.

• Relative scriptShell paths in pnpm-workspace.yaml now resolve from the workspace root, including when scripts run in nested packages. Bare command names such as bash still use PATH #​14422.

• Fixed installing the pnpm version pinned in packageManager when nodeLinker is hoisted. Managed Node.js, Deno, and Bun installations also work when the global config uses nodeLinker: hoisted #​14595.

• The JavaScript pnpm can again switch to a project's pinned pnpm version on platforms without a native binary for that version, such as Alpine Linux with pnpm 10 or Intel Macs with pnpm 11. If a native pnpm version does not support the platform, the error now names the missing target #​13622.

• Provisioning Yarn 6 now uses GH_TOKEN or GITHUB_TOKEN when available to avoid GitHub's anonymous API rate limit in CI. Tokens are only sent when strict-ssl is enabled.

• Fixed concurrent installs sharing a global virtual store on macOS failing with "failed to import ... No such file or directory" #​14560.

• Fixed pnpm setup failing with ERR_PNPM_DIRECTORY_FETCHER_PATH_ESCAPE on Windows. Local file: dependencies whose directories are symlinks or junctions are now packed correctly #​14618.

• On Windows, installs now retry replacing command shims temporarily locked by another process #​14549.

• Fixed argument forwarding on Windows with shellEmulator enabled. Paths ending in a backslash, line breaks, and literal shell expressions are preserved #​14548.

• Windows store paths now consistently use backslashes in pnpm store path output and in the storeDir and virtualStoreDir fields of node_modules/.modules.yaml.

• Invalid certificates in ca or cafile no longer cause an Invalid CA certificate error. Valid certificates still apply, and blank cert or key values are treated as unset #​14646.

• Installs now respect the archive extraction concurrency limit even after a download is abandoned #​14585.

• pnpm audit summaries now exclude advisories ignored through auditConfig.ignoreGhsas and report them separately. When all advisories are ignored, the summary says so #​14535.

• pnpm pack --json now reports errors as JSON. Lifecycle script output appears before the final JSON output.

• pnpm outdated -r now wraps the Dependents column, keeping the table readable when many workspace projects use the same dependency #​14591.

• Shell completions now support the pn alias in bash, fish, pwsh, and zsh #​11955.

• pnpm version now accepts -m as a short alias for --message #​14567.

Platinum Sponsors

Gold Sponsors

v12.3.4: pnpm 12.3.4

Compare Source

Patch Changes

• Sped up dependency resolution in large workspaces #​14352.

• pnpm 12 now accepts the boolean settings as command-line flags on every command that takes them in pnpm 11, for example pnpm install --unsafe-perm, pnpm add foo --offline, and pnpm install --dangerously-allow-all-builds. pnpm 12 rejected them with unexpected argument, which failed every install on Vercel, whose build runs pnpm install --unsafe-perm #​14346.

  pnpm remove now accepts --unsafe-perm, the same flag pnpm install, pnpm add, and pnpm update take.

Platinum Sponsors

Gold Sponsors

v12.3.3: pnpm 12.3.3

Compare Source

Patch Changes

• Fixed concurrent installs sharing a store occasionally failing with an ENOENT error while importing a package file #​14353.

• Sped up writing the lockfile in large workspaces #​14352.

• Sped up dependency resolution in large workspaces #​14352.

• pnpm now runs through Node.js when it was installed by a tool that skips build scripts, such as Vercel's packageManager provisioning, Bun, Deno, or npm install --ignore-scripts. Those installs previously failed with syntax error near unexpected token ')'. They still cannot run pnpm on Windows. On macOS only a shell can start it #​14346.

Platinum Sponsors

Gold Sponsors

v12.3.2: pnpm 12.3.2

Compare Source

Patch Changes

• pnpm audit --fix update no longer aborts when a vulnerable package has no safe version inside its declared range #​14508. The run updates every package it can and lists the rest as remaining.

• pnpm install no longer reruns root lifecycle scripts when the global virtual store contains an unfinished-build marker in a package slot that the current lockfile does not use pnpm/pnpm#14485.

• Sped up installs that have no lockfile. pnpm now links packages whose dependency subtree has no peer dependencies into the virtual store while resolution is still running.

• pnpm run and pnpm exec now start without reinstalling on filesystems that keep sub-millisecond mtimes, such as NTFS. Previously, every run on those filesystems reinstalled first pnpm/pnpm#14486.

