fix(ci): restore pnpm vulnerability audit

[dev-jodee]

Summary

• Bump pnpm 10.15.1 → 11.13.0 so pnpm audit uses npm's bulk advisory endpoint
• Migrate pnpm.overrides out of package.json into pnpm-workspace.yaml (supported location in pnpm 11)
• Add explicit allowBuilds dependency build policy required by pnpm 11

Test Plan

• pnpm install --frozen-lockfile: passes supply-chain policies, lockfile unchanged; builds only esbuild + unrs-resolver
• pnpm audit --ignore-unfixable: exit 0

Mirrors solana-foundation/subscriptions#208 (overrides kept escrow-specific).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
solana-escrow-program	Ready	Preview, Comment	Jul 15, 2026 7:09pm

[greptile-apps]

Greptile Summary

This PR migrates the pnpm workspace configuration to be compatible with pnpm 11, which silently ignores pnpm.overrides in package.json and requires them in pnpm-workspace.yaml. The changes are straightforward and mechanically correct.

• Bumps packageManager in package.json from pnpm@10.15.1 to pnpm@11.13.0 with an updated SHA-512 integrity hash.
• Moves the pnpm.overrides block (unchanged values) from package.json into pnpm-workspace.yaml, and adds the pnpm 11 allowBuilds build-policy map that explicitly permits esbuild/unrs-resolver and denies bufferutil/utf-8-validate.

Confidence Score: 5/5

Safe to merge — the change is a mechanical relocation of existing config values plus a pnpm major-version pin, with no logic changes.

All override values are identical to those removed from package.json; the lockfile stays at version 9.0 (compatible with pnpm 11) and the overrides recorded in it match the new workspace yaml. The allowBuilds entries match the packages that actually require install scripts in this dependency tree, confirmed by the author's frozen-lockfile test. No new dependencies, no schema changes, no code paths affected.

No files require special attention.

Important Files Changed

Filename	Overview
package.json	Removes the pnpm.overrides block (now in pnpm-workspace.yaml) and bumps packageManager to pnpm@11.13.0 with a 128-char SHA-512 hash.
pnpm-workspace.yaml	Adds the migrated overrides block and a new allowBuilds map required by pnpm 11's strictDepBuilds default; values are identical to the removed package.json entries.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[pnpm install] --> B{pnpm version?}
    B -->|pnpm 10| C[Reads overrides from package.json pnpm.overrides]
    B -->|pnpm 11| D[Reads overrides from pnpm-workspace.yaml]
    D --> E{allowBuilds check}
    E -->|esbuild / unrs-resolver: true| F[Run install script ✓]
    E -->|bufferutil / utf-8-validate: false| G[Skip install script ✓]
    E -->|Any unlisted package| H[Error: strictDepBuilds = true]
    D --> I[Apply overrides to resolved deps]
    I --> J[pnpm-lock.yaml lockfileVersion 9.0 unchanged]
    J --> K[pnpm audit uses npm bulk advisory endpoint]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[pnpm install] --> B{pnpm version?}
    B -->|pnpm 10| C[Reads overrides from package.json pnpm.overrides]
    B -->|pnpm 11| D[Reads overrides from pnpm-workspace.yaml]
    D --> E{allowBuilds check}
    E -->|esbuild / unrs-resolver: true| F[Run install script ✓]
    E -->|bufferutil / utf-8-validate: false| G[Skip install script ✓]
    E -->|Any unlisted package| H[Error: strictDepBuilds = true]
    D --> I[Apply overrides to resolved deps]
    I --> J[pnpm-lock.yaml lockfileVersion 9.0 unchanged]
    J --> K[pnpm audit uses npm bulk advisory endpoint]

Loading

_{Reviews (1): Last reviewed commit: "fix(ci): restore pnpm vulnerability audi..." | Re-trigger Greptile}

[github-actions]

Compute Unit Report

Instruction	Samples	CUs	Est Cost (Low) [SOL]	Est Cost (Med) [SOL]	Est Cost (High) [SOL]	Δ Avg vs main
AddBlockTokenExtensions	49	5597	0.000005001	0.000005223	0.000007798
AddTimelock	17	5422	0.000005001	0.000005216	0.000007711
AllowMint	30	23272	0.000005006	0.000005930	0.000016636
BlockMint	6	2372	0.000005000	0.000005094	0.000006186
CreateEscrow	131	4583	0.000005001	0.000005183	0.000007291
Deposit	7	14746	0.000005004	0.000005589	0.000012373
RemoveExtension	4	5586	0.000005001	0.000005223	0.000007793
SetArbiter	14	5455	0.000005001	0.000005218	0.000007727
SetHook	33	4634	0.000005001	0.000005185	0.000007317
SetImmutable	8	2152	0.000005000	0.000005086	0.000006076
UnblockTokenExtension	5	4279	0.000005001	0.000005171	0.000007139
UpdateAdmin	6	1881	0.000005000	0.000005075	0.000005940
Withdraw	18	9220	0.000005002	0.000005368	0.000009610

🔺 increase · 🔻 decrease · – unchanged · 🆕 new · 🗑 removed (vs main)

Generated: 2026-07-15