chore: harden pnpm supply-chain config

[CybotTM]

Why

Every dependency PR has been failing CI since pnpm 11 landed (last green build on main: 2026-05-06). The Docker build dies on:

[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: @parcel/watcher@2.5.6, esbuild@0.27.2

pnpm now refuses to silently skip lifecycle scripts. We need to tell it explicitly what to do — and that gives us an opportunity to harden the config rather than just bypass the check.

What this changes

Adds three settings to pnpm-workspace.yaml:

Setting	Purpose
strictDepBuilds: true	Fail install when any dependency wants to run a lifecycle script that isn't explicitly handled. Blocks newly added transitives from sneaking in postinstall code.
allowBuilds: { esbuild: false, "@parcel/watcher": false }	Deny lifecycle scripts for these two. Both ship prebuilt binaries via platform-specific optionalDependencies (@esbuild/linux-x64, @parcel/watcher-linux-x64-glibc, …), so the postinstall is redundant. Setting false means even a hijacked future release cannot execute code at install time — name-based allowlists wouldn't catch that.
minimumReleaseAge: 10080	7-day quarantine on newly published versions. Reduces the window in which a hijacked publish can land before the community/npm flags it. Use minimumReleaseAgeExclude for hotfixes.

Defense layering recap:

• Lockfile + --frozen-lockfile — version substitution requires a lockfile diff (visible in PR review).
• allowBuilds: false — even a tarball with the right integrity hash can't run scripts.
• minimumReleaseAge — buys time for the community to flag a malicious publish.
• Dependabot/Renovate review — humans see the integrity hash change.

Verification

Built the Docker image locally with this config — pnpm install --frozen-lockfile completes cleanly (no ERR_PNPM_IGNORED_BUILDS), vite build produces the expected dist artifacts:

Done in 3.3s using pnpm v11.0.9
✓ 100 modules transformed.
✓ built in 3.19s

esbuild's binary still works because the platform-specific @esbuild/linux-x64-musl package was installed via optionalDependencies; same for @parcel/watcher-linux-x64-musl.

Follow-ups (not in this PR)

• Once merged, #714 (and the eslint-plugin-vue / renovate vite PRs) will rebase and the Docker build should go green.
• Consider pinning pnpm via packageManager field instead of corepack prepare pnpm@latest so future major-version pnpm changes don't silently break CI again.
• Provenance verification (npm audit signatures / sigstore) as a non-blocking job — most npm packages don't publish provenance yet, so hard-enforcement isn't practical tree-wide today.

[gemini-code-assist]

Code Review

This pull request introduces supply-chain hardening for pnpm by enabling strict dependency builds and setting a minimum release age for packages. Feedback suggests correcting the configuration for blocking lifecycle scripts by using the "ignoredBuilds" array instead of a map in "allowBuilds". Additionally, it is recommended to update the pnpm version requirement in package.json to ensure compatibility with these new features.

[Copilot]

Pull request overview

Updates the pnpm workspace configuration to explicitly handle dependency lifecycle scripts and add supply-chain safety constraints, addressing CI failures introduced by pnpm v11’s stricter build-script handling.

Changes:

• Add strictDepBuilds: true to fail installs when dependencies request lifecycle scripts that aren’t explicitly handled.
• Add allowBuilds entries to explicitly deny lifecycle scripts for esbuild and @parcel/watcher.
• Add minimumReleaseAge: 10080 (7 days) to quarantine newly published versions during dependency resolution.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud