* chore: update dependencies, Node.js, pnpm, and GitHub Actions
* chore: update pnpm/setup to v3.1.2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: update pnpm/setup examples to v3.1.2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Part of pnpm/tasks#191.
Wrong claims:
- npmrc: `ca` defaults to the system trust store (v12) or the Node.js
CA set (v11), not "the npm CA certificate".
- pnpm-cli: `--config.<key>` does not populate `npm_config_*` for
scripts (v11 and v12).
- pnpm-vs-npm, package-sources: `file:` directories are copied into the
virtual store and installed; only `link:` is a symlink.
- pnpmfile: `importPackage` is removed in v12; changing the pnpmfile
re-resolves, so the lockfile need not be deleted (v11 and v12).
- scripts: list every environment variable a script receives (v11 and
v12), and the full set of built-ins a script can shadow.
- supply-chain-security: build scripts are blocked by `allowBuilds` and
`strictDepBuilds`, and `blockExoticSubdeps` is on by default.
- workspaces: pnpm has built-in release management (v11 and v12).
Missing:
- npmrc: `NODE_EXTRA_CA_CERTS`.
- pnpm-cli: `--workspace-packages`, `-y`, and the `NO_COLOR`,
`pnpm_config_*`, `PNPM_HOME`, `PNPM_SHIM_BYPASS` variables.
- package_json: a `packageManager` section, `@<scope>:registry` in the
`publishConfig` list, the built-in injected-deps sync.
- pnpmfile: `beforePacking(pkg, dir, context)`, TL;DR rows for
`updateConfig`, `preResolution`, `finders`, the `.cjs` fallback.
- typescript: `addMissingPeerTypes`; uninstall: cache, state, and
config directories; scripts: project lifecycle stages; workspaces: a
minimal `packages` example and live sync while a script runs.
- sidebar: `only-allow-pnpm`, `production`, and `cli/cache`.
Clarity and duplication:
- One home for git-dependency preparation (package-managers), Python
index rules (registries), finders (finders.md).
- motivation, symlinked-node-modules-structure: files are hard-linked or
cloned; package directories are real directories; Node resolves
symlinks to real paths.
- podman copies the lockfile and workspace manifest; webcontainers leads
with `pmOnFail: ignore`; task priority applies within a concurrency
group; logos get alt text; store-loader spells out CAS.
- using-changesets workflow uses the same action versions and Node.js
24 as the CI guide (v11 and v12).
Stale history on v12 pages:
- Removed "Added in" markers for v11 and older, and rewrote "Since
v11..." and pnpm 10/11 narration as current behavior.
Review follow-up: the script environment notes say which
npm_config_* keys are filtered (auth, scope registry, per-registry)
and that pnpm sets npm_config_user_agent and npm_config_node_gyp; a
string `bin` sets npm_package_bin; NODE_EXTRA_CA_CERTS adds to
whichever CA set applies; the v10 codemod command notes pnpx;
motivation notes that pnpm copies files when neither hard links nor
clones work; production says `pnpm fetch` reads the lockfile, not the
package manifests.
* docs: lint prose with Vale
Add Vale with an in-repo style, .vale/styles/pnpm, that turns the
writing rules in AGENTS.md and the Google developer documentation style
guide into lint rules. The stock Vale packages (Google, Microsoft,
RedHat, write-good) were too noisy to block on, for example 1,300
passive-voice hits in the v12 docs alone, so the rules are written for
this repo, following the GitLab model. Each one links the guideline it
enforces.
Levels:
- error, fails CI: dashes, plain-word substitutions, condescending
words, "please", "note that", hedges, puffery, optional plurals,
exclamation marks, ellipses, curly quotes, generic link text, product
spellings, sentence-case headings, repeated words, double spaces,
implementation history in comments; in changesets, bold or italic
emphasis, internal names and release-line names.
- warning: future tense, sentences over 30 words, "instead of" and
"so that" tails in changesets.
- suggestion: passive voice.
.vale.ini scopes the rules. Docs get every rule. Contributor Markdown
and code comments keep dashes and headings as warnings until their
roughly 8,100 em dashes are rewritten. Released changesets stay in
.changeset/ and are not rewritten, so lint-prose.mjs lints only the
changesets added since PROSE_BASE (the PR base in CI).
The prose workflow installs a pinned, checksum-verified Vale release and
runs `pnpm lint:prose`. The rest of this change rewrites the existing
docs, READMEs, contributor Markdown, and code comments to pass the
error-level rules. Only prose and comment text changed. Renamed
headings keep their anchors.
Spelling stays with cspell, which checks identifiers that Vale does not
see.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: keep prose lint from flattening meaning
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Code blocks that hold only shell commands now use the `sh` language,
and blocks showing a file's contents carry a `title` naming the file,
across the pnpm v12, pnpm v11, and pnpr docs. Bold file-name labels
above code blocks are folded into the titles.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Port applicable documentation contributions from the website PR backlog to
pnpm/docs and pnpm11/docs now that documentation lives alongside the CLI.
Reconcile overlapping fixes and outdated paths against the current code.
Keep documentation for unmerged features with the implementation PRs.
The PR description credits each original author and records all 99 dispositions.
