From 7debd8476b4a14794c384b7e5c5b7fbb67dbd3e1 Mon Sep 17 00:00:00 2001
From: Chris Tate <chris@ctate.dev>
Date: Wed, 20 May 2026 15:23:23 -0500
Subject: [PATCH] chore: require pnpm minimum release age

- Enforce a two-day pnpm minimum release age and explicitly deny dependency install builds.

- Require Node 24+ and pnpm 11+ through package metadata and .node-version.

- Align CI with denied native builds by avoiding build-time node-pty loading.
---
 .github/workflows/ci.yml                |  2 +-
 .github/workflows/release.yml           |  7 ++++++-
 .gitignore                              |  1 +
 .node-version                           |  1 +
 README.md                               |  4 ++--
 examples/vue/vite-plugins/pty-server.ts |  9 +++++----
 package.json                            | 17 +++++------------
 pnpm-workspace.yaml                     | 16 ++++++++++++++++
 8 files changed, 37 insertions(+), 20 deletions(-)
 create mode 100644 .node-version

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2a250ca..792391a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version-file: .node-version
           cache: pnpm
 
       - run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 804a9be..c670296 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,6 +22,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .node-version
+
       - name: Compare versions to registry
         id: check
         run: |
@@ -57,7 +62,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "24"
+          node-version-file: .node-version
           cache: pnpm
           registry-url: "https://registry.npmjs.org"
 
diff --git a/.gitignore b/.gitignore
index 98f8fd5..f94bcad 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,7 @@ zig-out/
 !packages/@wterm/ghostty/wasm/ghostty-vt.wasm
 .DS_Store
 node_modules/
+.pnpm-store/
 dist/
 .turbo/
 *.tsbuildinfo
diff --git a/.node-version b/.node-version
new file mode 100644
index 0000000..a45fd52
--- /dev/null
+++ b/.node-version
@@ -0,0 +1 @@
+24
diff --git a/README.md b/README.md
index 85e51e0..14b6bd4 100644
--- a/README.md
+++ b/README.md
@@ -34,8 +34,8 @@ wterm ("dub-term") renders to the DOM — native text selection, copy/paste, fin
 ### Prerequisites
 
 - [Zig](https://ziglang.org/) 0.16.0+
-- [Node.js](https://nodejs.org/) 20+
-- [pnpm](https://pnpm.io/) 10+
+- [Node.js](https://nodejs.org/) 24+
+- [pnpm](https://pnpm.io/) 11+
 
 ### Setup
 
diff --git a/examples/vue/vite-plugins/pty-server.ts b/examples/vue/vite-plugins/pty-server.ts
index 6bef7b6..dbca00c 100644
--- a/examples/vue/vite-plugins/pty-server.ts
+++ b/examples/vue/vite-plugins/pty-server.ts
@@ -1,6 +1,6 @@
 import type { Plugin } from "vite";
+import type { IPty } from "node-pty";
 import { WebSocketServer, type WebSocket } from "ws";
-import * as pty from "node-pty";
 import { parse as parseUrl } from "url";
 
 function cleanEnv(): Record<string, string> {
@@ -11,11 +11,12 @@ function cleanEnv(): Record<string, string> {
   return env;
 }
 
-function handlePTYConnection(ws: WebSocket) {
+async function handlePTYConnection(ws: WebSocket) {
   const shell = process.env.SHELL || "/bin/zsh";
 
-  let ptyProcess: pty.IPty;
+  let ptyProcess: IPty;
   try {
+    const pty = await import("node-pty");
     ptyProcess = pty.spawn(shell, ["-l"], {
       name: "xterm-256color",
       cols: 80,
@@ -71,7 +72,7 @@ export function ptyServer(): Plugin {
         if (pathname !== "/api/terminal") return;
 
         wss.handleUpgrade(req, socket, head, (ws) => {
-          handlePTYConnection(ws);
+          void handlePTYConnection(ws);
         });
       });
     },
diff --git a/package.json b/package.json
index 630971d..dfff315 100644
--- a/package.json
+++ b/package.json
@@ -7,6 +7,10 @@
     "type": "git",
     "url": "https://github.com/vercel-labs/wterm"
   },
+  "engines": {
+    "node": ">=24.0.0",
+    "pnpm": ">=11.0.0"
+  },
   "scripts": {
     "build": "turbo run build",
     "predev": "command -v portless >/dev/null 2>&1 || (echo '\\nportless is required but not installed. Run: npm i -g portless\\nSee: https://github.com/vercel-labs/portless\\n' && exit 1)",
@@ -27,16 +31,5 @@
     "turbo": "^2.9.6",
     "vitest": "^4.1.4"
   },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "cpu-features",
-      "esbuild",
-      "node-pty",
-      "ssh2"
-    ],
-    "patchedDependencies": {
-      "next-themes@0.4.6": "patches/next-themes@0.4.6.patch"
-    }
-  },
-  "packageManager": "pnpm@10.11.0"
+  "packageManager": "pnpm@11.1.3"
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index e9010d3..563bd9d 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -4,3 +4,19 @@ packages:
   - "packages/@internal/*"
   - "apps/*"
   - "examples/*"
+
+minimumReleaseAge: 2880
+
+allowBuilds:
+  "@mongodb-js/zstd": false
+  "cpu-features": false
+  "esbuild": false
+  "msw": false
+  "node-pty": false
+  "node-liblzma": false
+  "sharp": false
+  "ssh2": false
+  "unrs-resolver": false
+
+patchedDependencies:
+  "next-themes@0.4.6": "patches/next-themes@0.4.6.patch"