chore(deps): update all non-major dependencies

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@typescript/native-preview](https://www.typescriptlang.org/) ([source](https://redirect.github.com/microsoft/typescript-go)) | [`7.0.0-dev.20260510.1` → `7.0.0-dev.20260517.1`](https://renovatebot.com/diffs/npm/@typescript%2fnative-preview/7.0.0-dev.20260510.1/7.0.0-dev.20260517.1) |  |  | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`11.0.9` → `11.1.2`](https://renovatebot.com/diffs/npm/pnpm/11.0.9/11.1.2) |  |  | --- ### Release Notes <details> <summary>microsoft/typescript-go (@&#8203;typescript/native-preview)</summary> ### [`v7.0.0-dev.20260517.1`](https://redirect.github.com/microsoft/typescript-go/compare/f4a1d2a1d0d5df4333f2440500e3a6c4b4702d9a...0a7029951e88d89ed512227578935c2c0dd2bd86) [Compare Source](https://redirect.github.com/microsoft/typescript-go/compare/f4a1d2a1d0d5df4333f2440500e3a6c4b4702d9a...0a7029951e88d89ed512227578935c2c0dd2bd86) ### [`v7.0.0-dev.20260516.1`](https://redirect.github.com/microsoft/typescript-go/compare/c282336ea94f8a2e63187afd0f8d4bfb3b3f4d3b...f4a1d2a1d0d5df4333f2440500e3a6c4b4702d9a) [Compare Source](https://redirect.github.com/microsoft/typescript-go/compare/c282336ea94f8a2e63187afd0f8d4bfb3b3f4d3b...f4a1d2a1d0d5df4333f2440500e3a6c4b4702d9a) ### [`v7.0.0-dev.20260515.1`](https://redirect.github.com/microsoft/typescript-go/compare/47ca64821ddc972ae77ed3b75337ac3a2d635562...c282336ea94f8a2e63187afd0f8d4bfb3b3f4d3b) [Compare Source](https://redirect.github.com/microsoft/typescript-go/compare/47ca64821ddc972ae77ed3b75337ac3a2d635562...c282336ea94f8a2e63187afd0f8d4bfb3b3f4d3b) ### [`v7.0.0-dev.20260514.1`](https://redirect.github.com/microsoft/typescript-go/compare/01cc06960f62a508d26232175e0fcfd16846ed4f...47ca64821ddc972ae77ed3b75337ac3a2d635562) [Compare Source](https://redirect.github.com/microsoft/typescript-go/compare/01cc06960f62a508d26232175e0fcfd16846ed4f...47ca64821ddc972ae77ed3b75337ac3a2d635562) ### [`v7.0.0-dev.20260513.1`](https://redirect.github.com/microsoft/typescript-go/compare/adb2ab4ed7d7849bb222eb27c41437d5520335a9...01cc06960f62a508d26232175e0fcfd16846ed4f) [Compare Source](https://redirect.github.com/microsoft/typescript-go/compare/adb2ab4ed7d7849bb222eb27c41437d5520335a9...01cc06960f62a508d26232175e0fcfd16846ed4f) ### [`v7.0.0-dev.20260512.1`](https://redirect.github.com/microsoft/typescript-go/compare/092b34f534182baf2875887c20ffed2177f14d92...adb2ab4ed7d7849bb222eb27c41437d5520335a9) [Compare Source](https://redirect.github.com/microsoft/typescript-go/compare/092b34f534182baf2875887c20ffed2177f14d92...adb2ab4ed7d7849bb222eb27c41437d5520335a9) ### [`v7.0.0-dev.20260511.1`](https://redirect.github.com/microsoft/typescript-go/compare/092b34f534182baf2875887c20ffed2177f14d92...092b34f534182baf2875887c20ffed2177f14d92) [Compare Source](https://redirect.github.com/microsoft/typescript-go/compare/092b34f534182baf2875887c20ffed2177f14d92...092b34f534182baf2875887c20ffed2177f14d92) </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.1.2`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1112) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.1.1...v11.1.2) ##### Patch Changes - `convertEnginesRuntimeToDependencies`: switch the runtime-dependency write to `Object.defineProperty` so the CodeQL `js/prototype-polluting-assignment` rule treats the assignment as safe regardless of the property name (follow-up to [#&#8203;11609](https://redirect.github.com/pnpm/pnpm/pull/11609)). - Address CodeQL static-analysis findings: guard manifest dependency writes against prototype-polluting keys (`__proto__`, `constructor`, `prototype`), and replace a potentially super-linear semver-detection regex in registry 404 hints with an O(n) parser. - Strip `sec-fetch-*` headers from outgoing HTTP requests. These headers are automatically added by undici's `fetch()` implementation per the Fetch spec but cause Azure DevOps Artifacts to return HTTP 400 for uncached upstream packages, as ADO interprets them as browser requests [#&#8203;11572](https://redirect.github.com/pnpm/pnpm/issues/11572). - Fix `minimumReleaseAge` handling for cached abbreviated metadata. The version-spec cache fast path no longer rethrows `ERR_PNPM_MISSING_TIME` under `strictPublishedByCheck`; it now falls through to the registry-fetch path, consistent with the adjacent mtime-gated cache block. When the registry returns 304 Not Modified for a package whose cached metadata is abbreviated (no per-version `time`), pnpm now re-fetches with `fullMetadata: true` if `minimumReleaseAge` is active and the package was modified after the cutoff. The upgraded metadata is persisted to disk so subsequent installs don't repeat the fetch. Previously the abbreviated meta was used as-is and the maturity check fell back to its warn-and-skip path, silently bypassing the quarantine and emitting a misleading "metadata is missing the time field" warning. Closes [#&#8203;11619](https://redirect.github.com/pnpm/pnpm/issues/11619). - Fix `pnpm upgrade --interactive --latest -r` not respecting named catalog groups. Previously, upgrading a dependency using a named catalog (e.g. `"catalog:foo"`) would incorrectly rewrite `package.json` to `"catalog:"` and place the updated version in the default catalog instead of the named one [#&#8203;10115](https://redirect.github.com/pnpm/pnpm/issues/10115). - Fixed `optimisticRepeatInstall` skipping `pnpm-lock.yaml` merge conflict resolution when the existing `node_modules` state appears up to date. - Fix `minimumReleaseAge` / `resolutionMode: time-based` installs failing on lockfiles whose `time:` block is missing entries. The npm-resolver's peek-from-store fast path now surfaces `publishedAt` from the lockfile rather than discarding it, and falls through to a registry metadata fetch when the time-based cutoff can't be computed from the data on hand. ### [`v11.1.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1111) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.1.0...v11.1.1) ##### Patch Changes - Skip installability validation when scanning workspace projects in `checkDepsStatus` (run by `verifyDepsBeforeRun`). Previously the status check called `findWorkspaceProjects`, which validates each project's `engines` and `os`/`cpu`/`libc` and warns about useless fields in non-root manifests — work that the install pipeline already performs. With no `nodeVersion` threaded through, the engine check also fell back to the system Node from `PATH` and emitted spurious "Unsupported engine" warnings before scripts ran. Status-only callers now use `findWorkspaceProjectsNoCheck`; install paths continue to validate. - Fixed `pnpm add <alias>:@&#8203;scope/pkg` for [named registries](https://redirect.github.com/pnpm/pnpm/pull/11324). The local resolver was claiming any specifier containing `/` as a local directory, so `pnpm add bit:@&#8203;teambit/bit` (with `bit` configured under `namedRegistries`) installed a bogus link to `bit:@&#8203;teambit/bit/` instead of resolving from the configured registry. The local resolver now runs after the named-registry resolver in the resolution chain. - Updated `@zkochan/cmd-shim` to 9.0.3. The sh shim it writes for `.cmd` / `.bat` targets now escapes the `/C` switch as `//C`, so it survives the path translation Git Bash applies when launching `cmd.exe`. Without this, a bare `/C` was rewritten to `C:\` before reaching cmd.exe — the switch was dropped, cmd started interactively, and the calling script saw the cmd banner instead of the wrapped command's output. Affects any cmd-shim-wrapped batch script invoked from Git Bash / MSYS / Cygwin on Windows. See [pnpm/cmd-shim#55](https://redirect.github.com/pnpm/cmd-shim/pull/55). ### [`v11.1.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1110) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.0.9...v11.1.0) ##### Minor Changes - Added `pnpm audit signatures` to verify ECDSA registry signatures for installed packages against keys from `/-/npm/v1/keys` [#&#8203;7909](https://redirect.github.com/pnpm/pnpm/issues/7909). Scoped registries are respected, and registries without signing keys are skipped. - Added support for installing packages from the [GitHub Packages npm registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-npm-registry) via a built-in `gh:` prefix (e.g. `pnpm add gh:@&#8203;acme/private`), and, more broadly, for arbitrary named registries in the style of [vlt's named-registry aliases](https://docs.vlt.sh/cli/registries). Authentication is picked up from the existing per-URL `.npmrc` entries (e.g. `//npm.pkg.github.com/:_authToken=...