build(deps): bump pnpm/setup from 1.0.0 to 2.1.0 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: pnpm/setup.

Updates pnpm/setup from 1.0.0 to 2.1.0

Release notes

Sourced from pnpm/setup's releases.

v2.1.0

What's Changed

• fix: restore cache before installing runtime by @​Stanzilla in pnpm/setup#39
• feat: install multiple runtimes from devEngines.runtime by @​BlankParticle in pnpm/setup#32
• perf: cache pnpm's lockfile verification results by @​zkochan in pnpm/setup#30
• feat: add working-directory, deprecating package-json-file by @​haines in pnpm/setup#27
• feat: add a require-lockfile input by @​sebdanielsson in pnpm/setup#23
• ci: update dependencies with pnpm/update instead of Dependabot by @​zkochan in pnpm/setup#41
• chore: update dependencies by @​github-actions[bot] in pnpm/setup#42

New Contributors

• @​Stanzilla made their first contribution in pnpm/setup#39
• @​BlankParticle made their first contribution in pnpm/setup#32
• @​haines made their first contribution in pnpm/setup#27
• @​sebdanielsson made their first contribution in pnpm/setup#23
• @​github-actions[bot] made their first contribution in pnpm/setup#42

Full Changelog: pnpm/setup@v2.0.2...v2.1.0

v2.0.2

What's Changed

• feat: install pnpm from the npm registry, verified against npm's signature by @​zkochan in pnpm/setup#24
• fix: keep the installed runtime authoritative against context-aware shims by @​zkochan in pnpm/setup#25

Full Changelog: pnpm/setup@v2.0.1...v2.0.2

v2.0.1

What's Changed

• fix: normalize Windows cache store paths by @​zkochan in pnpm/setup#22
• docs(README): bump versions (node, action/setup) by @​urban-adeininger in pnpm/setup#20

New Contributors

• @​urban-adeininger made their first contribution in pnpm/setup#20

Full Changelog: pnpm/setup@v2.0.0...v2.0.1

v2.0.0

The action no longer installs pnpm through npm. It downloads pnpm's self-contained release binary for the runner's platform straight from pnpm's GitHub releases, verifies it against the SHA-256 digest GitHub publishes for the asset, and puts it on PATH. No Node.js, no npm, no @pnpm/exe, no self-update round-trip.

That also makes the action immune to broken npm artifacts. pnpm 11.13.0's @pnpm/exe build shipped without its platform binary, which made v1 install a placeholder file that failed later with This: not found and exit code 127. The GitHub release binary for that same version is fine, so v2 installs it correctly. v2 additionally verifies the install by running pnpm --version and comparing it against the requested version, so a bad artifact fails immediately with a clear message instead of surfacing as a confusing error in a later step.

Breaking changes

pnpm v11 or newer is required. v1 could set up pnpm 10 via pnpm self-update; v2 rejects anything below v11 with an explanatory error. The action is built around pnpm's self-contained release binaries and the pnpm runtime command, both of which arrived in v11.

If you need pnpm 10 or older, use pnpm/action-setup instead.

The bin-dest output points somewhere new. It was ~/setup-pnpm/node_modules/.bin/bin; it is now ~/setup-pnpm (the dest directory itself). Workflows that read the output are unaffected — it still names the directory holding pnpm — but anything that hardcoded the old path needs updating.

... (truncated)

Commits

• 703c526 chore: update dependencies (#42)
• e02cd34 ci: update dependencies with pnpm/update instead of Dependabot (#41)
• 0080eca feat: add a require-lockfile input (#23)
• 3327d57 feat: add working-directory, deprecating package-json-file (#27)
• 0e9f373 perf: cache pnpm's lockfile verification results (#30)
• f2f7d5f feat: install multiple runtimes from devEngines.runtime (#32)
• 1dad155 fix: restore cache before installing runtime (#39)
• 84cb39b fix: keep the installed runtime authoritative against context-aware shims (#25)
• ed0c46d feat: install pnpm from the npm registry, verified against npm's signature (#24)
• 4700d73 README: bump versions (node, actions/setup) (#20)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions