Update dependencies and add pnpm workspace configuration - #279
Merged
Conversation
Bump @actions/cache, @types/node, eslint, prettier, smol-toml, and typescript-eslint to their latest versions, dedupe transitive deps, and pin remaining vulnerable transitive packages (undici, rollup, fast-xml-parser, brace-expansion) via pnpm overrides in pnpm-workspace.yaml. pnpm audit now reports no known vulnerabilities. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6F3N1ZgwerPyNf7UEp9Tx
pavelzw
reviewed
Aug 5, 2026
CI pins pnpm/action-setup to major version 9, which doesn't understand
pnpm-workspace.yaml's overrides/allowBuilds fields and actually fails
outright ("packages field missing or empty") when that file exists
without a packages: list. Move the dependency overrides back into
package.json's pnpm.overrides field (the pre-v10 location, supported by
pnpm v9) and drop pnpm-workspace.yaml. Verified pnpm audit is still
clean and the lockfile is unchanged when installed with pnpm v9.
Also bump the package version to 0.10.1 per review feedback.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M6F3N1ZgwerPyNf7UEp9Tx
The "Reference latest version in README" check requires every setup-pixi@v<version> mention to match package.json's version field. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6F3N1ZgwerPyNf7UEp9Tx
pnpm 10+ reads overrides/allowBuilds from pnpm-workspace.yaml instead of package.json's pnpm field, which is the cleaner, forward-compatible location and matches what's used locally. Verified with a fresh --frozen-lockfile install under pnpm 10: lockfile is unchanged, build, lint, and audit all still pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M6F3N1ZgwerPyNf7UEp9Tx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
@actions/cachefrom^6.1.0to^6.2.0pnpm-workspace.yamlconfiguration with:dist/index.jsanddist/post.js)Test Plan
Existing CI tests pass with updated dependencies.
https://claude.ai/code/session_01M6F3N1ZgwerPyNf7UEp9Tx