dev: upgrade to pnpm 11

- Upgrade to latest pnpm 11 version
- Fall back to default min release age (1d) and enforce strict checks
- Forbid all lifecycle scripts of dependencies that currently have them:
  None of them are needed for JSON Forms to build
- Update corepack link in README

Author: lucas-koehler

.devcontainer/Dockerfile

@@ -15,5 +15,5 @@ ENV CHROME_BIN=/usr/bin/chromium
 # RUN su node -c "source /usr/local/share/nvm/nvm.sh && nvm install ${EXTRA_NODE_VERSION}"
 
 # Install and configure pnpm
-RUN su node -c "npm install -g pnpm@10"
+RUN su node -c "npm install -g pnpm@11"
 RUN su node -c "pnpm config set store-dir /home/node/.pnpm-store"

README.md

@@ -44,7 +44,7 @@ Independently of the assigned milestone, contributions are always accepted and a
 ### First time setup
 
 - Install [node.js](https://nodejs.org/) (only Node v24+ < 25 is currently supported)
-- Install pnpm: <https://pnpm.io/installation> (use pnpm 10.33.0+) or use [corepack](https://nodejs.org/docs/latest-v18.x/api/corepack.html) to enable the recommended version
+- Install pnpm: <https://pnpm.io/installation> (use pnpm 11+) or use [corepack](https://github.com/nodejs/corepack) to enable the recommended version
 - Clone this repository
 - Install dependencies: `pnpm i --frozen-lockfile`
 

package.json

@@ -2,9 +2,9 @@
   "name": "jsonforms-monorepo",
   "engines": {
     "node": "^24",
-    "pnpm": "^10.33.0"
+    "pnpm": "^11"
   },
-  "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",
+  "packageManager": "pnpm@11.24.0+sha512.bd27e345e976dcb0be0b7a1228217b049a817e21b1f355c90dbe7dc46671895a8bc1e6d06c24554505ea93ea0b45f489a27ec1bfbc8de6a9659fca0f16fa0000",
   "scripts": {
     "lerna": "lerna",
     "preparePublish": "git clean -dfx && pnpm i --frozen-lockfile && pnpm run clean && pnpm run build && pnpm run doc && pnpm run test",

pnpm-workspace.yaml

@@ -1,6 +1,12 @@
 packages:
   - 'packages/*'
-# The minimum age of dependency versions to be installed in minutes. 4320 minutes is 72h.
-# This is to avoid supply chain attacks where a new version of a dependency is published with malicious code.
-minimumReleaseAge: 4320
+allowBuilds:
+  '@parcel/watcher': false
+  core-js: false
+  esbuild: false
+  lmdb: false
+  msgpackr-extract: false
+  nodent-runtime: false
+  nx: false
 minimumReleaseAgeIgnoreMissingTime: false
+minimumReleaseAgeStrict: true