🔧 chore(deps): bump pnpm to 11.20.0 - #44
Conversation
- 🔧 apply the pnpm registry security fix
|
✅ Approved No issues found. This is a straightforward pnpm version bump (11.18.0 → 11.20.0) with an updated integrity hash. LGTM. |
There was a problem hiding this comment.
🟢 Ready to approve
The change is a straightforward packageManager-only version bump with no other pnpm version pins found in the repo.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
Updates the repository’s declared package manager version so Corepack/pnpm consumers use pnpm 11.20.0, aligning the repo with the latest same-major release and associated security fixes.
Changes:
- Bumped
packageManagerinpackage.jsonfrom pnpm11.18.0to11.20.0(including the integrity hash).
File summaries
| File | Description |
|---|---|
| package.json | Updates the pinned pnpm version via the packageManager field to 11.20.0. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 49d41a5470
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -1,5 +1,5 @@ | |||
| { | |||
| "packageManager": "pnpm@11.18.0+sha512.33d83c77da82f49fba836925c6f1b841181ec3132b670639bd012f7075f5c7cf634c5f870147c19aae7478fac01df09d8892e880454896edd23ee9b33757563c", | |||
| "packageManager": "pnpm@11.20.0+sha512.mm8zCpW2ZEbqCI+vFSFAWooB8H/ecSTMmVjf7VLUu0NnN+ZbCPhfN7Rvy6N1CSVYrFEmK4FoRLIvY0Bu0Wa/7g==", | |||
There was a problem hiding this comment.
When Corepack is used, the new base64/SRI suffix is not a valid semver build component because it contains characters such as /, +, and =. With Corepack 0.34.6, even pnpm --version from this repository exits with Invalid package manager specification ... expected a semver version, preventing installs and lint commands from running. Corepack's documented packageManager format uses a hexadecimal hash suffix; convert this SHA-512 value to hex or let corepack use pnpm@11.20.0 generate the field.
Useful? React with 👍 / 👎.
Summary
namedRegistriesValidation
Risk
Low. This is a same-major, packageManager-only update. pnpm 11.20.0 is semi-breaking only for projects using
namedRegistries; no migration is required here.