[ublacklist-bot]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
oxfmt (source)	0.73.0 → 0.74.0			devDependencies	minor
oxlint (source)	1.88.0 → 1.89.0			devDependencies	minor
pnpm (source)	12.13.0 → 12.14.0			packageManager	minor	12.15.0
zizmorcore/zizmor-action	v0.6.4 → v0.7.1			action	minor	v0.8.0

---

Release Notes

oxc-project/oxc (oxfmt)

v0.74.0: oxfmt v0.74.0

Compare Source

🐛 Bug Fixes

• e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#​27957) (leaysgur)
• 782ab6e linter: Search string values without UTF-8 conversion (#​26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#​27955) (leaysgur)
• 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#​27948) (leaysgur)
• 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#​27947) (leaysgur)
• 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#​27946) (leaysgur)
• c22a9b2 formatter: Treat static block with only empty statements as empty (#​27945) (leaysgur)
• d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#​27823) (leaysgur)
• c4c1727 formatter/sort_imports: Keep comments after the last import (#​27822) (leaysgur)
• a64677e formatter: Print JSDoc embedded snippets with LF (#​27821) (leaysgur)
• 2c1cc20 formatter: Keep comment only Vue bindings as-is (#​27820) (leaysgur)
• 1bf236d formatter/sort_imports: Do not use comments as import source (#​27819) (leaysgur)
• 52ee29d formatter_yaml: Never start col-0 line with document marker or BOM (#​27818) (leaysgur)
• 81c75e7 formatter/css: Keep glued css-in-js statement placeholders glued (#​27814) (leaysgur)
• a1ef7f4 formatter: Keep typecast parens in same-operator binary and arrow chain (#​27812) (leaysgur)
• de110ce formatter: Keep more parens around TSInstantiationExpression (#​27811) (leaysgur)
• 8b02e90 formatter_json: Reject invalid JSON instead of dropping them (#​27785) (leaysgur)
• 6fe4c1b formatter: Treat lone CR in JSX text and argument blank lines (#​27780) (leaysgur)
• 5605362 oxfmt: Validate editorconfig as like oxfmtrc (#​27778) (leaysgur)
• 5b2acb0 formatter_core: Report error position releative to CRLF source (#​27777) (leaysgur)
• c78e80e formatter_core: Report parse error positions relative to the BOM-headed source (#​27776) (leaysgur)
• 3a980c9 formatter_toml: Handle BOM like other languages (#​27775) (leaysgur)
• 97c9fc4 oxfmt: Handle BOM in config JSON (#​27774) (leaysgur)
• 28eb4a7 oxfmt: Print trailing newline for --list-different (#​27773) (leaysgur)
• d2bea21 formatter: Glue comments to an opener in empty for-head slots and array holes (#​27737) (leaysgur)
• 6a95ec1 formatter: Keep comment position on holey array (#​27730) (leaysgur)
• 54769da formatter: Break after dangling line comment in holey array (#​27729) (leaysgur)
• 99077ef formatter_json: Reject unary expressions other than signed numbers (#​27728) (leaysgur)
• 22cd4cd formatter_json: Handle holey array and comments (#​27727) (leaysgur)
• 644ca1c formatter: Do not indent logical chains whose right sides all inline (#​27667) (leaysgur)
• a07a0fb formatter: Wrap comment-only JSX expression container in a group (#​27666) (leaysgur)

⚡ Performance

• e220293 formatter: Check only the operator suppression mark in is_quiet (#​27952) (leaysgur)
• e5fdc9c formatter_core: Write into one element stack through a concrete Formatter (#​27559) (leaysgur)
• a342f7e formatter: Skip comment handling for nodes with no comment near them (#​27557) (leaysgur)
• d8ce750 formatter: Write string literals with swapped quotes into the arena (#​27558) (Yuji Sugiura)
• 1c393c0 formatter_core: Skip scanning texts with nothing to rewrite (#​27561) (leaysgur)
• 1d3ef10 formatter_core: Keep the embedded IR when nothing in it is rewritten (#​27673) (leaysgur)

📚 Documentation

• 1325225 oxfmt: Update useless comment prefix (#​27956) (leaysgur)
• d0dd140 formatter: Note lossy cooked round-trip in template embeds (#​27944) (leaysgur)
• 8a3a6c8 oxfmt: Update stale notes on the JSDoc string-out channel and fixture origins (#​27824) (leaysgur)

oxc-project/oxc (oxlint)

v1.89.0

Compare Source

🐛 Bug Fixes

• 9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (#​27699) (camc314)

pnpm/pnpm (pnpm)

v12.14.0: pnpm 12.14.0

Compare Source

This release adds the sideEffectsCache.exclude setting, stops pnpm install from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.

Minor Changes

• Added the sideEffectsCache.exclude setting for packages whose build depends on something pnpm cannot include in the cache key, such as the system libraries a native addon links against. pnpm builds the listed packages in every project and never restores or saves their builds through the side-effects cache, locally or on a remoteCache server. Under the global virtual store, each project gets its own copy of these packages and of the packages that depend on them. Entries use the same name, @scope/*, and name@version patterns as minimumReleaseAgeExclude #​5271.

