chore(deps): migrate to pnpm 11

.github/workflows/snyk.yml

@@ -34,7 +34,7 @@ jobs:
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
-          args: --severity-threshold=high --sarif-file-output=snyk.sarif
+          args: --severity-threshold=high --sarif-file-output=snyk.sarif --all-projects
 
       - name: Upload results to GitHub Security tab
         if: hashFiles('snyk.sarif') != ''

CHANGELOG.md

@@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Dev: migrated pnpm config from `package.json` `pnpm.onlyBuiltDependencies` (removed in pnpm 11) to `pnpm-workspace.yaml` `allowBuilds`. `packageManager` and `engines.pnpm` bumped to pnpm 11. No user-facing behaviour change; published package surface is identical.
 - **BREAKING**: minimum Node version raised from 20 to 22 (`engines.node >=22.0.0`). Driven by upstream pnpm 11.x dropping Node 20 support (uses `node:sqlite`, available in Node 22.13+ only). `@types/node` bumped to `^24` (LTS line).
 - Upgraded CLI framework `commander` 12→14. No user-facing behaviour change expected; `--help`, `--version`, and subcommand signatures (`generate <resource-type>`, `locales`, `describe`) are unchanged. If `--help` output formatting shifts (whitespace), it is upstream cosmetic.
 - Dev: bumped typescript 5.9→6 (added tsconfig flags for tsup DTS compatibility). vitest stays at 3.x; vitest 4 deferred across the workspace pending vitepress 2 stable (vitepress 1 pins vite 5; vitest 4 requires vite 6+). No user-facing behaviour change.

package.json

@@ -90,15 +90,9 @@
     "vitepress": "^1.6.4",
     "vitest": "^3.2.4"
   },
-  "packageManager": "pnpm@10.32.1",
+  "packageManager": "pnpm@11.1.3",
   "engines": {
     "node": ">=22.0.0",
-    "pnpm": ">=10.0.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild",
-      "lefthook"
-    ]
+    "pnpm": ">=11.0.0"
   }
 }

pnpm-workspace.yaml

@@ -0,0 +1,5 @@
+# Per-project pnpm config (this is not a monorepo).
+# `allowBuilds` replaces the removed `pnpm.onlyBuiltDependencies` family.
+allowBuilds:
+  esbuild: true
+  lefthook: true