chore(deps): update github actions (major)

[ferrlabs-renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/checkout	action	major	v6 → v7
actions/setup-node	action	major	v6 → v7
pnpm (source)	uses-with	major	11 → 12

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Various dependency updates

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in #​1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in #​1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in #​1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in #​1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in #​1536
• docs: Update restore-only cache documentation by @​priya-kinthali in #​1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in #​1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1569

New Contributors

• @​chiranjib-swain made their first contribution in #​1536
• @​deiga made their first contribution in #​1548
• @​jasongin made their first contribution in #​1569

Full Changelog: actions/setup-node@v6...v7.0.0

pnpm/pnpm (pnpm)

v12.3.4: pnpm 12.3.4

Compare Source

Patch Changes

• Sped up dependency resolution in large workspaces #​14352.

• pnpm 12 now accepts the boolean settings as command-line flags on every command that takes them in pnpm 11, for example pnpm install --unsafe-perm, pnpm add foo --offline, and pnpm install --dangerously-allow-all-builds. pnpm 12 rejected them with unexpected argument, which failed every install on Vercel, whose build runs pnpm install --unsafe-perm #​14346.

  pnpm remove now accepts --unsafe-perm, the same flag pnpm install, pnpm add, and pnpm update take.

Platinum Sponsors

Gold Sponsors

v12.3.3: pnpm 12.3.3

Compare Source

Patch Changes

• Fixed concurrent installs sharing a store occasionally failing with an ENOENT error while importing a package file #​14353.

• Sped up writing the lockfile in large workspaces #​14352.

• Sped up dependency resolution in large workspaces #​14352.

• pnpm now runs through Node.js when it was installed by a tool that skips build scripts, such as Vercel's packageManager provisioning, Bun, Deno, or npm install --ignore-scripts. Those installs previously failed with syntax error near unexpected token ')'. They still cannot run pnpm on Windows. On macOS only a shell can start it #​14346.

Platinum Sponsors

Gold Sponsors

v12.3.2: pnpm 12.3.2

Compare Source

Patch Changes

• pnpm audit --fix update no longer aborts when a vulnerable package has no safe version inside its declared range #​14508. The run updates every package it can and lists the rest as remaining.

• pnpm install no longer reruns root lifecycle scripts when the global virtual store contains an unfinished-build marker in a package slot that the current lockfile does not use pnpm/pnpm#14485.

• Sped up installs that have no lockfile. pnpm now links packages whose dependency subtree has no peer dependencies into the virtual store while resolution is still running.

• pnpm run and pnpm exec now start without reinstalling on filesystems that keep sub-millisecond mtimes, such as NTFS. Previously, every run on those filesystems reinstalled first pnpm/pnpm#14486.

• pnpm import now keeps the versions recorded in package-lock.json, npm-shrinkwrap.json, or yarn.lock when it generates pnpm-lock.yaml. A range in package.json, a catalog, or an override still decides which versions are eligible, and the recorded version is preferred among them. The generated lockfile previously could pin newer versions than the source lockfile #​14476.

  pnpm import in a workspace now imports every workspace project into the shared lockfile. It previously imported only the project in the current directory.

  pnpm import now fails with ERR_PNPM_LOCKFILE_NOT_FOUND when none of the three source lockfiles is present. It also fails with ERR_PNPM_YARN_LOCKFILE_PARSE_FAILED when it cannot parse yarn.lock. It previously generated a lockfile from scratch in both cases.

  pnpm import always resolves locally. It warns when --pnpr-server or the pnpr-server setting is given and does not use the server.

• Sped up installs in large workspaces. Discovering the workspace projects no longer enumerates every matched directory to learn which manifest files it holds #​14352.

• Sped up installs in large workspaces. The resolver and the peer pass allocate less for every dependency edge #​14352.

• pnpm self-update, pnpm with, and automatic package-manager version switching no longer wait through registry retry delays when a configured registry has no signatures and registry.npmjs.org is unavailable #​14483.

• Sped up installs in large workspaces. Saving the lockfile is faster, and the install finishes without waiting for memory cleanup #​14352.

• pnpm install now relinks workspace packages when publishConfig.linkDirectory changes. Frozen installs report an outdated lockfile until it is regenerated pnpm/pnpm#14488.

• The pnpm npm wrapper keeps its placeholder shebang-less so pnpm 11 can install pnpm 12 through the version store. Wrapper installs must allow lifecycle scripts to install the native binary #​14502.

• Sped up dependency resolution when there is no lockfile, and for the dependencies a lockfile does not cover.

• Sped up installs in large workspaces. Workspace link: targets and importer ids are now derived from the paths' suffixes under the workspace root #​14352.

• pnpm install now reports "Already up to date" when local tarball dependencies have not changed #​14495.

• pnpm update now accepts --ignore-scripts and skips lifecycle scripts during the update pnpm/pnpm#14512.

• Sped up installs that restore a deleted node_modules from a warm global virtual store. pnpm no longer re-links packages that are already fully present in the global virtual store #​14510.

Platinum Sponsors

Gold Sponsors

v12.3.1: pnpm 12.3.1

Compare Source

Patch Changes

• Sped up installs in large workspaces: the anchor for re-rendering workspace link: targets is now derived once per project instead of once per dependency edge, and project ordering hashes paths by their raw bytes #​14352.

• After a self-update from pnpm 12.2 to 12.3, global commands such as node, npm, and yarn failed with unexpected argument '--shim' found. Global commands now launch normally, and their first launch migrates the global bin directory to native shims. When self-update downgrades to pnpm 12.2 or older, it keeps the newer native shims so those commands continue to work.

• Sped up installs in large workspaces. The check that verifies each project against the lockfile now runs the projects in parallel #​14352.

Platinum Sponsors

Gold Sponsors

v12.3.0: pnpm 12.3

Compare Source

Minor Changes

• Every context-aware global command (node, deno, bun, and the shims created with pnpm shim add) is now a native executable on every platform, so environment variables whose names are not valid shell identifiers reach these commands. On Windows, <name>.exe replaces the .cmd and .ps1 shims for them. Shims written by earlier pnpm 12 releases are migrated on the next global install or self-update.

• pnpm remove and pnpm update now accept --trust-lockfile, --no-trust-lockfile, --trust-policy, --trust-policy-exclude and --trust-policy-ignore-after, the same flags pnpm install and pnpm add take, so the supply-chain settings can be overridden for a single run. pnpm remove verifies the lockfile against the active policies the way pnpm install does, and --trust-lockfile skips that pass for every entry, not only the package being removed.

  pnpm now also honors --config.trust-lockfile=<value>, and accepts the bare --trust-lockfile / --no-trust-lockfile spelling on the commands that previously took the setting from the config file alone.

Patch Changes

• pnpm add <local directory>, pnpm add <local tarball>, pnpm add file:<path> and pnpm add <tarball URL> work again. A specifier given without a <name>@ prefix is no longer read as a registry package name and rejected with ERR_PNPM_PACKAGE_MANAGER_ADD_RESOLVE_LATEST #​14437.

• Fixed pnpm deploy --legacy ignoring allowUnusedPatches supplied through --config.allow-unused-patches or the PNPM_CONFIG_ALLOW_UNUSED_PATCHES environment variable pnpm/pnpm#14450.

• Fixed pnpm install --lockfile-only writing a lockfile that referenced a missing peer-suffixed snapshot when an npm-aliased dependency took part in a cyclic peer dependency graph. The following pnpm install --frozen-lockfile failed with ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY #​14449.

• pnpm config now accepts -g/--global, --location, and --json before its subcommand pnpm/pnpm#14421.

• pnpm dedupe now converges in one pass when it re-resolves a lockfile created by pnpm 11, so a second run no longer changes the lockfile #​14455.

• Fixed detached child processes being terminated on Windows when another program launches pnpm directly, without a shell, as nr from @antfu/ni does #​14447.

• Fixed pnpm docs <package>@<version> ignoring the requested version. It now opens the selected version's homepage and reports a missing version instead of opening the package-level homepage pnpm/pnpm#14428.

