[andykenward]

Moves the repo from pnpm 11.22.0 to 12.14.0 and drops the pin from #897. Dependabot's updater runs pnpm 12 since dependabot/dependabot-core#16169 and dependabot/dependabot-core#16170 (merged 2026-09-15, announced in GitHub's changelog on 2026-10-20), so the reason for the pin is gone.

The one line to look at is pmOnFail: ignore in pnpm-workspace.yaml. With the default, pnpm 12 writes pnpm-lock.yaml as two YAML documents, a boot document with pnpm's own binaries first. GitHub's dependency graph still reads only the first document (dependabot/dependabot-core#15904, open). Checked on 2026-10-20 against a public pnpm 12 repo through the GraphQL dependencyGraphManifests API: the graph credits its lockfile with pnpm's 15 binaries and none of its 2016 project packages. For this repo that would mean no Dependabot alerts and no security PRs, with no error. ignore is the only value that keeps the lockfile single-document; warn and error both still write the boot document. The cost is that pnpm no longer switches itself to the packageManager version, which the devcontainer (pnpmVersion) and CI (pnpm/action-setup) already handle. Remove the line once dependabot/dependabot-core#15904 closes.

Known gap that stays: a security update of a transitive dependency locked on more than one major (undici is on 6, 7 and 8 here) fails on pnpm 12 (dependabot/dependabot-core#16434). Those bumps stay manual, as undici already is.

Validation

• pnpm run all passed on pnpm 12.14.0.
• pnpm install --frozen-lockfile passes and leaves pnpm-lock.yaml unchanged.
• Not verified: a real Dependabot run on this repo under pnpm 12. The next npm Dependabot job after merge is the check.

🤖 Generated with Claude Code

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	99.56%	679 / 682
🔵	Statements	99.56%	692 / 695
🔵	Functions	100%	167 / 167
🔵	Branches	94.51%	293 / 310

File Coverage

No changed files found.

Generated in workflow #2561 for commit e1c808f by the Vitest Coverage Report Action

[github-actions]

⚠️ No Changeset found

Latest commit: e1c808f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR