chore: bump pnpm lockfile

[HenryQW]

Involved Issue / 该 PR 相关 Issue

Close #

Example for the Proposed Route(s) / 路由地址示例

NOROUTE

New RSS Route Checklist / 新 RSS 路由检查表

• New Route / 新的路由
  • Follows Script Standard / 跟随 路由规范
• Anti-bot or rate limit / 反爬/频率限制
  • If yes, do your code reflect this sign? / 如果有, 是否有对应的措施?
• Date and time / 日期和时间
  • Parsed / 可以解析
  • Correct time zone / 时区正确
• New package added / 添加了新的包
• Puppeteer

Note / 说明

lockfile v6 is deprecated by pnpm v9, and is now readonly.

pnpm/pnpm#7934

[TonyRL]

Dependabot is still having minor issue with pnpm v9 dependabot/dependabot-core#9522 though.

[TonyRL]

RSSHub/.github/workflows/build-assets.yml

Lines 25 to 27 in 936e703

	uses: pnpm/action-setup@v3
	with:
	version: 8

GitHub actions also need to be bumped.

[HenryQW]

RSSHub/.github/workflows/build-assets.yml

Lines 25 to 27 in 936e703

	uses: pnpm/action-setup@v3
	with:
	version: 8

GitHub actions also need to be bumped.

Done. I think current CIs are way too complicated, we might want to simplify them.

[HenryQW]

Dependabot is still having minor issue with pnpm v9 dependabot/dependabot-core#9522 though.

dependabot is really slow in adopting these major changes, which is very annoying, but I think it is solved? dependabot/dependabot-core#9668

[TonyRL]

@DIYgod Can you enable Dependabot on Actions runners in https://github.com/DIYgod/RSSHub/settings/security_analysis too? No sure if changing environment helps pnpm/pnpm#6530

[DIYgod]

@TonyRL Now it is opened