fix(ci): restore pnpm vulnerability audit

[dev-jodee]

Summary

• Bump packageManager to pnpm@11.13.0 so pnpm audit uses npm's bulk advisory endpoint
• Migrate dependency overrides from package.json pnpm block to the pnpm 11 supported location in pnpm-workspace.yaml (versions unchanged)
• Add allowBuilds build policy required by pnpm 11: esbuild/unrs-resolver enabled, bufferutil/utf-8-validate denied

Test Plan

• corepack pnpm install --lockfile-only → lockfile unchanged, supply-chain audit passes (1022 entries)
• pnpm 11 parses config with no placeholder allowBuilds entries appended

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
solana-rewards-program	Ready	Preview, Comment	Jul 15, 2026 7:03pm

[greptile-apps]

Greptile Summary

This PR upgrades the workspace from pnpm 10 to pnpm 11 and restores the CI vulnerability audit, which was broken because pnpm 11 silently ignores pnpm.overrides declared inside package.json — a known security-critical regression in pnpm 11.

• package.json: Bumps packageManager to pnpm@11.13.0 (with updated Corepack sha512 hash) and removes the now-ignored pnpm.overrides block.
• pnpm-workspace.yaml: Receives the migrated overrides map (all version pins unchanged) and a new allowBuilds policy — esbuild and unrs-resolver permitted, bufferutil and utf-8-validate denied — following the pnpm 11 build-script approval model.

Confidence Score: 5/5

Safe to merge — all overrides are a straight migration with no version changes, and the allowBuilds policy correctly permits the native build tools the project depends on.

Both files make mechanical, well-scoped changes: the overrides are byte-for-byte equivalent to what was in package.json, the packageManager hash matches pnpm 11.13.0, and the allowBuilds entries are consistent with what the project actually needs (esbuild/unrs-resolver for native tooling; bufferutil/utf-8-validate safely fall back to JS).

No files require special attention.

Important Files Changed

Filename	Overview
package.json	Bumps packageManager from pnpm 10.15.1 to 11.13.0 with updated Corepack hash; removes pnpm.overrides block that pnpm 11 silently ignores (moved to pnpm-workspace.yaml)
pnpm-workspace.yaml	Adds overrides (migrated from package.json) and new allowBuilds build policy; all version pins are unchanged and YAML scalar types are correct (all versions have two dots, parsed as strings)

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Developer runs pnpm install] --> B{pnpm version?}
    B -->|pnpm 10| C[Reads overrides from package.json pnpm block]
    B -->|pnpm 11| D[Reads overrides from pnpm-workspace.yaml]
    B -->|pnpm 11| E[Reads allowBuilds from pnpm-workspace.yaml]
    C --> F[Overrides applied to lockfile]
    D --> F
    E --> G{Package needs build script?}
    G -->|esbuild / unrs-resolver| H[Build allowed]
    G -->|bufferutil / utf-8-validate| I[Build denied - JS fallback used]
    F --> J[pnpm audit runs via npm bulk advisory endpoint]
    H --> J
    I --> J
    J --> K[CI vulnerability audit passes]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Developer runs pnpm install] --> B{pnpm version?}
    B -->|pnpm 10| C[Reads overrides from package.json pnpm block]
    B -->|pnpm 11| D[Reads overrides from pnpm-workspace.yaml]
    B -->|pnpm 11| E[Reads allowBuilds from pnpm-workspace.yaml]
    C --> F[Overrides applied to lockfile]
    D --> F
    E --> G{Package needs build script?}
    G -->|esbuild / unrs-resolver| H[Build allowed]
    G -->|bufferutil / utf-8-validate| I[Build denied - JS fallback used]
    F --> J[pnpm audit runs via npm bulk advisory endpoint]
    H --> J
    I --> J
    J --> K[CI vulnerability audit passes]

Loading

_{Reviews (1): Last reviewed commit: "fix(ci): restore pnpm vulnerability audi..." | Re-trigger Greptile}

[github-actions]

Compute Unit Report

Instruction	Samples	CUs	Est Cost (Low) [SOL]	Est Cost (Med) [SOL]	Est Cost (High) [SOL]	Δ Avg vs main
AddDirectRecipient	74	10867	0.000005003	0.000005434	0.000010433
ClaimDirect	27	9459	0.000005002	0.000005378	0.000009729
ClaimMerkle	24	108642	0.000005032	0.000009345	0.000059321
CloseDirectDistribution	7	7770	0.000005002	0.000005310	0.000008885
CloseDirectRecipient	6	3526	0.000005001	0.000005141	0.000006763
CloseMerkleClaim	3	3045	0.000005000	0.000005121	0.000006522
CloseMerkleDistribution	15	7921	0.000005002	0.000005316	0.000008960
CreateDirectDistribution	103	12811	0.000005003	0.000005512	0.000011405
CreateMerkleDistribution	91	14394	0.000005004	0.000005575	0.000012197
RevokeDirectRecipient	12	9132	0.000005002	0.000005365	0.000009566
RevokeMerkleClaim	15	110083	0.000005033	0.000009403	0.000060041

🔺 increase · 🔻 decrease · – unchanged · 🆕 new · 🗑 removed (vs main)

Generated: 2026-07-15

[amilz]

LGTM: bumps pnpm to 11.13.0 and migrates pnpm overrides + allowBuilds into pnpm-workspace.yaml; dependency-only, all CI green.