From 98701cca371ec4073f7b56f7a3af0732589a32e2 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 8 Aug 2026 07:29:53 +0000 Subject: [PATCH 1/2] chore(deps): update pnpm to v11 [security] --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 0f28ce4..d7197fb 100644 --- a/package.json +++ b/package.json @@ -3,7 +3,7 @@ "version": "0.1.0", "private": true, "type": "module", - "packageManager": "pnpm@10.32.1", + "packageManager": "pnpm@11.5.3", "engines": { "node": ">=24" }, From 9a65de9271af588865f335fcb49cb515a849952b Mon Sep 17 00:00:00 2001 From: stxkxs <139715017+stxkxs@users.noreply.github.com> Date: Sat, 8 Aug 2026 11:49:44 -0700 Subject: [PATCH 2/2] fix: declare esbuild's build script in the dialect pnpm 11 reads MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pnpm 11 bump fails its own install. pnpm 10 skipped an unapproved build script with a warning; pnpm 11 makes that an error, so `pnpm install --frozen-lockfile` exits 1 on ERR_PNPM_IGNORED_BUILDS for esbuild@0.28.1 and nothing downstream of install runs. esbuild arrives transitively through astro. Its platform binary comes from the @esbuild/ optional dependency rather than from the script, which is why skipping it was invisible under pnpm 10 and the site built anyway. The setting was also renamed, and the old spellings fail silently. Both pnpm 10 names — onlyBuiltDependencies and ignoredBuiltDependencies — are simply not read by pnpm 11, with no warning that a key was ignored; each was set in turn and the install went on failing on the same build. That is the same shape as pnpm 11 dropping `package.json#pnpm`, which is why the overrides in this file moved here in the first place. It takes a map, not a list: `esbuild: true`. pnpm writes the scaffold itself on a failed install, as `esbuild: set this to true or false`. There is no key for "deliberately skipped", so the build is allowed rather than suppressed. This must land with the bump, not before it — allowBuilds cannot be written in both dialects, so unlike the overrides it has no window where both package managers read it. --- pnpm-workspace.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index be34331..23672f1 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -36,3 +36,16 @@ overrides: # frontmatter parser down a major version, and an unbounded `>=4.3.1` collapses # both lines to 5.x. The scoped form moves only the vulnerable resolution. js-yaml@4: "^4.3.1" + +# pnpm 11 turns an ignored build script into an install error where pnpm 10 only +# warned, and it renamed the setting: the pnpm 10 spellings +# (onlyBuiltDependencies, ignoredBuiltDependencies) are not read here and do not +# warn about being ignored — verified by setting each and watching the install +# fail on the same build. There is no key for "deliberately skipped", so a build +# is either allowed or the install does not complete. +# +# esbuild arrives transitively through astro. Its platform binary comes from the +# @esbuild/ optional dependency, not from this script, which is why +# pnpm 10 skipped it and the site built anyway. +allowBuilds: + esbuild: true