Skip to content

chore: upgrade pnpm to 11.9.0 #339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
crutchcorn merged 3 commits into from
Aug 9, 2026
Merged

chore: upgrade pnpm to 11.9.0 #339

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4a8b331
chore: upgrade pnpm to 11.9.0
Sheraff Jun 23, 2026
ce57067
chore: increase pnpm minimum release age
Sheraff Jun 24, 2026
d5439aa
Merge branch 'main' into chore/pnpm-11-9
crutchcorn Aug 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 2 additions & 11 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@
"type": "git",
"url": "https://github.com/tanstack/store.git"
},
"packageManager": "pnpm@11.1.0",
"packageManager": "pnpm@11.9.0",
"engines": {
"pnpm": ">=11.0.0"
"pnpm": ">=11.9.0"
},
"type": "module",
"scripts": {
Expand Down Expand Up @@ -82,15 +82,6 @@
"@tanstack/vue-store": "workspace:*",
"@tanstack/lit-store": "workspace:*"
},
"pnpm": {
"packageExtensions": {
"@vue/composition-api": {
"peerDependencies": {
"vue": ">= 2.5"
}
}
}
},
"sherif": {
"ignorePackage": [
"./examples/*"
Expand Down
70 changes: 24 additions & 46 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 11 additions & 0 deletions pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,22 @@ linkWorkspacePackages: true
preferWorkspacePackages: true
blockExoticSubdeps: true
trustPolicy: 'no-downgrade'
minimumReleaseAge: 1440

@coderabbitai coderabbitai Bot Aug 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
rg --hidden -n -C 3 \
  'minimumReleaseAge|minimumReleaseAgeIgnoreMissingTime|registry|registries' \
  -g '!.git' .

Repository: TanStack/store

Length of output: 2882

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

for f in .npmrc pnpm-workspace.yaml package.json .pnpmfile.cjs pnpm-workspace.yaml; do
  if [ -f "$f" ]; then
    echo "--- $f ---"
    cat -n "$f"
  fi
done

Repository: TanStack/store

Length of output: 7325

🌐 Web query:

pnpm dependency-resolution minimumReleaseAge minimumReleaseAgeIgnoreMissingTime default true

💡 Result:

The setting minimumReleaseAgeIgnoreMissingTime was introduced in pnpm v11.0.0 to control behavior when a package's registry metadata does not include a publish time field (often the case with some private registries or mirrors) [1][2][3]. Key details regarding this setting: - Default value: true [1][3] - Type: Boolean [1][3] - Behavior: When set to true (the default), pnpm skips the minimumReleaseAge maturity check for packages missing the time field, allowing them to be installed [1][3]. If set to false, pnpm will fail resolution for these packages instead of installing them [1][3]. - Context: This setting works in conjunction with minimumReleaseAge, which defines the minimum number of minutes a version must have been published before it can be installed (defaulting to 1440 minutes, or 1 day, in pnpm v11) [4][5][1]. When the default value of true is active, pnpm typically prints a warning once per affected package when it encounters one missing the time field [2].

Citations:

Set minimumReleaseAgeIgnoreMissingTime: false when relying on release age.

This workspace uses minimumReleaseAge: 1440, but minimumReleaseAgeIgnoreMissingTime is still at the pnpm default true. Any configured registry, mirror, or private registry metadata that omits the time field makes minimumReleaseAge bypass the age check. Set this flag to false unless the npm registry/mirror is known to supply publish timestamps for all installed packages.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pnpm-workspace.yaml` at line 6, Add minimumReleaseAgeIgnoreMissingTime: false
alongside minimumReleaseAge in the workspace configuration so packages missing
registry publish timestamps do not bypass the release-age check.

Source: MCP tools


trustPolicyExclude:
- 'chokidar@4.0.3' # Socket: popular, 193M weekly downloads; alerts page returned no alert entries
- 'semver@5.7.2' # Socket: popular legacy line, 673M weekly downloads; alerts page returned no alert entries
- 'semver@6.3.1' # Socket: popular latest-6 line, 673M weekly downloads; alerts page returned no alert entries

peerDependencyRules:
allowedVersions:
'@vue/composition-api>vue': '>= 2.5'

packageExtensions:
'@vue/composition-api':
peerDependencies:
vue: '>= 2.5'
Comment on lines 13 to +20

@coderabbitai coderabbitai Bot Aug 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
rg -n -C 6 \
  '`@vue/composition-api`|peerDependencies|vue:' \
  pnpm-lock.yaml packages/vue-store/package.json

Repository: TanStack/store

Length of output: 50371

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo '--- pnpm-workspace.yaml relevant lines ---'
sed -n '1,35p' pnpm-workspace.yaml

echo
echo '--- composition-api metadata from npm ---'
npm view `@vue/composition-api`@1.7.2 peerDependencies vulnerabilities --json 2>/dev/null || true

echo
echo '--- lockfile targeted entries ---'
python3 - <<'PY'
from pathlib import Path
p=Path('pnpm-lock.yaml')
lines=p.read_text().splitlines()
needles=['`@vue/composition-api`@1.7.2', "packages/vue-store:", "`@tanstack/vue-store`@0.11.1"]
for n in needles:
    print(f'-- {n} --')
    for i,l in enumerate(lines):
        if n in l:
            start=max(0,i-8); end=min(len(lines),i+40)
            for j in range(start,end):
                print(f'{j+1}: {lines[j]}')
PY

Repository: TanStack/store

Length of output: 11500

🌐 Web query:

Vue.js composition-api 1.7.2 package.json peerDependencies vue >= 2.5 < 2.7

💡 Result:

The package @vue/composition-api version 1.7.2 includes "vue": ">= 2.5 < 2.7" in its peerDependencies [1][2][3]. This plugin was designed to bring Composition API support to Vue 2 [2][4]. Following the release of Vue 2.7, which included the Composition API natively, this package entered maintenance mode and is intended for use with Vue 2.6 or earlier [2][4]. Use of the plugin is generally unnecessary for projects using Vue 2.7 or later [2][5].

Citations:

Keep the @vue/composition-api peer ranges scoped to 1.7.2.

The lockfile installs @vue/composition-api@1.7.2, whose peer contract is vue: >= 2.5 < 2.7. The unversioned selector in both allowedVersions and packageExtensions applies this exception to every @vue/composition-api package, including future majors that should not satisfy that contract. Scope both entries to @vue/composition-api@1.7.2 so the override does not extend unsupported Vue majors.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pnpm-workspace.yaml` around lines 13 - 20, Scope both the peer dependency
rule and package extension for `@vue/composition-api` to version 1.7.2, preserving
the Vue peer range >= 2.5. Update the allowedVersions selector and
packageExtensions key so future `@vue/composition-api` versions do not inherit
this override.

Source: MCP tools


packages:
- 'packages/**'
- 'examples/angular/**'
Expand Down
Loading