[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
concurrently	10.0.6 → 10.0.7
pnpm (source)	11.28.10 → 11.28.11
rimraf	6.1.3 → 6.1.4
serve	14.2.6 → 14.2.7

---

Release Notes

open-cli-tools/concurrently (concurrently)

v10.0.7

Compare Source

What's Changed

• fix: log failed input writes instead of crashing by @​fzakaria in #​631
• fix: flush grouped output after spawn errors by @​mithilkatkoria in #​634
• fix: forward signals to the teardown command by @​fzakaria in #​630
• fix: don't treat an empty command name as an input target by @​NgoQuocViet2001 in #​640

New Contributors

• @​fzakaria made their first contribution in #​631
• @​mithilkatkoria made their first contribution in #​634
• @​NgoQuocViet2001 made their first contribution in #​640

Full Changelog: open-cli-tools/concurrently@v10.0.6...v10.0.7

pnpm/pnpm (pnpm)

v11.28.11: pnpm 11.28.11

Compare Source

pnpm 11.28.11 fixes frozen installs with excludeLinksFromLockfile, pnpm link in workspaces, pnpm deploy with dangling symlinks, and verifyDepsBeforeRun starting needless installs.

Patch Changes

Installing packages

• pnpm deploy now keeps a symlink in the project whose target is missing from the source, such as a link into a node_modules directory that was removed after the build. Deploy used to fail with ENOENT on such a link #​17571.

• A package with bundledDependencies and a build script now keeps its bundled dependencies when it is restored from the side-effects cache #​17523.

• pnpm install now links the runtime that an earlier pnpm install --no-runtime skipped #​17542.

• Commands of a package whose bin paths contain excess parent directory segments, such as ../dist/cli.js, are no longer missing. Such paths now resolve inside the package #​17586.

• Generated POSIX shell shims now quote their paths, so shell special characters in a path stay literal.

• A repeat pnpm install now rewrites the bin shims after extendNodePath changes. Before, it reported "Already up to date" and the shims kept the NODE_PATH of the previous setting.

Lockfile and resolution

• pnpm install --frozen-lockfile now accepts the lockfile it wrote with excludeLinksFromLockfile and linkWorkspacePackages on, when a project depends on a workspace package through a plain version range or a catalog: entry. It used to fail with ERR_PNPM_OUTDATED_LOCKFILE.

• pnpm install --frozen-lockfile, pnpm approve-builds, and pnpm rebuild now accept a lockfile that resolves a * dependency to a prerelease latest version. pnpm wrote such a lockfile and then reported it as outdated #​17594.

• Packages from the default registry keep plain lockfile keys, even when a prefix such as npmjs points at the registry set as registry. A dependency written with such a prefix shares the plain entry of the same package. The next install rewrites keys that earlier versions qualified this way #​17575.

• Relative local paths in root overrides now resolve from the workspace root when each project has its own lockfile #​17691.

  Installing a local directory dependency no longer fails when another project's install is writing a lockfile in that directory.

• Peer deduplication no longer gives a project different copies of a dependency across direct and transitive paths when an optional peer has no provider #​17666.

• A Node.js version range such as >=26.13, for example in devEngines.runtime, now resolves to the newest stable release that satisfies it. pnpm picks a prerelease only when no stable release matches #​17516.

verifyDepsBeforeRun

• With verifyDepsBeforeRun, pnpm run and pnpm exec now report dependencies as out of date after a dependency is added to the package.json of a local directory dependency, such as "lib": "file:../lib". Before, the command ran without the new dependency installed.

• verifyDepsBeforeRun no longer reports dependencies as out of sync when only the version field of a single-project repository changed #​17560. The same holds for a workspace project that no dependency can resolve to. A script run after such a change no longer starts an install first.

pnpm link

• In a workspace, pnpm link <dir> now adds the link: dependency to the package.json of the project where the command runs, not to the workspace root's package.json. The link is created in that project's node_modules, as documented. The override is still written to the root pnpm-workspace.yaml.

• pnpm link with several paths now records every linked package in the overrides of pnpm-workspace.yaml. Some of them could be missing before.

• pnpm link now fails without changing package.json or pnpm-workspace.yaml when the linked package's name is not a valid npm package name. It used to write that name to both files, which made every later install fail #​17475.

pnpm update

• pnpm update with only negated selectors, such as pnpm update '!foo', now leaves the dependencies listed in update.ignoreDeps unchanged pnpm/tasks#243.

• pnpm update --depth 0 without selectors now does nothing when every direct dependency is listed in update.ignoreDeps. Before, it failed with ERR_PNPM_NO_PACKAGE_IN_DEPENDENCIES pnpm/tasks#251.

Store and self-update

• pnpm store prune now keeps packages linked from a configured modules directory pnpm/tasks#230.

• pnpm store status no longer reports untouched packages as modified when the global virtual store is enabled. If the installed global-store layout cannot be verified, the command reports ERR_PNPM_STORE_STATUS_UNVERIFIABLE and asks for a reinstall #​17631.

• pnpm store add now fails right away with ERR_PNPM_FROZEN_STORE_WRITE when frozenStore is enabled. It used to retry each download for minutes before failing, or fail with a SQLite error on an empty store.

• pnpm self-update now reinstalls a cached engine if its executable cannot run. This repairs shared store entries damaged by an earlier install #​17582.

Platinum Sponsors

Gold Sponsors

isaacs/rimraf (rimraf)

v6.1.4

Compare Source

vercel/serve (serve)

v14.2.7

Compare Source

Patch Changes

• 37b3a74: Replace clipboardy with tinyclip
• 86e42e2: Keep the requested host when falling back to a different port

---

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

• Branch creation
  • "before 5am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Benchmark: PR vs main

Fixture	Size	main	PR	Change
15.3 MiB animated PNG (850 metadata chunks)	15.3 MiB	0.92 µs	0.91 µs	0.99x (-0.6%)
31.2 MiB static PNG	31.2 MiB	0.58 µs	0.59 µs	1.01x (+0.8%)
16.0 MiB animated GIF	16.0 MiB	654.48 µs	655.01 µs	1.00x (+0.1%)
16.0 MiB static GIF	16.0 MiB	150.07 µs	148.26 µs	0.99x (-1.2%)
521 B animated PNG	521 B	0.94 µs	0.95 µs	1.00x (+0.5%)
156 B static PNG	156 B	0.48 µs	0.48 µs	1.01x (+0.7%)
218 B animated GIF	218 B	0.17 µs	0.17 µs	0.99x (-0.5%)
100 B static GIF	100 B	0.16 µs	0.16 µs	1.00x (+0.0%)
40.1 KiB animated WebP	40.1 KiB	0.49 µs	0.49 µs	1.00x (-0.5%)
10.2 KiB static WebP	10.2 KiB	0.49 µs	0.49 µs	1.00x (+0.2%)
2.2 KiB animated AVIF	2.2 KiB	2.01 µs	2.01 µs	1.00x (+0.2%)
494 B static AVIF	494 B	1.23 µs	1.23 µs	1.00x (+0.1%)

Regression rule: PR/main > 1.25x and at least 0.50 µs slower. Node v24.22.2, linux x64, AMD EPYC 9V74 80-Core Processor.

_{Commit 8d52b62 · ✅ no significant regression · run}