chore(deps): upgrade pnpm to 12.18.0 and vitest to 5.1.0

.github/workflows/ci.yml

@@ -27,8 +27,6 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 10.26.2
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:

docs/agent-playbook.md

@@ -39,7 +39,7 @@ mistakes to avoid, the per-deliverable checklist, and the release mechanics.
     is the invocation router; include quoted user phrases or the skill is dead weight.
 12. **Silently swallows fs errors** (`catch { return [] }`). → LRN-001. Distinguish
     empty-result from lookup-failure.
-13. **Uses npm or yarn.** → pnpm 10 only; CI runs `--frozen-lockfile`, a foreign lockfile
+13. **Uses npm or yarn.** → pnpm only; CI runs `--frozen-lockfile`, a foreign lockfile
     breaks it.
 14. **Adds vitest to `scripts/` tests or node:test to plugin tests.** → Framework per area is
     fixed (see Conventions in `AGENTS.md`).

package.json

@@ -2,7 +2,7 @@
   "name": "@jmlweb/skills-monorepo",
   "version": "0.0.0",
   "private": true,
-  "packageManager": "pnpm@10.26.2",
+  "packageManager": "pnpm@12.18.0",
   "type": "module",
   "scripts": {
     "postinstall": "simple-git-hooks",

plugins/atlassian-polish/package.json

@@ -18,7 +18,7 @@
   "devDependencies": {
     "@types/node": "^22.20.5",
     "typescript": "^7.0.2",
-    "vitest": "^5.0.5"
+    "vitest": "^5.1.0"
   },
   "keywords": [
     "claude-code",

plugins/dev-workflow/package.json

@@ -19,7 +19,7 @@
   "devDependencies": {
     "@types/node": "^22.20.5",
     "typescript": "^7.0.2",
-    "vitest": "^5.0.5"
+    "vitest": "^5.1.0"
   },
   "keywords": [
     "claude-code",

plugins/flowstate/package.json

@@ -19,7 +19,7 @@
   "devDependencies": {
     "@types/node": "^22.20.5",
     "typescript": "^7.0.2",
-    "vitest": "^5.0.5"
+    "vitest": "^5.1.0"
   },
   "keywords": [
     "claude-code",

pnpm-workspace.yaml

@@ -4,3 +4,8 @@ packages:
 
 # Refuse package versions published less than 7 days ago (minutes) — guards against compromised releases.
 minimumReleaseAge: 10080
+
+# pnpm 11+ fails install on unreviewed build scripts; neither is needed (esbuild ships its binary via optional deps, the root postinstall installs the git hooks).
+allowBuilds:
+  esbuild: false
+  simple-git-hooks: false