[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pnpm (source)	12.16.0 → 12.16.1
pnpm (source)	12.16.0 → 12.16.1

---

Release Notes

pnpm/pnpm (pnpm)

v12.16.1: pnpm 12.16.1

Compare Source

This release fixes pnpm install hanging on a cold store in workspaces that install Cargo crates, and pnpm pack shipping a file that files excludes by name.

Patch Changes

• pnpm install no longer hangs on a cold store in a workspace that also installs Cargo crates or a Rust toolchain.

• pnpm pack and pnpm publish now apply a files entry that names a file after the glob and directory entries, as npm does. A file excluded by name, such as !dist/index.js, stays out even when a later dist/** matches it. A file named by its path, such as lib/secret.js, ships even when a later !lib/*.js matches it.

• pnpm install no longer leaves a broken symlink in an injected workspace dependency when the package links to a file outside its published files and pnpm imports by hardlink. Installing a git dependency now skips internal directory symlinks when importing its files into the store.

• pnpm install now relinks a command that a workspace project renames into the projects that depend on it when sharedWorkspaceLockfile is false pnpm/tasks#224.

• pnpm install and pnpm rebuild now refresh privately hoisted .bin shims in node_modules/.pnpm/node_modules/.bin after a dependency build replaces a script target with a native executable #​17402.

• pnpm install now reads a package's manifest to decide its peer dependencies when it updates an existing lockfile, as it does when it resolves from scratch.

• Commands, pnpm --version, pnpm self-update, and invocations with unknown flags now apply the same packageManager and devEngines.packageManager settings when switching to the pinned pnpm version or recording it in pnpm-lock.yaml. --config.<key> flags and lockfileDir now reach the version switch and lockfile sync on every entry point. Unreadable settings in pnpm-workspace.yaml or the global config.yaml that do not affect the pin decision no longer block the version switch pnpm/tasks#222.

• pnpm now accepts the --cache-dir <dir> flag, as in pnpm install --cache-dir /tmp/pnpm-cache #​17422.

• When the version or range given to pnpm unpublish matches every published version, the error now says so and shows the same command with --force. Before, the error suggested running pnpm unpublish <pkg>@<version>, the command that had just failed.

Platinum Sponsors

Gold Sponsors

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 6 to add, 1 to change, 1 to destroy.

Plan output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.network.aws_security_group.tasks will be created
  + resource "aws_security_group" "tasks" {
      + arn                    = (known after apply)
      + description            = "ECS tasks of cupcake-cupcake; peer rules are managed by javabin-app-peers-sync"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "cupcake-cupcake-tasks"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = true
      + tags                   = {
          + "Name"            = "cupcake-cupcake-tasks"
          + "javabin-network" = "app"
        }
      + tags_all               = {
          + "Name"            = "cupcake-cupcake-tasks"
          + "environment"     = "production"
          + "javabin-network" = "app"
          + "managed-by"      = "terraform"
          + "repo"            = "javaBin/frosting"
          + "service"         = "cupcake"
          + "team"            = "cupcake"
        }
      + vpc_id                 = "vpc-0cd3502de2527a310"
    }

  # module.network.aws_service_discovery_service.this will be created
  + resource "aws_service_discovery_service" "this" {
      + arn           = (known after apply)
      + force_destroy = true
      + id            = (known after apply)
      + name          = "cupcake-cupcake"
      + namespace_id  = (known after apply)
      + tags_all      = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + type          = (known after apply)

      + dns_config {
          + namespace_id   = "ns-4qfb7mei2fit4q4b"
          + routing_policy = "MULTIVALUE"

          + dns_records {
              + ttl  = 10
              + type = "A"
            }
        }

      + health_check_custom_config {
          + failure_threshold = 1
        }
    }

  # module.network.aws_ssm_parameter.network will be created
  + resource "aws_ssm_parameter" "network" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + description    = "App-to-app request for cupcake-cupcake — read by the platform app-peers-sync Lambda"
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (known after apply)
      + name           = "/javabin/apps/cupcake/cupcake/network"
      + tags_all       = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + tier           = (known after apply)
      + type           = "String"
      + value          = (sensitive value)
      + version        = (known after apply)
    }

  # module.network.aws_vpc_security_group_egress_rule.all will be created
  + resource "aws_vpc_security_group_egress_rule" "all" {
      + arn                    = (known after apply)
      + cidr_ipv4              = "0.0.0.0/0"
      + description            = "All outbound"
      + id                     = (known after apply)
      + ip_protocol            = "-1"
      + security_group_id      = (known after apply)
      + security_group_rule_id = (known after apply)
      + tags_all               = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
    }

  # module.network.aws_vpc_security_group_ingress_rule.alb[0] will be created
  + resource "aws_vpc_security_group_ingress_rule" "alb" {
      + arn                          = (known after apply)
      + description                  = "ALB to the app port"
      + from_port                    = 3000
      + id                           = (known after apply)
      + ip_protocol                  = "tcp"
      + referenced_security_group_id = "sg-061000c0fa68a41b7"
      + security_group_id            = (known after apply)
      + security_group_rule_id       = (known after apply)
      + tags_all                     = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + to_port                      = 3000
    }

  # module.service.aws_ecs_service.this will be updated in-place
  ~ resource "aws_ecs_service" "this" {
        id                                 = "arn:aws:ecs:eu-central-1:553637109631:service/javabin-platform/cupcake-cupcake"
        name                               = "cupcake-cupcake"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:eu-central-1:553637109631:task-definition/cupcake-cupcake:3" -> (known after apply)
        # (16 unchanged attributes hidden)

      ~ network_configuration {
          ~ security_groups  = [
              - "sg-0df9a0a3a22548c62",
            ] -> (known after apply)
            # (2 unchanged attributes hidden)
        }

      + service_registries {
          + registry_arn = (known after apply)
        }

        # (3 unchanged blocks hidden)
    }

  # module.service.aws_ecs_task_definition.this must be replaced
-/+ resource "aws_ecs_task_definition" "this" {
      ~ arn                      = "arn:aws:ecs:eu-central-1:553637109631:task-definition/cupcake-cupcake:3" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:eu-central-1:553637109631:task-definition/cupcake-cupcake" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  ~ environment            = [
                        {
                            name  = "COGNITO_DOMAIN"
                            value = "javabin-internal.auth.eu-central-1.amazoncognito.com"
                        },
                      + {
                          + name  = "COGNITO_EXTRA_AUTH_PARAMS"
                          + value = "prompt=select_account"
                        },
                        {
                            name  = "COGNITO_GROUPS"
                            value = "helter"
                        },
                        # (6 unchanged elements hidden)
                    ]
                    name                   = "cupcake"
                  ~ portMappings           = [
                      ~ {
                          - hostPort      = 3000
                            # (2 unchanged attributes hidden)
                        },
                    ]
                  - systemControls         = []
                  - volumesFrom            = []
                    # (7 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ enable_fault_injection   = false -> (known after apply)
      ~ id                       = "cupcake-cupcake" -> (known after apply)
      ~ revision                 = 3 -> (known after apply)
      - tags                     = {} -> null
        # (10 unchanged attributes hidden)

      - volume {
          - configure_at_launch = false -> null
          - name                = "tmp" -> null
        }
      + volume {
          + configure_at_launch = (known after apply)
          + name                = "tmp"
        }
    }

Plan: 6 to add, 1 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟡 MEDIUM

Creates new app networking resources (security group, egress/ingress rules, service discovery, SSM parameter) and replaces the cupcake ECS task definition, with a service update that moves networking to new security groups; no database or internet-facing exposure, but the task definition replacement and SG swap warrant a check before apply.

• 💥 [destruction] aws_ecs_task_definition.this is destroy-and-replace (forces replacement due to container_definitions change). Task definitions are immutable, so this creates revision 4 and deregisters the old one; the ECS service is updated in-place to the new revision, which triggers a rolling deployment of the cupcake tasks. Expect a brief deployment cycle; verify health checks and the minimum healthy percent settings.
• 🔒 [security] The ECS service's network_configuration drops security group sg-0df9a0a3a22548c62 and the plan shows the new tasks SG (aws_security_group.tasks) will be attached. Confirm the old SG is not also needed by other consumers and that the new SG's rules (ALB ingress on port 3000 from sg-061000c0fa68a41b7, all-outbound egress) are the intended replacement. Ingress is scoped to the ALB SG, not 0.0.0.0/0, so no public exposure is introduced.
• 🔒 [security] The container environment adds COGNITO_EXTRA_AUTH_PARAMS = prompt=select_account. This is a benign login UX parameter for Cognito, not a permission change. The container's hostPort 3000 mapping is removed (hostPort is dropped under awsvpc mode, which is normal).
• ✅ [routine] New service discovery service (cupcake-cupcake, MULTIVALUE A records, TTL 10) and an SSM parameter /javabin/apps/cupcake/cupcake/network are created. The SSM value is marked sensitive and is read by the platform app-peers-sync Lambda, which will also manage peer SG rules on the new tasks SG; note the Terraform config does not manage those peer rules, so drift is expected by design.
• 💰 [cost] No new billable resources such as NAT gateways, load balancers, or RDS instances are created. Cost impact is negligible; the only ongoing cost is minor (Cloud Map and SSM standard parameters are essentially free).

[github-actions]

Terraform Plan

✅ No changes — infrastructure is up to date.

Plan output

Acquiring state lock. This may take a few moments...

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.