build(deps): bump pnpm from 8.9.2 to 10.21.0

[dependabot]

Bumps pnpm from 8.9.2 to 10.21.0.

Release notes

Sourced from pnpm's releases.

pnpm 10.21

Minor Changes

• Node.js Runtime Installation for Dependencies. Added support for automatic Node.js runtime installation for dependencies. pnpm will now install the Node.js version required by a dependency if that dependency declares a Node.js runtime in the "engines" field. For example:

  {
    "engines": {
      "runtime": {
        "name": "node",
        "version": "^24.11.0",
        "onFail": "download"
      }
    }
  }

  If the package with the Node.js runtime dependency is a CLI app, pnpm will bind the CLI app to the required Node.js version. This ensures that, regardless of the globally installed Node.js instance, the CLI will use the compatible version of Node.js.

  If the package has a postinstall script, that script will be executed using the specified Node.js version.

  Related PR: #10141

• Added a new setting: trustPolicy.

  When set to no-downgrade, pnpm will fail installation if a package’s trust level has decreased compared to previous releases — for example, if it was previously published by a trusted publisher but now only has provenance or no trust evidence. This helps prevent installing potentially compromised versions of a package.

  Related issue: #8889.

• Added support for pnpm config get globalconfig to retrieve the global config file path #9977.

Patch Changes

• When a user runs pnpm update on a dependency that is not directly listed in package.json, none of the direct dependencies should be updated #10155.
• Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #10160.
• Setting gitBranchLockfile and related settings via pnpm-workspace.yaml should work #9651.

Platinum Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.21.0

Minor Changes

• Node.js Runtime Installation for Dependencies. Added support for automatic Node.js runtime installation for dependencies. pnpm will now install the Node.js version required by a dependency if that dependency declares a Node.js runtime in the "engines" field. For example:

  {
    "engines": {
      "runtime": {
        "name": "node",
        "version": "^24.11.0",
        "onFail": "download"
      }
    }
  }

  If the package with the Node.js runtime dependency is a CLI app, pnpm will bind the CLI app to the required Node.js version. This ensures that, regardless of the globally installed Node.js instance, the CLI will use the compatible version of Node.js.

  If the package has a postinstall script, that script will be executed using the specified Node.js version.

  Related PR: #10141

• Added a new setting: trustPolicy.

  When set to no-downgrade, pnpm will fail installation if a package’s trust level has decreased compared to previous releases — for example, if it was previously published by a trusted publisher but now only has provenance or no trust evidence. This helps prevent installing potentially compromised versions of a package.

  Related issue: #8889.

• Added support for pnpm config get globalconfig to retrieve the global config file path #9977.

Patch Changes

• When a user runs pnpm update on a dependency that is not directly listed in package.json, none of the direct dependencies should be updated #10155.
• Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #10160.
• Setting gitBranchLockfile and related settings via pnpm-workspace.yaml should work #9651.

10.20.0

Minor Changes

• Support --all option in pnpm --help to list all commands #8628.

Patch Changes

• When the latest version doesn't satisfy the maturity requirement configured by minimumReleaseAge, pick the highest version that is mature enough, even if it has a different major version #10100.
• create command should not verify patch info.
• Set managePackageManagerVersions to false, when switching to a different version of pnpm CLI, in order to avoid subsequent switches #10063.

... (truncated)

Commits

• c1ec45b chore: fix repository URLs in package.json files of utils
• 2e2dc27 chore(release): 10.21.0
• 68ad086 feat: add support for npm package trust evidence check via a new trustPolicy ...
• 17344ca fix(update): prevent package.json updates when updating indirect dependencies...
• 5847af4 feat: install js runtime as prod dependency (#10141)
• 49f03d1 chore(release): 10.20.0
• 5c27936 fix(create): create command should not verify patch info (#10122)
• 6e9ad42 feat: support -a option in pnpm --help to list all commands (#8628)
• a1a1ab3 fix: don't ever switch to another version of pnpm when it has beens switched ...
• d9bcd61 chore(release): 10.19.1-oidc-test.3
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for pnpm since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
devs-in-tech	Ready	Preview	Comment	Nov 10, 2025 8:12pm

[netlify]

❌ Deploy Preview for devsintech failed. Why did it fail? →

Name	Link
🔨 Latest commit	f440d99
🔍 Latest deploy log	https://app.netlify.com/projects/devsintech/deploys/691246ec7803cc00087f5590