[will-white]

Supersedes #120, which cannot merge as a bare packageManager bump.

pnpm 11 adds two install-time policies that the current repo state violates. Both fail at pnpm install --frozen-lockfile, so CI goes red before it reaches lint or build.

1. minimumReleaseAge now defaults to 24 hours

Three transitive lockfile entries were published inside that window, so --frozen-lockfile rejected the lockfile outright:

✗ Lockfile failed supply-chain policy check (576 entries)
[ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 3 lockfile entries failed verification:
  @napi-rs/wasm-runtime@1.2.3, electron-to-chromium@1.5.405, get-tsconfig@4.14.2

Rebuilt from a fresh resolution under pnpm 11, which selects the aged versions instead (electron-to-chromium 1.5.405 → 1.5.404, get-tsconfig 4.14.2 → 4.14.1). No direct dependency changes version — only 12 transitive pins move.

2. An undecided build script is now fatal

pnpm 10 warned; pnpm 11 exits 1:

[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: unrs-resolver@1.12.2

unrs-resolver arrives via eslint-config-next and has always installed unbuilt here, falling back to its wasm binding. pnpm-workspace.yaml now records that decision explicitly.

⚠️ The setting is allowBuilds in pnpm 11 — the pnpm 10 spelling ignoredBuiltDependencies is accepted by pnpm config get but has no effect on the install, which makes it look like the config simply is not read.

Renovate

"minimumReleaseAge": "3 days" in renovate.json, so Renovate stops proposing releases that pnpm would then reject at install time. Without it, future lockfile PRs would fail CI for reasons unrelated to the bump they carry.

Verification

Under pnpm 11.21.0: install --frozen-lockfile, prettier --check ., eslint ., and next build all pass locally.

[Copilot]

Pull request overview

Updates the repository’s package manager tooling to pnpm v11 and aligns Renovate + workspace configuration with pnpm v11’s new install-time policies so CI can run pnpm install --frozen-lockfile successfully again.

Changes:

• Bump packageManager to pnpm@11.21.0.
• Add Renovate minimumReleaseAge to avoid lockfile updates that pnpm v11 would reject.
• Regenerate pnpm-lock.yaml under pnpm v11 and explicitly record the unrs-resolver build-script decision via pnpm-workspace.yaml.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
renovate.json	Adds a 3-day minimum release age to keep Renovate PRs compatible with pnpm v11’s default supply-chain policy.
pnpm-workspace.yaml	Records the explicit install-time build-script policy decision for unrs-resolver required by pnpm v11.
pnpm-lock.yaml	Updates transitive resolutions/pins to satisfy pnpm v11 install-time policy checks.
package.json	Bumps the declared package manager to pnpm 11.21.0.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.