Update npm minor/patch by renovate[bot] · Pull Request #1836 · NomicFoundation/slang

renovate · 2026-06-08T01:38:17Z

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	`24.12.3` → `24.12.4`
cspell (source)	`10.0.0` → `10.0.1`
pnpm (source)	`10.33.4` → `10.34.1`
ts-jest (source)	`29.4.9` → `29.4.11`
tsx (source)	`4.21.0` → `4.22.4`

Release Notes

streetsidesoftware/cspell (cspell)

`v10.0.1`

Compare Source

Fixes

fix(cli): ignore closed readline after stdin (#8862)

pnpm/pnpm (pnpm)

`v10.34.1`: pnpm 10.34.1

Compare Source

Patch Changes

Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.

Platinum Sponsors

Gold Sponsors

`v10.34.0`: pnpm 10.34

Compare Source

Minor Changes

Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.

pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.

The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.

--force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.

Patch Changes

Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml were not loaded when pnpm was invoked from outside <dir> #11535.
Reject dependency aliases that contain path-traversal segments (such as @x/../../../../../.git/hooks) when reading them from a package manifest or symlinking them into node_modules. A malicious registry package could otherwise use a transitive dependency key to make pnpm install create symlinks at attacker-chosen paths outside the intended node_modules directory.

Platinum Sponsors

Gold Sponsors

kulshekhar/ts-jest (ts-jest)

`v29.4.11`

Compare Source

Bug Fixes

preserve Bundler on the CJS path under TypeScript >= 6 (3941818), closes #4198

`v29.4.10`

Compare Source

Bug Fixes

pass resolutionMode to ts.resolveModuleName for hybrid module support (b557a85)
rebuild Program when consecutive compiles need different module kinds (a82a2b3), closes #4774
respect tsconfig moduleResolution instead of forcing Node10 (1bffffc)
transformer: transpile mjs files from node_modules for CJS mode (96d025d)
transformer: use a consistent comparator in hoist-jest sortStatements (8a8fd2f)

privatenumber/tsx (tsx)

`v4.22.4`

Compare Source

Bug Fixes

resolve CommonJS directory requires inside dependencies (#803) (1ce8463)

This release is also available on:

npm package (@latest dist-tag)

Bug Fixes

support Node 20.11/21.2 import.meta paths (acf3d8f)
support Node.js 24.15.0 (c1d2d45)
support Node.js 26.1.0 and 25.9.0 (1d7e528)

This release is also available on:

npm package (@latest dist-tag)

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- "before 9am on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-06-08T01:38:20Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 5 workspace projects
 ERROR  Invalid Version: ^24.12.3

pnpm: Invalid Version: ^24.12.3
    at new _SemVer (/opt/containerbase/tools/pnpm/10.34.1/24.15.0/node_modules/pnpm/dist/pnpm.cjs:6217:17)
    at compare (/opt/containerbase/tools/pnpm/10.34.1/24.15.0/node_modules/pnpm/dist/pnpm.cjs:6628:65)
    at Object.eq (/opt/containerbase/tools/pnpm/10.34.1/24.15.0/node_modules/pnpm/dist/pnpm.cjs:6712:31)
    at installSome (/opt/containerbase/tools/pnpm/10.34.1/24.15.0/node_modules/pnpm/dist/pnpm.cjs:164284:223)
    at _install (/opt/containerbase/tools/pnpm/10.34.1/24.15.0/node_modules/pnpm/dist/pnpm.cjs:164226:21)
    at async mutateModules (/opt/containerbase/tools/pnpm/10.34.1/24.15.0/node_modules/pnpm/dist/pnpm.cjs:164083:23)
    at async recursive (/opt/containerbase/tools/pnpm/10.34.1/24.15.0/node_modules/pnpm/dist/pnpm.cjs:165478:100)
    at async recursiveInstallThenUpdateWorkspaceState (/opt/containerbase/tools/pnpm/10.34.1/24.15.0/node_modules/pnpm/dist/pnpm.cjs:165989:31)
    at async installDeps (/opt/containerbase/tools/pnpm/10.34.1/24.15.0/node_modules/pnpm/dist/pnpm.cjs:165796:11)
    at async /opt/containerbase/tools/pnpm/10.34.1/24.15.0/node_modules/pnpm/dist/pnpm.cjs:202717:23

changeset-bot · 2026-06-08T01:38:21Z

⚠️ No Changeset found

Latest commit: 04dbae7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2026-06-08T01:49:26Z

Bencher Report

Branch	renovate/npm-minorpatch
Testbed	ci

⚠️ WARNING: Truncated view!
The full continuous benchmarking report exceeds the maximum length allowed on this platform.

⚠️ WARNING: No Threshold found!
Without a Threshold, no Alerts will ever be generated.

🚨 3 Alerts

🐰 View full continuous benchmarking report in Bencher

Renovate's artifacts step failed, so only the pnpm packageManager bump landed; the four catalog deps (@types/node, cspell, ts-jest, tsx) were never updated. Bumped the catalog floors to match the PR's stated targets and regenerated pnpm-lock.yaml with pnpm 10.34.1: @types/node ^24.12.3 -> ^24.12.4 cspell ^10.0.0 -> ^10.0.1 ts-jest ^29.4.9 -> ^29.4.11 tsx ^4.21.0 -> ^4.22.4

socket-security · 2026-06-08T09:46:09Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@types/node@24.12.4
	npm/tsx@4.22.4
	npm/cspell@10.0.1
	npm/ts-jest@29.4.11

View full report

renovate · 2026-06-08T09:56:07Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

renovate Bot requested a review from a team as a code owner June 8, 2026 01:38

renovate Bot added the dependencies Pull requests that update a dependency file label Jun 8, 2026

renovate Bot requested a review from a team as a code owner June 8, 2026 01:38

renovate Bot added the dependencies Pull requests that update a dependency file label Jun 8, 2026

Update npm minor/patch

bde6407

renovate Bot force-pushed the renovate/npm-minorpatch branch from 908193d to bde6407 Compare June 8, 2026 09:15

nebasuke self-assigned this Jun 8, 2026

nebasuke approved these changes Jun 8, 2026

View reviewed changes

nebasuke added this pull request to the merge queue Jun 8, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jun 8, 2026

nebasuke added this pull request to the merge queue Jun 8, 2026

Merged via the queue into main with commit 9f3d4bb Jun 8, 2026
17 checks passed

nebasuke deleted the renovate/npm-minorpatch branch June 8, 2026 11:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update npm minor/patch#1836

Update npm minor/patch#1836
nebasuke merged 2 commits into
mainfrom
renovate/npm-minorpatch

renovate Bot commented Jun 8, 2026

Uh oh!

renovate Bot commented Jun 8, 2026

Uh oh!

changeset-bot Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 8, 2026 •

edited

Loading

⚠️ WARNING: Truncated view!

⚠️ WARNING: No Threshold found!

Uh oh!

socket-security Bot commented Jun 8, 2026

Uh oh!

renovate Bot commented Jun 8, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Jun 8, 2026

Release Notes

Fixes

fix(cli): ignore closed readline after stdin (#​8862)

v10.34.1: pnpm 10.34.1

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.34.0: pnpm 10.34

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Configuration

Uh oh!

renovate Bot commented Jun 8, 2026

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

changeset-bot Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

github-actions Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ WARNING: Truncated view!

⚠️ WARNING: No Threshold found!

🚨 3 Alerts

Uh oh!

socket-security Bot commented Jun 8, 2026

Uh oh!

renovate Bot commented Jun 8, 2026

Edited/Blocked Notification

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fix(cli): ignore closed readline after stdin (#8862)

`v10.34.1`: pnpm 10.34.1

`v10.34.0`: pnpm 10.34

changeset-bot Bot commented Jun 8, 2026 •

edited

Loading

github-actions Bot commented Jun 8, 2026 •

edited

Loading