Upgrade to pnpm v12 and drop volta

.github/workflows/floating-deps.yml

@@ -36,7 +36,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version-file: .node-version
 
       - name: Install Postgres extensions
         env:

.github/workflows/lint.yml

@@ -16,7 +16,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version-file: .node-version
           cache: pnpm
 
       - run: pnpm install --frozen-lockfile
@@ -35,7 +35,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v7
         with:
-          node-version: 24
+          node-version-file: .node-version
           cache: pnpm
 
       - run: pnpm install --frozen-lockfile

.node-version

@@ -0,0 +1 @@
+24.21.0

CONTRIBUTING.md

@@ -39,21 +39,17 @@ Still interested? Coolio! Here is how to get started:
 
 Here comes a little surprise: You need [Node.JS](http://nodejs.org).
 
-This repository uses [pnpm](https://pnpm.io), and pins both Node and pnpm with
-[Volta](https://volta.sh):
+The development Node version is pinned in `.node-version`, which fnm, nvm, mise and
+asdf all read. CI's non-matrix jobs use the same file. Any Node satisfying `engines` in
+`package.json` works.
 
-```json
-"volta": { "node": "24.18.1", "pnpm": "10.34.5" }
-```
-
-With Volta installed, `cd`-ing into the repo gives you the right Node and pnpm
-automatically — nothing else to do. Without Volta, the same pnpm version is also in the
-`packageManager` field, which `corepack enable` and pnpm itself both honour; you will
-just have to get Node 24 yourself.
+This repository uses [pnpm](https://pnpm.io), pinned by the `packageManager` field in
+`package.json`. Install any pnpm 12 (for example `npm install -g pnpm@12`) and it will
+switch itself to the pinned version inside the repo.
 
-Keep `volta.pnpm` and `packageManager` in sync. pnpm self-switches to whatever
-`packageManager` says, so if they disagree the `packageManager` value silently wins and
-your Volta pin does nothing.
+pnpm does not resolve packages published less than a day ago (its default
+`minimumReleaseAge`). That is deliberate supply-chain protection, so a version you just
+saw announced may not install yet.
 
 ### 2. Install the dependencies
 
@@ -69,9 +65,9 @@ If you change anything in `package.json`, commit the updated lockfile alongside
 CI installs with `--frozen-lockfile` and will fail if the two disagree.
 
 The `libpq` package (via `pg-native`) compiles native bindings. pnpm only runs its build
-script because it is listed under `onlyBuiltDependencies` in `pnpm-workspace.yaml`; if you
-add another dependency that needs a build step, it has to be added there too or it will
-install silently broken.
+script because it is listed under `allowBuilds` in `pnpm-workspace.yaml`; if you add
+another dependency that needs a build step, it has to be added there too or
+`pnpm install` will fail.
 
 ### 3. Database
 
@@ -179,6 +175,7 @@ This package ships raw `lib/` — there is deliberately no `prepare`, `prepack`,
 `build` script, and adding one is a breaking change for consumers. Because the package
 is fetched as a GitHub tarball, a build script forces pnpm off that fast path into
 clone-and-build, _and_ trips pnpm's build gate: every consuming repo would have to add
-`sequelize` to its own `onlyBuiltDependencies` before it would install at all.
+`sequelize` to its own `allowBuilds` (`onlyBuiltDependencies` on pnpm 10) before it
+would install at all.
 
 If a build step ever becomes genuinely necessary, publish to a private registry instead.

package.json

@@ -62,7 +62,7 @@
     "test-postgres-native": "cross-env DIALECT=postgres-native pnpm test",
     "test-postgresn": "pnpm run test-postgres-native",
     "test-all": "pnpm run test-postgres && pnpm run test-postgres-native",
-    "sscce": "env-cmd -f $npm_package_options_env_cmd node sscce.js",
+    "sscce": "env-cmd -f ./test/config/.docker.env node sscce.js",
     "sscce-postgres": "cross-env DIALECT=postgres pnpm run sscce"
   },
   "dependencies": {
@@ -103,12 +103,5 @@
   "engines": {
     "node": ">=24.19.0"
   },
-  "volta": {
-    "node": "24.21.0",
-    "pnpm": "10.34.5"
-  },
-  "packageManager": "pnpm@10.34.5",
-  "options": {
-    "env_cmd": "./test/config/.docker.env"
-  }
+  "packageManager": "pnpm@12.8.1"
 }

pnpm-workspace.yaml

@@ -1,9 +1,10 @@
-# pnpm blocks dependency build scripts by default. This one compiles native
-# bindings and is silently non-functional without an approved build:
+# pnpm blocks dependency build scripts by default, and fails the install when an
+# unapproved package has one. This one compiles native bindings:
 #   libpq -> addon.node   (transitive via pg-native, postgres-native dialect)
-#
-# Note: pnpm 11 renamed this key to `allowBuilds` (a bool map). Do not migrate to it
-# without also reading the pnpm version note in CONTRIBUTING.md -- we are held on
-# pnpm 10 deliberately.
-onlyBuiltDependencies:
-  - libpq
+allowBuilds:
+  libpq: true
+
+minimumReleaseAgeExclude:
+  - vitest@5.0.3
+  - '@vitest/mocker@5.0.3'
+  - '@vitest/spy@5.0.3'