build(deps-dev): Bump pnpm from 10.20.0 to 10.21.0

[dependabot]

Bumps pnpm from 10.20.0 to 10.21.0.

Release notes

Sourced from pnpm's releases.

pnpm 10.21

Minor Changes

• Node.js Runtime Installation for Dependencies. Added support for automatic Node.js runtime installation for dependencies. pnpm will now install the Node.js version required by a dependency if that dependency declares a Node.js runtime in the "engines" field. For example:

  {
    "engines": {
      "runtime": {
        "name": "node",
        "version": "^24.11.0",
        "onFail": "download"
      }
    }
  }

  If the package with the Node.js runtime dependency is a CLI app, pnpm will bind the CLI app to the required Node.js version. This ensures that, regardless of the globally installed Node.js instance, the CLI will use the compatible version of Node.js.

  If the package has a postinstall script, that script will be executed using the specified Node.js version.

  Related PR: #10141

• Added a new setting: trustPolicy.

  When set to no-downgrade, pnpm will fail installation if a package’s trust level has decreased compared to previous releases — for example, if it was previously published by a trusted publisher but now only has provenance or no trust evidence. This helps prevent installing potentially compromised versions of a package.

  Related issue: #8889.

• Added support for pnpm config get globalconfig to retrieve the global config file path #9977.

Patch Changes

• When a user runs pnpm update on a dependency that is not directly listed in package.json, none of the direct dependencies should be updated #10155.
• Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #10160.
• Setting gitBranchLockfile and related settings via pnpm-workspace.yaml should work #9651.

Platinum Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.21.0

Minor Changes

• Node.js Runtime Installation for Dependencies. Added support for automatic Node.js runtime installation for dependencies. pnpm will now install the Node.js version required by a dependency if that dependency declares a Node.js runtime in the "engines" field. For example:

  {
    "engines": {
      "runtime": {
        "name": "node",
        "version": "^24.11.0",
        "onFail": "download"
      }
    }
  }

  If the package with the Node.js runtime dependency is a CLI app, pnpm will bind the CLI app to the required Node.js version. This ensures that, regardless of the globally installed Node.js instance, the CLI will use the compatible version of Node.js.

  If the package has a postinstall script, that script will be executed using the specified Node.js version.

  Related PR: #10141

• Added a new setting: trustPolicy.

  When set to no-downgrade, pnpm will fail installation if a package’s trust level has decreased compared to previous releases — for example, if it was previously published by a trusted publisher but now only has provenance or no trust evidence. This helps prevent installing potentially compromised versions of a package.

  Related issue: #8889.

• Added support for pnpm config get globalconfig to retrieve the global config file path #9977.

Patch Changes

• When a user runs pnpm update on a dependency that is not directly listed in package.json, none of the direct dependencies should be updated #10155.
• Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #10160.
• Setting gitBranchLockfile and related settings via pnpm-workspace.yaml should work #9651.

Commits

• c1ec45b chore: fix repository URLs in package.json files of utils
• 2e2dc27 chore(release): 10.21.0
• 68ad086 feat: add support for npm package trust evidence check via a new trustPolicy ...
• 17344ca fix(update): prevent package.json updates when updating indirect dependencies...
• 5847af4 feat: install js runtime as prod dependency (#10141)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}