pnpm-settings-migrator 0.13.0 → 0.15.0

package/README.md

@@ -43,6 +43,10 @@ The CLI no longer prints a startup banner, missing optional files, a zero-change
 count, or a duplicate completion message. Use `--version` to see the version.
 Warnings are reserved for settings requiring attention. Information blocks have
 one blank line between them, with no extra blank lines at the start or end.
+URL credentials are hidden in diffs, warnings, and errors. Parser diagnostics
+keep available locations but omit configuration source excerpts. For example,
+`https://user:p@ssword@proxy.example/` is displayed as
+`https://***@proxy.example/`; the stored setting is preserved.
 
 Other outcomes are reported according to the files actually changed:
 
@@ -180,6 +184,39 @@ consumes them from workspace configuration; their v11 support is unchanged.
 Invalid values and fields unsupported by the target remain in their sources.
 The global-only `macosBackup` setting is preserved with a project-refused warning.
 
+`forceIgnoresPlatform` requires pnpm 11.28.0+ or 12.7.0+. pnpm's defaults differ
+between those majors; the migrator only moves explicit values. For v12,
+`publishWaitTimeout` and `reporter` require 12.7.0+. The timeout is a nonnegative
+safe integer in milliseconds (zero disables waiting); numeric `.npmrc` values
+are converted to YAML numbers. Reporter values are `default`, `append-only`,
+`ndjson`, and `silent`, or preserved environment placeholders.
+
+From 11.28.0 / 12.7.0, dynamic `userAgent` values remain in their sources because
+pnpm ignores project values containing environment placeholders. From 11.28.1,
+invalid `patchedDependencies` maps and non-array `packages` values are retained
+with diagnostics. From 12.8.2, `globalShims` belongs in trusted global
+configuration and is retained with an incompatibility warning. Existing
+workspaces containing these incompatible values fail validation before writes.
+
+From 11.28.3, non-null `allowBuilds` values must be maps of booleans or strings.
+From 11.28.4, non-null `allowUnusedPatches` must be boolean, and non-null
+`ignoredOptionalDependencies` / `requiredScripts` must be string arrays.
+From 11.28.5, `httpProxy` and `httpsProxy` must be strings, including when empty;
+null is incompatible. Invalid values remain in their sources with diagnostics.
+
+For pnpm 12.9.0 and later stable v12 releases, URL-keyed `registries` entries
+can set `networkConcurrency` to a positive safe integer, or null to leave it
+unset. On older or unconfirmed targets, the entire registry setting stays in
+its source when it contains this field.
+
+For pnpm 12.10.0 and later stable v12 releases, `nodeLinker` additionally accepts
+`loaded` or `{ type: 'loaded', excluded: ['package-name'] }`, and `lockfile`
+accepts `{ includeResolutionSettings: true }` to record resolution settings in
+the lockfile. Existing linker strings and boolean `lockfile` values still work.
+`failIfNoMatch` also requires 12.10.0 for v12 targets, when pnpm first consumes
+it from workspace configuration. Unsupported or invalid nested settings stay
+intact in their source; the migrator does not add pnpm's defaults.
+
 </details>
 
 <details>
@@ -226,11 +263,11 @@ Notes:
   `overrides`, `saveExact`, and `savePrefix`. Supported subproject `.npmrc`
   fields are moved there by package name. pnpm 12.0–12.3 does not support
   `packageConfigs`.
-- For v12 targets from 12.4.0, migrating `packageConfigs` or subproject settings
-  requires `sharedWorkspaceLockfile: false` in the merged workspace. Otherwise
-  source settings remain with a warning; existing `packageConfigs` blocks
-  migration until the effective lockfile mode is compatible. This restriction
-  does not apply to v11. The migrator does not change this mode automatically.
+- For v11 targets and v12 targets from 12.4.0, migrating `packageConfigs` or
+  subproject settings requires `sharedWorkspaceLockfile: false` in the merged
+  workspace. Otherwise source settings remain with a warning; existing
+  `packageConfigs` blocks migration until the effective lockfile mode is
+  compatible. The migrator does not change this mode automatically.
 - Cleanup removes only source keys represented in the final workspace after
   applying the selected merge strategy.
   Each source is checked against its own values, including deprecated-key
@@ -254,13 +291,18 @@ Notes:
 - The migrator does not update the `packageManager` version, CI environment variables,
   shell setup, or pnpm commands in scripts. When `packageManager` still pins pnpm 10,
   pass `--compatibility v11` explicitly and update the pin separately.
-- Compatibility checks cover pnpm 11.27.1 and 12.6.0, retaining 11.25.0,
-  11.26.0, 12.2.1, 12.3.4, 12.4.0, 12.4.2, 12.5.0, and 12.5.1 regressions.
-  As [audited on 2026-09-24](docs/research/pnpm-settings-bump-2026-09-24.md),
-  npm `latest` and the highest stable release are 12.6.0; `latest-11` is 11.27.1.
-  The project is pinned to 12.6.0. The removed `pnpm install --resolution-only` CLI
-  flag is outside this settings migrator's scope; replace it with
-  `pnpm peers check` in scripts before upgrading.
+- Compatibility checks cover pnpm 11.28.5 and 12.10.0, including 11.28.0,
+  11.28.1, 11.28.2, 11.28.3, 11.28.4, 12.7.0, 12.8.0, 12.8.1, 12.8.2,
+  12.9.0, and 12.9.1. Earlier regressions remain at 11.25.0,
+  11.26.0, 11.27.1, 12.2.1, 12.3.4, 12.4.0, 12.4.2, 12.5.0, 12.5.1, and 12.6.0.
+  As [audited on 2026-10-06](docs/research/pnpm-settings-bump-2026-10-06.md),
+  npm `latest` is 12.9.1; the highest confirmed stable release is 12.10.0 on
+  `next-12`. The v11 target is 11.28.5 on `next-11`, while `latest-11` is
+  11.28.2. The project is pinned to 12.9.1. These checks verify the documented
+  fixtures, not every setting in every release. v10 has unit regressions and
+  source review through 10.34.6; real v10 consumption remains unverified.
+  The removed `pnpm install --resolution-only` CLI flag is outside this settings
+  migrator's scope; replace it with `pnpm peers check` in scripts before upgrading.
 
 </details>
 
@@ -294,6 +336,12 @@ for the upstream release and schema references.
 
 Force replacing deprecated pnpm settings with new keys and remove old keys during migration.
 
+For v10, replacing legacy build permissions with `allowBuilds` requires a
+confirmed stable target of 10.26.0 or later. Older or unconfirmed targets keep
+the legacy setting names and report a warning. Canonical `update` sections
+and registry prefixes take precedence over their deprecated aliases, including
+when they come from different configuration sources.
+
 <details>
 <summary>Deprecated setting conversion examples</summary>
 
@@ -325,6 +373,10 @@ Strategy to handle conflicts when merging settings with existing `pnpm-workspace
 `packageConfigs` matcher arrays preserve order and repeated entries because the
 last matching entry wins. With `merge`, incoming matchers follow existing ones;
 an overlapping end/start sequence is reused to keep repeated migrations stable.
+`filter` and `filterProd` use the same ordered merging: a repeated inclusion can
+restore projects removed by an earlier exclusion. Cleanup verifies the combined
+selector sequence. If package cleanup is disabled, later `.npmrc` selectors are
+retained when needed to keep repeated migrations stable.
 
 ### `--no-yarn-resolutions`