Skip to content

chore: upgrade pnpm to v11, bump deps - #914

Merged
antfu merged 1 commit into
mainfrom
antfu/upgrade-pnpm-v11
May 20, 2026
Merged

chore: upgrade pnpm to v11, bump deps#914
antfu merged 1 commit into
mainfrom
antfu/upgrade-pnpm-v11

Conversation

@antfu

@antfu antfu commented May 20, 2026

Copy link
Copy Markdown
Member

Summary

  • Bump packageManager to pnpm@11.1.3 and regenerate pnpm-lock.yaml under pnpm v11.
  • Migrate tsdown.config.ts from the deprecated top-level external / inlineOnly to the new deps.neverBundle / deps.onlyBundle shape (clears build deprecation warnings).
  • pnpm v11 auto-added minimumReleaseAgeExclude entries to pnpm-workspace.yaml for packages that had just landed within the trust-policy cutoff window.
  • Refresh caret ranges in package.json and examples/vite-vue3/package.json to the latest installed versions (eslint-config 7→9, typescript 5.9→6, vue-tsc 3.2→3.3, etc.).

Test plan

  • pnpm install succeeds under pnpm v11
  • pnpm run build — no external/inlineOnly deprecation warnings
  • pnpm run lint — clean
  • pnpm run typecheck — clean
  • pnpm run test — 36/36 passed

@antfu
chore: upgrade pnpm to v11, bump deps
bbf51c3 
- Bump packageManager to pnpm@11.1.3 and regenerate lockfile
- Migrate tsdown `external`/`inlineOnly` to `deps.neverBundle`/`onlyBundle`
- pnpm v11 auto-added `minimumReleaseAgeExclude` entries to workspace yaml
- Refresh dependency caret ranges to latest installed versions
@bolt-new-by-stackblitz

bolt-new-by-stackblitz Bot commented May 20, 2026

Copy link
Copy Markdown

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

@pkg-pr-new

pkg-pr-new Bot commented May 20, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/unplugin-vue-components@914

commit: bbf51c3

@socket-security

socket-security Bot commented May 20, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​types/​picomatch@​4.0.31001007484100
Addedwebpack@​5.106.2761009395100
Addedtinyglobby@​0.2.16991007784100
Addedrolldown@​1.0.1951007899100
Addedvitest@​4.1.6961007999100
Added@​types/​node@​25.9.11001008196100
Addedbumpp@​11.1.0991008292100
Addedvite@​8.0.13991008298100
Addedlocal-pkg@​1.2.01001008789100
Addedvant@​4.9.249810010087100
Addedrollup@​4.60.48810010099100
Addedtsdown@​0.22.0981008896100
Addedeslint@​10.4.08910010096100
Addedpicomatch@​4.0.410010010090100
Updatedtypescript@​5.9.3 ⏵ 6.0.3100 +110090 +19690
Added@​vue/​compiler-sfc@​3.5.34901009696100
Addedvue-router@​5.0.7911009995100
Addedvue-tsc@​3.3.11001009297100
Added@​vitejs/​plugin-vue@​6.0.710010010094100
Addedelement-plus@​2.14.09810010094100
Added@​nuxt/​kit@​4.4.69910010094100
Added@​nuxt/​schema@​4.4.69910010096100
Added@​antfu/​eslint-config@​9.0.09710010096100
Added@​iconify/​json@​2.2.47610010010096100

View full report

@socket-security

socket-security Bot commented May 20, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm markdown-it is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: pnpm-lock.yaml → npm/unplugin-vue-markdown@30.0.0 → npm/markdown-it@14.1.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/markdown-it@14.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@antfu
antfu merged commit 036d4d0 into main May 20, 2026
9 checks passed
@antfu
antfu deleted the antfu/upgrade-pnpm-v11 branch May 20, 2026 04:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@antfu