[github-actions]

Updates pnpm from 11.26.0 to 12.16.1

cc @nodejs/web-infra

Check this workflow's logs at https://github.com/nodejs/doc-kit/actions/runs/41257079054.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
api-docs-tooling	Ready	Preview	Nov 1, 2026 12:31am UTC

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	8f63bd4	2026-11-01T00:31:55.597Z	View logs ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.14%. Comparing base (0e999db) to head (8f63bd4).
⚠️ Report is 19 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1213   +/-   ##
=======================================
  Coverage   94.14%   94.14%           
=======================================
  Files         291      291           
  Lines       28942    28942           
  Branches     2942     2942           
=======================================
  Hits        27248    27248           
  Misses       1672     1672           
  Partials       22       22           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[btea]

doc-kit/.github/workflows/update-pnpm.yml

Line 62 in 0e999db

draft: true

Should we set draft to false?

[MattIPv4]

doc-kit/.github/workflows/update-pnpm.yml

Line 62 in 0e999db

draft: true

Should we set draft to false?

No, it is intentionally a draft so that when one of us marks it ready for review, that triggers the CI to run.

[MattIPv4]

This introduces the two-document lockfile that will break Dependabot security alerts, are we okay with that?

[ovflowd]

This introduces the two-document lockfile that will break Dependabot security alerts, are we okay with that?

Could you elaborate?

[MattIPv4]

This introduces the two-document lockfile that will break Dependabot security alerts, are we okay with that?

Could you elaborate?

GitHub cannot parse the two-document lockfile, so https://github.com/nodejs/doc-kit/security/dependabot will become empty, and we will no longer receive Dependabot alerts/updates for vulnerable dependencies. See dependabot/dependabot-core#15904 + https://github.com/orgs/community/discussions/211597

[ovflowd]

GitHub cannot parse the two-document lockfile

I don't think I understand you. I fail to understand you, could you please elaborate? What is this two-document lockfile?

[MattIPv4]

GitHub cannot parse the two-document lockfile

I don't think I understand you. I fail to understand you, could you please elaborate? What is this two-document lockfile?

In https://github.com/nodejs/doc-kit/blob/8f63bd4df1df07595f90603918c9ecb9d3c43ea1/pnpm-lock.yaml there are now two documents (a document is marked by ---). The first contains pnpm's own dependencies, and the second contains the project's dependencies. GitHub only reads the first document from the file, and so loses awareness of our project's actual dependencies.

[ovflowd]

encies, and the second contains the project's dependencies. GitHub only reads the first document from the file, and so loses awareness of our project's actual dependencies.

Appreciate the explanation. Marking this as a draft and blocking till upstream gets fixed.

[ovflowd]

Blocked by upstream. Otherwise Dependabot will partially stop working.

GitHub fixed the lockfile parsing: dependabot/dependabot-core#15904 (comment)