[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@hono/node-server	^2.1.1 → ^2.1.5			devDependencies	patch
@microsoft/api-extractor (source)	^7.59.1 → ^7.59.4			devDependencies	patch
@module-federation/runtime-tools (source)	^2.9.0 → ^2.9.2			devDependencies	patch
@rspack/dev-middleware	^2.0.4 → ^2.0.5			dependencies	patch
@types/node (source)	^24.13.4 → ^24.19.2			devDependencies	minor
@types/ws (source)	8.18.1 → 8.18.2			devDependencies	patch
express (source)	^5.2.1 → ^5.3.0			devDependencies	minor
hono (source)	^4.13.7 → ^4.13.13			devDependencies	patch
launch-editor	^2.14.1 → ^2.14.2			devDependencies	patch
node	24.20.0 → 24.21.0			uses-with	minor
open	^11.0.3 → ^11.0.4			devDependencies	patch
pnpm (source)	12.4.1 → 12.11.2			packageManager	minor
prettier (source)	3.9.6 → 3.9.10			devDependencies	patch
rstack (source)	^0.7.4 → ^0.8.3			devDependencies	minor	0.8.4
ws	^8.21.3 → ^8.22.0			devDependencies	minor

---

Release Notes

honojs/node-server (@​hono/node-server)

v2.1.5

Compare Source

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in #​404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in #​405

New Contributors

• @​affanmomin made their first contribution in #​404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

Compare Source

What's Changed

• chore: allow hono v5 as a peer dependency by @​yusukebe in #​406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

Compare Source

What's Changed

• ci: add autofix.ci by @​yusukebe in #​392
• fix: type error in early hints and add typecheck to CI by @​BlankParticle in #​390
• chore: add better benchmarks by @​BlankParticle in #​391
• docs(readme): update the benchmark by @​yusukebe in #​394
• test(request): accept asynchronous body read errors by @​usualoma in #​403
• fix(listener): avoid mutating response headers when setting Content-Length by @​usualoma in #​402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

microsoft/rushstack (@​microsoft/api-extractor)

v7.59.4

Tue, 06 Oct 2026 00:04:37 GMT

Version update only

v7.59.3

Mon, 28 Sep 2026 20:08:26 GMT

Version update only

v7.59.2

Tue, 22 Sep 2026 17:35:41 GMT

Patches

• Update the @microsoft/tsdoc dependency to ~0.17.0 and the @microsoft/tsdoc-config dependency to ~0.18.2.

module-federation/core (@​module-federation/runtime-tools)

v2.9.2

Compare Source

Patch Changes

• @​module-federation/runtime@2.9.2
• @​module-federation/webpack-bundler-runtime@2.9.2

v2.9.1

Compare Source

Patch Changes

• @​module-federation/runtime@2.9.1
• @​module-federation/webpack-bundler-runtime@2.9.1

expressjs/express (express)

v5.3.0

Compare Source

=====

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #​4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #​7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #​7057 and #​7478, and @​cyphercodes in #​7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #​7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #​7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #​5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #​6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #​7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #​6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #​7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

• Upgrade body-parser to ^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalid limit option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid limit values now throw at parser initialization instead of being ignored - by @​Mayvis in #​7390

⚡ Performance

• Avoid duplicate Content-Type header processing in res.send() when sending string responses without an explicit Content-Type header - by @​bjohansebas in #​6991

honojs/hono (hono)

v4.13.13

Compare Source

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'

const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))

const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in #​5439
• docs(request): fix jsdoc comments for some getters in #​5445
• fix(jsx): allow JSXNode function component results in #​5476
• feat(mount): introduce Mount Middleware and deprecate app.mount in #​5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

Compare Source

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in #​5485
• test(build): type-check the bundled declarations from a consumer project in #​5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in #​5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in #​5487
• fix(combine): return a Response from a short-circuiting middleware in some() in #​5391
• chore(deps): upgrade vite-plus to 1.0.0 in #​5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Compare Source

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in #​5433
• chore(package.json): invoke package scripts through pnpm instead of bun in #​5434
• chore: replace prettier with oxfmt in #​5435
• chore(deps): upgrade vitest to 5.0.1 in #​5437
• chore: let oxfmt sort imports instead of eslint in #​5442
• chore: replace eslint with oxlint in #​5443
• chore: introduce Vite+ in #​5444
• fix(types): allow returning a Blob as a response body in #​5446
• chore: convert build scripts into plugins in #​5448
• chore: stop editorconfig-checker from checking Markdown indent size in #​5455
• ci: remove empty step left in cr.yml by the pnpm migration in #​5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in #​5459
• feat(adapters): add @​hono/bun as a workspace package in #​5447
• chore(adapters/bun): ship ESM only in #​5462
• feat(adapters): add the seven adapters as workspace packages in #​5463
• feat(adapters/deno): publish to JSR in #​5465
• test: move adapter runtime tests into adapters/* in #​5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

Compare Source

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in #​5380
• fix(accepts): match media types and language tags case-insensitively in #​5376
• fix(linear-router): don't match an empty path segment as a param in #​5373
• fix(pretty-json): don't break responses with unparseable JSON bodies in #​5377
• fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in #​5379
• fix(aws-lambda): treat binary +xml archive media types as binary in #​5424
• fix(aws-lambda): preserve empty query parameters in #​5292
• fix(lambda-edge): sync content type detection with aws-lambda in #​5426
• fix(lambda-edge): fail with a descriptive error on a malformed event in #​5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

Compare Source

What's Changed

• docs: fix typos in code comments and link third-party middleware section in #​5343
• perf(jsx/dom): reduce lookup work for large keyed updates in #​5340
• fix(aws-lambda): respect backpressure when streaming the response body in #​5351
• fix(accepts, language): skip accept entries with quality 0 when matching in #​5311
• fix(accept): treat the q parameter name as case-insensitive in #​5349
• fix(accept): clamp a negative q to 0, not 1 in #​5357
• fix(request): keep the request media type when reusing a cached body in #​5366
• docs(combine): fix except() JSDoc param and add missing @​returns in #​5346
• perf(jsx/dom): optimize matching-head child lookup during reconciliation in #​5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

vitejs/launch-editor (launch-editor)

v2.14.2

Compare Source

actions/node-versions (node)

v24.21.0: 24.21.0

Compare Source

Node.js 24.21.0

sindresorhus/open (open)

v11.0.4

Compare Source

• Fix browser/browserPrivate not detecting Safari or Brave as the default browser 6ae6196

---

pnpm/pnpm (pnpm)

v12.11.2: pnpm 12.11.2

Compare Source

This release fixes --workspace-concurrency=Infinity, filters set by an updateConfig hook, and store fetches with enable-modules-dir=false.

Patch Changes

• --workspace-concurrency=Infinity now runs workspace projects with no concurrency limit. It used to fail with invalid digit found in string #​16793.

• pnpm install and other recursive commands now apply the filter and filterProd that an updateConfig hook sets. They used to run on every workspace project #​16792.

• enable-modules-dir=false now also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists.

Platinum Sponsors

Gold Sponsors

v12.11.1: pnpm 12.11.1

Compare Source

This release fixes two ways pnpm install could fail, runs tools of any Rust release through pnx, and treats registry.npmjs.com as an alias of the npm registry.

Patch Changes

• pnpm install no longer fails when packageManager pins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it.

• pnpm install no longer fails with ERR_PNPM_CMD_SHIM_CHMOD when node_modules/.bin holds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout.

• enable-modules-dir=false (enableModulesDir: false through the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing under node_modules. The setting exists for a node_modules that something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain --lockfile-only run still fetches nothing.

• pnpm pack and pnpm publish no longer put .npmignore and .gitignore files in the tarball. A files entry that names one still ships it.

• pnpm now treats https://registry.npmjs.com/ as an alias of https://registry.npmjs.org/. Registry requests, credentials, and trusted publishing use the canonical hostname.

• pnx --package=rust@<channel> <tool> runs a tool of that Rust release, for example pnx --package=rust@nightly-2026-01-01 cargo build. pnpm installs the release with the components and targets from rust-toolchain.toml and the target of each --target argument.

• pnpm install now links agent skills for more coding agents. It detects the agent from ANTIGRAVITY_AGENT, COPILOT_AGENT, COPILOT_CLI, CODEX_THREAD_ID, CODEX_SANDBOX, AI_AGENT, and CLAUDE_CODE pnpm/tasks#116.

• When the registry rejects pnpm stage publish, the error message now starts with "Failed to stage package".

Platinum Sponsors

Gold Sponsors

v12.11.0: pnpm 12.11.0

Compare Source

This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the permissions setting, and keeps the colors of streamed script output.

Minor Changes

• pnpm install now links the agent skills that direct dependencies ship under skills/<name>/SKILL.md into the project's agent skill directories, such as .claude/skills. A package's skills are linked only after you approve them with pnpm approve. The skills.dirs setting chooses the directories pnpm/rfcs#35.

