[danielgorgonha]

What & why

pnpm-workspace.yaml sets minimumReleaseAge: 1440, trustPolicy: no-downgrade and blockExoticSubdeps: true, but package.json pinned pnpm@9.15.0. pnpm 9 ignores all three without a warning. pnpm reads them from 10.16.0, 10.21.0 and 10.26.0 (trustPolicyExclude from 10.22.0; pnpm's own CHANGELOG). Measured on a copy of the repository: 9.15.0 accepted a TypeScript nightly published 19 hours earlier, and 10.34.9 refuses it.

• packageManager is now pnpm@10.34.9, the newest 10.x at least 14 days old (2026-10-25; latest-10). 10.34.8 fixes hoisting when a frozen install removes packages and moves the standalone executables from Node 20 (end of life) to Node 24; 10.34.9 only affects a lockfile created from nothing. Neither changes the three keys.
• engines.pnpm is now >=10.26.0. Corepack switches to the pinned pnpm by itself, but a pnpm 9 installed globally kept running and skipped the checks. With the bound it stops with ERR_PNPM_UNSUPPORTED_ENGINE (also with engine-strict off).
• Workflows are unchanged. The four pnpm/action-setup steps (ci.yml: ui, e2e, node-packages; desktop-release.yml) set no version and read packageManager. The actions stay pinned by SHA.
• trustPolicyExclude lists the only two locked packages the trust check refuses, each by exact version with its reason inline: semver@6.3.1 (a backport; the check orders by publish date, a false positive) and @trickfilm400/rollup-plugin-off-main-thread@3.0.0-pre1 (required by workbox-build@7.4.1 through vite-plugin-pwa; its 2.5.0 carried provenance, 3.0.0-pre1 carries none: not evidence of compromise, worth a tarball diff). Removing either brings back ERR_PNPM_TRUST_DOWNGRADE for that package; a resolution from nothing finds no third.
• pnpm-lock.yaml is unchanged. A --frozen-lockfile install on 10.34.9 reports it up to date and leaves it byte-identical. The first resolving install under pnpm 10 (add/update) will add libc: fields to the native-binding entries and dedupe lru-cache 11.5.2 into 11.5.3, once.
• Changelog: fragments under changelog.d/changed/ and changelog.d/known-limits/.

Known limit: the three settings act only when pnpm resolves dependencies. CI's --frozen-lockfile does not resolve, so CI does not re-check an existing lockfile. They guard the moment a contributor changes it.

Proofs (pnpm 10.34.9, Node 24)

Check	Result
minimumReleaseAge: add a TypeScript nightly 19 h old	ERR_PNPM_NO_MATURE_MATCHING_VERSION
blockExoticSubdeps: a dependency whose own dependency is a git URL, or a tarball	ERR_PNPM_EXOTIC_SUBDEP; with the key off: Done
trustPolicy: exclusions removed, then a resolving add	ERR_PNPM_TRUST_DOWNGRADE
Branch config as committed: a mature add	Done
pnpm 9.15.0 against this branch	ERR_PNPM_UNSUPPORTED_ENGINE
Red-check: parent commit's package.json with pnpm 9.15.0	the 19 h old nightly is accepted, no warning

A tarball URL on registry.npmjs.org itself is not refused: pnpm counts the configured registry as trusted.

To check on this PR

• Vercel preview: the build log must say using pnpm v10.34.x. With the engines bound, a Vercel build on pnpm 9 now fails instead of skipping the keys.
• desktop-release: on macOS, an "ignored build scripts: fsevents" warning is expected and harmless (its tarball ships a prebuilt binary).

Supersedes #822 (same change, rebased onto today's staging, pin moved to 10.34.9, engines bound added). Closes #820.

Verify-before-finishing checklist

• cargo fmt --check + cargo clippy -- -D warnings: not run, no Rust touched
• cargo test: not run, no Rust touched
• ui/: lint (0 errors) + vitest (258 files, 2999 passed, 1 expected fail) + build (tsc + vite) pass on pnpm 10.34.9 / Node 24; sdk and mcp-server: tsc and vitest pass
• No secret, key share, seed, or passphrase in code, logs, URLs, or query strings
• Every fund-moving path keeps preview + explicit confirmation: untouched
• If this touches the FROST signer, PCZT, or the loopback bridge: it does not
• User-facing strings go through i18n: none added
• Docs/comments in English; commit is type(scope): description
• AI disclosure: written with Claude Code; the commit carries Co-Authored-By: Claude <noreply@anthropic.com>, no session link

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
konclave-demo	Ready	Preview	Nov 13, 2026 3:50am UTC