mirror/pnpm
1
0 Fork 0
mirror of https://github.com/pnpm/pnpm.git synced 2026-11-07 14:33:03 -05:00
Code Issues Packages Projects Releases Wiki Activity

chore: update dependencies, Node.js, pnpm, and GitHub Actions (#17711)

Browse Source 
* chore: update dependencies, Node.js, pnpm, and GitHub Actions

* chore: regenerate the embedded ESM loader for enhanced-resolve 5.26.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* style: format Cargo.toml with taplo

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: adapt to sysinfo 0.40 and sigstore-sign 0.15, keep rusqlite at 0.39

- sysinfo 0.40 returns a Result from the System constructors.
- sigstore-sign 0.15 made SigningContext::production() fetch the signing
  config through TUF. Use the embedded public-good config, which is what
  production() returned before, and convert the new MediaType enum.
- rusqlite 0.41 (libsqlite3-sys 0.39) bundles a SQLite whose symbols
  collide with libsql-ffi's copy when both link into one binary, so stay on
  0.39 until that is sorted out.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: hold rusqlite at 0.39 in update.ignoreDeps

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: adapt the Windows kernel version probe to sysinfo 0.40

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* style: format the Windows kernel version probe

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Zoltan KochanClaude Opus 5.5github-actions[bot]
 authored and GitHub committed 2026-11-05 03:06:20 +01:00
1 parent 711994901d
commit feb8af92fe
28 files changed
+1793 -1616
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.config/pnpm/catalog.yaml
+13 -10
View File
@@ -6,7 +6,7 @@ catalog:
'@commitlint/cli': ^21.2.4
'@commitlint/config-conventional': ^21.2.4
'@commitlint/prompt-cli': ^21.2.4
'@cyclonedx/cyclonedx-library': 10.3.0
'@cyclonedx/cyclonedx-library': 10.4.0
'@emnapi/wasi-threads': 2.2.0
'@eslint/js': ^10.0.1
'@inquirer/prompts': ^8.7.5
@@ -25,7 +25,7 @@ catalog:
'@pnpm/tabtab': ^0.5.4
'@pnpm/tgz-fixtures': 0.0.0
'@reflink/reflink': 0.1.19
'@rushstack/worker-pool': 0.7.31
'@rushstack/worker-pool': 0.7.32
'@stylistic/eslint-plugin': ^5.10.0
'@tybys/wasm-util': 0.10.4
'@types/adm-zip': ^0.6.0
@@ -109,7 +109,7 @@ catalog:
can-write-to-dir: ^2.0.0
chalk: ^6.0.1
ci-info: ^4.4.0
cli-truncate: ^6.1.1
cli-truncate: ^6.2.0
cmd-extension: ^2.0.0
comver-to-semver: ^2.0.0
cross-env: ^10.1.0
@@ -127,7 +127,7 @@ catalog:
empathic: ^2.1.0
esbuild: ^0.28.2
escape-string-regexp: ^5.0.0
eslint: ^10.13.0
eslint: ^10.14.0
eslint-plugin-import-x: ^4.17.1
eslint-plugin-jest: ^29.17.0
eslint-plugin-n: ^18.5.0
@@ -178,7 +178,7 @@ catalog:
memfs: ^4.80.0
memoize: ^11.0.0
micromatch: ^4.0.8
msgpackr: 2.1.3
msgpackr: 2.1.4
nm-prune: ^5.0.0
# node-gyp 13 (with its nopt 10 and which 7 dependencies) requires Node.js
# ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's supported floor of >=22.13.
@@ -228,7 +228,7 @@ catalog:
rename-overwrite: ^7.0.1
render-help: ^2.0.0
resolve-link-target: ^3.0.0
rimraf: ^6.1.3
rimraf: ^6.1.4
root-link-target: ^4.0.0
rxjs: ^7.8.2
safe-buffer: 5.2.1
@@ -236,7 +236,7 @@ catalog:
safe-promise-defer: ^2.0.0
sanitize-filename: ^1.6.4
seek-bzip: 2.0.0
semver: ^7.8.5
semver: ^7.8.6
semver-range-intersect: ^0.3.1
semver-utils: ^1.1.4
shlex: ^3.0.0
@@ -295,16 +295,16 @@ catalog:
yaml: ^2.9.1
yaml-tag: 1.1.0
yauzl: ^3.4.0
enhanced-resolve: 5.26.0
enhanced-resolve: 5.26.1
catalogs:
# The runtime dependencies of get-pnpm, which npx and pnpm/setup install from
# its published manifest. Exact, so an installer that verifies what it
# downloads does not take a new release of its own dependencies unreviewed.
get-pnpm:
confbox: 0.3.1
confbox: 0.3.2
picomatch: 4.0.7
semver: 7.8.5
semver: 7.8.6
catalogMode: strict
@@ -316,6 +316,8 @@ catalogPrune: true
# (>=22.13); the comment at each catalog entry above records the reason.
# typescript is held on 6.x because typescript-eslint does not support the
# TypeScript 7.0 API yet.
# The rusqlite crate is held on 0.39: from 0.41 its bundled SQLite collides
# with libsql-ffi's copy when both link into one binary.
update:
ignoreDeps:
- '@babel/core'
@@ -335,6 +337,7 @@ update:
- normalize-package-data
- npm-packlist
- npm-registry-fetch
- rusqlite
- ssri
- tempy
- typescript
.github/actions/binstall/action.yml
+1 -1
View File
@@ -12,7 +12,7 @@ runs:
steps:
- name: Install cargo-binstall
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: cargo-binstall
.github/actions/rust-release-target/action.yml
+1 -1
View File
@@ -15,7 +15,7 @@ runs:
steps:
- name: Install cross
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: cross
.github/workflows/benchmark.yml
+1 -1
View File
@@ -95,7 +95,7 @@ jobs:
- name: Install Bencher CLI
if: steps.bench.outputs.bench_dir != ''
uses: bencherdev/bencher@58a33f76185c1187f3df355817d2ac7285ac77f0 # v0.6.14
uses: bencherdev/bencher@7de3c69a85380826613050826b4bce062be2f07d # v0.6.16
- name: Upload results to Bencher
if: steps.bench.outputs.bench_dir != ''
.github/workflows/cargo-equivalence.yml
+1 -1
View File
@@ -80,7 +80,7 @@ jobs:
run: pnpm runtime set node 22 --global
- name: Install just and cargo-nextest
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: just,cargo-nextest
.github/workflows/ci-performance-bencher-upload.yml
+1 -1
View File
@@ -120,7 +120,7 @@ jobs:
- name: Install Bencher CLI
if: steps.artifacts.outputs.count != '0'
uses: bencherdev/bencher@58a33f76185c1187f3df355817d2ac7285ac77f0 # v0.6.14
uses: bencherdev/bencher@7de3c69a85380826613050826b4bce062be2f07d # v0.6.16
- name: Upload results to Bencher
if: steps.artifacts.outputs.count != '0'
.github/workflows/codeql-analysis.yml
+3 -3
View File
@@ -52,7 +52,7 @@ jobs:
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -63,7 +63,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
uses: github/codeql-action/autobuild@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