  Added the permissions setting, which records what each dependency may do. Its build capability works like allowBuilds and takes precedence over it. pnpm approve-builds writes to permissions when pnpm-workspace.yaml already has it, and to allowBuilds otherwise.

  Added pnpm permissions, which lists the granted and denied permissions and the packages awaiting approval. pnpm approve reviews build scripts and agent skills in one prompt pnpm/rfcs#36.

• pnpm now installs and runs Rust toolchains.

  • With cargo.enabled, pnpm install installs the toolchain named in rust-toolchain.toml. pnpm verifies the release signature, stores the toolchain once per machine, and links it into .pnpm/rust. pnpm run and pnpm exec put its cargo and rustc on the PATH.
  • pnpm add -g rust@<channel> installs a toolchain globally. The cargo and rustc commands run it outside projects that pin their own. pnpm update -g, pnpm ls -g, and pnpm remove -g manage it like any global package.
  • In a project, pnpm add rust@<channel> pins the toolchain in rust-toolchain.toml.
  • pnpm shim add rust adds project-aware shims for cargo, rustc, and the other Rust tools. In a project with a rust-toolchain.toml, they run the toolchain the file names and install it on first use. Elsewhere, the next command of the same name on PATH runs, such as rustup's.

• pnpm run and pnpm exec now keep the colors of script output that they print under the project's name, such as with --stream. pnpm sets FORCE_COLOR=1 for these scripts when its own output is in color, unless FORCE_COLOR is already set.

  Script output is also rendered more cleanly:

  • A line that a progress bar redraws with \r shows only its last state.
  • Escape codes that move the cursor or clear the screen are dropped.
  • Long colored lines are cut at the terminal width.
  • pnpm -r run no longer garbles its live output when a script fails while other scripts are still running.

Patch Changes

Installing packages

• pnpm no longer panics with "unexpected error when polling the I/O driver" when it runs under QEMU user-mode emulation, such as a linux/amd64 container on an Apple Silicon Mac #​16696.

• pnpm view, pnpm update, and other commands that read registry metadata now work behind proxies that end a response by closing the connection without a TLS close_notify alert #​16704.

• pnpm now switches to the version a project pins in packageManager or devEngines.packageManager even when pnpm-workspace.yaml has a setting the running pnpm cannot read, such as a lockfile.includeResolutionSettings section. If pnpm does not switch, it still reports that setting #​16675.

• When the pnpm package has to download its native binary on first run, it now uses the registry and credentials from .npmrc and from the npm_config_registry and pnpm_config_registry environment variables. COREPACK_NPM_REGISTRY still takes precedence. A project .npmrc is not read when COREPACK_INTEGRITY_KEYS turns off the signature check #​16655.

• pnpm install and pnpm add --config now apply minimumReleaseAge when they resolve a config dependency. A config dependency range resolves to the newest version that is old enough, so a later clean pnpm install --frozen-lockfile accepts the lockfile #​16660.

• pnpm remove with catalogPrune no longer removes catalog entries that pnpm-lock.yaml still records for workspace projects missing from disk. Before, a following frozen install failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH #​16679.

• With cargo.enabled, pnpm install now writes the source replacement for vendored crates into .pnpm/crates/config.toml and includes it as optional from .cargo/config.toml. A checkout without .pnpm builds with plain Cargo #​16659.

• With nodeLinker.type set to loaded, Node.js now stops with ERR_PNPM_LOADER_UNSUPPORTED_NODE when it preloads the store loader on a version the loader cannot serve. The supported versions are ^24.18.0 || >=26.2.0. On other versions, CommonJS packages imported from ESM failed with Cannot find module on their first relative require().

• On Windows, pnpm install no longer fails with "The filename, directory name, or volume label syntax is incorrect" when a package contains a file whose name is invalid on Windows, such as icon.svg?as=metadata.d.ts. pnpm removes the invalid characters from the name and prints a warning that lists the renamed files.

• On Windows, hoisting no longer fails intermittently with link errors when a junction is created or replaced concurrently pnpm/tasks#53.

Resolving dependencies

• pnpm install --no-optional now installs the peer dependencies a project declares when autoInstallPeers is on. The lockfile marked such a peer optional: true when another dependency had it as an optional peer.

• pnpm install and pnpm dedupe now link an optional peer to the workspace package that the workspace root depends on when the picked version matches it. They installed the registry package with the same name and version #​16706.

