build: update pnpm to v10.31.0 (main)

[angular-robot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pnpm (source)	10.30.3 → 10.31.0

---

Release Notes

pnpm/pnpm (pnpm)

v10.31.0: pnpm 10.31

Compare Source

Minor Changes

• When pnpm updates the pnpm-workspace.yaml, comments, string formatting, and whitespace will be preserved.

Patch Changes

• Added -F as a short alias for the --filter option in the help output.

• Handle undefined pkgSnapshot in pnpm why -r #​10700.

• Fix headless install not being used when a project has an injected self-referencing file: dependency that resolves to link: in the lockfile.

• Fixed a race condition when multiple worker threads import the same package to the global virtual store concurrently. The rename operation now tolerates ENOTEMPTY/EEXIST errors if another thread already completed the import.

• When lockfile-include-tarball-url is set to false, tarball URLs are now always excluded from the lockfile. Previously, tarball URLs could still appear for packages hosted under non-standard URLs, making the behavior flaky and inconsistent #​6667.

• Fixed optimisticRepeatInstall skipping install when overrides, packageExtensions, ignoredOptionalDependencies, patchedDependencies, or peersSuffixMaxLength changed.

• Fixed pnpm patch-commit failing with "unable to access '/.config/git/attributes': Permission denied" error in environments where HOME is unset or non-standard (Docker containers, CI systems).

  The issue occurred because pnpm was setting HOME and the Windows user profile env var to empty strings to suppress user git configuration when running git diff. This caused git to resolve the home directory (~) as root (/), leading to permission errors when attempting to access /.config/git/attributes.

  Now uses GIT_CONFIG_GLOBAL: os.devNull instead, which is git's proper mechanism for bypassing user-level configuration without corrupting the home directory path resolution.

  Fixes #​6537

• Fix pnpm why -r --parseable missing dependents when multiple workspace packages share the same dependency #​8100.

• Fix link-workspace-packages=true incorrectly linking workspace packages when the requested version doesn't match the workspace package's version. Previously, on fresh installs the version constraint is overridden to * in the fallback resolution paths, causing any workspace package with a matching name to be linked regardless of version #​10173.

• Fixed pnpm update --interactive table breaking with long version strings (e.g., prerelease versions like 7.0.0-dev.20251209.1) by dynamically calculating column widths instead of using hardcoded values #​10316.

• Explicitly tell npm the path to the global rc config file.

• The parameter set by the --allow-build flag is written to allowBuilds.

• Fix a bug in which specifying filter on pnpm-workspace.yaml would cause pnpm to not detect any projects.

• Print help message on running pnpm dlx without arguments and exit.

Platinum Sponsors

Gold Sponsors

---

• If you want to rebase/retry this PR, check this box

[gemini-code-assist]

Code Review

This pull request updates pnpm from version 10.30.3 to 10.31.0. The changes are consistent across MODULE.bazel, MODULE.bazel.lock, and package.json. I have one suggestion to improve developer experience by using a more flexible version range for pnpm in the engines field of package.json.

_{Note: Security Review did not run due to the size of the PR.}

[gemini-code-assist]

While pinning the pnpm version in the packageManager field is great for ensuring consistent environments, using a strict version in the engines field can be overly restrictive for developers who might not be using corepack. A developer with a slightly different patch version of pnpm installed globally would be blocked.

Using a caret range ^ would provide more flexibility without compromising the enforced version for corepack users. This aligns with the practice used for the node engine version in this same file.

Suggested change

	"pnpm": "10.31.0"
	"pnpm": "^10.31.0"

[alan-agius4]

This PR was merged into the repository. The changes were merged into the following branches:

• main: 081153b