Skip to content

chore(deps): bump @pnpm/catalogs.config from 0.1.0 to 1100.0.0#18

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/pnpm/catalogs.config-1100.0.0
Open

chore(deps): bump @pnpm/catalogs.config from 0.1.0 to 1100.0.0#18
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/pnpm/catalogs.config-1100.0.0

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Apr 17, 2026

Bumps @pnpm/catalogs.config from 0.1.0 to 1100.0.0.

Release notes

Sourced from @​pnpm/catalogs.config's releases.

pnpm 11 RC 2

Major Changes

  • Breaking: removed the managePackageManagerVersions, packageManagerStrict, and packageManagerStrictVersion settings. They existed only to derive the onFail behavior for the legacy packageManager field, and the pmOnFail setting introduced alongside pnpm with subsumes all three — it directly sets the onFail behavior of both packageManager and devEngines.packageManager. The COREPACK_ENABLE_STRICT environment variable is no longer honored (it only gated packageManagerStrict); use pmOnFail instead.

    Migration:

    Removed setting Replace with
    managePackageManagerVersions: true pmOnFail: download (default)
    managePackageManagerVersions: false pmOnFail: ignore
    packageManagerStrict: false pmOnFail: warn
    packageManagerStrictVersion: true pmOnFail: error
    COREPACK_ENABLE_STRICT=0 pmOnFail: warn

Minor Changes

  • pnpm dlx and pnpm create now respect security and trust policy settings (minimumReleaseAge, minimumReleaseAgeExclude, minimumReleaseAgeStrict, trustPolicy, trustPolicyExclude, trustPolicyIgnoreAfter) from project-level configuration #11183.

  • Implemented native star, unstar, stars, and whoami commands.

  • Add pnpm with <version|current> <args...> command. Runs pnpm at a specific version (or the currently active one) for a single invocation, bypassing the project's packageManager and devEngines.packageManager pins. Uses the same install mechanism as pnpm self-update, caching the downloaded pnpm in the global virtual store for reuse.

    Examples:

    pnpm with current install           # ignore the pinned version, use the running pnpm
    pnpm with 11.0.0-rc.1 install       # install using pnpm 11.0.0-rc.1
    pnpm with next install              # install using the "next" dist-tag
    

    Also adds a new pmOnFail setting that overrides the onFail behavior of packageManager and devEngines.packageManager. Accepted values: download, error, warn, ignore. Can be set via CLI flag, env var, pnpm-workspace.yaml, or .npmrc — useful when version management is handled by an external tool (asdf, mise, Volta, etc.) and the project wants pnpm itself to skip the check.

    pnpm install --pm-on-fail=ignore            # direct CLI flag
    pnpm_config_pm_on_fail=ignore pnpm install  # env var
    # or in pnpm-workspace.yaml:
    #   pmOnFail: ignore
    
  • pnpm init now writes a devEngines.packageManager field instead of the packageManager field when init-package-manager is enabled.

  • When pnpm is declared via the packageManager field in package.json, its resolution info is no longer written to pnpm-lock.yaml — unless the pinned pnpm version is v12 or newer. The packageManagerDependencies section is still populated (and reused across runs) when pnpm is declared via devEngines.packageManager. This makes the transition from pnpm v10 to v11 quieter by avoiding unnecessary lockfile churn for projects that pin an older pnpm in the legacy packageManager field.

  • Added a new setting runtimeOnFail that overrides the onFail field of devEngines.runtime (and engines.runtime) in the root project's package.json. Accepted values: ignore, warn, error, download. For example, setting runtimeOnFail=download makes pnpm download the declared runtime version even when the manifest does not set onFail: "download".

Patch Changes

  • pnpm init no longer adds the devEngines.packageManager field when run inside a workspace subpackage. The field is only added to the workspace root's package.json.

... (truncated)

Commits

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 17, 2026
Bumps [@pnpm/catalogs.config](https://github.com/pnpm/pnpm) from 0.1.0 to 1100.0.0.
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Commits](https://github.com/pnpm/pnpm/commits)

---
updated-dependencies:
- dependency-name: "@pnpm/catalogs.config"
  dependency-version: 1100.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/pnpm/catalogs.config-1100.0.0 branch from 68421a8 to fda2d31 Compare April 17, 2026 19:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants