Move to pnpm 12 with pnpm's supply-chain settings

.changeset/pnpm-12.md

@@ -0,0 +1,2 @@
+---
+---

.github/workflows/ci.yml

@@ -22,7 +22,8 @@ jobs:
           fetch-depth: 0
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v6
+        # v6.1.0 is the first release that installs pnpm 12; the v6 tag still points to 6.0.10.
+        uses: pnpm/action-setup@v6.1.0
 
       - name: Setup Node
         uses: actions/setup-node@v6

.github/workflows/release.yml

@@ -36,7 +36,8 @@ jobs:
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup PNPM
-        uses: pnpm/action-setup@v6
+        # v6.1.0 is the first release that installs pnpm 12; the v6 tag still points to 6.0.10.
+        uses: pnpm/action-setup@v6.1.0
 
       - name: Setup Node
         uses: actions/setup-node@v6

netlify.toml

@@ -4,7 +4,6 @@ publish = "apps/docs/dist"
 
 [build.environment]
 NODE_VERSION = "22.18.0"
-PNPM_VERSION = "11.22.0"
 
 [[redirects]]
 from = "/docs/tsx-pages"

package.json

@@ -23,5 +23,5 @@
   "engines": {
     "node": ">=24.11.0 <25"
   },
-  "packageManager": "pnpm@11.28.0"
+  "packageManager": "pnpm@12.8.1"
 }

pnpm-workspace.yaml

@@ -60,3 +60,9 @@ allowBuilds:
   core-js: false
   esbuild: true
   msw: true
+
+# pnpm's supply-chain recommendations (https://pnpm.io/supply-chain-security).
+# blockExoticSubdeps and a one-day minimumReleaseAge are already defaults.
+trustPolicy: no-downgrade
+# A takeover is found within days, so versions older than 30 days are not held to it.
+trustPolicyIgnoreAfter: 43200