Move to pnpm 12 with pnpm's supply-chain settings

[silveltman]

• packageManager is pnpm 12.8.1. The lockfile keeps every resolved version; pnpm 12 only adds a record of its own version.
• Netlify no longer sets PNPM_VERSION (it was 11.22.0), so it builds with the version from packageManager, like CI.
• pnpm-workspace.yaml adds pnpm's recommended trustPolicy: no-downgrade and ignores versions older than 30 days (trustPolicyIgnoreAfter), which covers semver@6.3.1. blockExoticSubdeps and a one-day minimumReleaseAge are already pnpm defaults.
• CI and the release workflow pin pnpm/action-setup@v6.1.0, the first release that supports pnpm 12. The v6 tag still points to 6.0.10.
• An empty changeset, because nothing published changes.

pnpm check and pnpm build pass locally on pnpm 12.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the package manager used for builds and releases to pnpm 12.
  • Added safeguards to help prevent package downgrades and account for package release age.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f5b865f5-674b-4877-868c-8141ab30deb6

📥 Commits

Reviewing files that changed from the base of the PR and between d2602c1 and 2b33147.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (6)

• .changeset/pnpm-12.md
• .github/workflows/ci.yml
• .github/workflows/release.yml
• netlify.toml
• package.json
• pnpm-workspace.yaml

💤 Files with no reviewable changes (1)

• netlify.toml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Priority: ➖ Normal

Change: Other

Merge Risk: ⚪ Minimal · up to 2b331

The build environments use the declared pnpm version, and the trust policy applies its documented 30-day threshold. No merge-blocking issue is supported; proceed with normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 2b331

The configuration aligns package-manager versions without visibly expanding build or release permissions. No introduced security weakness was established, but Netlify’s effective installation behavior and enforcement during cache reuse or rollback remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A compromised installer or accepted dependency could affect repository validation, documentation build output, or release automation. Release automation already has repository-write and identity-token permissions and uses a GitHub App credential; those authorities are unchanged by this PR.

Trust Boundaries and Controls

• inferred — The workspace explicitly selects no-downgrade trust checking with a publication-age exception: 43200 minutes means versions older than 30 days are exempt from that check. This is a bounded acceptance control, not a guarantee that every dependency is trusted; the reviewed base had no explicit workspace trust-policy setting.

Hardening Proposals

• proposed — Confirm Netlify’s effective pnpm version and trust-policy enforcement on clean and cached installations. Establish whether rollback is intended to restore the older dependency policy or preserve the new control independently of the deployed commit.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main changes: migration to pnpm 12 and addition of pnpm supply-chain settings.
Description check	✅ Passed	The description directly explains the pnpm upgrade, workflow changes, supply-chain settings, Netlify configuration, and validation results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}