# ℹ️ Command-line programs to run using the OS shell.
# 📚 https://git.io/JvXDl
@@ -77,4 +77,4 @@ jobs:
# make release
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
.github/workflows/pacquet-cargo-unused.yml
+2 -2
View File
@@ -30,7 +30,7 @@ jobs:
uses: $/.github/actions/install-crates
- name: Install cargo-unused-features
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: cargo-unused-features
@@ -62,7 +62,7 @@ jobs:
- name: Install cargo-udeps
if: steps.filter.outputs.src == 'true'
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: cargo-udeps
.github/workflows/pacquet-ci.yml
+5 -5
View File
@@ -260,7 +260,7 @@ jobs:
continue-on-error: true
- name: Install just
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: just
@@ -279,7 +279,7 @@ jobs:
just install
- name: Install cargo-nextest
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: cargo-nextest,sccache@0.17.0
@@ -517,7 +517,7 @@ jobs:
run: pnpm runtime set node 22 --global
- name: Install just
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: just,cargo-nextest
@@ -737,7 +737,7 @@ jobs:
with:
persist-credentials: false
- uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
- uses: crate-ci/typos@4c8b7f51ca60df14e3c5ca82770dfbbe6c3dae85 # v1.52.0
with:
files: pnpm pnpr
@@ -777,7 +777,7 @@ jobs:
- name: Install cargo-deny
if: github.event_name == 'merge_group' || steps.filter.outputs.src == 'true'
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: cargo-deny
.github/workflows/pacquet-codecov.yml
+3 -3
View File
@@ -67,7 +67,7 @@ jobs:
uses: $/.github/actions/rustup
- name: Install cargo-llvm-cov
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: cargo-llvm-cov
@@ -77,7 +77,7 @@ jobs:
python-version: '3.13'
- name: Install cargo-nextest
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: cargo-nextest,sccache@0.17.0
@@ -124,7 +124,7 @@ jobs:
continue-on-error: true
- name: Install just
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: just
.github/workflows/pacquet-integrated-benchmark-comment.yml
+1 -1
View File
@@ -162,7 +162,7 @@ jobs:
- name: Install Bencher CLI
if: hashFiles('benchmark-artifact/bencher-results.json') != ''
uses: bencherdev/bencher@58a33f76185c1187f3df355817d2ac7285ac77f0 # v0.6.14
uses: bencherdev/bencher@7de3c69a85380826613050826b4bce062be2f07d # v0.6.16
- name: Upload PR results to Bencher
# workflow_run runs in the base-repo privilege context, so
.github/workflows/pacquet-integrated-benchmark.yml
+2 -2
View File
@@ -454,7 +454,7 @@ jobs:
run: sudo apt-get update && sudo apt-get install --yes strace
- name: Install just
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: just
@@ -1142,7 +1142,7 @@ jobs:
- name: Install Bencher CLI
if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && !inputs.head_ref
uses: bencherdev/bencher@58a33f76185c1187f3df355817d2ac7285ac77f0 # v0.6.14
uses: bencherdev/bencher@7de3c69a85380826613050826b4bce062be2f07d # v0.6.16
- name: Upload results to Bencher
# Runs on push and workflow_dispatch — both execute in the
.github/workflows/pacquet-micro-benchmark.yml
+1 -1
View File
@@ -95,7 +95,7 @@ jobs:
steps:
- name: Install critcmp
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: critcmp
.github/workflows/release.yml
+1 -1
View File
@@ -1354,7 +1354,7 @@ jobs:
persist-credentials: false
- name: Install cross
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: cross
.github/workflows/update-latest.yml
+1 -1
View File
@@ -256,7 +256,7 @@ jobs:
steps:
- name: Send toot to Mastodon
id: mastodon
uses: cbrgm/mastodon-github-action@5939c6e084a12d79415a1e7637a6dbf6de241ab1 # v2.2.5
uses: cbrgm/mastodon-github-action@69546c2a09678575ded3a0ac3a28f10ca38a759d # v2.2.6
with:
message: |
pnpm@${{ github.event.inputs.version }} is out!
.github/workflows/version-switch-matrix.yml
+1 -1
View File
@@ -61,7 +61,7 @@ jobs:
run: pnpm runtime set node 22 --global
- name: Install just and cargo-nextest
uses: taiki-e/install-action@86f7a0ffb25f40114606501a311ebcfaf882ea32 # v2.88.0
uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
with:
tool: just,cargo-nextest
.github/workflows/zizmor.yml
+1 -1
View File
@@ -31,7 +31,7 @@ jobs:
persist-credentials: false
- name: Run zizmor
uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
with:
# Fork PRs run with a read-only GITHUB_TOKEN, so SARIF upload to
# Code scanning would fail. In that case, run zizmor anyway and
Cargo.lock
Generated
+1085 -954
View File
File diff suppressed because it is too large. Load diff
Cargo.toml
+61 -57
View File
@@ -139,37 +139,37 @@ pnpr-upstream = { path = "pnpr/crates/upstream" }
pnpr-fixtures = { path = "pnpr/crates/pnpr-fixtures" }
# Dependencies
openidconnect = { version = "4.0.1", default-features = false }
async-recursion = { version = "1.1.1" }
async-trait = { version = "0.1.83" }
axum = { version = "0.8.7", default-features = false, features = [
openidconnect = { version = "4.1.0", default-features = false }
async-recursion = { version = "1.2.0" }
async-trait = { version = "0.1.92" }
axum = { version = "0.8.9", default-features = false, features = [
"http1",
"tokio",
"json",
"matched-path",
"original-uri",
] }
clap = { version = "4", features = ["derive", "string"] }
command-extra = { version = "1.0.0" }
clap = { version = "4.6.7", features = ["derive", "string"] }
command-extra = { version = "1.5.0" }
base64 = { version = "0.23.1" }
bcrypt = { version = "0.19.1" }
bytes = { version = "1.11.0" }
bcrypt = { version = "0.19.3" }
bytes = { version = "1.12.1" }
cap-primitives = { version = "4.0.3" }
cargo-lock = { version = "11.1.0" }
cargo-util-schemas = { version = "0.14.2" }
chrono = { version = "0.4.44", default-features = false, features = ["clock"] }
console = { version = "0.16.3" }
cargo-util-schemas = { version = "0.14.3" }
chrono = { version = "0.4.45", default-features = false, features = ["clock"] }
console = { version = "0.16.6" }
core-foundation = { version = "0.10.1" }
crossterm = { version = "0.29.0" }
dashmap = { version = "7.0.0-rc2" }
deno_task_shell = { version = "0.33.3" }
derive_more = { version = "2.1.1", features = ["full"] }
dialoguer = { version = "0.12.0", default-features = false }
diffy = { version = "0.5.0" }
diffy = { version = "0.5.2" }
ed25519-dalek = { version = "2.2.0", default-features = false, features = ["std", "zeroize"] }
dunce = { version = "1.0.5" }
home = { version = "0.5.12" }
http = { version = "1.4.0" }
http = { version = "1.5.0" }
http-0-2 = { package = "http", version = "0.2.12" }
httpdate = { version = "1.0.3" }
hyper-0-14 = { package = "hyper", version = "0.14.32", default-features = false, features = ["client", "runtime"] }
@@ -177,38 +177,38 @@ hyper-0-14 = { package = "hyper", version = "0.14.32", default-features = false,