• Removal overrides such as "debug>supports-color": "-" now also apply to an optional peer that a package declares only in peerDependenciesMeta #​16681.

• pnpm add and other installs that re-resolve dependencies now keep the locked devEngines.runtime version while it still satisfies the declared range #​16764.

• pnpm audit --fix update now updates only the dependencies whose locked version is vulnerable #​14928.

• pnpm outdated and pnpm update --interactive now apply overrides before they look up the latest version. Before, a dependency overridden to an npm alias was compared with the latest version of the package the override replaces #​16719.

Patched dependencies

• Patches saved with CRLF line endings now apply, including a patch that creates or deletes a file. pnpm rejected the git headers of such a patch with ERR_PNPM_INVALID_PATCH and the message invalid file mode: 100644 #​16641.

• A patch that changes a file's mode, such as adding or removing the executable bit, now applies the new mode on Unix pnpm/tasks#110.

Injected dependencies and deploy

• With sharedWorkspaceLockfile: false, an injected workspace package installed in the same run as its dependent now holds only the files its files field selects. The copy also held other files of the project, such as tsconfig.json #​16683.

• A script listed in syncInjectedDepsAfterScripts no longer fails when it rewrites package.json while pnpm is copying its edits into the injected copies. The sync after the script now replaces a half-copied manifest.

• pnpm deploy with a shared lockfile no longer fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH for settings.dedupeInjectedDeps or settings.dedupePeerDependents when lockfile.includeResolutionSettings is enabled. The deployed lockfile now records both settings as false, the values the deploy installs with.

• pnpm deploy now writes the dependencies in the deployed package.json sorted by name. It also sorts the allowBuilds entries in the deployed pnpm-workspace.yaml. Repeated deploys of the same lockfile now produce identical files #​16687.

Packing and publishing

• pnpm pack and pnpm publish now match .npmignore and .gitignore rules the way npm does. A negation such as !lib/** or !lib/**/!(*.map) re-includes files under a directory that an earlier * rule excluded #​16743.

• pnpm pack and pnpm publish no longer always include root files that merely start with README, LICENSE, or LICENCE, such as README_INTERNAL.md. Only README, LICENSE, LICENCE, and COPYING, with or without an extension, ship regardless of files and .npmignore, as in npm #​16753.

• pnpm publish --provenance=false and --no-provenance now turn off provenance under trusted publishing, so a package can be published from a self-hosted runner. Setting provenance: false in pnpm-workspace.yaml does the same #​16721.

Speed and resource use

• pnpm install hardlinks files from a group-writable or world-writable store again. pnpm copied every file from such a store into node_modules #​16677.

• A repeat pnpm install no longer imports patched packages and packages with build scripts again when nothing changed. Their builds no longer run again either. This happened when recursiveInstall was false or the project had a file: dependency #​16705.

• Verifying the lockfile against trustPolicy and minimumReleaseAge uses less memory. pnpm no longer keeps every published version's manifest of each checked package in memory until the install ends #​16656.

• pnpm rebuild <pkg> and pnpm rebuild --pending no longer read the manifest of every installed package to find build scripts. Only the selected packages are inspected and built. On a large node_modules served lazily, such as over a network or FUSE mount, this turned a rebuild of a few packages into a fetch of every package.

• pnpm rebuild no longer removes and recreates node_modules when the settings recorded in node_modules/.modules.yaml differ from the current configuration. The rebuild runs the build scripts against the installed packages as they are.

• pnpm store prune now compacts the store's index.db after removing package entries, so the file shrinks again #​16717.

Registry commands

• pnpm whoami, pnpm bugs, pnpm docs, pnpm repo, pnpm star, pnpm unstar, and pnpm stars now honor the --registry option.

• --registry now takes precedence over a scope's configured registry for scoped packages in pnpm access, pnpm view, pnpm repo, pnpm star, pnpm unstar, pnpm owner, pnpm deprecate, pnpm undeprecate, pnpm unpublish, pnpm dist-tag, pnpm team, and pnpm stage. Without --registry, pnpm access now sends a scoped package or scope to the registry configured for that scope.

• Registry commands now keep the path of a registry URL such as https://example.com/npm/ when they build request URLs. This applies to pnpm access, pnpm owner, pnpm ping, pnpm search, pnpm star, pnpm stars, pnpm team, pnpm unstar, and pnpm whoami.

• pnpm view now honors the network retry settings.

• pnpm repo now fetches the repository URLs of several packages in parallel.

Platinum Sponsors

config help if that's undesired. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.