From 3cb4774f3522cf963a3228e3cda469d2dc07d747 Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 2 Jul 2026 14:52:03 +0100
Subject: [PATCH 1/9] chore: pin pnpm version via packageManager field

---
 package.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package.json b/package.json
index d58353fe..4f75280d 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
   "engines": {
     "node": ">=18.17.0"
   },
+  "packageManager": "pnpm@11.5.0",
   "scripts": {
     "prepare": "husky install",
     "build": "rimraf dist && rollup -c rollup.config.js --bundleConfigAsCjs",

From af085665551d539eb2e6a0fb0352e284c0d329a8 Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 2 Jul 2026 15:08:33 +0100
Subject: [PATCH 2/9] fix: pin pnpm 11.7.0 with integrity hash and align CI
 pnpm setup

- Pin packageManager to pnpm@11.7.0 with corepack integrity hash
- Bump coverage-diff workflow to @v1 (drops hardcoded pnpm version: 9)
- Drop version: 9 from functional_tests and bump action-setup to v6.0.9
---
 .github/workflows/coverage-diff.yml    | 2 +-
 .github/workflows/functional_tests.yml | 4 +---
 package.json                           | 2 +-
 3 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/coverage-diff.yml b/.github/workflows/coverage-diff.yml
index ca9fac34..02c95217 100644
--- a/.github/workflows/coverage-diff.yml
+++ b/.github/workflows/coverage-diff.yml
@@ -9,4 +9,4 @@ jobs:
     permissions:
       checks: write
       pull-requests: write
-    uses: fingerprintjs/dx-team-toolkit/.github/workflows/coverage-diff.yml@0de982832e53cff28e272cee33547b039f5193c8
+    uses: fingerprintjs/dx-team-toolkit/.github/workflows/coverage-diff.yml@v1
diff --git a/.github/workflows/functional_tests.yml b/.github/workflows/functional_tests.yml
index 4593f6c8..bebc8350 100644
--- a/.github/workflows/functional_tests.yml
+++ b/.github/workflows/functional_tests.yml
@@ -39,9 +39,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: 'Install pnpm'
-        uses: pnpm/action-setup@129abb77bf5884e578fcaf1f37628e41622cc371
-        with:
-          version: 9
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - uses: actions/setup-node@v4
         with:
diff --git a/package.json b/package.json
index 4f75280d..e6a58e1c 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
   "engines": {
     "node": ">=18.17.0"
   },
-  "packageManager": "pnpm@11.5.0",
+  "packageManager": "pnpm@11.7.0+sha512.19cc852c120c7125760f2443ee6be0ca5b40f9f50598de1a09a1f177503e010e57c23c77646e01e761de59bf874fb22a3398c33ab9691fc13eb946b6f0f4d620",
   "scripts": {
     "prepare": "husky install",
     "build": "rimraf dist && rollup -c rollup.config.js --bundleConfigAsCjs",

From 24db3e9ea01ab7727207f455107dcab828853881 Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 2 Jul 2026 15:11:06 +0100
Subject: [PATCH 3/9] fix: allow esbuild build scripts via
 pnpm.onlyBuiltDependencies

pnpm 11.x errors on ignored build scripts (ERR_PNPM_IGNORED_BUILDS);
esbuild needs its postinstall to fetch its native binary.
---
 package.json | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/package.json b/package.json
index e6a58e1c..2836ae65 100644
--- a/package.json
+++ b/package.json
@@ -80,5 +80,10 @@
     "typedoc": "^0.27.9",
     "typescript": "^5.4.0",
     "yaml": "^2.6.0"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
   }
 }

From d3f0492260bdfad611509ad1235a21760941f1e2 Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 2 Jul 2026 15:12:04 +0100
Subject: [PATCH 4/9] chore: pin pnpm to 11.5.0 with integrity hash

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2836ae65..bedb9f39 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
   "engines": {
     "node": ">=18.17.0"
   },
-  "packageManager": "pnpm@11.7.0+sha512.19cc852c120c7125760f2443ee6be0ca5b40f9f50598de1a09a1f177503e010e57c23c77646e01e761de59bf874fb22a3398c33ab9691fc13eb946b6f0f4d620",
+  "packageManager": "pnpm@11.5.0+sha512.dbfcc4f81cf48597afd4bc391ffdf12c11f1a9fb83a395bfa6b0a2d9cc2fd8ffebafdb1ccbd529632153f793904c2615b7f09fe1a345473fd1c35845172a8eb1",
   "scripts": {
     "prepare": "husky install",
     "build": "rimraf dist && rollup -c rollup.config.js --bundleConfigAsCjs",

