chore(deps): bump pnpm from 11.11.0 to 11.12.0 in /packages/dd-trace/test/plugins/versions in the test-versions group across 1 directory by dependabot[bot] · Pull Request #9365 · DataDog/dd-trace-js

dependabot · 2026-07-15T00:54:06Z

Bumps the test-versions group with 1 update in the /packages/dd-trace/test/plugins/versions directory: pnpm.

Updates pnpm from 11.11.0 to 11.12.0

Release notes

pnpm 11.12

Minor Changes

a897ef7: Custom fetchers exported from a pnpmfile can now delegate by returning a { delegate: <resolution> } envelope: pnpm rewrites the package's resolution to the delegated shape and runs the built-in fetcher on it. This is the portable delegation form that also works in pacquet, where cafs and fetchers cannot be passed to the hook. Related to pnpm/pnpm#11685.

Patch Changes

2b02764: The changed-packages filter (--filter "...[<since>]") no longer allows an option-like <since> value (such as --output=<path>) to be interpreted as a git option — git now rejects it as a bad revision. The repository root is also resolved to the nearest .git entry, so the filter works in a git worktree checked out inside another repository's tree.

43711ce: pnpm outdated no longer checks the registry for dependencies that are resolved from local link:, file:, or workspace: references in the lockfile #12827.

3c6718b: Fixed a deadlock in peer dependency resolution: pnpm install hung forever when a peer dependency cycle spanned a project's own dependencies and auto-installed peer providers, for example when installing [email protected] #12921.

252f15e: Fixed peer dependency auto-install picking a version the peer range rejects. In a workspace with several projects, a package declaring a peer dependency with a semver range (for example ^1.0.0) could get the highest version found anywhere in the workspace (for example a 2.0.0 resolved for another project) instead of a version that satisfies the range. Peers are now deduplicated onto the highest preferred version that satisfies the declared range, and when none does, the range is resolved from the registry.

Also fixed re-resolving with an existing lockfile hoisting a different peer version than a fresh install of the same manifest: root dependencies reused from the lockfile were invisible to peer hoisting, so a peer that a root dependency provides could be bound to another version.

a38adda: pnpm self-update <version> now installs the requested pnpm version when it matches the currently running version but is missing from the global self-update directory.

6a85968: pnpm stage list now stops paginating after a fail-safe cap of 1000 pages, so a misbehaving registry cannot keep the command looping forever.

eee7c9a: verify-deps-before-run no longer spawns a pnpm install when pnpm is executed in a directory that has no package.json. A mistyped command run outside a project (for example pnpm witch 10 login) used to crash with a confusing error from the spawned install; now it fails with the regular "no package.json found" error.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

11.12.0

Minor Changes

a897ef7: Custom fetchers exported from a pnpmfile can now delegate by returning a { delegate: <resolution> } envelope: pnpm rewrites the package's resolution to the delegated shape and runs the built-in fetcher on it. This is the portable delegation form that also works in pacquet, where cafs and fetchers cannot be passed to the hook. Related to pnpm/pnpm#11685.

Patch Changes

2b02764: The changed-packages filter (--filter "...[<since>]") no longer allows an option-like <since> value (such as --output=<path>) to be interpreted as a git option — git now rejects it as a bad revision. The repository root is also resolved to the nearest .git entry, so the filter works in a git worktree checked out inside another repository's tree.

43711ce: pnpm outdated no longer checks the registry for dependencies that are resolved from local link:, file:, or workspace: references in the lockfile #12827.

3c6718b: Fixed a deadlock in peer dependency resolution: pnpm install hung forever when a peer dependency cycle spanned a project's own dependencies and auto-installed peer providers, for example when installing [email protected] #12921.

252f15e: Fixed peer dependency auto-install picking a version the peer range rejects. In a workspace with several projects, a package declaring a peer dependency with a semver range (for example ^1.0.0) could get the highest version found anywhere in the workspace (for example a 2.0.0 resolved for another project) instead of a version that satisfies the range. Peers are now deduplicated onto the highest preferred version that satisfies the declared range, and when none does, the range is resolved from the registry.

Also fixed re-resolving with an existing lockfile hoisting a different peer version than a fresh install of the same manifest: root dependencies reused from the lockfile were invisible to peer hoisting, so a peer that a root dependency provides could be bound to another version.

a38adda: pnpm self-update <version> now installs the requested pnpm version when it matches the currently running version but is missing from the global self-update directory.

6a85968: pnpm stage list now stops paginating after a fail-safe cap of 1000 pages, so a misbehaving registry cannot keep the command looping forever.

eee7c9a: verify-deps-before-run no longer spawns a pnpm install when pnpm is executed in a directory that has no package.json. A mistyped command run outside a project (for example pnpm witch 10 login) used to crash with a confusing error from the spawned install; now it fails with the regular "no package.json found" error.

Commits

98722fa chore(release): 11.12.0 (#12937)
8e17c3d refactor: rename the pacquet/ directory to pnpm/ (#12913)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the test-versions group with 1 update in the /packages/dd-trace/test/plugins/versions directory: [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm). Updates `pnpm` from 11.11.0 to 11.12.0 - [Release notes](https://github.com/pnpm/pnpm/releases) - [Changelog](https://github.com/pnpm/pnpm/blob/main/pnpm11/pnpm/CHANGELOG.md) - [Commits](https://github.com/pnpm/pnpm/commits/v11.12.0/pnpm11/pnpm) --- updated-dependencies: - dependency-name: pnpm dependency-version: 11.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: test-versions ... Signed-off-by: dependabot[bot] <[email protected]>

dd-octo-sts · 2026-07-15T00:54:53Z

Overall package size

Self size: 6.76 MB
Deduped: 7.42 MB
No deduping: 7.42 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.3.1 | 122.62 kB | 438.86 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

pr-commenter · 2026-07-15T01:12:04Z

Benchmarks

Benchmark execution time: 2026-07-15 01:12:00

Comparing candidate commit 254e17b in PR branch dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/test-versions-63978eea31 with baseline commit 1abef82 in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 2328 metrics, 30 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-24

unstable execution_time [-209529.596µs; +208646.629µs] or [-7.854%; +7.821%]

scenario:appsec-appsec-enabled-26

unstable execution_time [-238.195ms; +253.033ms] or [-9.271%; +9.848%]

scenario:appsec-appsec-enabled-with-attacks-26

unstable execution_time [-189.308ms; +177.014ms] or [-6.498%; +6.076%]

scenario:appsec-control-20

unstable execution_time [-94.282ms; +127.765ms] or [-5.812%; +7.876%]

scenario:appsec-control-24

unstable execution_time [-116.398ms; +121.340ms] or [-9.400%; +9.799%]

scenario:appsec-control-26

unstable execution_time [-130.654ms; +128.311ms] or [-10.512%; +10.324%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-20

unstable execution_time [-17.316ms; +13.424ms] or [-6.731%; +5.218%]

scenario:appsec-iast-with-vulnerability-iast-enabled-always-active-20

unstable execution_time [-26.202ms; +36.791ms] or [-4.755%; +6.676%]

scenario:child_process-shell-string-24

unstable execution_time [-13.050ms; +24.864ms] or [-4.008%; +7.636%]

scenario:debugger-line-probe-with-snapshot-minimal-26

unstable cpu_user_time [-2583.927ms; +4148.215ms] or [-27.069%; +43.456%]
unstable execution_time [-2579.148ms; +4149.812ms] or [-25.141%; +40.452%]
unstable instructions [-23.1G instructions; +36.9G instructions] or [-28.958%; +46.281%]
unstable max_rss_usage [-9.448MB; +12.421MB] or [-5.897%; +7.752%]
unstable throughput [-817.796op/s; +503.720op/s] or [-25.322%; +15.597%]

scenario:debugger-line-probe-without-snapshot-24

unstable cpu_user_time [-1755.586ms; +547.471ms] or [-21.251%; +6.627%]
unstable execution_time [-1831.182ms; +599.200ms] or [-20.427%; +6.684%]
unstable instructions [-14.7G instructions; +4.7G instructions] or [-21.792%; +6.982%]
unstable throughput [-158.983op/s; +482.440op/s] or [-4.318%; +13.104%]

scenario:debugger-line-probe-without-snapshot-26

unstable cpu_user_time [-4537.210ms; +3012.007ms] or [-40.885%; +27.142%]
unstable execution_time [-4536.732ms; +3009.130ms] or [-38.318%; +25.416%]
unstable instructions [-40.7G instructions; +27.0G instructions] or [-43.624%; +28.965%]
unstable max_rss_usage [-13.708MB; +10.238MB] or [-8.330%; +6.221%]
unstable throughput [-590.145op/s; +888.664op/s] or [-20.257%; +30.504%]

scenario:dogstatsd-with-tags-20

unstable cpu_user_time [-490.923ms; +116.364ms] or [-10.144%; +2.404%]
unstable execution_time [-491.410ms; +120.641ms] or [-9.988%; +2.452%]
unstable throughput [-42414.587op/s; +172841.456op/s] or [-2.489%; +10.143%]

scenario:plugin-graphql-long-with-depth-on-max-20

unstable cpu_user_time [-682.751ms; +737.117ms] or [-5.308%; +5.730%]
unstable execution_time [-687.090ms; +737.431ms] or [-5.226%; +5.609%]
unstable throughput [-3.345op/s; +3.143op/s] or [-5.467%; +5.136%]

scenario:plugin-pg-service-26

unstable execution_time [-62.307ms; +31.102ms] or [-6.918%; +3.453%]