• pnpm import now keeps the versions recorded in package-lock.json, npm-shrinkwrap.json, or yarn.lock when it generates pnpm-lock.yaml. A range in package.json, a catalog, or an override still decides which versions are eligible, and the recorded version is preferred among them. The generated lockfile previously could pin newer versions than the source lockfile #​14476.

  pnpm import in a workspace now imports every workspace project into the shared lockfile. It previously imported only the project in the current directory.

  pnpm import now fails with ERR_PNPM_LOCKFILE_NOT_FOUND when none of the three source lockfiles is present. It also fails with ERR_PNPM_YARN_LOCKFILE_PARSE_FAILED when it cannot parse yarn.lock. It previously generated a lockfile from scratch in both cases.

  pnpm import always resolves locally. It warns when --pnpr-server or the pnpr-server setting is given and does not use the server.

• Sped up installs in large workspaces. Discovering the workspace projects no longer enumerates every matched directory to learn which manifest files it holds #​14352.

• Sped up installs in large workspaces. The resolver and the peer pass allocate less for every dependency edge #​14352.

• pnpm self-update, pnpm with, and automatic package-manager version switching no longer wait through registry retry delays when a configured registry has no signatures and registry.npmjs.org is unavailable #​14483.

• Sped up installs in large workspaces. Saving the lockfile is faster, and the install finishes without waiting for memory cleanup #​14352.

• pnpm install now relinks workspace packages when publishConfig.linkDirectory changes. Frozen installs report an outdated lockfile until it is regenerated pnpm/pnpm#14488.

• The pnpm npm wrapper keeps its placeholder shebang-less so pnpm 11 can install pnpm 12 through the version store. Wrapper installs must allow lifecycle scripts to install the native binary #​14502.

• Sped up dependency resolution when there is no lockfile, and for the dependencies a lockfile does not cover.

• Sped up installs in large workspaces. Workspace link: targets and importer ids are now derived from the paths' suffixes under the workspace root #​14352.

• pnpm install now reports "Already up to date" when local tarball dependencies have not changed #​14495.

• pnpm update now accepts --ignore-scripts and skips lifecycle scripts during the update pnpm/pnpm#14512.

• Sped up installs that restore a deleted node_modules from a warm global virtual store. pnpm no longer re-links packages that are already fully present in the global virtual store #​14510.

Platinum Sponsors

Gold Sponsors

Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 86ef137

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@tailor-platform/create-sdk

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/create-sdk@86ef137

@tailor-platform/eslint-plugin-sdk

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/eslint-plugin-sdk@86ef137

@tailor-platform/sdk

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk@86ef137

@tailor-platform/sdk-plugin-seed

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk-plugin-seed@86ef137

@tailor-platform/sdk-plugin-setup

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk-plugin-setup@86ef137

@tailor-platform/sdk-plugin-tailordb-erd

pnpm add https://pkg.pr.new/tailor-platform/sdk/@tailor-platform/sdk-plugin-tailordb-erd@86ef137

commit: 86ef137

[github-actions]

🤖 Claude Dependency Review

✅ Recommended Actions

None — safe to merge after testing. This major version update includes performance improvements and is backward compatible for this project's usage patterns. No code changes required.

📦 Update Summary

• Library: pnpm
• Version: 11.25.0 → 12.3.4
• Change Type: Major

📝 Release Notes

Full Release History: pnpm v11.25.0...v12.3.4

Key Releases:

• v12.3.4 - Performance improvements and flag compatibility fixes
• v12.3.3 - Concurrent install fixes and performance improvements
• v12.3.2 - Audit fixes and install optimizations
• v12.3.1 - Workspace performance improvements
• v12.3.0 - Native executables and trust policy improvements
• v12.2.1 - Executable target restoration
• v12.2.0 - Catalog workspace protocol support
• v12.0.0 - Major rewrite to Rust

Migration Guide: pnpm v12 Discussion

🔐 Security Assessment

• Risk: 🟢 Low
• Known vulnerabilities: None found for either version
• Supply-chain notes:
  • No vulnerabilities reported for pnpm 11.25.0 or 12.3.4
  • Previous CVEs (CVE-2026-50021, CVE-2026-55698, CVE-2026-50016) affected versions before 11.4.0 and have been fixed
  • pnpm 12 is a Rust rewrite maintaining compatibility with v11's lockfile format
  • No maintainer changes or suspicious activity detected
  • Package is actively maintained by the pnpm team

Assessment Sources:

• pnpm Vulnerabilities Overview
• Tenable Security Plugin
• VulDB CVE-2026-50021

🚨 Breaking Changes

v12.0.0 Breaking Changes

1. Git Dependency Handling

• Git dependencies on GitHub/GitLab/Bitbucket now normalize to HTTPS URLs
• SSH URLs are no longer recorded in lockfiles for these hosts
• Impact: Not applicable to this project (no git dependencies detected)

2. Workspace Settings Validation

• pnpm-workspace.yaml can no longer contain unrecognized settings
• Typos now trigger ERR_PNPM_UNRECOGNIZED_WORKSPACE_SETTINGS errors
• Impact: Current pnpm-workspace.yaml uses valid settings (nodeLinker, enableGlobalVirtualStore, saveExact, minimumReleaseAge, trustPolicy, etc.)

