Bumps [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) from 10.24.0
to 10.27.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pnpm/pnpm/releases">pnpm's
releases</a>.</em></p>
<blockquote>
<h2>pnpm 10.27</h2>
<h2>Minor Changes</h2>
<ul>
<li>
<p>Adding <code>trustPolicyIgnoreAfter</code> allows you to ignore trust
policy checks for packages published more than a specified time ago<a
href="https://redirect.github.com/pnpm/pnpm/issues/10352">#10352</a>.</p>
</li>
<li>
<p>Added project registry for global virtual store prune support.</p>
<p>Projects using the store are now registered via symlinks in
<code>{storeDir}/v10/projects/</code>. This enables <code>pnpm store
prune</code> to track which packages are still in use by active projects
and safely remove unused packages from the global virtual store.</p>
</li>
<li>
<p><strong>Semi-breaking.</strong> Changed the location of unscoped
packages in the virtual global store. They will now be stored under a
directory named <code>@</code> to maintain a uniform 4-level directory
depth.</p>
</li>
<li>
<p>Added mark-and-sweep garbage collection for global virtual store.</p>
<p><code>pnpm store prune</code> now removes unused packages from the
global virtual store's <code>links/</code> directory. The algorithm:</p>
<ol>
<li>Scans all registered projects for symlinks pointing to the
store</li>
<li>Walks transitive dependencies to mark reachable packages</li>
<li>Removes any package directories not marked as reachable</li>
</ol>
<p>This includes support for workspace monorepos - all
<code>node_modules</code> directories within a project (including those
in workspace packages) are scanned.</p>
</li>
</ul>
<h2>Patch Changes</h2>
<ul>
<li>Throw an error if the value of the <code>tokenHelper</code> or
<code><url>:tokenHelper</code> setting contains an environment
variable.</li>
<li>Git dependencies with build scripts should respect the
<code>dangerouslyAllowAllBuilds</code> settings <a
href="https://redirect.github.com/pnpm/pnpm/issues/10376">#10376</a>.</li>
<li>Skip the package manager check when running with --global and a
project packageManager is configured, and warn that the check is
skipped.</li>
<li><code>pnpm store prune</code> should not fail if the dlx cache
directory has files, not only directories <a
href="https://redirect.github.com/pnpm/pnpm/pull/10384">#10384</a></li>
<li>Fixed a bug (<a
href="https://redirect.github.com/pnpm/pnpm/issues/9759">#9759</a>)
where <code>pnpm add</code> would incorrectly modify a catalog entry in
<code>pnpm-workspace.yaml</code> to its exact version.</li>
</ul>
<h2>Platinum Sponsors</h2>
<!-- raw HTML omitted -->
<h2>Gold Sponsors</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pnpm/pnpm/blob/v10.27.0/pnpm/CHANGELOG.md">pnpm's
changelog</a>.</em></p>
<blockquote>
<h2>10.27.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p>Adding <code>trustPolicyIgnoreAfter</code> allows you to ignore trust
policy checks for packages published more than a specified time ago<a
href="https://redirect.github.com/pnpm/pnpm/issues/10352">#10352</a>.</p>
</li>
<li>
<p>Added project registry for global virtual store prune support.</p>
<p>Projects using the store are now registered via symlinks in
<code>{storeDir}/v10/projects/</code>. This enables <code>pnpm store
prune</code> to track which packages are still in use by active projects
and safely remove unused packages from the global virtual store.</p>
</li>
<li>
<p><strong>Semi-breaking.</strong> Changed the location of unscoped
packages in the virtual global store. They will now be stored under a
directory named <code>@</code> to maintain a uniform 4-level directory
depth.</p>
</li>
<li>
<p>Added mark-and-sweep garbage collection for global virtual store.</p>
<p><code>pnpm store prune</code> now removes unused packages from the
global virtual store's <code>links/</code> directory. The algorithm:</p>
<ol>
<li>Scans all registered projects for symlinks pointing to the
store</li>
<li>Walks transitive dependencies to mark reachable packages</li>
<li>Removes any package directories not marked as reachable</li>
</ol>
<p>This includes support for workspace monorepos - all
<code>node_modules</code> directories within a project (including those
in workspace packages) are scanned.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>Throw an error if the value of the <code>tokenHelper</code> or
<code><url>:tokenHelper</code> setting contains an environment
variable.</li>
<li>Git dependencies with build scripts should respect the
<code>dangerouslyAllowAllBuilds</code> settings <a
href="https://redirect.github.com/pnpm/pnpm/issues/10376">#10376</a>.</li>
<li>Skip the package manager check when running with --global and a
project packageManager is configured, and warn that the check is
skipped.</li>
<li><code>pnpm store prune</code> should not fail if the dlx cache
directory has files, not only directories <a
href="https://redirect.github.com/pnpm/pnpm/pull/10384">#10384</a></li>
<li>Fixed a bug (<a
href="https://redirect.github.com/pnpm/pnpm/issues/9759">#9759</a>)
