build(deps-dev): bump all

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
cspell (source)	8.6.1 -> 8.7.0					devDependencies	minor
node (source)	20.12.1 -> 20.12.2					engines	patch
pnpm (source)	9.0.0-beta.3+sha256.e55cdbdef21da8b4fd68345716937e473f0645e2f65313f390b0d33f2d2440a3 -> 9.0.0-rc.0					packageManager	patch
pnpm (source)	9.0.0-beta.3 -> 9.0.0-rc.0					engines	patch

---

Release Notes

streetsidesoftware/cspell (cspell)

v8.7.0

Compare Source

Note: Version bump only for package cspell

nodejs/node (node)

v20.12.2: 2024-04-10, Version 20.12.2 'Iron' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

• CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Commits

• [69ffc6d50d] - src: disallow direct .bat and .cmd file spawning (Ben Noordhuis) nodejs-private/node-private#563

pnpm/pnpm (pnpm)

v9.0.0-rc.0

Compare Source

Installation instructions: https://pnpm.io/9.x/installation

Major Changes

• Node.js v16 support dropped. Use at least Node.js v18.12.

• Lockfile version bumped to v9.

• Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 #​7470.

• The dedupe-injected-deps setting is true by default.

• The default value of the link-workspace-packages setting changed from true to false. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol.

• The default value of the hoist-workspace-packages is true.

• pnpm licenses list prints license information of all versions of the same package in case different versions use different licenses. The format of the pnpm licenses list --json output has been changed #​7528.

• A new command added for printing completion code to the console: pnpm completion [shell]. The old command that modified the user's shell dotfiles has been removed #​3083.

• pnpm will now check the package.json file for a packageManager field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.

• enable-pre-post-scripts is set to true by default. This means that when you run a script like start, prestart and poststart will also run.

• When installing git-hosted dependencies, only pick the files that would be packed with the package #​7638.

• Use the same directory for state files on macOS as on Linux (~/.local/state/pnpm).

• Peer dependencies of peer dependencies are now resolved correctly. When peer dependencies have peer dependencies of their own, the peer dependencies are grouped with their own peer dependencies before being linked to their dependents.

  For instance, if card has react in peer dependencies and react has typescript in its peer dependencies, then the same version of react may be linked from different places if there are multiple versions of typescript. For instance:

  project1/package.json
  {
    "dependencies": {
      "card": "1.0.0",
      "react": "16.8.0",
      "typescript": "7.0.0"
    }
  }
  project2/package.json
  {
    "dependencies": {
      "card": "1.0.0",
      "react": "16.8.0",
      "typescript": "8.0.0"
    }
  }
  node_modules
    .pnpm
      card@1.0.0(react@16.8.0(typescript@7.0.0))
        node_modules
          card
          react --> ../../react@16.8.0(typescript@7.0.0)/node_modules/react
      react@16.8.0(typescript@7.0.0)
        node_modules
          react
          typescript --> ../../typescript@7.0.0/node_modules/typescript
      typescript@7.0.0
        node_modules
          typescript
      card@1.0.0(react@16.8.0(typescript@8.0.0))
        node_modules
          card
          react --> ../../react@16.8.0(typescript@8.0.0)/node_modules/react
      react@16.8.0(typescript@8.0.0)
        node_modules
          react
          typescript --> ../../typescript@8.0.0/node_modules/typescript
      typescript@8.0.0
        node_modules
          typescript
  

  In the above example, both projects have card in dependencies but the projects use different versions of typescript. Hence, even though the same version of card is used, card in project1 will reference react from a directory where it is placed with typescript@7.0.0 (because it resolves typescript from the dependencies of project1), while card in project2 will reference react with typescript@8.0.0.

  Related issue: #​7444.

  Related PR: #​7606.

• Optional peer dependencies may be resolved from any packages in the dependency graph #​7830.

Minor Changes

• It is now possible to install only a subdirectory from a Git repository.

  For example, pnpm add github:user/repo#path:packages/foo will add a dependency from the packages/foo subdirectory.

  This new parameter may be combined with other supported parameters separated by &. For instance, the next command will install the same package from the dev branch: pnpm add github:user/repo#dev&path:packages/bar.

  Related issue: #​4765.
  Related PR: #​7487.

• node-gyp updated to version 10.

• PowerShell completion support added #​7597.

• Support node-options option inside .npmrc file when running scripts #​7596.

• Added support for registry-scoped SSL configurations (cert, key, and ca). Three new settings supported: <registryURL>:certfile, <registryURL>:keyfile, and <registryURL>:ca. For instance:

  //registry.mycomp.com/:certfile=server-cert.pem
  //registry.mycomp.com/:keyfile=server-key.pem
  //registry.mycomp.com/:cafile=client-cert.pem
  

  Related issue: #​7427.
  Related PR: #​7626.

• Add a field named ignoredOptionalDependencies. This is an array of strings. If an optional dependency has its name included in this array, it will be skipped #​7714.

• The checksum of the .pnpmfile.cjs is saved into the lockfile. If the pnpmfile gets modified, the lockfile is reanalyzed to apply the changes #​7662.

• Added cache for pnpm dlx #​5277.

Patch Changes

• Package tarballs are not downloaded during --lockfile-only installation #​1328.
• Peer dependency rules should only affect reporting, not data in the lockfile #​7758.
• Link overrides should be able to use absolute path #​7749.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

---

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher

🚮 Removed packages: npm/cspell@8.6.1

View full report↗︎

[netlify]

❌ Deploy Preview for openinfis failed.

Name	Link
🔨 Latest commit	9f24106
🔍 Latest deploy log	https://app.netlify.com/sites/openinfis/deploys/66176f161ecef20008b7eca7