Tooling: Move to pnpm 11

- Pin pnpm to `11` in `mise.toml` (was `10`, while the manifest already required `>=11`).
- Move pnpm settings out of the now-ignored `package.json` `pnpm` field into `pnpm-workspace.yaml`: `allowBuilds` (esbuild, renamed from `onlyBuiltDependencies`) and `peerDependencyRules`.
- Set `verifyDepsBeforeRun: false` so `pnpm exec` stops printing an install summary that the check runner misread as unformatted files.
- Ignore the `only-allow` binary in knip (used by the `preinstall` guard).

Author: vdavid

knip.config.ts

@@ -4,7 +4,7 @@ const config: KnipConfig = {
     entry: ['src/routes/**/+*.{ts,svelte}', 'src/hooks.ts', 'src/lib/worker/analyzer.worker.ts'],
     project: ['src/**/*.{ts,svelte}'],
     ignore: ['src/app.d.ts'],
-    ignoreBinaries: ['wrangler'],
+    ignoreBinaries: ['wrangler', 'only-allow'],
     ignoreDependencies: ['buffer', 'tailwindcss', 'chartjs-adapter-date-fns', 'chartjs-plugin-zoom', 'date-fns'],
 }
 

mise.toml

@@ -1,4 +1,4 @@
 [tools]
 node = "25"
-pnpm = "10"
+pnpm = "11"
 go = "1.25"

package.json

@@ -3,9 +3,9 @@
     "version": "0.0.1",
     "private": true,
     "type": "module",
-    "packageManager": "pnpm@10.33.2",
+    "packageManager": "pnpm@11.1.2",
     "scripts": {
-        "preinstall": "node -e \"if(!/pnpm/.test(process.env.npm_config_user_agent))throw new Error('Use pnpm to install dependencies')\"",
+        "preinstall": "npx only-allow pnpm",
         "dev": "concurrently -n app,proxy -c cyan,magenta --kill-others-on-fail 'pnpm dev:app' 'pnpm dev:cors-proxy'",
         "dev:app": "vite dev",
         "dev:cors-proxy": "pnpm -C cors-proxy dev",
@@ -19,16 +19,6 @@
         "test:coverage": "vitest run --coverage",
         "knip": "knip"
     },
-    "pnpm": {
-        "onlyBuiltDependencies": [
-            "esbuild"
-        ],
-        "peerDependencyRules": {
-            "allowedVersions": {
-                "vite-plugin-devtools-json>vite": "8"
-            }
-        }
-    },
     "devDependencies": {
         "@eslint/js": "^10.0.1",
         "@sveltejs/adapter-static": "^3.0.10",
@@ -62,5 +52,8 @@
         "date-fns": "^4.1.0",
         "idb": "^8.0.3",
         "isomorphic-git": "^1.37.5"
+    },
+    "engines": {
+        "pnpm": ">=11"
     }
 }

pnpm-workspace.yaml

@@ -0,0 +1,16 @@
+# pnpm 11 no longer reads the `pnpm` field in package.json — these settings live here now.
+# Not a monorepo; this file exists only to hold pnpm settings.
+
+# Allow esbuild to run its install script (build the native binary) despite a global ignore-scripts.
+allowBuilds:
+    esbuild: true
+
+# vite-plugin-devtools-json declares a narrower vite peer range; we run vite 8.
+peerDependencyRules:
+    allowedVersions:
+        vite-plugin-devtools-json>vite: '8'
+
+# pnpm 11's `pnpm exec`/`pnpm run` print an "Already up to date / Done in …" install summary by
+# default. The check runner parses `pnpm exec prettier --list-different` stdout as a file list, so
+# that noise reads as "unformatted files". Disabling the pre-run verification keeps stdout clean.
+verifyDepsBeforeRun: false