• Sped up installs in large workspaces. pnpm-lock.yaml is now read while the workspace projects are being discovered #​14352.

• Fixed filtered and recursive pnpm run and pnpm exec hanging when a script reads from the terminal. Interactive prompts work again in a script that pnpm never runs alongside another one, such as a single --filtered project, --workspace-concurrency=1, a dependency chain, or a task declaring concurrency: 1 #​14397.

• Fixed false unmet peer errors for auto-installed peers in linked workspace packages.

• Fixed npm global installs on Windows so the PowerShell shims invoke pnpm.exe.

• Fixed pnpm with current <command> when global options precede it, such as pnpm --workspace-root with current --version pnpm/pnpm#14413.

  A short-option cluster that mixes a global flag with an option owned by the command, such as pnpm -ro dist pack-app, is now parsed like the same options written after the command.

  An option written before the command name is now reported as an unknown option unless that command accepts it, instead of being taken for the command to run. pnpm -P exec echo and pnpm -z exec echo fail the way pnpm --tag next exec echo does.

• Apply pure insertions in zero-context patches at the correct line instead of one line early.

• Improved peer dependency resolution performance when many packages reuse the same peer ranges.

• pnpm outdated and pnpm update now follow local actions and reusable workflows referenced with GitHub's self-repository syntax (uses: $/.github/actions/setup) when looking for outdated GitHub Actions, the same way they follow ./ references.

• The pnpm install --help descriptions of --prod and --dev no longer claim that the flags take precedence over NODE_ENV. pnpm does not read NODE_ENV when selecting which dependency groups to install #​14445.

• Sped up installs in large workspaces. The check that decides whether the lockfile needs updating no longer compares every project against every lockfile entry #​14352.

• Sped up dependency resolution in large workspaces that use link: dependencies #​14352.

• On Linux, pnpm now resolves registry hostnames through the system resolver (getaddrinfo), as it already does on macOS and Windows and as pnpm 11 did. Previously, an /etc/resolv.conf containing an option the bundled pure-Rust resolver did not recognize, such as options no_tld_query, made pnpm ignore the configured nameservers and silently query Google's public DNS instead #​14469.

• Sped up dependency resolution in large workspaces. The resolver builds fewer lookup keys for each dependency #​14352.

• catalogMode and --save-catalog no longer move a local path, tarball, or workspace:<path> specifier into a catalog. Such a specifier is resolved against the project that declares it, so one catalog entry cannot mean the same directory for every project that references it #​14437.

• Sped up installs in large workspaces. The workspace dependency graph is now built once per run instead of twice #​14352.

• Sped up writing pnpm-lock.yaml in large workspaces #​14352.

• Fixed non-frozen installs through a pnpr server failing instead of regenerating a conflicted lockfile.

• pnpm update --interactive renders its checklist the way pnpm 11 does. Group headings and column headers are separators the cursor skips instead of checkboxes that select nothing. The columns of one group line up with the next. a toggles all and i inverts the selection. The confirmed selection is echoed as a list of package names #​14423.

• Fixed pnpm config commands targeting global configuration to skip project package manager version switching, allowing registry authentication to be configured before pnpm downloads a project-pinned version pnpm/pnpm#14463.

• Fixed pnpm retaining the surrounding quotes in .npmrc values, including auth tokens expanded from environment variables. This restores authentication with registries configured using :_authToken="${TOKEN}" pnpm/pnpm#14427.

• Fetch and tarball errors no longer print the secrets of the URL they name. Inline user:pass@ credentials and the query string or fragment of a signed URL are hidden, so a failed install or pnpm add <url> cannot leak them into terminal scrollback or CI logs.

• When dist-tags.latest names a version whose manifest pnpm cannot read, the error now names that version and the field it could not decode, instead of reporting the tag as empty.

• Retry transient Windows file-lock errors, including sharing violations, while linking dependencies with the default (isolated) nodeLinker. This fixes pnpm/pnpm#14407.

• pnpm run, pnpm exec, pnpm rebuild, and the script shortcuts such as pnpm test now load the pnpmfile, so updateConfig hook settings such as extraEnv and extraBinPaths reach the scripts they spawn #​14433.

• The pnpm executable of the npm package now works when the package was installed without running its install scripts, as under --ignore-scripts or the default build-script block of pnpm and Bun #​14346. In that case it runs through Node.js and, in a terminal, says how to switch to the native binary.

• Sped up installs in large workspaces. The resolver no longer copies the whole lockfile before resolving #​14352.

• minimumReleaseAgeStrict now defaults to true when minimumReleaseAge is explicitly configured, whether in pnpm-workspace.yaml, the global config.yaml, a PNPM_CONFIG_* variable, or a CLI flag. The built-in 1440-minute default stays non-strict. Previously an explicit cutoff was treated as non-strict, so immature versions were silently added to minimumReleaseAgeExclude instead of being gated with a prompt #​14409.

• Preserve environment variables whose names are not valid shell identifiers when launching Node.js installed by pnpm runtime set node --global on Unix pnpm/pnpm#14417.

• Fixed pnpm repo and pnpm docs failing to open the Windows browser from WSL pnpm/pnpm#14467.

• pnpm link, pnpm outdated, and pnpm import now apply pnpmfile updateConfig hooks before resolving dependencies.

• Fixed standalone installations to preserve the bundled node-gyp files used to build native dependencies.

• Fixed resolution against registries whose version manifests carry _npmUser, dist.attestations, dist.unpackedSize, dist.fileCount, or peerDependenciesMeta in a shape npm does not use. Such a version was skipped as though it had never been published, so pnpm add could fail with "no version found for the latest tag" even though the registry served it.

• pnpm unpublish now completes the two-factor authentication a registry asks for instead of failing with ERR_PNPM_UNAUTHORIZED while logged in. A 401 that is an OTP challenge starts the web-based authentication flow, or prompts for a classic one-time password. The obtained password is reused by every request of the run #​14464.

• On Windows, pnpm now resolves host names through the system resolver instead of its own DNS client. The built-in client bound a UDP socket for every lookup, which made Windows Defender Firewall ask to allow pnpm.exe again after every pnpm self-update #​14405.

Platinum Sponsors

Gold Sponsors

v12.2.1: pnpm 12.2.1

Compare Source

Patch Changes

• Restored the pnpm executable target without a file extension so pnpm 12.1 and earlier can upgrade to newer pnpm 12 releases on POSIX systems.

Platinum Sponsors

Gold Sponsors

config help if that's undesired. If you want to rebase/retry this PR, check this box This PR has been generated by Mend Renovate CLI.

[ferrfleet]

Only file touched is .github/workflows/release.yml: actions/checkout v6→v7, actions/setup-node v6→v7, and pnpm/action-setup's pnpm version input 11→12.

What changed upstream: checkout v7 and setup-node v7 are both ESM migrations, no behavioral breaks for a standard with: usage like this one. setup-node v7 does drop its dummy NODE_AUTH_TOKEN export, but this workflow already sets NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} explicitly per publish step, so that removal doesn't touch it. pnpm v12's breaking changes are stricter pnpm-workspace.yaml validation and stricter engineStrict enforcement.

What breaks here: nothing found. pnpm-workspace.yaml only uses packages, injectWorkspacePackages, allowBuilds, and overrides — all recognized keys. There's no .npmrc setting engine-strict, so the tighter engine enforcement doesn't apply. --frozen-lockfile behavior is unchanged in v12.

CI: release.yml only triggers on release: published, so none of this PR's CI jobs actually exercise the changed file — the green checks here are unrelated to this bump. Nit: this means the SHA/version bump is unverified by CI and will only be proven out on the next actual release.

No blocking issues.

[github-actions]

SonarQube — aucune nouvelle issue

_{Comparaison entre le projet bac à sable de cette PR et la branche par défaut : SonarQube Community n'analyse pas les PR, ce delta est calculé côté CI. Détail}