`), so no separate auth mechanism is required. Additional aliases — or an override for the built-in `gh` alias, for GitHub Enterprise Server — can be configured under `namedRegistries` in `pnpm-workspace.yaml`: ```yaml namedRegistries: gh: https://npm.pkg.github.example.com/ work: https://npm.work.example.com/ ``` With this, `work:@&#8203;corp/lib@^2.0.0` resolves against `https://npm.work.example.com/`. [#&#8203;8941](https://redirect.github.com/pnpm/pnpm/issues/8941). - Allow setting sbom spec version using `--sbom-spec-version` [#&#8203;11389](https://redirect.github.com/pnpm/pnpm/pull/11389). - Add `--no-runtime` flag (config: `runtime=false`) to skip installing runtime entries (e.g. Node.js downloaded via `devEngines.runtime`) without modifying the lockfile. The lockfile keeps the runtime entry so frozen-lockfile validation still passes; only the runtime fetch and `.bin` linking are skipped. Useful in CI matrices where the runtime is provisioned externally (e.g. via `pnpm runtime -g set node <version>`) before `pnpm install` runs. - Added the `pnpm bugs` command that opens a package's bug tracker URL in the browser. With no arguments, it reads the current project's `package.json`; with one or more package names, it fetches each package's metadata from the registry and opens its bug tracker. Falls back to `<repository>/issues` when the `bugs` field is missing [#&#8203;11279](https://redirect.github.com/pnpm/pnpm/pull/11279). - Added `pnpm owner` command to manage package owners on the registry. ##### Patch Changes - Added "published X ago by Y" information to the `pnpm view` command output, similar to `npm view`. This is useful when comparing against `minimumReleaseAge`. For example, `pnpm view pnpm` now shows: ``` published 17 hours ago by GitHub Actions ``` - `pnpm publish` now honors the configured HTTP/HTTPS proxy (including `https_proxy`/`http_proxy`/`no_proxy` environment variables) when polling the registry's `doneUrl` during the web-based authentication flow. Previously the poll bypassed the proxy, causing the registry to respond `403` from a different source IP and the login to never complete [#&#8203;11561](https://redirect.github.com/pnpm/pnpm/issues/11561). - `pnpm add -g` now installs each space-separated package into its own isolated directory by default. To bundle multiple packages into the same isolated install (so that they share dependencies and are removed together), pass them as a comma-separated list. For example: - `pnpm add -g foo bar` installs `foo` and `bar` as two independent globals — removing one does not affect the other. - `pnpm add -g foo,bar qar` bundles `foo` and `bar` into a single isolated install while `qar` is installed on its own. Related: [#&#8203;11587](https://redirect.github.com/pnpm/pnpm/issues/11587). - `pnpm runtime set <name> <version>` no longer fails in the root of a multi-package workspace with the `ADDING_TO_ROOT` error. Installing the workspace root is a valid target for a runtime, so the command now bypasses that safety check. - Fix `pnpm --version` hanging for the lifetime of the worker pool after the version was printed. `main.ts`'s `--version` short-circuit returned before reaching the command-handler `finally` that calls `finishWorkers()`, so the worker pool that `switchCliVersion` had spawned during integrity resolution stayed alive and held the Node event loop open. The CLI entry now runs `finishWorkers()` from its own `finally`, so every exit path tears the pool down. Repro: `pnpm --version` in a workspace whose `devEngines.packageManager` version already matches the running pnpm + `onFail: "download"`. `switchCliVersion` resolves the integrity (spawning workers), finds nothing to swap, returns. The version prints, then the process hangs. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/sxzz/ast-kit). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzkuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE3OS4zIiwidGFyZ2V0QnJhbmNoIjoibmV4dCIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->