Update pnpm to v10.34.6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pnpm (source)	10.34.5 → 10.34.6

---

Release Notes

pnpm/pnpm (pnpm)

v10.34.6

Compare Source

Patch Changes

• e7888e5: pnpm self-update now resolves and verifies pnpm through registry, authentication, proxy, and TLS settings from trusted non-project configuration. Project configuration and the default project pnpmfile can no longer redirect the pnpm download or disable engine identity verification.

• 46bc7c9: pnpm no longer tells you to update itself with Corepack or with pnpm add -g:

  • The update notification now suggests pnpm self-update, or the standalone install script when pnpm is running under Corepack. It used to suggest corepack use pnpm@<version>, or pnpm add -g pnpm / pnpm add -g @pnpm/exe when pnpm was not installed by the standalone script — but pnpm add -g refuses to install pnpm and points at pnpm self-update anyway, and @pnpm/exe is not published for pnpm v12 or newer, where the unscoped pnpm package is itself the native executable.
  • pnpm self-update under Corepack now points at the standalone install script too, instead of telling you to update pnpm with Corepack.

• 46bc7c9: Updated adm-zip to v0.6.0, which fixes a memory-exhaustion vulnerability where a crafted ZIP file could make it allocate 4 GB of memory. adm-zip is used to extract the Node.js, Bun, and Deno archives that pnpm downloads on Windows.

• Updated the embedded Node.js release keys to the current canonical nodejs/release-keys list.

• Updated the embedded npm registry signing keys to the set currently advertised by npm.

• 702ad5f: Update the embedded Node.js release keys with the new key added to nodejs/release-keys (Stewart X Addison, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD).

Platinum Sponsors

Gold Sponsors

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 7507c063-e64f-43bb-8ff6-6df21c98ab52

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}