3. Canonical Cycle Breaking

• Dependency cycles broken deterministically during peer resolution
• Lockfiles re-keyed on next resolution but remain compatible during headless installs
• 2-3x faster peer resolution performance
• Impact: First install after upgrade will regenerate lockfile, subsequent installs faster

4. Engine Strict Enforcement

• Under engineStrict, incompatible packages fail even when nested under optionalDependencies
• Impact: Not using engineStrict in this project

5. Linux Hardlink Preference

• packageImportMethod: auto prioritizes hardlinks before cloning on Linux
• Impact: Performance improvement on Linux systems

6. Rust Engine Integration

• Complete rewrite to Rust for performance
• 30x faster installs in some scenarios
• Impact: Performance improvement, no code changes needed

Source: pnpm v12 Breaking Changes (GitHub Discussion)

✨ Main Changes

Performance Improvements

• Workspace Performance: Multiple optimizations for large workspaces (v12.3.0-12.3.4)

  • Sped up dependency resolution in large workspaces
  • Faster lockfile writing and reading
  • Parallel project checking against lockfile
  • Workspace dependency graph built once per run instead of twice

• Installation Speed:

  • Faster installs that restore deleted node_modules from warm global virtual store
  • No-lockfile installs optimized
  • Faster dependency resolution

Bug Fixes (v12.3.x)

• Fixed concurrent installs sharing a store occasionally failing with ENOENT (v12.3.3)
• Fixed pnpm install not rerunning lifecycle scripts on NTFS filesystems (v12.3.2)
• Fixed pnpm audit --fix handling when no safe version exists (v12.3.2)
• Fixed pnpm import keeping versions from package-lock.json/yarn.lock (v12.3.2)
• Fixed authentication token handling for registries (v12.3.0)
• Fixed DNS resolution on Windows (v12.3.0)

New Features (v12.3.x)

• Native executables for global commands on all platforms (v12.3.0)
• Catalog support for workspace dependencies via workspace: protocol (v12.2.0)
• Trust policy flags for pnpm remove and pnpm update (v12.3.0)
• Improved pnpm update --interactive UI (v12.3.0)

Compatibility Fixes (v12.3.4)

• pnpm 12 now accepts boolean settings as command-line flags that worked in pnpm 11 (e.g., --unsafe-perm, --offline)
• Fixed compatibility with Vercel builds that run pnpm install --unsafe-perm

🔍 Impact Analysis

📁 Usage Locations

pnpm is used as the project's package manager throughout the entire codebase:

1. package.json

   "packageManager": "pnpm@​12.3.4"

   • Feature used: Package manager version pinning
   • Impact: This field update is the primary change; all tools will use pnpm 12.3.4

2. package.json (Scripts)

   "scripts": {
     "build": "pnpm -r run build",
     "test": "pnpm run build && pnpm -r run test",
     "check": "pnpm run generate && pnpm run format && pnpm run \"/^check:/\"",
     ...
   }

   • Feature used: pnpm CLI commands (-r, --filter, script running)
   • Impact: All CLI commands remain compatible; performance should improve

3. .github/actions/install-deps/action.yml

   - name: Install pnpm + Node.js
     uses: pnpm/setup@​703c52620218391530e48b9e8870d5c0082e1b9b
     with:
       runtime: node@​${{ inputs.node-version }}
       cache: true
       install: false
   
   - name: Install dependencies
     run: pnpm install

   • Feature used: GitHub Actions integration via pnpm/setup action
   • Impact: No changes needed; action will use version from packageManager field

4. .github/workflows/ci.yml (and other workflows)

   pnpm -r --filter '!@​tailor-platform/sdk' run build
   pnpm -r run lint
   pnpm run lint:vitest
   pnpm format:check

   • Feature used: Workspace commands, filtering, recursive execution
   • Impact: All workflow commands compatible; faster execution expected

5. .github/workflows/deploy-drift-check.yml

   pnpm exec tailor workspace create
   pnpm exec tailor deploy
   pnpm exec tsx scripts/cleanup-e2e-workspaces.ts

   • Feature used: pnpm exec for running CLI tools
   • Impact: No changes needed; compatible

6. .github/workflows/lockfile-audit-fix.yml

   pnpm install
   pnpm install --frozen-lockfile

   • Feature used: Installation with and without frozen lockfile
   • Impact: Faster installs; first run will regenerate lockfile

7. pnpm-workspace.yaml

   nodeLinker: isolated
   enableGlobalVirtualStore: true
   saveExact: true
   minimumReleaseAge: 4320
   minimumReleaseAgeStrict: true
   trustPolicy: no-downgrade
   blockExoticSubdeps: true

   • Feature used: Workspace configuration, trust policies, build controls
   • Impact: All settings are valid in v12; stricter validation will catch future typos

8. packages/sdk/src/cli/commands/init.ts

   let packageManager = detectPackageManager();
   // ...spawns package manager for create-sdk

   • Feature used: Package manager detection and spawning
   • Impact: Will correctly detect pnpm 12; no changes needed

9. packages/sdk-plugin-setup/src/templates.ts

   const { workingDirectory, environment, packageManager } = params;
   // Generates CI templates with package manager commands
   .replaceAll("__PACKAGE_MANAGER__", () => packageManager)

   • Feature used: Template generation for CI workflows
   • Impact: Templates will use pnpm 12; compatible

10. packages/create-sdk/src/init.ts

    const packageManager = detectPackageManager();
    await execa(packageManager, ["install"]);

    • Feature used: Package manager detection for scaffolding
    • Impact: Will use pnpm 12 for new projects; compatible

11. Documentation Files (Multiple)

    • AGENTS.md, README.md, docs/getting-started.md, etc.
    • Feature used: Documentation references to pnpm commands
    • Impact: All documented commands remain valid

Summary

• Total files directly affected: 181 files reference pnpm
• Critical paths: CI workflows, package scripts, dependency installation
• All usage patterns are compatible with pnpm v12
• Expected benefits: Faster installs, better performance in large workspaces, stricter validation

---

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[github-actions]

Code Metrics Report (packages/sdk)

	main (c1201d1)	#2296 (f84faac)	+/-
Coverage	83.7%	83.7%	+0.0%
Code to Test Ratio	1:0.5	1:0.5	0.0

Details

  |                    | main (c1201d1) | #2296 (f84faac) |  +/-  |
  |--------------------|----------------|-----------------|-------|
+ | Coverage           |          83.7% |           83.7% | +0.0% |
  |   Files            |            523 |             523 |     0 |
  |   Lines            |          21230 |           21230 |     0 |
+ |   Covered          |          17778 |           17780 |    +2 |
  | Code to Test Ratio |          1:0.5 |           1:0.5 |   0.0 |
  |   Code             |         163073 |          163073 |     0 |
  |   Test             |          85974 |           85974 |     0 |

Code coverage of files in pull request scope (72.2% → 74.4%)

Files	Coverage	+/-	Status
packages/sdk/src/cli/commands/workflow/waiter.ts	74.4%	+2.2%	affected

SDK Configure Bundle Size

	main (c1201d1)	#2296 (f84faac)	+/-
configure-index-size	13.37KB	13.37KB	0KB
dependency-chunks-size	20.72KB	20.72KB	0KB
total-bundle-size	34.1KB	34.1KB	0KB

Runtime Performance

	main (c1201d1)	#2296 (f84faac)	+/-
Generate Median	2,503ms	1,101ms	-1,402ms
Generate Max	2,629ms	1,118ms	-1,511ms
Apply Build Median	2,735ms	1,193ms	-1,542ms
Apply Build Max	2,825ms	1,204ms	-1,621ms

Type Performance (instantiations)

	main (c1201d1)	#2296 (f84faac)	+/-
tailordb-basic	47,310	47,310	0
tailordb-optional	4,768	4,768	0
tailordb-relation	4,840	4,840	0
tailordb-validate	694	694	0
tailordb-hooks	5,833	5,833	0
tailordb-object	13,762	13,762	0
tailordb-enum	1,619	1,619	0
resolver-basic	12,120	12,120	0
resolver-nested	35,419	35,419	0
resolver-array	24,056	24,056	0
executor-schedule	4,489	4,489	0
executor-webhook	1,130	1,130	0
executor-record	5,443	5,443	0
executor-resolver	5,808	5,808	0
executor-operation-function	1,118	1,118	0
executor-operation-gql	1,126	1,126	0
executor-operation-webhook	1,137	1,137	0
executor-operation-workflow	1,931	1,931	0

---

Reported by octocov

[Copilot]

🔵 Needs a closer look

The pnpm major upgrade and lockfile/CI changes warrant final human validation.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 7/8 changed files
• Comments generated: 0 new
• Review effort level: Lite