chore(deps): upgrade pnpm 10.32 → 11.5

.github/workflows/ci.yml

@@ -108,7 +108,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v6
         with:
-          version: 10
+          version: 11
       - uses: actions/setup-node@v6
         with:
           node-version: 26
@@ -131,7 +131,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v6
         with:
-          version: 10
+          version: 11
       - uses: actions/setup-node@v6
         with:
           node-version: 26
@@ -162,7 +162,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v6
         with:
-          version: 10
+          version: 11
       - uses: actions/setup-node@v6
         with:
           node-version: 26
@@ -189,7 +189,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v6
         with:
-          version: 10
+          version: 11
       - uses: actions/setup-node@v6
         with:
           node-version: 26

.github/workflows/release.yml

@@ -89,7 +89,7 @@ jobs:
       # Frontend
       - uses: pnpm/action-setup@v6
         with:
-          version: 10
+          version: 11
       - uses: actions/setup-node@v6
         with:
           node-version: 26

README.md

@@ -113,7 +113,7 @@ make setup-secrets    # generate dev secrets (first time only)
 make docker-up-dev    # start with hot-reload
 ```
 
-**Prerequisites:** Rust 1.96+, Node.js 26 (LTS)+, pnpm 10.32+ — or just Docker. See [Setup Guide](docs/setup-guide.md) for details.
+**Prerequisites:** Rust 1.96+, Node.js 26 (LTS)+, pnpm 11.5+ — or just Docker. See [Setup Guide](docs/setup-guide.md) for details.
 
 ## 🏗️ Architecture
 

docs/deployment-guide.md

@@ -6,7 +6,7 @@
 | ---------------- | ------- | ----------------------------------------------------- |
 | Rust             | 1.96+   | `rustup default stable`                               |
 | Node.js          | 26+     | [nodejs.org](https://nodejs.org/) or `nvm install 26` |
-| pnpm             | 10.32+  | `corepack enable` (ships with Node.js 26+)            |
+| pnpm             | 11.5+   | `corepack enable` (ships with Node.js 26+)            |
 | Docker + Compose | Latest  | [docker.com](https://www.docker.com/) (optional)      |
 | Make             | Any     | Pre-installed on macOS/Linux                          |
 

docs/maintainer-guide.md

@@ -82,7 +82,7 @@ emailibrium/
 | ------- | ------- | ----------------------------------------------- |
 | Rust    | 1.96+   | Backend compilation                             |
 | Node.js | 26+     | Frontend toolchain                              |
-| pnpm    | 10.32+  | Frontend package management                     |
+| pnpm    | 11.5+   | Frontend package management                     |
 | Docker  | 24+     | Containerized deployment                        |
 | SQLite  | 3.35+   | Database (usually pre-installed on macOS/Linux) |
 

docs/setup-guide.md

@@ -9,7 +9,7 @@ Run `make setup` for an interactive wizard that automates these steps.
 | -------------- | --------------- | ----------------------------------------------------------------- |
 | Rust           | 1.96            | `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \| sh` |
 | Node.js        | 26 (LTS)        | `brew install node@26` or [nodejs.org](https://nodejs.org/)       |
-| pnpm           | 10.32           | `npm install -g pnpm@10`                                          |
+| pnpm           | 11.5            | `npm install -g pnpm@11`                                          |
 | Docker         | 24.0+           | [docs.docker.com/get-docker](https://docs.docker.com/get-docker/) |
 | Docker Compose | v2              | Included with Docker Desktop                                      |
 | Make           | 3.81+           | `xcode-select --install` (macOS) or `apt install build-essential` |

frontend/package.json

@@ -15,5 +15,5 @@
     "turbo": "^2.9.16",
     "typescript": "^6.0.3"
   },
-  "packageManager": "pnpm@10.32.1"
+  "packageManager": "pnpm@11.5.2"
 }

frontend/pnpm-workspace.yaml

@@ -1,6 +1,13 @@
 packages:
   - "apps/*"
   - "packages/*"
+# pnpm 11 enables a `minimumReleaseAge` cooldown by default, which rejects
+# lockfile entries for packages published within the window (e.g. a fresh
+# typescript-eslint patch) and breaks `--frozen-lockfile` in CI. We pin the
+# "always latest-compatible" dependency policy, so disable the cooldown
+# explicitly and rely on our existing supply-chain controls instead:
+# the `overrides` IOC pins below and Dependabot review.
+minimumReleaseAge: 0
 overrides:
   "brace-expansion@<1.1.13": "1.1.13"
   "brace-expansion@>=4.0.0 <5.0.6": "5.0.6"
@@ -9,8 +16,15 @@ overrides:
 peerDependencyRules:
   allowedVersions:
     "eslint-plugin-react>eslint": "10"
-onlyBuiltDependencies:
-  - esbuild
-  - msw
+# pnpm 11 removed `onlyBuiltDependencies` in favour of the `allowBuilds` map and
+# makes `strictDepBuilds` fatal by default, so every dependency with a lifecycle
+# script must be explicitly classified or `--frozen-lockfile` fails in CI.
+# esbuild + msw need their postinstall (msw writes its service worker); the web
+# app consumes node-llama-cpp via prebuilt binaries, so its postinstall stays
+# disabled (false) — matching the prior pnpm 10 behaviour.
+allowBuilds:
+  esbuild: true
+  msw: true
+  node-llama-cpp: false
 allowedDeprecatedVersions:
   "@ungap/structured-clone": "*"