a8ff38dde6
* chore(release): pacquet 12.0.0-rc.7, pnpr 0.1.0-alpha.7 * chore(cargo): bump h2 to 0.4.16 for RUSTSEC-2026-0258 RUSTSEC-2026-0258 (h2 unbounded empty DATA frames, low-severity DoS) was published to the advisory database on 2026-08-17 and fails `cargo deny check` on every branch that touches Cargo.lock. The workspace locks two h2 majors. h2 0.4.13, which backs pnpr's own HTTP/2 server through axum 0.8 -> hyper 1.x and pacquet's outbound requests through reqwest, moves to the patched 0.4.16; its dependency set is unchanged, so this is a lockfile-only edit. h2 0.3.27 has no fix: the advisory patches only `>= 0.4.16`, 0.3.27 is the final 0.3 release, and the copy is pulled by libsql's gRPC client stack (libsql -> tonic 0.11 -> axum 0.6 -> hyper 0.14) that the newest stable libsql, 0.9.30, is still pinned to. That client only talks to the operator-configured libsql/sqld backend, never to untrusted registry clients, so it is ignored in deny.toml until libsql 0.10 leaves prerelease. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(changeset): correct the registries release notes Two review findings on the release PR: The registry-rename note claimed `node_modules/.modules.yaml` keeps its `registries` field, which contradicts another entry in the same release saying the field is dropped. The removal is the true behaviour: the writer deletes the key on every rewrite and the Rust `modules-yaml` crate has no such field. The rename genuinely changes nothing on disk, so the two `.modules.yaml` mentions are dropped from that paragraph rather than restated -- the removal already has its own entry. The catalog `outdated` note wrote a bare `outdated --compatible`; release prose spells out the published executable, so it is now `pnpm outdated --compatible`. Both the pending changesets and the generated pacquet changelog carry the prose, so both are corrected; fixing only the changelog would let the release tooling reintroduce the old text on the next regeneration. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
420 B
420 B
pacquet
| pacquet |
|---|
| patch |
pnpm outdated and pnpm update --interactive now dereference catalog: specifiers before querying the registry. A catalog entry that is an npm alias ('@types/zkochan__table': npm:@types/table@6.3.2) no longer fails with ERR_PNPM_OUTDATED_REGISTRY_ERROR for the alias key, and pnpm outdated --compatible compares against the range the catalog holds instead of skipping the dependency.