chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/checkout	action	minor	v4.0.0 -> v4.1.1
amannn/action-semantic-pull-request	action	minor	v5.2.0 -> v5.4.0
pnpm (source)	packageManager	minor	8.5.1 -> 8.12.0

---

Release Notes

actions/checkout (actions/checkout)

v4.1.1

Compare Source

What's Changed

• Update CODEOWNERS to Launch team by @​joshmgross in https://github.com/actions/checkout/pull/1510
• Correct link to GitHub Docs by @​peterbe in https://github.com/actions/checkout/pull/1511
• Link to release page from what's new section by @​cory-miller in https://github.com/actions/checkout/pull/1514

New Contributors

• @​joshmgross made their first contribution in https://github.com/actions/checkout/pull/1510
• @​peterbe made their first contribution in https://github.com/actions/checkout/pull/1511

Full Changelog: actions/checkout@v4.1.0...v4.1.1

v4.1.0

Compare Source

• Add support for partial checkout filters

amannn/action-semantic-pull-request (amannn/action-semantic-pull-request)

v5.4.0

Compare Source

Features

• Use github.api_url as default for githubBaseUrl (#​243 by @​fty4) (4d5734a)

v5.3.0

Compare Source

Features

• Use Node.js 20 in action (#​240) (4c0d5a2)

pnpm/pnpm (pnpm)

v8.12.0

Compare Source

Minor Changes

• Add support for basic authorization header #​7371.

Patch Changes

• Fix a bug where pnpm incorrectly passes a flag to a run handler as a fallback command #​7244.
• When dedupe-direct-deps is set to true, commands of dependencies should be deduplicated #​7359.

Our Gold Sponsors

Our Silver Sponsors

v8.11.0

Compare Source

Minor Changes

• (IMPORTANT) When the package tarballs aren't hosted on the same domain on which the registry (the server with the package metadata) is, the dependency keys in the lockfile should only contain /<pkg_name>@&#8203;<pkg_version, not <domain>/<pkg_name>@&#8203;<pkg_version>.

  This change is a fix to avoid the same package from being added to node_modules/.pnpm multiple times. The change to the lockfile is backward compatible, so previous versions of pnpm will work with the fixed lockfile.

  We recommend that all team members update pnpm in order to avoid repeated changes in the lockfile.

  Related PR: #​7318.

Patch Changes

• pnpm add a-module-already-in-dev-deps will show a message to notice the user that the package was not moved to "dependencies" #​926.
• The modules directory should not be removed if the registry configuration has changed.
• Fix missing auth tokens in registries with paths specified (e.g. //npm.pkg.github.com/pnpm). #​5970 #​2933

Our Gold Sponsors

Our Silver Sponsors

v8.10.5

Compare Source

Patch Changes

• Don't fail on an empty pnpm-workspace.yaml file #​7307.

Our Gold Sponsors

Our Silver Sponsors

v8.10.4

Compare Source

Patch Changes

• Fixed out-of-memory exception that was happening on dependencies with many peer dependencies, when node-linker was set to hoisted #​6227.

Our Gold Sponsors

Our Silver Sponsors

v8.10.3

Compare Source

Patch Changes

• (Important) Increased the default amount of allowed concurrent network request on systems that have more than 16 CPUs #​7285.

• pnpm patch should reuse existing patch when shared-workspace-file=false #​7252.

• Don't retry fetching missing packages, since the retries will never work #​7276.

• When using pnpm store prune --force alien directories are removed from the store #​7272.

• Downgraded npm-packlist because the newer version significantly slows down the installation of local directory dependencies, making it unbearably slow.

  npm-packlist was upgraded in this PR to fix #​6997. We added our own file deduplication to fix the issue of duplicate file entries.

• Fixed a performance regression on running installation on a project with an up to date lockfile #​7297.

• Throw an error on invalid pnpm-workspace.yaml file #​7273.