Bumps the test-versions group with 1 update in the /packages/dd-trace/test/plugins/versions directory: [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm). Updates `pnpm` from 11.11.0 to 11.12.0 - [Release notes](https://github.com/pnpm/pnpm/releases) - [Changelog](https://github.com/pnpm/pnpm/blob/main/pnpm11/pnpm/CHANGELOG.md) - [Commits](https://github.com/pnpm/pnpm/commits/v11.12.0/pnpm11/pnpm) --- updated-dependencies: - dependency-name: pnpm dependency-version: 11.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: test-versions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot Bot added dependabot dependencies javascript Pull requests that update javascript code semver-patch labels Jul 15, 2026

dependabot Bot requested a review from a team as a code owner July 15, 2026 00:54

dependabot Bot added the javascript Pull requests that update javascript code label Jul 15, 2026

dependabot Bot requested review from bojbrook and removed request for a team July 15, 2026 00:54

dependabot Bot added the dependabot label Jul 15, 2026

dd-octo-sts Bot approved these changes Jul 15, 2026

View reviewed changes

dd-octo-sts Bot enabled auto-merge (squash) July 15, 2026 00:54

dd-octo-sts Bot merged commit 6b22cba into master Jul 15, 2026
656 checks passed

dd-octo-sts Bot deleted the dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/test-versions-63978eea31 branch July 15, 2026 01:12

This was referenced Jul 15, 2026

v6.4.0 proposal #9368

Merged

v5.115.0 proposal #9369

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump pnpm from 11.11.0 to 11.12.0 in /packages/dd-trace/test/plugins/versions in the test-versions group across 1 directory#9365

chore(deps): bump pnpm from 11.11.0 to 11.12.0 in /packages/dd-trace/test/plugins/versions in the test-versions group across 1 directory#9365
dd-octo-sts[bot] merged 1 commit into
masterfrom
dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/test-versions-63978eea31

dependabot Bot commented on behalf of github Jul 15, 2026

Uh oh!

dd-octo-sts Bot commented Jul 15, 2026

Uh oh!

pr-commenter Bot commented Jul 15, 2026

Explanation

More details about the CI and significant changes

Unstable benchmarks

scenario:appsec-appsec-enabled-24

scenario:appsec-appsec-enabled-26

scenario:appsec-appsec-enabled-with-attacks-26

scenario:appsec-control-20

scenario:appsec-control-24

scenario:appsec-control-26

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-20

scenario:appsec-iast-with-vulnerability-iast-enabled-always-active-20

scenario:child_process-shell-string-24

scenario:debugger-line-probe-with-snapshot-minimal-26

scenario:debugger-line-probe-without-snapshot-24

scenario:debugger-line-probe-without-snapshot-26

scenario:dogstatsd-with-tags-20

scenario:plugin-graphql-long-with-depth-on-max-20

scenario:plugin-pg-service-26

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 15, 2026

pnpm 11.12

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

11.12.0

Minor Changes

Patch Changes

Uh oh!

dd-octo-sts Bot commented Jul 15, 2026

Overall package size

Uh oh!

pr-commenter Bot commented Jul 15, 2026

Benchmarks

Explanation

More details about the CI and significant changes

Unstable benchmarks

scenario:appsec-appsec-enabled-24

scenario:appsec-appsec-enabled-26

scenario:appsec-appsec-enabled-with-attacks-26

scenario:appsec-control-20

scenario:appsec-control-24

scenario:appsec-control-26

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-20

scenario:appsec-iast-with-vulnerability-iast-enabled-always-active-20

scenario:child_process-shell-string-24

scenario:debugger-line-probe-with-snapshot-minimal-26

scenario:debugger-line-probe-without-snapshot-24

scenario:debugger-line-probe-without-snapshot-26

scenario:dogstatsd-with-tags-20

scenario:plugin-graphql-long-with-depth-on-max-20

scenario:plugin-pg-service-26

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants