chore: upgrade to pnpm 10, add 3-day minimum dependency age

[mishushakov]

Bumps pnpm 9.15.9 → 10.34.5 across packageManager fields, engines, and all seven pnpm/action-setup steps; since pnpm 10 blocks dependency lifecycle scripts by default, esbuild is added to onlyBuiltDependencies to keep the JS build working (the lockfile is unchanged — v9.0 format is shared by pnpm 9 and 10).

Sets minimumReleaseAge: 4320 (3 days) so newly published versions have time to be caught and unpublished before we install them, with e2b excluded since we control its releases — Renovate gets a matching floor and exemption, otherwise it would propose versions pnpm then refuses to install.

Finally, moves the pnpm, Node, and Bun versions into .tool-versions alongside the Python and Poetry entries already wired up there; Node had been hardcoded in seven places at three different versions, and the release job keeps its explicit Node 24 pin, which is deliberate for npm 11 OIDC trusted publishing (#259).

Verified locally on pnpm 10.34.5: install --frozen-lockfile from a clean node_modules, js build, and js lint all pass, and the .tool-versions parser emits all five TOOL_VERSION_* vars with a parse step confirmed present earlier in every job that references one.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes how all CI installs dependencies and blocks fresh registry releases for three days; a misconfigured exclude or onlyBuiltDependencies could break installs or builds.

Overview
Upgrades pnpm from 9.15.9 to 10.34.5 in root, js, and python packageManager fields and tightens root engines.pnpm to >=10.16.0 <11. pnpm-workspace.yaml adds minimumReleaseAge (3 days), excludes e2b, and lists esbuild under onlyBuiltDependencies for pnpm 10’s lifecycle-script defaults.

Renovate mirrors the 3-day floor and e2b exemption so proposed bumps match what pnpm will install.

.tool-versions now pins pnpm, node (20), and bun; CI workflows use parse-tool-versions and pnpm/action-setup@v4 with those env vars instead of hardcoded versions. The final release job in release.yml still uses Node 24.x for npm 11 OIDC publishing.

^{Reviewed by Cursor Bugbot for commit 3996965. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Performed automated security triage on the current PR head. One net-new finding met this workflow's reporting thresholds.

  

_{Sent by Cursor Security Agent: Security Reviewer}

[claude]

LGTM — straightforward CI/tooling chore.

Extended reasoning...

Overview

This PR upgrades pnpm from 9.15.9 to 10.34.5 across all packageManager fields, engines constraints, and seven pnpm/action-setup steps in CI workflows; adds esbuild to onlyBuiltDependencies to accommodate pnpm 10's default blocking of dependency lifecycle scripts; sets a 3-day minimumReleaseAge in pnpm-workspace.yaml (with e2b excluded) plus a matching Renovate config; and consolidates pnpm/Node/Bun versions into .tool-versions, replacing seven hardcoded, previously-inconsistent Node version strings across workflow files.

Security risks

No production code paths are touched — this is entirely CI configuration and package manager/tooling metadata. The minimumReleaseAge addition is itself a defensive security improvement (delays adoption of freshly published, potentially compromised packages). The e2b exclusion is reasonable since it is the repo's own SDK. No auth, crypto, or permission logic is affected.

Level of scrutiny

Low-to-moderate scrutiny is appropriate: this is a mechanical, well-scoped chore (version bumps + config consolidation) rather than a logic change. The main risk area — pnpm 10's stricter lifecycle-script blocking possibly breaking installs if a needed package isn't added to onlyBuiltDependencies — is exactly what the PR description says was verified locally (frozen-lockfile install from a clean node_modules, plus build and lint, all passing on pnpm 10.34.5). I independently checked the lockfile and package.json files across the repo for other install/postinstall scripts that might need allowlisting and found none beyond esbuild, which is already handled.

Other factors

No bugs were surfaced by the bug-hunting system, and the one candidate issue considered (Renovate's minimumReleaseAge not blocking branch creation for fresh releases) was investigated and ruled out. The changes are internally consistent (all packageManager fields, engines ranges, and CI references agree on pnpm 10.34.5), and the deliberate Node 24 pin in the release job for OIDC publishing is called out and preserved correctly.