Our Gold Sponsors

Our Silver Sponsors

v8.10.2

Compare Source

Patch Changes

• Fixed a regression that was shipped with pnpm v8.10.0. Dependencies that were already built should not be rebuilt on repeat install. This issue was introduced via the changes related to supportedArchitectures. Related issue #​7268.

Our Gold Sponsors

Our Silver Sponsors

v8.10.1

Compare Source

Patch Changes

• (Important) Tarball resolutions in pnpm-lock.yaml will no longer contain a registry field. This field has been unused for a long time. This change should not cause any issues besides backward compatible modifications to the lockfile #​7262.
• Fix issue when trying to use pnpm dlx in the root of a Windows Drive #​7263.
• Optional dependencies that do not have to be built will be reflinked (or hardlinked) to the store instead of copied #​7046.
• If a package's tarball cannot be fetched, print the dependency chain that leads to the failed package #​7265.
• After upgrading one of our dependencies, we started to sometimes have an error on publish. We have forked @npmcli/arborist to patch it with a fix #​7269.

Our Gold Sponsors

Our Silver Sponsors

v8.10.0

Compare Source

Minor Changes

• Support for multiple architectures when installing dependencies #​5965.

  You can now specify architectures for which you'd like to install optional dependencies, even if they don't match the architecture of the system running the install. Use the supportedArchitectures field in package.json to define your preferences.

  For example, the following configuration tells pnpm to install optional dependencies for Windows x64:

  {
    "pnpm": {
      "supportedArchitectures": {
        "os": ["win32"],
        "cpu": ["x64"]
      }
    }
  }

  Whereas this configuration will have pnpm install optional dependencies for Windows, macOS, and the architecture of the system currently running the install. It includes artifacts for both x64 and arm64 CPUs:

  {
    "pnpm": {
      "supportedArchitectures": {
        "os": ["win32", "darwin", "current"],
        "cpu": ["x64", "arm64"]
      }
    }
  }

  Additionally, supportedArchitectures also supports specifying the libc of the system.

• The pnpm licenses list command now accepts the --filter option to check the licenses of the dependencies of a subset of workspace projects #​5806.

Patch Changes

• Allow scoped name as bin name #​7112.

• When running scripts recursively inside a workspace, the logs of the scripts are grouped together in some CI tools. (Only works with --workspace-concurrency 1)

• Print a warning when installing a dependency from a non-existent directory #​7159

• Should fetch dependency from tarball url when patching dependency installed from git #​7196

• pnpm setup should add a newline at the end of the updated shell config file #​7227.

• Improved the performance of linking bins of hoisted dependencies to node_modules/.pnpm/node_modules/.bin #​7212.

• Wrongful ELIFECYCLE error on program termination #​7164.

• pnpm publish should not pack the same file twice sometimes #​6997.

  The fix was to update npm-packlist to the latest version.

Our Gold Sponsors

Our Silver Sponsors

v8.9.2

Compare Source

Patch Changes

• Don't use reflink on Windows #​7186.
• Do not run node-gyp rebuild if preinstall lifecycle script is present #​7206.

Our Gold Sponsors

Our Silver Sponsors

	Configuration 📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired. If you want to rebase/retry this PR, check this box This PR has been generated by Mend Renovate. View repository job log here.

[codecov]

Codecov Report

Merging #2184 (8d4f71c) into next (1a67381) will increase coverage by 0.00%.
The diff coverage is n/a.

Additional details and impacted files

@@           Coverage Diff           @@
##             next    #2184   +/-   ##
=======================================
  Coverage   99.57%   99.57%           
=======================================
  Files        2805     2805           
  Lines      250179   250179           
  Branches     1107     1105    -2     
=======================================
+ Hits       249120   249121    +1     
+ Misses       1031     1030    -1     
  Partials       28       28           

see 1 file with indirect coverage changes

[ST-DDT]

This might be the end for our node-14 support.

[matthewmayer]

You already cannot build using Node 14 with pnpm 8.x (see #2074 ). However using Faker still works fine in Node 14. Presumably dropping Node 14 will be part of 9.0 as its breaking.

[Shinigami92]

Blocking this until we are on v9

blocked, wait until v9

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.