This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`10.17.1` -> `10.18.0`](https://renovatebot.com/diffs/npm/pnpm/10.17.1/10.18.0) | [![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/10.18.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/10.18.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/10.17.1/10.18.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/10.17.1/10.18.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) |

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

### [`v10.18.0`](https://github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#10180)

[Compare Source](pnpm/pnpm@v10.17.1...v10.18.0)

##### Minor Changes

- Added network performance monitoring to pnpm by implementing warnings for slow network requests, including both metadata fetches and tarball downloads.

  Added configuration options for warning thresholds: `fetchWarnTimeoutMs` and `fetchMinSpeedKiBps`.
  Warning messages are displayed when requests exceed time thresholds or fall below speed minimums

  Related PR: [#&#8203;10025](pnpm/pnpm#10025).

##### Patch Changes

- Retry filesystem operations on EAGAIN errors [#&#8203;9959](pnpm/pnpm#9959).
- Outdated command respects `minimumReleaseAge` configuration [#&#8203;10030](pnpm/pnpm#10030).
- Correctly apply the `cleanupUnusedCatalogs` configuration when removing dependent packages.
- Don't fail with a meaningless error when `scriptShell` is set to `false` [#&#8203;8748](pnpm/pnpm#8748).
- `pnpm dlx` should not fail when `minimumReleaseAge` is set [#&#8203;10037](pnpm/pnpm#10037).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or PR is renamed to start with "rebase!".

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Related work items: #30372

The `fetchMinSpeedKiBps` warning fired on any tarball ≥1 KiB with
non-zero elapsed time, so small-but-normal downloads (e.g. a 5 KiB
tarball finishing in 150 ms) tripped it constantly — handshake and
TTFB dominate the computed average there, not real throughput.

Replace the `len >= 1024` gate with `elapsed > 1s`, mirroring
pnpm/pnpm#10025. Update unit tests and the settings docs accordingly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

## Summary
- The `fetchMinSpeedKiBps` warning fired on any tarball ≥1 KiB with
non-zero elapsed time, so small-but-normal downloads (e.g. a 5 KiB
tarball finishing in 150 ms) tripped it constantly — handshake and TTFB
dominate the computed "average" there, not real throughput.
- Replace the `len >= 1024` gate in `warn_slow_tarball` with `elapsed >
1s`, mirroring pnpm's [`elapsedSec >
1`](pnpm/pnpm#10025) gate in its remote tarball
fetcher.
- Update the unit tests in `crates/aube-registry/src/client.rs` (new
sub-second and 1-second boundary cases; the fast/slow cases now use >1s
elapsed so the math actually runs) and regenerate the
`fetchMinSpeedKiBps` settings docs.

## Test plan
- [x] `cargo test -p aube-registry` (74 passed, including the 5
`slow_tarball_tests` cases)
- [x] `cargo clippy -p aube-registry -p aube-settings --all-targets --
-D warnings`
- [x] `cargo fmt --check`
- [x] `cargo run -p aube-settings --bin generate-settings-docs`
(regenerated `docs/settings/*.md`)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: changes only the conditions under which an observability
`fetchMinSpeedKiBps` warning is emitted, not the actual download
behavior or retry logic.
> 
> **Overview**
> Reduces noisy `fetchMinSpeedKiBps` warnings by changing
`warn_slow_tarball` to skip throughput checks for transfers that
complete in **≤ 1s** (and empty bodies), mirroring pnpm’s `elapsedSec >
1` gate.
> 
> Updates the pure-function unit tests to cover sub-second and 1-second
boundary cases and adjusts the fast/slow scenarios so the speed
calculation runs past the new gate, and regenerates the
`fetchMinSpeedKiBps` settings docs to match the simplified behavior
description.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
23ace11. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>