feat(pnpm): add support for configDependencies

[huyhua-nvg]

Changes

This pull request adds comprehensive support for pnpm's configDependencies to the npm manager, enabling extraction, parsing, and updating of these dependencies in pnpm-workspace.yaml files. It also enhances the handling of npm package metadata by extracting integrity and tarball fields, and improves the robustness of file extraction logic. The changes are covered by extensive new tests to ensure correct behavior.

Support for pnpm configDependencies:

• Added extraction and parsing of configDependencies from pnpm-workspace.yaml, supporting both string and object formats. This includes schema updates, extraction logic, and new tests to cover various scenarios. [1] [2] [3] [4] [5] [6] [7]
• Implemented the ability to update configDependencies entries, handling both scalar and object forms, including updating integrity and tarball fields as appropriate. Thoroughly tested with a variety of edge cases. [1] [2] [3] [4] [5]

NPM package metadata improvements:

• Enhanced the npm datasource to extract integrity and tarball fields from package metadata, storing them as newDigest and downloadUrl in release objects. [1] [2] [3]

File extraction logic improvements:

• Improved pnpm workspace file extraction to better detect and handle files that are not JSON or yarn config files, increasing robustness. [1] [2]

These changes ensure that Renovate can fully manage pnpm config dependencies, providing accurate updates and metadata extraction for advanced pnpm workflows.

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

The public repository:

[viceice]

why so many PR's?

• feat(pnpm): add support for configDependencies #40589
• feat(pnpm): add support for configDependencies #40590

[huyhua-nvg]

@viceice sorry about that. I messed up by force pushing and those PRs were autoclosed.

[viceice]

@viceice sorry about that. I messed up by force pushing and those PRs were autoclosed.

you can reopen after auto closing as long it's not merged

[viceice]

@viceice sorry about that. I messed up by force pushing and those PRs were autoclosed.

you can reopen after auto closing as long it's not merged