Repository navigation
upgrade pnpm version - #48975
Merged
Merged
upgrade pnpm version#48975
Conversation
edewit
reviewed
May 18, 2026
Contributor
Author
|
@edewit refined and updated to 11.1.3. The two most notable t 8000 hings are:
|
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Contributor
Author
|
11.1.1 - can still fail with a 403 during a pnpm build https://github.com/keycloak/keycloak/actions/runs/26185010713/job/77038933331?pr=48975#step:7:1024 11.1.3 - failed for me twice on the same javascript test. I'm unsure if that's related. |
Contributor
|
how about we check in the generated code and only run it when things have changes? that way the kiota cli doesn't need to be downloaded on each build |
Contributor
Author
Contributor
|
@edewit Can you please review when you get a chance? |
edewit
approved these changes
May 26, 2026
vmuzikar
approved these changes
May 26, 2026
Closed
edewit
added a commit
to edewit/keycloak
that referenced
this pull request
Jun 1, 2026
The pnpm 11 upgrade (keycloak#48975) added security floor overrides for several transitive dependencies. Re-testing shows most of them are no longer needed: pnpm already resolves to patched versions without forcing them. Remove overrides that no longer change resolution: - picomatch@^2, flatted, minimatch@~3, minimatch@~9 - @isaacs/brace-expansion@^5 (unused in the lockfile) - diff@^4 (already resolves to 4.0.4) Keep overrides still required because mocha (dev dep of keycloak-admin-client) would otherwise pull vulnerable versions: - serialize-javascript: ^7.0.5 (mocha requests ^6.0.2) - diff@^7: ^8.0.3 (mocha requests ^7.0.0, CVE fix requires >=8.0.3) Also bump the serialize-javascript floor from ^7.0.3 to ^7.0.5 to match the fully patched advisory range. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
edewit
added a commit
to edewit/keycloak
that referenced
this pull request
Jun 2, 2026
The pnpm 11 upgrade (keycloak#48975) added security floor overrides for several transitive dependencies. Re-testing shows most of them are no longer needed: pnpm already resolves to patched versions without forcing them. Remove overrides that no longer change resolution: - picomatch@^2, flatted, minimatch@~3, minimatch@~9 - @isaacs/brace-expansion@^5 (unused in the lockfile) - diff@^4 (already resolves to 4.0.4) Keep overrides still required because mocha (dev dep of keycloak-admin-client) would otherwise pull vulnerable versions: - serialize-javascript: ^7.0.5 (mocha requests ^6.0.2) - diff@^7: ^8.0.3 (mocha requests ^7.0.0, CVE fix requires >=8.0.3) Also bump the serialize-javascript floor from ^7.0.3 to ^7.0.5 to match the fully patched advisory range. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
stianst
pushed a commit
that referenced
this pull request
Jun 11, 2026
The pnpm 11 upgrade (#48975) added security floor overrides for several transitive dependencies. Re-testing shows most of them are no longer needed: pnpm already resolves to patched versions without forcing them. Remove overrides that no longer change resolution: - picomatch@^2, flatted, minimatch@~3, minimatch@~9 - @isaacs/brace-expansion@^5 (unused in the lockfile) - diff@^4 (already resolves to 4.0.4) Keep overrides still required because mocha (dev dep of keycloak-admin-client) would otherwise pull vulnerable versions: - serialize-javascript: ^7.0.5 (mocha requests ^6.0.2) - diff@^7: ^8.0.3 (mocha requests ^7.0.0, CVE fix requires >=8.0.3) Also bump the serialize-javascript floor from ^7.0.3 to ^7.0.5 to match the fully patched advisory range. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
sashyo
pushed a commit
to tide-foundation/keycloak-IGA
that referenced
this pull request
Jul 20, 2026
* task: upgrading pnpm to 11.1.3 Signed-off-by: Steve Hawkins <shawkins@redhat.com> * switching to 11.1.1 Signed-off-by: Steve Hawkins <shawkins@redhat.com> --------- Signed-off-by: Steve Hawkins <shawkins@redhat.com>
sashyo
pushed a commit
to tide-foundation/keycloak-IGA
that referenced
this pull request
Jul 20, 2026
The pnpm 11 upgrade (keycloak#48975) added security floor overrides for several transitive dependencies. Re-testing shows most of them are no longer needed: pnpm already resolves to patched versions without forcing them. Remove overrides that no longer change resolution: - picomatch@^2, flatted, minimatch@~3, minimatch@~9 - @isaacs/brace-expansion@^5 (unused in the lockfile) - diff@^4 (already resolves to 4.0.4) Keep overrides still required because mocha (dev dep of keycloak-admin-client) would otherwise pull vulnerable versions: - serialize-javascript: ^7.0.5 (mocha requests ^6.0.2) - diff@^7: ^8.0.3 (mocha requests ^7.0.0, CVE fix requires >=8.0.3) Also bump the serialize-javascript floor from ^7.0.3 to ^7.0.5 to match the fully patched advisory range. Signed-off-by: Erik Jan de Wit <erikjan.dewit@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes: #49164
@edewit not sure if this helps anything with the build, but in trying to understand our pnpm build issue it looked vaguely related to pnpm/action-setup#178 which several user link prs to that have upgrades of the pnpm version.
This was my best guess at aligning to latest. It doesn't seem great that the maven plugin doesn't understand version 11+ as it should be using the .mjs file, not the .cjs. Captured eirslett/frontend-maven-plugin#1224 to track that issue.