Bump the packages group with 2 updates

[dependabot]

Bumps the packages group with 2 updates: pnpm and @typescript-eslint/types.

Updates pnpm from 10.26.2 to 10.27.0

Release notes

Sourced from pnpm's releases.

pnpm 10.27

Minor Changes

• Adding trustPolicyIgnoreAfter allows you to ignore trust policy checks for packages published more than a specified time ago#10352.

• Added project registry for global virtual store prune support.

  Projects using the store are now registered via symlinks in {storeDir}/v10/projects/. This enables pnpm store prune to track which packages are still in use by active projects and safely remove unused packages from the global virtual store.

• Semi-breaking. Changed the location of unscoped packages in the virtual global store. They will now be stored under a directory named @ to maintain a uniform 4-level directory depth.

• Added mark-and-sweep garbage collection for global virtual store.

  pnpm store prune now removes unused packages from the global virtual store's links/ directory. The algorithm:

  1. Scans all registered projects for symlinks pointing to the store
  2. Walks transitive dependencies to mark reachable packages
  3. Removes any package directories not marked as reachable

  This includes support for workspace monorepos - all node_modules directories within a project (including those in workspace packages) are scanned.

Patch Changes

• Throw an error if the value of the tokenHelper or <url>:tokenHelper setting contains an environment variable.
• Git dependencies with build scripts should respect the dangerouslyAllowAllBuilds settings #10376.
• Skip the package manager check when running with --global and a project packageManager is configured, and warn that the check is skipped.
• pnpm store prune should not fail if the dlx cache directory has files, not only directories #10384
• Fixed a bug (#9759) where pnpm add would incorrectly modify a catalog entry in pnpm-workspace.yaml to its exact version.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.27.0

Minor Changes

• Adding trustPolicyIgnoreAfter allows you to ignore trust policy checks for packages published more than a specified time ago#10352.

• Added project registry for global virtual store prune support.

  Projects using the store are now registered via symlinks in {storeDir}/v10/projects/. This enables pnpm store prune to track which packages are still in use by active projects and safely remove unused packages from the global virtual store.

• Semi-breaking. Changed the location of unscoped packages in the virtual global store. They will now be stored under a directory named @ to maintain a uniform 4-level directory depth.

• Added mark-and-sweep garbage collection for global virtual store.

  pnpm store prune now removes unused packages from the global virtual store's links/ directory. The algorithm:

  1. Scans all registered projects for symlinks pointing to the store
  2. Walks transitive dependencies to mark reachable packages
  3. Removes any package directories not marked as reachable

  This includes support for workspace monorepos - all node_modules directories within a project (including those in workspace packages) are scanned.

Patch Changes

• Throw an error if the value of the tokenHelper or <url>:tokenHelper setting contains an environment variable.
• Git dependencies with build scripts should respect the dangerouslyAllowAllBuilds settings #10376.
• Skip the package manager check when running with --global and a project packageManager is configured, and warn that the check is skipped.
• pnpm store prune should not fail if the dlx cache directory has files, not only directories #10384
• Fixed a bug (#9759) where pnpm add would incorrectly modify a catalog entry in pnpm-workspace.yaml to its exact version.

Commits

• 6bdba72 chore(release): 10.27.0
• 512f188 fix: git dependencies respect dangerouslyAllowAllBuilds (#10387)
• c23bdf7 feat(cli): skip package manager check when using --global option (#10368)
• 3f2c5f4 feat: add trustPolicyIgnoreAfter (#10359)
• See full diff in compare view

Updates @typescript-eslint/types from 8.50.1 to 8.51.0

Release notes

Sourced from @​typescript-eslint/types's releases.

v8.51.0

8.51.0 (2025-12-29)

🚀 Features

• eslint-plugin: expose rule name via RuleModule interface (#11719)
• eslint-plugin: [no-useless-default-assignment] fix some cases to optional syntax (#11871)
• eslint-plugin: add namespace to plugin meta (#11885)
• tsconfig-utils: more informative error on parsing failures (#11888)

🩹 Fixes

• eslint-plugin: fix crash and false positives in no-useless-default-assignment (#11845)
• eslint-plugin: remove fixable from no-dynamic-delete rule (#11876)
• eslint-plugin: bump ts-api-utils to 2.2.0 (#11881)
• eslint-plugin: [prefer-optional-chain] handle MemberExpression in final chain position (#11835)

❤️ Thank You

• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• mdm317
• Ulrich Stark
• Yannick Decat @​mho22
• Yukihiro Hasegawa @​y-hsgw

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/types's changelog.

8.51.0 (2025-12-29)

This was a version bump only for types to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

• e4c57f5 chore(release): publish 8.51.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
github-rest-api-executor	Error		Dec 30, 2025 10:30pm