• pnpm login now prints the npm-notice response header during web-based login. Registries use it to show the verification code that completes the sign-in in the browser.

Patch Changes

Installing packages

• pnpm install and pnpm add no longer wait for the daily update check. If the command finishes first, pnpm skips the update notice and checks again next time. On a registry that accepted the connection but never answered, an install that had nothing to do used to take minutes #​16839.

• pnpm install, pnpm add and pnpm update now reuse pnpm-lock.yaml when the workspace configures a catalog entry that no dependency references, such as an unused entry or one whose package an overrides entry replaces. Before, every resolution in such a workspace resolved all dependencies again from the registry #​16923.

• pnpm install now looks up a git dependency's branch or tag once per install, even when many workspace projects depend on it. With linkWorkspacePackages enabled, it used to run git ls-remote once per project #​16899.

• A filtered install, such as pnpm install --filter <pkg>, now keeps the pnpm-lock.yaml entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk #​16931.

• pnpm now decides whether a dependency that a package also declares as an optional peer is linked as a dependency or as a peer from the shallowest path that reaches the package. When an existing lockfile records such a dependency as a regular dependency and a newly added dependency now provides the peer, pnpm records it as a peer, as a fresh install does. The lockfile entry of such a package can change on the next install #​16901.

• An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store #​16929.

Running commands and scripts

• pnpm no longer aborts with a core dump when the reader of its output has exited, as in pnpm list | head -1 or pnpm start 2>&1 | head -1. The command finishes with its usual exit code, and a failing script's exit code is kept. A write to stdout that fails for another reason, such as a full disk, ends the command with exit code 1 #​16904 pnpm/tasks#132.

• On Windows, pnpm exec, pnpm run, and commands such as pnpm nx now return when the command they run exits, even if it left a detached process running and pnpm's output is redirected or piped. Previously a shell reading that output waited until the detached process, such as the Nx daemon, exited #​16930.

• Commands that do not write the project manifest now leave a missing package.json absent. This covers queries such as pnpm why and pnpm outdated, pnpm fetch, pnpm dedupe --check, and commands that exit with an error, such as pnpm rt ls. These commands used to create one from the initialization template. pnpm sbom run from a lockfile alone now reports the root component as unknown with version 0.0.0 #​16907.

• pnpm run now reports a failed script as a JSON record under --reporter=ndjson. It printed a plain [ELIFECYCLE] line to stderr.

• pnpm run no longer prints [ELIFECYCLE] Command failed with exit code N. to stderr when a script fails under --reporter=silent, --silent, or --loglevel=silent.

• pnpm pipeline --dry-run no longer writes a run report when no projects are selected. With --json it prints {"tasks": []} pnpm/tasks#126.

Packing and publishing

• pnpm pack and pnpm publish now ship the whole gitignored directory that main, browser, or bin points into, as npm does. Previously only the main and bin files themselves were packed, and a gitignored browser file was left out #​16908.

• pnpm pack and pnpm publish now honor a .npmignore or .gitignore inside a subdirectory when package.json has a files field. The package root's ignore files and those inherited from the workspace are still skipped #​16909.

Setting up pnpm and toolchains

• --registry, --https-proxy, --http-proxy, and --no-proxy now apply when pnpm resolves and downloads the pnpm version a project pins in packageManager. Before, these lookups went to https://registry.npmjs.org/, which a firewall that only allows a private registry blocks #​16911.

• On Windows, pnpm install now installs the Rust toolchain for rustup's default host, so a machine set up with rustup set default-host x86_64-pc-windows-gnu gets the MinGW toolchain. Without a default host, pnpm installs the MSVC toolchain for the machine's architecture, as rustup does. This includes a pnpm built for MinGW, such as the MSYS2 package, which has installed the MinGW toolchain since 12.13.0. An x64 pnpm on ARM64 Windows now installs the ARM64 toolchain #​16854.

Platinum Sponsors

Gold Sponsors

zizmorcore/zizmor-action

v0.7.1

Compare Source

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in #​178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Compare Source

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#​2437)

• The self-hosted-runner audit is now significantly more precise (#​2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396)

• zizmor is now aware of the image_version workflow trigger (#​2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402)

• The cache-poisoning audit is now aware of pnpm/setup (#​2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#​2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#​2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#​2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#​2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#​2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#​2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#​2444)

action notes

What's Changed

• Bootstrap zizmor without Docker by @​potiuk in #​169
• Bump sync-zizmor-versions.py to Python 3.11 for locking by @​woodruffw in #​174
• Sync zizmor versions by @​github-actions[bot] in #​175

New Contributors

• @​potiuk made their first contribution in #​169

Full Changelog: zizmorcore/zizmor-action@v0.6.4...v0.7.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 PM and 05:59 PM, only on Friday (* 12-17 * * 5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.