[aversini]

Automated non-major dependency bump (deps-train).

package.json

• pnpm 12.15.0 → 12.16.0

packages/secret/package.json

• inquirer 14.2.4 → 14.2.5

packages/bundlecheck/package.json

• @inquirer/select 5.2.7 → 5.2.8

Transitive refresh (pnpm update) — 4 package(s) moved

Show transitive changes

• fast-copy 4.2.0 → 4.3.1
• magic-string 1.4.3 → 1.4.5
• postcss 8.5.31 → 8.5.32
• strtok3 10.6.2 → 10.6.3

---

What changed

pnpm 12.15.0 → 12.16.0

pnpm 12.16

This release adds a global --env-file flag, updates to a symlinked pnpm-lock.yaml, and pnpm setup --no-modify-path. It also fixes two security issues, in zstd decompression and in signing.

Minor Changes

• Added a repeatable global --env-file <path> flag to load environment variables from dotenv-style files before running a command. Later files override earlier files, variables already in the environment are preserved, and loaded variables are visible to user-level .npmrc interpolation and lifecycle scripts #7111.

• pnpm can now update a pnpm-lock.yaml that is a symlink. List the directories the lockfile may link into in the symlinkedLockfileTargetDirs setting, in the global config or with PNPM_CONFIG_SYMLINKED_LOCKFILE_TARGET_DIRS. pnpm writes the update to the file the symlink points to if that file is inside one of these directories. The symlink stays in place. pnpm ignores this setting in pnpm-workspace.yaml #17222.

• Added a --no-modify-path option to pnpm setup. It installs pnpm without adding it to PATH, leaving the shell config file, the Windows registry, and the GitHub Actions environment files unchanged. pnpm setup then prints the lines to add yourself get.pnpm.io#37.

Patch Changes

Security

• Fixed memory exposure and allocation handling vulnerabilities when processing zst

…notes truncated.

compare 12.15.0…12.16.0 · npm

inquirer 14.2.4 → 14.2.5

[email protected]

[email protected]

What's new

• Dependencies updated: @inquirer/[email protected] fixes the cursor overlapping the message when the password prompt is empty (#2360), and @inquirer/[email protected] fixes piped-stdin answers being dropped before the first render (#2359)

compare 14.2.4…14.2.5 · npm

@inquirer/select 5.2.7 → 5.2.8

releases · npm

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates pnpm to 12.16.0, inquirer to 14.2.5, and @inquirer/select to 5.2.8.

• The repository now pins pnpm 12.16.0.
• The bundlecheck and secret prompts use newer Inquirer packages.
• The lockfile now selects newer versions of four transitive packages.

_{Reviews (1) · Last reviewed commit: "fix: bump non-breaking dependencies to l..." · Reviewed by Greptile}