# pnpm 12 and pnpm 11 write a tarball's entries in the same order. ICU4X 2.2
# is already in the tree through `idna`, so this adds the collator and its
# root collation data rather than a second provider stack.
icu_collator = { version = "2.2.0", features = ["compiled_data"] }
icu_locale_core = { version = "2.2.0" }
icu_normalizer = { version = "2.2.0", default-features = false, features = ["compiled_data"] }
icu_provider = { version = "2.2.0" }
indexmap = { version = "2.14.0", features = ["serde"] }
insta = { version = "1.47.2", features = ["yaml", "glob", "walkdir"] }
icu_collator = { version = "2.4.0", features = ["compiled_data"] }
icu_locale_core = { version = "2.4.0" }
icu_normalizer = { version = "2.4.0", default-features = false, features = ["compiled_data"] }
icu_provider = { version = "2.4.0" }
indexmap = { version = "2.14.2", features = ["serde"] }
insta = { version = "1.49.0", features = ["yaml", "glob", "walkdir"] }
itertools = { version = "0.15.0" }
libsql = { version = "0.9.30", default-features = false, features = ["core", "remote", "replication", "sync"] }
futures-util = { version = "0.3.32" }
flate2 = { version = "1.1.9", default-features = false, features = ["zlib-rs"] }
gethostname = { version = "1" }
getrandom = { version = "0.4.2" }
futures-util = { version = "0.3.34" }
flate2 = { version = "1.1.10", default-features = false, features = ["zlib-rs"] }
gethostname = { version = "1.1.0" }
getrandom = { version = "0.4.3" }
miette = { version = "7.6.0", features = ["fancy"] }
mimalloc = { version = "0.1.52" }
napi = { version = "3.10.3", default-features = false, features = [
napi = { version = "3.16.1", default-features = false, features = [
"napi8",
"object_indexmap",
"serde-json",
"tokio_rt",
"async",
] }
napi-build = { version = "2.3.2" }
napi-derive = { version = "3.5.9" }
napi-build = { version = "2.6.0" }
napi-derive = { version = "3.7.0" }
num_cpus = { version = "1.17.0" }
object_store = { version = "0.14", features = ["aws"] }
open = { version = "5.3.5" }
object_store = { version = "0.14.2", features = ["aws"] }
open = { version = "5.4.5" }
os_display = { version = "0.1.4" }
owo-colors = { version = "4", features = ["supports-colors"] }
reflink-copy = { version = "0.1.29" }
junction = { version = "2.0.0" }
libc = { version = "0.2.186" }
reqwest = { version = "0.13", default-features = false, features = [
owo-colors = { version = "4.4.0", features = ["supports-colors"] }
reflink-copy = { version = "0.1.32" }
junction = { version = "2.1.0" }
libc = { version = "0.2.191" }
reqwest = { version = "0.13.5", default-features = false, features = [
"gzip",
"json",
"rustls",
@@ -224,64 +224,68 @@ pipe-trait = { version = "0.4.0" }
pubgrub = { version = "0.4.0" }
pep440_rs = { version = "0.7.3" }
pep508_rs = { version = "0.9.2" }
pgp = { version = "0.20.0", default-features = false }
pgp = { version = "0.21.0", default-features = false }
qrcode = { version = "0.14.1", default-features = false }
rayon = { version = "1.12.0" }
regex = { version = "1.12.3" }
regex = { version = "1.13.1" }
regress = { version = "0.12.0" }
rmp-serde = { version = "1.3.0" }
rmp-serde = { version = "1.3.1" }
rusqlite = { version = "0.39.0", features = ["bundled"] }
same-file = { version = "1.0.6" }
security-framework = { version = "3.7.0" }
security-framework-sys = { version = "2.17.0" }
serde = { version = "1.0.228", features = ["derive"] }
serde_json = { version = "1.0.150", features = ["preserve_order", "raw_value"] }
json5 = { version = "=1.3.1" }
serde = { version = "1.0.229", features = ["derive"] }
serde_json = { version = "1.0.154", features = ["preserve_order", "raw_value"] }
json5 = { version = "=1.3.7" }
semver = { version = "1.0.28" }
shell-words = { version = "1.1.1" }
rustc-hash = { version = "2.1.1" }
rustls = { version = "0.23", default-features = false, features = ["std"] }
rustc-hash = { version = "2.1.3" }
rustls = { version = "0.23.46", default-features = false, features = ["std"] }
rustls-platform-verifier = { version = "0.7.1" }
serde-saphyr = { version = "2.1.0" }
sqlx = { version = "0.8.6", default-features = false, features = ["runtime-tokio-rustls"] }