From b8ba278a031fd696d6fb55082494cfd9b6544cd1 Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 2 Jul 2026 15:20:52 +0100
Subject: [PATCH 5/9] fix: allow esbuild build via pnpm allowBuilds in
 workspace config

pnpm 11.5.0 gates build scripts via allowBuilds in pnpm-workspace.yaml;
onlyBuiltDependencies in package.json is not honored in a workspace.
---
 package.json        | 5 -----
 pnpm-workspace.yaml | 3 +++
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index bedb9f39..57d2a13e 100644
--- a/package.json
+++ b/package.json
@@ -80,10 +80,5 @@
     "typedoc": "^0.27.9",
     "typescript": "^5.4.0",
     "yaml": "^2.6.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild"
-    ]
   }
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 18e0aa3c..4e87646a 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -2,3 +2,6 @@ packages:
   - './'
   - './example'
   - './tests/functional-tests'
+
+allowBuilds:
+  esbuild: true

From 61df3d0ba3f9f4f303885128ccf1d0de28a79c38 Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 2 Jul 2026 15:31:43 +0100
Subject: [PATCH 6/9] fix: restore eslint/prettier public-hoisting for pnpm 11

pnpm 11 dropped the default public-hoist-pattern for *eslint*/*prettier*
that pnpm 9 provided; without it the eslint bin is not linked into the
root node_modules/.bin and the lint script fails with 'eslint: not found'.
---
 pnpm-workspace.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 4e87646a..be31c288 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -5,3 +5,7 @@ packages:
 
 allowBuilds:
   esbuild: true
+
+publicHoistPattern:
+  - '*eslint*'
+  - '*prettier*'

From a7d3a30547b9659f6b5cc7c2e9362f362fd64e19 Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 2 Jul 2026 15:38:15 +0100
Subject: [PATCH 7/9] chore: pin pnpm to 9.15.9 with integrity hash

pnpm 9.15.9 is the last version supporting Node 18+ (11.x requires
Node >=22.13, which breaks the Node 18-21 smoke tests). pnpm 9 also
public-hoists eslint/prettier and has no strict build-scripts gate,
so no extra workspace config is needed.
---
 package.json        | 2 +-
 pnpm-workspace.yaml | 7 -------
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/package.json b/package.json
index 57d2a13e..49aedd5b 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
   "engines": {
     "node": ">=18.17.0"
   },
-  "packageManager": "pnpm@11.5.0+sha512.dbfcc4f81cf48597afd4bc391ffdf12c11f1a9fb83a395bfa6b0a2d9cc2fd8ffebafdb1ccbd529632153f793904c2615b7f09fe1a345473fd1c35845172a8eb1",
+  "packageManager": "pnpm@9.15.9+sha512.68046141893c66fad01c079231128e9afb89ef87e2691d69e4d40eee228988295fd4682181bae55b58418c3a253bde65a505ec7c5f9403ece5cc3cd37dcf2531",
   "scripts": {
     "prepare": "husky install",
     "build": "rimraf dist && rollup -c rollup.config.js --bundleConfigAsCjs",
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index be31c288..18e0aa3c 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -2,10 +2,3 @@ packages:
   - './'
   - './example'
   - './tests/functional-tests'
-
-allowBuilds:
-  esbuild: true
-
-publicHoistPattern:
-  - '*eslint*'
-  - '*prettier*'

From cb9db0f108ef4f6482a502f15c8162fd15d2b449 Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 2 Jul 2026 15:42:27 +0100
Subject: [PATCH 8/9] ci: pin dx-team-toolkit workflows to pnpm 9 version

The dx-team-toolkit @v1 tag moved to a revision that installs pnpm 11
(requires Node >=22.13 and drops eslint/prettier public-hoisting),
breaking build/lint and the Node 18-21 smoke tests. Pin all reusable
workflow refs to 0de9828, the last revision that uses pnpm 9, restoring
green CI without a packageManager pin.
---
 .github/workflows/analyze-commits.yml  | 4 ++--
 .github/workflows/build.yml            | 2 +-
 .github/workflows/coverage-diff.yml    | 2 +-
 .github/workflows/coverage-report.yml  | 2 +-
 .github/workflows/functional_tests.yml | 4 +++-
 .github/workflows/release.yml          | 2 +-
 package.json                           | 1 -
 7 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/analyze-commits.yml b/.github/workflows/analyze-commits.yml
index f9cf8bac..fb8dbca5 100644
--- a/.github/workflows/analyze-commits.yml
+++ b/.github/workflows/analyze-commits.yml
@@ -8,13 +8,13 @@ permissions:
 jobs:
   analyze-commits:
     name: Generate docs and coverage report
-    uses: fingerprintjs/dx-team-toolkit/.github/workflows/analyze-commits.yml@v1
+    uses: fingerprintjs/dx-team-toolkit/.github/workflows/analyze-commits.yml@0de982832e53cff28e272cee33547b039f5193c8
     with:
       previewNotes: false
 
   preview-changeset:
     name: Preview changeset
-    uses: fingerprintjs/dx-team-toolkit/.github/workflows/preview-changeset-release.yml@v1
+    uses: fingerprintjs/dx-team-toolkit/.github/workflows/preview-changeset-release.yml@0de982832e53cff28e272cee33547b039f5193c8
     with:
       pr-title: ${{ github.event.pull_request.title }}
 
