chore(deps): pin pnpm 11.17.0 -> 11.18.0 (#53) - #68
Merged
Conversation
Deferred on 2026-07-29 purely so the release would clear the 24-hour cooldown rather than waive it. 11.18.0 published 2026-07-29T07:50:16Z and was 32.7h old at the bump, and is still `latest` - so the wait cost nothing and no bypass was needed. `pnpm-workspace.yaml` is untouched and no `minimumReleaseAgeExclude` block appears anywhere in the diff, which was the point of waiting. One correction to the issue's acceptance criteria: it predicted the lockfile would not move. It does, by 38 lines - but every one of them is pnpm's own `packageManagerDependencies` entry and its seven platform binaries (`@pnpm/exe`, `@pnpm/linux-arm64`, ...). pnpm 11 tracks the package manager it self-downloads in the lockfile, so a version change there is expected. No project dependency re-resolved; verified by filtering the diff for any non-`@pnpm/` package line, which returns nothing. That distinction matters here because transitive re-resolution is the thing that has broken `vp check` with TS2321 before. Gate: `pnpm run verify` green under 11.18.0 - 1255 passed / 3 skipped (app, up from the issue's 1249 baseline as tests landed since), 12 (worker), 3 (container). `pnpm --version` prints 11.18.0 via `onFail: download`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BkKb3S2cGyRFFHSzuCQBgj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #53.
Deferred on 2026-07-29 for one reason only: the release was ~15 hours old and the 24-hour cooldown applies to pnpm updating itself. It published
2026-07-29T07:50:16Z, so it was 32.7 hours old at the time of this bump, and is stilllatest. The wait cost nothing and nothing was waived -pnpm-workspace.yamlis untouched and nominimumReleaseAgeExcludeblock appears in the diff, which was the whole point.One acceptance criterion in the issue was wrong
#53 said
pnpm installshould be "a no-op on the lockfile (this bump should not re-resolve anything)". The second half holds; the first does not.pnpm-lock.yamlmoves by 38 lines, and every one of them is pnpm's ownpackageManagerDependenciesentry plus its seven platform binaries (@pnpm/exe,@pnpm/linux-arm64,@pnpm/win-x64, ...). pnpm 11 tracks the package manager it self-downloads in the lockfile, so a version change there necessarily shows up. No project dependency re-resolved - verified by filtering the diff for any package line that isn't@pnpm/*orpnpm@*, which returns nothing.That distinction is the one worth checking rather than assuming: transitive re-resolution is exactly what has broken
vp checkwithTS2321in this repo before, and "the lockfile changed" alone doesn't tell you which kind of change it was.Evidence
pnpm --version->11.18.0(self-downloaded viaonFail: download; Homebrew's copy still lags and doesn't govern here)pnpm install->Scope: all 3 workspace projects/Already up to datein 192mspnpm run verifygreen in ~67s: 1255 passed / 3 skipped (app), 12 (worker), 3 (container)The app count is up from the issue's 1249 baseline because tests landed between the 2026-07-29 audit and now, not because anything changed here.
Expect no behaviour change - 11.18.0's notes are an optional-dependency resolution fix,
pnpm setupwritingPNPM_HOMEto GitHub Actions env files,publishConfig.name, andself-updatehardening. None of it touches this repo. It is a currency bump.