pnpm-settings-migrator 0.14.0 → 0.16.0

package/README.md

@@ -43,6 +43,10 @@ The CLI no longer prints a startup banner, missing optional files, a zero-change
 count, or a duplicate completion message. Use `--version` to see the version.
 Warnings are reserved for settings requiring attention. Information blocks have
 one blank line between them, with no extra blank lines at the start or end.
+URL credentials are hidden in diffs, warnings, and errors. Parser diagnostics
+keep available locations but omit configuration source excerpts. For example,
+`https://user:p@ssword@proxy.example/` is displayed as
+`https://***@proxy.example/`; the stored setting is preserved.
 
 Other outcomes are reported according to the files actually changed:
 
@@ -194,6 +198,45 @@ with diagnostics. From 12.8.2, `globalShims` belongs in trusted global
 configuration and is retained with an incompatibility warning. Existing
 workspaces containing these incompatible values fail validation before writes.
 
+From 11.28.3, non-null `allowBuilds` values must be maps of booleans or strings.
+From 11.28.4, non-null `allowUnusedPatches` must be boolean, and non-null
+`ignoredOptionalDependencies` / `requiredScripts` must be string arrays.
+From 11.28.5, `httpProxy` and `httpsProxy` must be strings, including when empty;
+null is incompatible. Invalid values remain in their sources with diagnostics.
+
+For pnpm 12.9.0 and later stable v12 releases, URL-keyed `registries` entries
+can set `networkConcurrency` to a positive safe integer, or null to leave it
+unset. On older or unconfirmed targets, the entire registry setting stays in
+its source when it contains this field.
+
+For pnpm 12.10.0 and later stable v12 releases, `nodeLinker` additionally accepts
+`loaded` or `{ type: 'loaded', excluded: ['package-name'] }`, and `lockfile`
+accepts `{ includeResolutionSettings: true }` to record resolution settings in
+the lockfile. Existing linker strings and boolean `lockfile` values still work.
+`failIfNoMatch` also requires 12.10.0 for v12 targets, when pnpm first consumes
+it from workspace configuration. Unsupported or invalid nested settings stay
+intact in their source; the migrator does not add pnpm's defaults.
+
+For pnpm 12.11.0 and later stable v12 releases, `permissions` maps dependency
+names or package IDs to `build` and `skills` decisions. Boolean `build`
+decisions override matching `allowBuilds` entries; strings are undecided prompts
+and null leaves a capability unset. Both settings are preserved for pnpm to
+apply its precedence. Unknown capabilities or invalid nested values keep the
+entire source object intact.
+
+`skills.dirs` accepts an array of workspace-relative agent skill directories;
+an empty array disables linking. Workspace `provenance` also requires 12.11.0
+for v12 targets and accepts boolean or null values. Its v11 support is unchanged.
+For example, targeting 12.11.0 migrates
+`{ "pnpm": { "permissions": { "example": { "build": false, "skills": true } }, "skills": { "dirs": [".agents/skills"] } } }`
+to equivalent workspace YAML. Targeting 12.10.1 retains these settings with
+diagnostics.
+
+pnpm v12 reads `filter` and `filterProd` from CLI arguments or `updateConfig`
+hooks, not workspace YAML. These settings remain in their source with
+diagnostics for v12 targets; existing YAML containing them blocks migration.
+The 12.11.2 hook fix does not add workspace support.
+
 </details>
 
 <details>
@@ -240,11 +283,11 @@ Notes:
   `overrides`, `saveExact`, and `savePrefix`. Supported subproject `.npmrc`
   fields are moved there by package name. pnpm 12.0–12.3 does not support
   `packageConfigs`.
-- For v12 targets from 12.4.0, migrating `packageConfigs` or subproject settings
-  requires `sharedWorkspaceLockfile: false` in the merged workspace. Otherwise
-  source settings remain with a warning; existing `packageConfigs` blocks
-  migration until the effective lockfile mode is compatible. This restriction
-  does not apply to v11. The migrator does not change this mode automatically.
+- For v11 targets and v12 targets from 12.4.0, migrating `packageConfigs` or
+  subproject settings requires `sharedWorkspaceLockfile: false` in the merged
+  workspace. Otherwise source settings remain with a warning; existing
+  `packageConfigs` blocks migration until the effective lockfile mode is
+  compatible. The migrator does not change this mode automatically.
 - Cleanup removes only source keys represented in the final workspace after
   applying the selected merge strategy.
   Each source is checked against its own values, including deprecated-key
@@ -268,12 +311,15 @@ Notes:
 - The migrator does not update the `packageManager` version, CI environment variables,
   shell setup, or pnpm commands in scripts. When `packageManager` still pins pnpm 10,
   pass `--compatibility v11` explicitly and update the pin separately.
-- Compatibility checks cover pnpm 11.28.2 and 12.8.2, including 11.28.0,
-  11.28.1, 12.7.0, 12.8.0, and 12.8.1. Earlier regressions remain at 11.25.0,
+- Compatibility checks cover pnpm 11.28.5 and 12.11.2, including 11.28.0,
+  11.28.1, 11.28.2, 11.28.3, 11.28.4, 12.7.0, 12.8.0, 12.8.1, 12.8.2,
+  12.9.0, 12.9.1, 12.10.0, 12.10.1, 12.11.0, and 12.11.1.
+  Earlier regressions remain at 11.25.0,
   11.26.0, 11.27.1, 12.2.1, 12.3.4, 12.4.0, 12.4.2, 12.5.0, 12.5.1, and 12.6.0.
-  As [audited on 2026-09-30](docs/research/pnpm-settings-bump-2026-09-30.md),
-  npm `latest` is 12.8.1; the highest confirmed stable release is 12.8.2 on
-  `next-12`. The project is pinned to 12.8.1. These checks verify the documented
+  As [audited on 2026-10-10](docs/research/pnpm-settings-bump-2026-10-10.md),
+  npm `latest` is 12.10.1; the highest confirmed stable release is 12.11.2 on
+  `next-12`. The v11 target is 11.28.5 on `next-11`, while `latest-11` is
+  11.28.2. The project is pinned to 12.10.1. These checks verify the documented
   fixtures, not every setting in every release. v10 has unit regressions and
   source review through 10.34.6; real v10 consumption remains unverified.
   The removed `pnpm install --resolution-only` CLI flag is outside this settings
@@ -311,6 +357,12 @@ for the upstream release and schema references.
 
 Force replacing deprecated pnpm settings with new keys and remove old keys during migration.
 
+For v10, replacing legacy build permissions with `allowBuilds` requires a
+confirmed stable target of 10.26.0 or later. Older or unconfirmed targets keep
+the legacy setting names and report a warning. Canonical `update` sections
+and registry prefixes take precedence over their deprecated aliases, including
+when they come from different configuration sources.
+
 <details>
 <summary>Deprecated setting conversion examples</summary>
 
@@ -342,6 +394,10 @@ Strategy to handle conflicts when merging settings with existing `pnpm-workspace
 `packageConfigs` matcher arrays preserve order and repeated entries because the
 last matching entry wins. With `merge`, incoming matchers follow existing ones;
 an overlapping end/start sequence is reused to keep repeated migrations stable.
+For v11 targets, `filter` and `filterProd` use the same ordered merging: a repeated inclusion can
+restore projects removed by an earlier exclusion. Cleanup verifies the combined
+selector sequence. If package cleanup is disabled, later `.npmrc` selectors are
+retained when needed to keep repeated migrations stable.
 
 ### `--no-yarn-resolutions`