chore(deps): update pnpm/setup action to v3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
pnpm/setup	action	major	v1 → v3

---

Release Notes

pnpm/setup (pnpm/setup)

v3.0.0

Compare Source

What's Changed

• fix!: include runid in cache key, restore freshest lockfile match by @​poulet42 in #​43
• feat!: automatically detect Node.js version files by @​Neonsy in #​49
• docs: add private registry authentication recipes by @​zkochan in #​61
• fix: avoid deprecated shell spawning for pnpm commands by @​sebdanielsson in #​52
• fix: require-lockfile no longer accepts a lockfile pnpm will not use by @​zkochan in #​60

New Contributors

• @​poulet42 made their first contribution in #​43
• @​Neonsy made their first contribution in #​49

Full Changelog: pnpm/setup@v2.1.0...v3.0.0

v2.1.0

Compare Source

What's Changed

• fix: restore cache before installing runtime by @​Stanzilla in #​39
• feat: install multiple runtimes from devEngines.runtime by @​BlankParticle in #​32
• perf: cache pnpm's lockfile verification results by @​zkochan in #​30
• feat: add working-directory, deprecating package-json-file by @​haines in #​27
• feat: add a require-lockfile input by @​sebdanielsson in #​23
• ci: update dependencies with pnpm/update instead of Dependabot by @​zkochan in #​41
• chore: update dependencies by @​github-actions[bot] in #​42

New Contributors

• @​Stanzilla made their first contribution in #​39
• @​BlankParticle made their first contribution in #​32
• @​haines made their first contribution in #​27
• @​sebdanielsson made their first contribution in #​23
• @​github-actions[bot] made their first contribution in #​42

Full Changelog: pnpm/setup@v2.0.2...v2.1.0

v2.0.2

Compare Source

What's Changed

• feat: install pnpm from the npm registry, verified against npm's signature by @​zkochan in #​24
• fix: keep the installed runtime authoritative against context-aware shims by @​zkochan in #​25

Full Changelog: pnpm/setup@v2.0.1...v2.0.2

v2.0.1

Compare Source

What's Changed

• fix: normalize Windows cache store paths by @​zkochan in #​22
• docs(README): bump versions (node, action/setup) by @​urban-adeininger in #​20

New Contributors

• @​urban-adeininger made their first contribution in #​20

Full Changelog: pnpm/setup@v2.0.0...v2.0.1

v2.0.0

Compare Source

The action no longer installs pnpm through npm. It downloads pnpm's self-contained release binary for the runner's platform straight from pnpm's GitHub releases, verifies it against the SHA-256 digest GitHub publishes for the asset, and puts it on PATH. No Node.js, no npm, no @pnpm/exe, no self-update round-trip.

That also makes the action immune to broken npm artifacts. pnpm 11.13.0's @pnpm/exe build shipped without its platform binary, which made v1 install a placeholder file that failed later with This: not found and exit code 127. The GitHub release binary for that same version is fine, so v2 installs it correctly. v2 additionally verifies the install by running pnpm --version and comparing it against the requested version, so a bad artifact fails immediately with a clear message instead of surfacing as a confusing error in a later step.

Breaking changes

pnpm v11 or newer is required. v1 could set up pnpm 10 via pnpm self-update; v2 rejects anything below v11 with an explanatory error. The action is built around pnpm's self-contained release binaries and the pnpm runtime command, both of which arrived in v11.

If you need pnpm 10 or older, use pnpm/action-setup instead.

The bin-dest output points somewhere new. It was ~/setup-pnpm/node_modules/.bin/bin; it is now ~/setup-pnpm (the dest directory itself). Workflows that read the output are unaffected — it still names the directory holding pnpm — but anything that hardcoded the old path needs updating.

cache-hit is stricter. It is now true only on an exact key match. v1 reported true for any restore. This matches what actions/cache means by cache-hit.

No inputs or outputs were removed or renamed.

What's new

• Flexible version specs. version accepts an exact version (12.0.0-beta.4), a semver range (^12.0.0), or an npm dist-tag (next-12). It is still optional when packageManager or devEngines.packageManager is set in package.json.
• Partial store cache reuse. Cache restore now falls back to restore keys, so a single changed dependency no longer forces a full re-download of the store.
• New token input. Used for the GitHub release lookup, defaulting to ${{ github.token }} so the low anonymous API rate limit doesn't apply. It rarely needs to be set.
• pnpx, pn, and pnx aliases are linked next to the pnpm binary.

Upgrading

For most workflows the upgrade is the tag:

-      - uses: pnpm/setup@v1
+      - uses: pnpm/setup@v2

Check first that the pnpm version you install — via the version input, packageManager, or devEngines.packageManager — is v11 or newer.

One platform caveat: pnpm v11 publishes no binary for Intel macOS (darwin-x64). Use pnpm v12 or newer on Intel macOS runners.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6a89128

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR