deps: move to pnpm 12 and hold back releases newer than three days

[MaxMB15]

What this changes

Moves the repo from pnpm 10.34.6 to pnpm 12.8.1, and turns on pnpm's release age check.

Version

pnpm 12.8.1 came out on 2026-09-28. It's the newest 12.x that was at least two weeks old when I picked it. packageManager carries its sha512, so Corepack checks the download. pnpm/action-setup v6.1.0, which CI already uses, supports pnpm 12.

Locally, Corepack needs to be 0.34.5 or later. pnpm 12 ships only bin/pnpm.mjs, and Corepack up to 0.34.4 looks for bin/pnpm.cjs (nodejs/corepack#776). Node 24.12.0 is the first 24.x that bundles 0.34.5, and 22.22.1 bundles 0.34.6. docs/development.md now says so, with npm i -g corepack@latest for an older Node 24.

The lockfile works unchanged. pnpm install with pnpm 12, with and without --frozen-lockfile, leaves pnpm-lock.yaml exactly as it is, so no versions change.

Release age

minimumReleaseAge: 4320 means pnpm only installs versions that have been on the registry for three days. pnpm's own default since 11 is one day. Two things about how pnpm 12 applies it:

• Since the age is set explicitly, the check is strict. When nothing old enough fits a range, pnpm add and pnpm update stop, or ask in a terminal, instead of quietly taking a newer version.
• The check covers every entry already in pnpm-lock.yaml, on every install. A lockfile that names a version younger than three days fails pnpm install --frozen-lockfile in CI with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION.

Dev's lockfile has 19 entries published between 2026-10-10 and 2026-10-12. They're vitest, @vitest/coverage-v8, @vitest/mocker and @vitest/spy 5.0.4, typescript-eslint 8.71.2 with its ten @typescript-eslint packages, @tanstack/react-virtual 3.14.17 and virtual-core 3.19.2, prettier 3.9.10 and tinybench 6.2.2. Rather than downgrade them, minimumReleaseAgeExclude lists those exact versions. Downgrading wasn't possible for Vitest anyway, since ^5.0.4 allows nothing older. The last of them, @typescript-eslint/parser 8.71.2, was published at 17:11:57 UTC on 2026-10-12, so it passes the check on its own after 2026-10-15 17:12 UTC. The list stays in this PR. Its entries are exact versions, so leaving them past that date is harmless, and a follow-up removes them.

The repo's own packages need no exclusion. The root and apps/desktop never come from the registry, and the check only applies to registry versions.

Dependabot

pnpm 12 writes an extra YAML document at the top of pnpm-lock.yaml that records its own version. GitHub's dependency graph reads only that first document, sees no dependencies, and closes every open alert. That's dependabot/dependabot-core#15904, still open, and it also matches the warning in pnpm's lockfile docs. pmOnFail: ignore keeps the lockfile a single document, as it is today. I checked that pnpm 12.8.1 then writes one document.

The cost is that pnpm 11 and later no longer check or switch their own version. Corepack locally and pnpm/action-setup in CI already run the version packageManager names, so this only matters for a pnpm installed some other way. A pnpm 11 or later installed that way runs as its own version without a warning. A global pnpm 10 doesn't know pmOnFail and still switches to 12.8.1. docs/development.md says to use Corepack.

Other Dependabot points:

• Its seven-day cooldown is longer than the three-day check, so version updates pass. Security updates skip the cooldown and can bring a version younger than three days. CI's install then fails. Re-run the job once that version is three days old, or add its name@version to minimumReleaseAgeExclude on that PR's branch. docs/development.md now says so.
• dependabot/dependabot-core#16434 is still open. With pnpm 12, a security update fails for a transitive dependency that's locked at more than one major, so such an alert would need a manual update.
• dependabot/dependabot-core#16376, merged on 2026-10-01, fixed Dependabot's updates in repos that set their own release age on pnpm 12.3 and later.

Other pnpm 11 and 12 changes I checked

• pnpm reads pnpm_config_* environment variables, not npm_config_*. Nothing in the repo or CI sets either.
• .npmrc now holds only auth and registry settings. The repo has none.
• strictDepBuilds, blockExoticSubdeps and verifyDepsBeforeRun are on by default. strictDepBuilds already was. Every locked package comes from the registry with an integrity hash. verifyDepsBeforeRun makes pnpm run and pnpm exec install first when node_modules is out of date.
• pnpm 12 fails on a setting in pnpm-workspace.yaml it doesn't know. It reads all of ours.
• pnpm 12 is a native program. The npm package is a small launcher that downloads the binary and checks its signature on first use, and Corepack 0.34.5 or later runs that launcher.
• The package store moves from v10 to v11, so the first install after the switch downloads the packages again.
• pnpm 12's Cargo and Python support is opt in and stays off.

The setup-frontend action's description now mentions the age check, since a CI failure from it shows up in that step.

How it was tested

• With pnpm 12.8.1, pnpm install --frozen-lockfile from an empty node_modules passes and reports all 461 lockfile entries pass the checks. Without the exclusion list it fails on the 19 entries above.
• pnpm lint, pnpm format:check, pnpm test with 458 Rust core tests and 2005 frontend tests, pnpm exec tsc -b --noEmit and pnpm build:desktop pass. The pre-commit hook ran on the commit.
• pnpm tauri ios build --debug --target aarch64-sim builds with pnpm 12. That includes Xcode's Build Rust Code phase, which runs pnpm tauri ios xcode-script.
• When run directly rather than through Corepack, pnpm 10.34.6 switches to 12.8.1 in this repo, and pnpm 12.11.2 runs as itself with no warning.
• In a scratch project with the same settings, pnpm add tinybench@^6.2.2 stops because 6.2.2 is too new, pnpm add tinybench@^6.2.0 picks 6.2.1, and the lockfile stays one document.

I didn't run the app, so the boxes below stay unchecked.

• macOS
• Linux (Wayland)
• Linux (X11)

Checklist

• The pull request targets dev
• pnpm lint, pnpm test and cargo clippy --workspace --all-targets -- -D warnings pass
• User-facing changes are added to the Unreleased section of CHANGELOG.md (tooling only, so none)
• No playlist URLs, logins or API keys in the code, tests or screenshots
• I have read the Contributor License Agreement and agree to it

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.