# 0.11 removes the LowerHex impl on Output; revisit after upstream/consumers catch up
sha2 = { version = "0.10.9" }
sigstore-sign = { version = "0.11.0" }
sigstore-sign = { version = "0.15.1" }
# C2SP signed notes and tiled transparency logs, ported from Go's
# `golang.org/x/mod/sumdb/note` and `sumdb/tlog`. Pure Rust, so the release
# record verifier also builds for WebAssembly.
signed_note = { version = "0.2.0" }
smart-default = { version = "0.7.1" }
spdx = { version = "0.13.4" }
spdx = { version = "0.13.6" }
split-first-char = { version = "2.0.1" }
ssri = { version = "9.2.0" }
strum = { version = "0.28.0", features = ["derive"] }
sysinfo = { version = "0.39.2" }
tabled = { version = "0.21", features = ["ansi"] }
sysinfo = { version = "0.40.1" }
tabled = { version = "0.22.0", features = ["ansi"] }
tar = { version = "0.4.46" }
text-block-macros = { version = "0.2.0" }
tower = { version = "0.5.3" }
tower-0-4 = { package = "tower", version = "0.4.13", default-features = false, features = ["util"] }
tower-http = { version = "0.7.0", features = ["compression-gzip", "compression-zstd", "cors", "trace"] }
tower-http = { version = "0.7.1", features = ["compression-gzip", "compression-zstd", "cors", "trace"] }
tracing = { version = "0.1.44" }
tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
# Native IO features live in consumers' target dependencies so Cargo's feature
# unification does not pull OS networking or process drivers into WASI builds.
tokio = { version = "1", features = ["rt", "rt-multi-thread", "macros", "fs", "io-util", "sync"] }
toml = { version = "1.1.5" }
tokio = { version = "1.54.1", features = ["rt", "rt-multi-thread", "macros", "fs", "io-util", "sync"] }
toml = { version = "1.2.0" }
tlog_tiles = { version = "0.2.0" }
tokio-rustls = { version = "0.26.4", default-features = false, features = ["tls12"] }
tokio-rustls = { version = "0.26.6", default-features = false, features = ["tls12"] }
url = { version = "2.5.8" }
walkdir = { version = "2.5.0" }
webpki-root-certs = { version = "1.0.10" }
windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_System_JobObjects", "Win32_System_Threading"] }
yaml_serde = { version = "0.10.4" }
yamlpatch = { version = "1.25.2" }
yamlpath = { version = "1.25.2" }
webpki-root-certs = { version = "1.0.11" }
windows-sys = { version = "0.61.2", features = [
"Win32_Foundation",
"Win32_System_JobObjects",
"Win32_System_Threading",
] }
yaml_serde = { version = "0.10.7" }
yamlpatch = { version = "1.32.0" }
yamlpath = { version = "1.32.0" }
wax = { version = "0.7.0" }
which = { version = "8.0.2" }
zeroize = { version = "1.8.2" }
zip = { version = "9", default-features = false, features = ["deflate"] }
which = { version = "8.0.6" }
zeroize = { version = "1.9.1" }
zip = { version = "9.3.0", default-features = false, features = ["deflate"] }
zstd = { version = "0.14.3", default-features = false }
zune-inflate = { version = "0.2.54" }
package.json
+2 -2
View File
@@ -87,11 +87,11 @@
"shx": "catalog:",
"typescript": "catalog:"
},
"packageManager": "pnpm@12.16.1",
"packageManager": "pnpm@12.18.0",
"devEngines": {
"packageManager": {
"name": "pnpm",
"version": "12.16.1",
"version": "12.18.0",
"onFail": "download"
},
"runtime": {
pnpm-lock.yaml
Generated
+578 -547
View File
File diff suppressed because it is too large. Load diff
pnpm/crates/deps-restorer/src/cas-loader.mjs.inc
+12 -12
View File
File diff suppressed because one or more lines are too long.
pnpm/crates/deps-restorer/src/shared_side_effects/platform.rs
+4 -1
View File
@@ -102,7 +102,10 @@ pub(super) fn parse_macos_product_version(value: &str) -> Option<(u32, u32)> {
}
#[cfg(windows)]
pub(super) fn windows_kernel_version() -> Option<(u32, u32, u32)> {
let build = System::kernel_version()?.parse().ok()?;
let build = System::kernel_version()
.ok()?
.parse()
.ok()?;
// Windows 10 and 11 both use NT kernel version 10.0; sysinfo provides the build number.
validate_windows_kernel_version(10, 0, build)
}
pnpm/crates/publish/src/provenance_gen.rs
+4 -3
View File
@@ -21,7 +21,7 @@ use pnpm_reporter::Reporter;
use serde_json::{Value, json};
use sha2::{Digest, Sha512};
#[cfg(not(target_family = "wasm"))]
use sigstore_sign::{SigningContext, oidc::IdentityToken};
use sigstore_sign::{SigningContext, oidc::IdentityToken, trust_root::SigstoreInstance};
use crate::{
capabilities::{Clock, EnvVar, Host, OidcFetch, OidcFetchError},
@@ -148,7 +148,8 @@ impl SignProvenance for Host {
) -> Result<SignedProvenance, ProvenanceGenError> {
let token = IdentityToken::from_jwt(jwt)
.map_err(|source| ProvenanceGenError::IdentityToken { source: source.to_string() })?;
let context = SigningContext::production();
let context = SigningContext::from_embedded(SigstoreInstance::PublicGood)
.map_err(|source| ProvenanceGenError::Sign { source: source.to_string() })?;
let deadline = timeout.unwrap_or(DEFAULT_SIGN_TIMEOUT);
sign_with_retry(SIGN_RETRY_OPTS, || {
with_sign_deadline(deadline, async {
@@ -158,7 +159,7 @@ impl SignProvenance for Host {
.await
.map_err(|source| ProvenanceGenError::Sign { source: source.to_string() })?;
let data = serde_json::to_string(&bundle).expect("serialize sigstore bundle");
Ok(SignedProvenance { media_type: bundle.media_type, data })
Ok(SignedProvenance { media_type: bundle.media_type.as_str().to_owned(), data })
})
})
.await
pnpm/crates/testing-utils/src/stall_report.rs
+1 -1
View File
@@ -170,7 +170,7 @@ struct RunProcesses {
impl RunProcesses {
/// `details` is what to read of each process beyond its environment.
fn find(run: &OsString, root: Option<Pid>, details: ProcessRefreshKind) -> Self {
let mut system = System::new();
let mut system = System::new().expect("read the process table");
system.refresh_processes_specifics(
ProcessesToUpdate::All,
true,
pnpm/crates/testing-utils/src/stall_report/tests.rs
+1 -1
View File
@@ -83,7 +83,7 @@ fn assert_grandchild_reported_and_killed(message: &str) {
.and_then(|pid| pid.parse().ok())
.unwrap_or_else(|| panic!("the report must list the grandchild:\n{message}"));
let deadline = Instant::now() + Duration::from_secs(10);
let mut system = System::new();
let mut system = System::new().expect("read the process table");
loop {
system.refresh_processes_specifics(
ProcessesToUpdate::All,
pnpm/tasks/registry-mock/src/mock_instance/tests.rs
+1
View File
@@ -23,6 +23,7 @@ fn options(client: &Client, port: u16) -> MockInstanceOptions<'_> {
fn processes() -> System {
System::new_with_specifics(RefreshKind::nothing().with_processes(ProcessRefreshKind::nothing()))
.expect("read the process table")
}
/// How long [`ChildCleanup::assert_reaped`] waits for the process table to
pnpm/tasks/registry-mock/src/process_kill.rs
+5 -2
View File
@@ -9,9 +9,12 @@ use sysinfo::{Pid, ProcessRefreshKind, RefreshKind, Signal, System};
/// so we send the signal directly to the recorded PID instead of
/// walking the process tree.
pub fn kill_process_by_pid(pid: Pid, signal: Signal) -> bool {
let system = RefreshKind::nothing()
let Ok(system) = RefreshKind::nothing()
.with_processes(ProcessRefreshKind::nothing())
.pipe(System::new_with_specifics);
.pipe(System::new_with_specifics)
else {
return false;
};
system
.processes()
.get(&pid)