fix: silence package manager warnings that break outdated --json

[wmaurer]

Problem

When you open a package.json in a pnpm workspace, the plugin can fail with this
message:

Error running pnpm outdated --json. Try running manually.

The virtual text is never shown. If you run pnpm outdated --json yourself in the same
directory, it works. This makes the error confusing.

Root cause

pnpm writes warnings to stdout, not to stderr, even when you use --json:

$ pnpm outdated --json 2>/dev/null
[WARN] The metadata of noise-pkg is missing the "time" field; skipping the minimumReleaseAge check for this package.
{
  "noise-pkg": { "latest": "2.0.0", "wanted": "1.0.0", ... }
}

$ pnpm outdated --json 2>&1 >/dev/null
(empty)

utils/job.lua passes all of stdout to vim.json.decode. The library behind it needs
the whole string to be one JSON document. Spaces before the JSON are fine, but any other
text is not. The payload here is valid JSON, but it does not start at the beginning of
the string. So the decode fails and the feature stops working.

The exit code is not the problem. ignore_error = true already handles the exit code 1
that outdated returns.

You do not need any special configuration for this to happen. pnpm config get minimumReleaseAge returns undefined, but pnpm still runs the check. So it also affects
users who have configured nothing. What you do need is a dependency from a registry that
has no time field in its package metadata. Self-hosted registries such as GitLab,
Verdaccio and Artifactory do this.

Fix

Add --loglevel=error to the outdated command. This hides the warnings, but the JSON
payload and real errors still come through.

The command now lives in show.__get_outdated_command. This follows the same pattern as
change-version.__get_version_list_command.

Verification

I reproduced the problem with a local registry that serves package metadata without a
time field, using pnpm 11.3.0 and Neovim 0.12.4. This produces the exact warning shown
above. These are the results for each flag:

command	decodes
pnpm outdated --json	✗ warning before the payload
pnpm --loglevel=error outdated --json	✓
pnpm --reporter=silent outdated --json	✓
pnpm --silent outdated --json	✓
pnpm --reporter=ndjson outdated --json	✗ puts everything inside log records

The payload is exactly the same with and without the flag. So the flag hides the warning
but keeps the result. npm accepts the same flag, and its output does not change.

I also ran the real utils/job.lua code with the new command against that registry. It
now decodes correctly, where before it failed.

make test passes completely, and stylua 0.17.0 reports no problems.

Alternatives considered

Another option is to make the decode in job.lua more tolerant: skip the extra text and
find the first position where the JSON decodes. This would work for every package
manager at once, including the yq job and any manager added later.

I chose the flag instead, for two reasons. First, it solves the cause instead of
accepting the broken output. Second, the search becomes very slow when the output never
decodes, because it tries again from every { in the string, including the thousands of
them inside the payload. I measured 31 ms for 92 KB, but 6.1 s for 945 KB. This runs in
the on_exit callback, so a cut-off response would freeze the editor before it shows the
error anyway.

Setting loglevel=error in .npmrc also works. But it hides pnpm warnings in the whole
repository for everyone, while the flag only affects this one command.

[vuki656]

Thanks <3