where <code>pnpm add</code> would incorrectly modify a catalog entry in
<code>pnpm-workspace.yaml</code> to its exact version.</li>
</ul>
<h2>10.26.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>Improve error message when a package version exists but does not meet
the <code>minimumReleaseAge</code> constraint. The error now clearly
states that the version exists and shows a human-readable time since
release (e.g., "released 6 hours ago") <a
href="https://redirect.github.com/pnpm/pnpm/issues/10307">#10307</a>.</p>
</li>
<li>
<p>Fix installation of Git dependencies using annotated tags <a
href="https://redirect.github.com/pnpm/pnpm/issues/10335">#10335</a>.</p>
<p>Previously, pnpm would store the annotated tag object's SHA in the
lockfile instead of the actual commit SHA. This caused
<code>ERR_PNPM_GIT_CHECKOUT_FAILED</code> errors because the checked-out
commit hash didn't match the stored tag object hash.</p>
</li>
<li>
<p>Binaries of runtime engines (Node.js, Deno, Bun) are written to
<code>node_modules/.bin</code> before lifecycle scripts (install,
postinstall, prepare) are executed <a
href="https://redirect.github.com/pnpm/pnpm/issues/10244">#10244</a>.</p>
</li>
<li>
<p>Try to avoid making network calls with preferOffline <a
href="https://redirect.github.com/pnpm/pnpm/pull/10334">#10334</a>.</p>
</li>
</ul>
<h2>10.26.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Don't fail on <code>pnpm add</code>, when
<code>blockExoticSubdeps</code> is set to <code>true</code> <a
href="https://redirect.github.com/pnpm/pnpm/issues/10324">#10324</a>.</li>
<li>Always resolve git references to full commits and ensure
<code>HEAD</code> points to the commit after checkout <a
href="https://redirect.github.com/pnpm/pnpm/pull/10310">#10310</a>.</li>
</ul>
<h2>10.26.0</h2>
<h3>Minor Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pnpm/pnpm/commit/6bdba72ad31e4d6b79821405e09c6bdcc93894ee"><code>6bdba72</code></a>
chore(release): 10.27.0</li>
<li><a
href="https://github.com/pnpm/pnpm/commit/512f18817d610ae83646c4f864089710e1a28f17"><code>512f188</code></a>
fix: git dependencies respect <code>dangerouslyAllowAllBuilds</code> (<a
href="https://github.com/pnpm/pnpm/tree/HEAD/pnpm/issues/10387">#10387</a>)</li>
<li><a
href="https://github.com/pnpm/pnpm/commit/c23bdf7311cdc5763e2c9527e1b0a130448301c4"><code>c23bdf7</code></a>
feat(cli): skip package manager check when using --global option (<a
href="https://github.com/pnpm/pnpm/tree/HEAD/pnpm/issues/10368">#10368</a>)</li>
<li><a
href="https://github.com/pnpm/pnpm/commit/3f2c5f4d3958e6a150f734917eabd6ad88452e98"><code>3f2c5f4</code></a>
feat: add <code>trustPolicyIgnoreAfter</code> (<a
href="https://github.com/pnpm/pnpm/tree/HEAD/pnpm/issues/10359">#10359</a>)</li>
<li><a
href="https://github.com/pnpm/pnpm/commit/8ec7939657b78167c2753f05dacd62feabd59180"><code>8ec7939</code></a>
chore(release): 10.26.2</li>
<li><a
href="https://github.com/pnpm/pnpm/commit/4986c46b48f48ae7c5aeef2aca90820ab7b3775c"><code>4986c46</code></a>
chore(release): 10.26.1</li>
<li><a
href="https://github.com/pnpm/pnpm/commit/244e33b4e963b257952dadf192d829bfec858fb9"><code>244e33b</code></a>
chore(release): 10.26.0</li>
<li><a
href="https://github.com/pnpm/pnpm/commit/40775391d54d400c7d516bffaca667215a5e472d"><code>4077539</code></a>
fix(git-fetcher): block git dependencies from running prepare scripts
unless ...</li>
<li><a
href="https://github.com/pnpm/pnpm/commit/b0cd2dea489e28162a233cf02af3646cdd57bb8c"><code>b0cd2de</code></a>
chore(release): 10.25.0</li>
<li><a
href="https://github.com/pnpm/pnpm/commit/fa82ec393a2627fee47956b639b6ce57a4679318"><code>fa82ec3</code></a>
docs: update sponsors</li>
<li>Additional commits viewable in <a
href="https://github.com/pnpm/pnpm/commits/v10.27.0/pnpm">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/storytold/artcraft/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- refactored all markdown content as a shared library for use across
both the ArtCraft website and the app (FAQ, tutorials, news)
- added a news page to the website
- added a news & updates option to the app's bottom right help context
menu
Instructions to add and build News Posts for both the site and app is in
``NEWS_POSTS.md`` but in short:
- To add a new news post, create an .md file in
``libs/markdown-content/src/lib/content/news/`` folder
- Restart the artcraft-website dev server after adding new posts (or in
/frontend directory, run ``node scripts/generate-news-json.mjs``
manually) - this will update the public ``news.json`` file on the
website.
- This is just a temporary workaround - this way if the ArtCraft app
itself hasn't updated, it'll still be able to load the latest public
``news.json`` file from the website to show within the app.
**UX: Improve video generation validation feedback**
- Enable "Generate" button interactions to provide actionable error
toasts instead of silent disabling.
- Add inline "Starting frame required" warning with icon when a
reference image is missing.
- Update tooltip component to support conditional disabling for better
UX control.
dependabot[bot]
Brandon Thomas
bflatastic