fix: bump non-breaking dependencies to latest

[aversini]

Automated non-major dependency bump (deps-train).

package.json

• turbo 2.11.3 → 2.11.4
• pnpm 11.27.1 → 11.28.0

---

What changed

turbo 2.11.3 → 2.11.4

Turborepo v2.11.4

What's Changed

Changelog

• fix: Respect negated global dependencies in affected detection by @anthonyshew in fix: Respect negated global dependencies in affected detection vercel/turborepo#14164
• chore: Release Turborepo 2.11.3 by @github-actions[bot] in chore: Release Turborepo 2.11.3 vercel/turborepo#14165
• test: Share Go compilation caches across integration tests by @anthonyshew in test: Share Go compilation caches across integration tests vercel/turborepo#14166
• refactor: Add injectable manifest loading to repository graphs by @anthonyshew in refactor: Add injectable manifest loading to repository graphs vercel/turborepo#14167
• test: Move Go and Cargo scope planning into crate tests by @anthonyshew in test: Move Go and Cargo scope planning into crate tests vercel/turborepo#14168
• refactor: Extract subprocess-free Go observation assembly by @anthonyshew in refactor: Extract subprocess-free Go observation assembly vercel/turborepo#14169
• test: Move Cargo environment hash contracts into crates by @anthonyshew in test: Move Cargo environment hash contracts into crates vercel/turborepo#14170
• test: Move Cargo output layout matrices to repository contracts by @anthonyshew in test: Move Cargo output layout matrices to repository contracts vercel/turborepo#14171
• test: Cover Go discovery identities in memory by @anthonyshew in test: Cover Go discovery identities in memory vercel/turborepo#14172
• test: Cover Go hash inputs in repository contracts by @anthonyshew in test: Cover Go hash inputs in repository contracts vercel/turborepo#14174
• test: Move uv hash input contracts into crates by @anthonyshew in test: Move uv hash input contracts into crates vercel/turborepo#14175
• test: Cover Go task selection in the engine by @anthonyshew in https://github.com/vercel/

…notes truncated.

compare 2.11.3…2.11.4 · npm

pnpm 11.27.1 → 11.28.0

pnpm 11.28

pnpm 11.28.0 adds the forceIgnoresPlatform setting and pnpm update --peer, and fixes many bugs in pnpm deploy, --filter, nodeLinker: hoisted, and custom modulesDir setups. This release also carries security fixes for shell completion, bin shims on Nix, lifecycle scripts inside a custom modulesDir, and userAgent placeholders in pnpm-workspace.yaml.

Minor Changes

• Added the forceIgnoresPlatform setting. When it is false, pnpm install --force skips optional dependencies whose os, cpu or libc do not match the host instead of installing all of them. The default stays true #6133.

Patch Changes

Security

• pnpm no longer expands environment variables in a userAgent set in a project's pnpm-workspace.yaml. A userAgent with a placeholder in that file is now ignored. Before this fix, pnpm sent the variable's value to the configured registry #15415.

• pnpm no longer treats packages inside a custom modulesDir as workspace projects, including one that packageConfigs sets for a project. Before, with a modulesDir such as vendor and a packages pattern such as **, a repeat install ran the lifecycle scripts of dependencies that allowBuilds had not approved #15412.

• On Nix, a dependency's bin named like a system utility such as sed can no longer redirect a POSIX bin shim or the

…notes truncated.

compare 11.27.1…11.28.0 · npm