From 4b1274e34a720cf3fc4908bbb141a14572510c28 Mon Sep 17 00:00:00 2001
From: opencode <opencode@kubebase.de>
Date: Mon, 3 Aug 2026 13:06:43 +0200
Subject: [PATCH] fix(ci): use pnpm 11 allowBuilds instead of
 onlyBuiltDependencies

pnpm 11 treats ignored build scripts as a hard error during fresh
installs (CI/Docker), while the old onlyBuiltDependencies list is
deprecated. The stray 'allowBuilds: esbuild: set this to true or false'
placeholder was invalid YAML semantics and blocked the esbuild
postinstall, failing 'pnpm install --frozen-lockfile' in the Docker
builder stage (ERR_PNPM_IGNORED_BUILDS).
---
 pnpm-workspace.yaml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 95ae88b..8fe94d1 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -75,11 +75,14 @@ catalog:
 
 autoInstallPeers: false
 
-onlyBuiltDependencies:
-  - '@swc/core'
-  - esbuild
-  - msw
-  - unrs-resolver
+# pnpm 11: allowBuilds (map) replaces onlyBuiltDependencies (list).
+# Build scripts are blocked by default (supply-chain defense). Only allow
+# scripts for packages that genuinely need a postinstall to work.
+allowBuilds:
+  '@swc/core': true
+  esbuild: true
+  msw: true
+  unrs-resolver: true
 
 overrides:
   # replit uses linux-x64 only, we can exclude all other platforms
@@ -174,6 +177,3 @@ overrides:
   linkify-it: ">=5.0.2"
   brace-expansion: ">=5.0.8"
   fast-uri: ">=3.1.4"
-
-allowBuilds:
-  esbuild: set this to true or false