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 69e04757..c22f4635 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -7,4 +7,4 @@ on:
 jobs:
   build-and-check:
     name: Build project and run CI checks
-    uses: fingerprintjs/dx-team-toolkit/.github/workflows/build-typescript-project.yml@v1
+    uses: fingerprintjs/dx-team-toolkit/.github/workflows/build-typescript-project.yml@0de982832e53cff28e272cee33547b039f5193c8
diff --git a/.github/workflows/coverage-diff.yml b/.github/workflows/coverage-diff.yml
index 02c95217..ca9fac34 100644
--- a/.github/workflows/coverage-diff.yml
+++ b/.github/workflows/coverage-diff.yml
@@ -9,4 +9,4 @@ jobs:
     permissions:
       checks: write
       pull-requests: write
-    uses: fingerprintjs/dx-team-toolkit/.github/workflows/coverage-diff.yml@v1
+    uses: fingerprintjs/dx-team-toolkit/.github/workflows/coverage-diff.yml@0de982832e53cff28e272cee33547b039f5193c8
diff --git a/.github/workflows/coverage-report.yml b/.github/workflows/coverage-report.yml
index 05766234..e3f5b094 100644
--- a/.github/workflows/coverage-report.yml
+++ b/.github/workflows/coverage-report.yml
@@ -8,7 +8,7 @@ on:
 jobs:
   coverage-report:
     name: Coverage report
-    uses: fingerprintjs/dx-team-toolkit/.github/workflows/docs-and-coverage.yml@v1
+    uses: fingerprintjs/dx-team-toolkit/.github/workflows/docs-and-coverage.yml@0de982832e53cff28e272cee33547b039f5193c8
     with:
       prepare-gh-pages-commands: |
         mv docs/* ./gh-pages
diff --git a/.github/workflows/functional_tests.yml b/.github/workflows/functional_tests.yml
index bebc8350..4593f6c8 100644
--- a/.github/workflows/functional_tests.yml
+++ b/.github/workflows/functional_tests.yml
@@ -39,7 +39,9 @@ jobs:
         uses: actions/checkout@v4
 
       - name: 'Install pnpm'
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@129abb77bf5884e578fcaf1f37628e41622cc371
+        with:
+          version: 9
 
       - uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 78da988f..1c998772 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   build-and-release:
     name: 'Build project, run CI checks and publish new release'
-    uses: fingerprintjs/dx-team-toolkit/.github/workflows/release-sdk-changesets.yml@v1
+    uses: fingerprintjs/dx-team-toolkit/.github/workflows/release-sdk-changesets.yml@0de982832e53cff28e272cee33547b039f5193c8
     with:
       appId: ${{ vars.APP_ID }}
       runnerAppId: ${{ vars.RUNNER_APP_ID }}
diff --git a/package.json b/package.json
index 49aedd5b..d58353fe 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,6 @@
   "engines": {
     "node": ">=18.17.0"
   },
-  "packageManager": "pnpm@9.15.9+sha512.68046141893c66fad01c079231128e9afb89ef87e2691d69e4d40eee228988295fd4682181bae55b58418c3a253bde65a505ec7c5f9403ece5cc3cd37dcf2531",
   "scripts": {
     "prepare": "husky install",
     "build": "rimraf dist && rollup -c rollup.config.js --bundleConfigAsCjs",

From 4a680fc61a17c69475d50a3d09cca9160455f992 Mon Sep 17 00:00:00 2001
From: Juraj Uhlar <juro.uhlar@gmail.com>
Date: Thu, 2 Jul 2026 15:45:31 +0100
Subject: [PATCH 9/9] ci: pin functional_tests build workflow to pnpm 9 version

The build job in functional_tests.yml also referenced
build-typescript-project.yml@v1, which now installs pnpm 11 and fails
with 'No pnpm version specified' once the packageManager field is gone.
Pin it to 0de9828 alongside the other toolkit refs.
---
 .github/workflows/functional_tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/functional_tests.yml b/.github/workflows/functional_tests.yml
index 4593f6c8..15875b2f 100644
--- a/.github/workflows/functional_tests.yml
+++ b/.github/workflows/functional_tests.yml
@@ -13,7 +13,7 @@ jobs:
 
   build:
     name: 'Build sdk'
-    uses: fingerprintjs/dx-team-toolkit/.github/workflows/build-typescript-project.yml@v1
+    uses: fingerprintjs/dx-team-toolkit/.github/workflows/build-typescript-project.yml@0de982832e53cff28e272cee33547b039f5193c8
     with:
       artifactName: node-sdk-artifact
       artifactPath: ./dist