[jmlweb]

Upgrades

• pnpm from 10.26.2 to 12.18.0 (packageManager in root package.json)
• vitest from ^5.0.5 to ^5.1.0 (plugins/atlassian-polish)
• vitest from ^5.0.5 to ^5.1.0 (plugins/dev-workflow)
• vitest from ^5.0.5 to ^5.1.0 (plugins/flowstate)

Not upgraded on purpose: @types/node stays at ^22.20.5, the latest 22.x release. npm-check-updates offered 26.6.6. The project runs on Node 22: engines.node is >=22 and the CI matrix is 22/24. Node 22 is supported until 2027-04-30, so no Node upgrade is needed and @types/node must not get ahead of it.

Dependabot: the @types/node semver-major ignore rule stays, because this upgrade does not adopt a new @types/node major. No other ignore rules exist.

Breaking changes and what changed for them

pnpm 11 (migration guide)

• Node.js 22+ required. Already satisfied: the CI matrix is 22/24 and release.yml uses 22. No change.
• allowBuilds replaces onlyBuiltDependencies and related settings. Unreviewed dependency build scripts now fail the install with ERR_PNPM_IGNORED_BUILDS. pnpm 10 skipped the build scripts of esbuild and simple-git-hooks silently. pnpm 12 failed the install instead.
  • Fix: pnpm-workspace.yaml now lists both under allowBuilds: false. This keeps pnpm 10's behaviour.
  • Why denying is safe: esbuild gets its binary from its platform optional dependencies. The root postinstall script still runs simple-git-hooks to install the pre-commit hook.
• .npmrc holds only auth and registry settings now. The repo has no .npmrc, so no change.
• minimumReleaseAge / blockExoticSubdeps defaults. The repo already sets minimumReleaseAge: 10080 (7 days). No change.

pnpm 12

• Unknown pnpm-workspace.yaml keys now fail the command. All keys are recognized, and install runs clean. No change.
• --frozen-lockfile false removed. CI uses the bare --frozen-lockfile flag. No change.
• Git dependencies canonicalized to HTTPS. The repo has no git dependencies. No change.
• Lockfile: pnpm 11+ adds a leading packageManagerDependencies YAML document that pins pnpm itself. The diff is generated, not edited by hand.
• CI: pnpm/action-setup v6.1.0, already pinned in the workflows, added pnpm v12 support (feat: support pnpm v12 pnpm/action-setup#288). Workflows are untouched.

Docs

• docs/agent-playbook.md: "pnpm 10 only" now reads "pnpm only", so the playbook does not pin a stale major.

Verification (local, pnpm 12.18.0)

• pnpm install --frozen-lockfile: OK
• pnpm typecheck: OK
• pnpm build: OK, and dist/ is unchanged
• pnpm lint:skills --strict: OK
• pnpm test: 467 flowstate tests + all plugin suites + 161 script tests pass
• pnpm version:sync (no diff), version:check, backlog:check, names:check: OK

🤖 Generated with Claude Code

[jmlweb]

🤖 hustle review: approve — Diff handles the pnpm 11+ build-script breaking change with allowBuilds, bumps vitest within the same major, and changes nothing unrelated. Lockfile was not visible; CI's frozen-lockfile install will validate it.

[jmlweb]

🤖 hustle review: approve — pnpm 12 breaking changes are handled: allowBuilds added, and the conflicting version pin removed from ci.yml so action-setup reads packageManager. The vitest bumps stay within ^5. The description wrongly says workflows are untouched, and the lockfile was not visible, so CI must confirm the frozen-lockfile install.