From e87129bd1b8df4bada2688ee690dd7419f51ff17 Mon Sep 17 00:00:00 2001
From: Hugo Richard <hugo.richard@vercel.com>
Date: Thu, 21 May 2026 11:27:34 +0100
Subject: [PATCH 1/3] chore(pnpm): upgrade to v11

---
 .github/workflows/autofix.yml |  2 --
 .github/workflows/ci.yml      | 10 ----------
 .npmrc                        |  2 --
 package.json                  |  9 ++-------
 pnpm-workspace.yaml           | 22 +++++++++++++---------
 5 files changed, 15 insertions(+), 30 deletions(-)
 delete mode 100644 .npmrc

diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index b29d30d2..10030b2c 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -16,8 +16,6 @@ jobs:
 
       - name: Install pnpm
         uses: pnpm/action-setup@v6
-        with:
-          version: 10.33.4
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6ce2ed0d..61b47ce3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,8 +15,6 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v6
-        with:
-          version: 10.33.4
       - uses: actions/setup-node@v6
         with:
           node-version: 22
@@ -33,8 +31,6 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v6
-        with:
-          version: 10.33.4
       - uses: actions/setup-node@v6
         with:
           node-version: 22
@@ -51,8 +47,6 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v6
-        with:
-          version: 10.33.4
       - uses: actions/setup-node@v6
         with:
           node-version: 22
@@ -69,8 +63,6 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v6
-        with:
-          version: 10.33.4
       - uses: actions/setup-node@v6
         with:
           node-version: 22
@@ -91,8 +83,6 @@ jobs:
         with:
           fetch-depth: 0
       - uses: pnpm/action-setup@v6
-        with:
-          version: 10.33.4
       - uses: actions/setup-node@v6
         with:
           node-version: 22
diff --git a/.npmrc b/.npmrc
deleted file mode 100644
index cf040424..00000000
--- a/.npmrc
+++ /dev/null
@@ -1,2 +0,0 @@
-shamefully-hoist=true
-strict-peer-dependencies=false
diff --git a/package.json b/package.json
index b725ecf8..1bde6707 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,7 @@
   },
   "author": "Hugo Richard <hugo.richard@vercel.com>",
   "license": "MIT",
-  "packageManager": "pnpm@10.33.4",
+  "packageManager": "pnpm@11.1.3",
   "scripts": {
     "dev": "turbo run dev --filter=@nuxtjs/mcp-toolkit-playground",
     "dev:starter": "turbo run dev --filter=@nuxtjs/mcp-toolkit-starter",
@@ -42,10 +42,5 @@
   "workspaces": [
     "apps/*",
     "packages/*"
-  ],
-  "pnpm": {
-    "overrides": {
-      "@nuxtjs/mcp-toolkit": "workspace:*"
-    }
-  }
+  ]
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 41b260d6..1a791581 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -2,13 +2,17 @@ packages:
   - apps/*
   - packages/*
 
-ignoredBuiltDependencies:
-  - '@parcel/watcher'
-  - esbuild
-  - unrs-resolver
-  - vue-demi
+shamefullyHoist: true
+strictPeerDependencies: false
 
-onlyBuiltDependencies:
-  - better-sqlite3
-  - isolated-vm
-  - sharp
+allowBuilds:
+  '@parcel/watcher': false
+  esbuild: false
+  unrs-resolver: false
+  vue-demi: false
+  better-sqlite3: true
+  isolated-vm: true
+  sharp: true
+
+overrides:
+  '@nuxtjs/mcp-toolkit': workspace:*

From 3ae04a3a40c40f0187d916e1e938e61fe4dd41cd Mon Sep 17 00:00:00 2001
From: Hugo Richard <hugo.richard@vercel.com>
Date: Thu, 21 May 2026 11:28:53 +0100
Subject: [PATCH 2/3] chore(pnpm): add minimumReleaseAge to harden supply chain

---
 pnpm-workspace.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 1a791581..0dc8d557 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -16,3 +16,16 @@ allowBuilds:
 
 overrides:
   '@nuxtjs/mcp-toolkit': workspace:*
+
+minimumReleaseAge: 2880
+
+minimumReleaseAgeExclude:
+  # Nuxt
+  - '@nuxt/*'
+  - '@nuxtjs/*'
+  - 'nuxt'
+  - 'nuxt-*'
+  # Vercel
+  - '@vercel/*'
+  - '@ai-sdk/*'
+  - 'ai'

From 7035c2659a86a456cb16d0d10566df492c6ff77a Mon Sep 17 00:00:00 2001
From: Hugo Richard <hugo.richard@vercel.com>
Date: Thu, 21 May 2026 12:41:21 +0100
Subject: [PATCH 3/3] chore(pnpm): declare ignored builds in allowBuilds map

---
 pnpm-workspace.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 0dc8d557..2e31c788 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -10,6 +10,8 @@ allowBuilds:
   esbuild: false
   unrs-resolver: false
   vue-demi: false
+  cbor-extract: false
+  core-js-pure: false
   better-sqlite3: true
   isolated-vm: true
   sharp: true