chore: upgrade pnpm to 11.9.0 - #339
Conversation
📝 WalkthroughWalkthroughThe project now requires pnpm 11.9.0. Workspace settings enforce a 24-hour release age, exclude three packages from trust-policy checks, and declare Vue as a peer dependency for ChangesWorkspace policy
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
View your CI Pipeline Execution ↗ for commit d5439aa
☁️ Nx Cloud last updated this comment at |
@tanstack/angular-store
@tanstack/lit-store
@tanstack/octane-store
@tanstack/preact-store
@tanstack/react-store
@tanstack/solid-store
@tanstack/store
@tanstack/svelte-store
@tanstack/vue-store
commit: |
# Conflicts: # pnpm-lock.yaml
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pnpm-workspace.yaml`:
- Line 6: Add minimumReleaseAgeIgnoreMissingTime: false alongside
minimumReleaseAge in the workspace configuration so packages missing registry
publish timestamps do not bypass the release-age check.
- Around line 13-20: Scope both the peer dependency rule and package extension
for `@vue/composition-api` to version 1.7.2, preserving the Vue peer range >= 2.5.
Update the allowedVersions selector and packageExtensions key so future
`@vue/composition-api` versions do not inherit this override.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 212bc09d-a8a1-48bc-bfdf-a181dc6f15b1
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
package.jsonpnpm-workspace.yaml
| preferWorkspacePackages: true | ||
| blockExoticSubdeps: true | ||
| trustPolicy: 'no-downgrade' | ||
| minimumReleaseAge: 1440 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg --hidden -n -C 3 \
'minimumReleaseAge|minimumReleaseAgeIgnoreMissingTime|registry|registries' \
-g '!.git' .Repository: TanStack/store
Length of output: 2882
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for f in .npmrc pnpm-workspace.yaml package.json .pnpmfile.cjs pnpm-workspace.yaml; do
if [ -f "$f" ]; then
echo "--- $f ---"
cat -n "$f"
fi
doneRepository: TanStack/store
Length of output: 7325
🌐 Web query:
pnpm dependency-resolution minimumReleaseAge minimumReleaseAgeIgnoreMissingTime default true
💡 Result:
The setting minimumReleaseAgeIgnoreMissingTime was introduced in pnpm v11.0.0 to control behavior when a package's registry metadata does not include a publish time field (often the case with some private registries or mirrors) [1][2][3]. Key details regarding this setting: - Default value: true [1][3] - Type: Boolean [1][3] - Behavior: When set to true (the default), pnpm skips the minimumReleaseAge maturity check for packages missing the time field, allowing them to be installed [1][3]. If set to false, pnpm will fail resolution for these packages instead of installing them [1][3]. - Context: This setting works in conjunction with minimumReleaseAge, which defines the minimum number of minutes a version must have been published before it can be installed (defaulting to 1440 minutes, or 1 day, in pnpm v11) [4][5][1]. When the default value of true is active, pnpm typically prints a warning once per affected package when it encounters one missing the time field [2].
Citations:
- 1: https://pnpm.io/settings/dependency-resolution
- 2: pnpm/pnpm@9e0833c
- 3: https://github.com/pnpm/pnpm.io/blob/aa7acf218a3a80aacdb5a23e5752f6585aa1dcdb/docs/settings.md
- 4: https://pnpm.io/supply-chain-security
- 5: https://pnpm.io/blog/releases/11.0
Set minimumReleaseAgeIgnoreMissingTime: false when relying on release age.
This workspace uses minimumReleaseAge: 1440, but minimumReleaseAgeIgnoreMissingTime is still at the pnpm default true. Any configured registry, mirror, or private registry metadata that omits the time field makes minimumReleaseAge bypass the age check. Set this flag to false unless the npm registry/mirror is known to supply publish timestamps for all installed packages.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pnpm-workspace.yaml` at line 6, Add minimumReleaseAgeIgnoreMissingTime: false
alongside minimumReleaseAge in the workspace configuration so packages missing
registry publish timestamps do not bypass the release-age check.
Source: MCP tools
| peerDependencyRules: | ||
| allowedVersions: | ||
| '@vue/composition-api>vue': '>= 2.5' | ||
|
|
||
| packageExtensions: | ||
| '@vue/composition-api': | ||
| peerDependencies: | ||
| vue: '>= 2.5' |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 6 \
'`@vue/composition-api`|peerDependencies|vue:' \
pnpm-lock.yaml packages/vue-store/package.jsonRepository: TanStack/store
Length of output: 50371
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo '--- pnpm-workspace.yaml relevant lines ---'
sed -n '1,35p' pnpm-workspace.yaml
echo
echo '--- composition-api metadata from npm ---'
npm view `@vue/composition-api`@1.7.2 peerDependencies vulnerabilities --json 2>/dev/null || true
echo
echo '--- lockfile targeted entries ---'
python3 - <<'PY'
from pathlib import Path
p=Path('pnpm-lock.yaml')
lines=p.read_text().splitlines()
needles=['`@vue/composition-api`@1.7.2', "packages/vue-store:", "`@tanstack/vue-store`@0.11.1"]
for n in needles:
print(f'-- {n} --')
for i,l in enumerate(lines):
if n in l:
start=max(0,i-8); end=min(len(lines),i+40)
for j in range(start,end):
print(f'{j+1}: {lines[j]}')
PYRepository: TanStack/store
Length of output: 11500
🌐 Web query:
Vue.js composition-api 1.7.2 package.json peerDependencies vue >= 2.5 < 2.7
💡 Result:
The package @vue/composition-api version 1.7.2 includes "vue": ">= 2.5 < 2.7" in its peerDependencies [1][2][3]. This plugin was designed to bring Composition API support to Vue 2 [2][4]. Following the release of Vue 2.7, which included the Composition API natively, this package entered maintenance mode and is intended for use with Vue 2.6 or earlier [2][4]. Use of the plugin is generally unnecessary for projects using Vue 2.7 or later [2][5].
Citations:
- 1: https://registry.npmjs.org/@vue/composition-api
- 2: https://npmx.dev/package/@vue/composition-api/v/1.7.2
- 3: https://www.npmjs.com/package/@vue/composition-api
- 4: https://npmx.dev/package/@vue/composition-api
- 5: https://github.com/vuejs/composition-api/blob/master/README.md
Keep the @vue/composition-api peer ranges scoped to 1.7.2.
The lockfile installs @vue/composition-api@1.7.2, whose peer contract is vue: >= 2.5 < 2.7. The unversioned selector in both allowedVersions and packageExtensions applies this exception to every @vue/composition-api package, including future majors that should not satisfy that contract. Scope both entries to @vue/composition-api@1.7.2 so the override does not extend unsupported Vue majors.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pnpm-workspace.yaml` around lines 13 - 20, Scope both the peer dependency
rule and package extension for `@vue/composition-api` to version 1.7.2, preserving
the Vue peer range >= 2.5. Update the allowedVersions selector and
packageExtensions key so future `@vue/composition-api` versions do not inherit
this override.
Source: MCP tools
2 participants
Summary
Verification
Summary by CodeRabbit