chore(deps): update pnpm to 11.21.0

[steipete]

Summary

• update the integrity-pinned project package manager from pnpm 11.20.0 to 11.21.0
• retain the existing 48-hour minimum release-age policy for package dependencies

The registry pass found no eligible package or lockfile updates. Oxfmt 0.63.0 and Oxlint 1.78.0 are newer but were published only about 15 hours before this pass, so pnpm correctly excluded them under minimumReleaseAge: 2880. PR #185 separately owns the current GitHub Actions digest refresh.

Verification

$ pnpm --version
11.21.0

$ pnpm install --frozen-lockfile
Already up to date
Done in 212ms using pnpm v11.21.0

$ pnpm typecheck
exit 0

$ pnpm lint
exit 0

$ pnpm format:check
All matched files use the correct format.

$ pnpm test -- --silent
Test Files  29 passed (29)
Tests  900 passed | 1 skipped (901)

$ pnpm build
exit 0

$ pnpm pack:smoke
packaged CLI smoke mapped 13 features (3 CUDA)

$ node dist/cli.js --version
0.7.2

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 10, 2026, 9:40 PM ET / August 11, 2026, 01:40 UTC.

ClawSweeper review

What this changes

The PR updates the project’s Corepack integrity-pinned pnpm version from 11.20.0 to 11.21.0 in package metadata.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

This is a focused, well-validated pnpm integrity-pin update that current main has not yet incorporated; it remains necessary until merged.

Priority: P3
Reviewed head: 967b4449bcf95bb5a27308e02878fc7a50f68d4d

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A narrowly scoped package-manager update with credible real command output covering the repository validation path.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (terminal): The PR body provides after-change terminal output for pnpm 11.21.0, frozen installation, checks, tests, build, package smoke, and CLI version; contributors should redact private data in future proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The PR body provides after-change terminal output for pnpm 11.21.0, frozen installation, checks, tests, build, package smoke, and CLI version; contributors should redact private data in future proof.
Evidence reviewed	6 items	Current main remains on the prior pnpm pin: Current main declares pnpm 11.20.0 with an integrity hash, so the requested 11.21.0 update is not already implemented. PR scope is a single integrity-pinned declaration: The PR head changes only the packageManager value to pnpm 11.21.0 and its SHA-512 integrity pin. Release-age policy remains unchanged: The workspace retains its 2,880-minute minimum dependency release age, consistent with the PR description.
Findings	None	None.
Security	None	None.

How this fits together

The package manifest declares the Node and pnpm toolchain used by contributors and CI. That pnpm version installs dependencies and runs the CLI’s validation and packaging workflow.

flowchart LR
  A[Contributor or CI] --> B[Package manifest]
  B --> C[Pinned pnpm release]
  C --> D[Install dependencies]
  D --> E[Validation commands]
  E --> F[Packaged CLI]

Loading

Before merge

• Complete next step (P2) - No repair is needed; this awaits normal merge review and required CI completion.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	1 file changed; 1 line added, 1 removed	The change is confined to the package-manager version and integrity declaration.
Recorded validation	9 commands reported	The PR body records frozen install, static checks, tests, build, package smoke, and CLI version output using pnpm 11.21.0.

Technical review

Best possible solution:

Merge the integrity-pinned pnpm update after the required CI checks complete, retaining the existing release-age policy.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates the project toolchain rather than reporting a reproducible product bug.

Is this the best way to solve the issue?

Yes: changing the existing integrity-pinned package-manager declaration is the narrowest maintainable way to adopt this pnpm release.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 1571f3143be5.

Labels

Label changes:

• add P3: This is routine, low-risk toolchain maintenance with no indicated user-facing regression.
• add proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides after-change terminal output for pnpm 11.21.0, frozen installation, checks, tests, build, package smoke, and CLI version; contributors should redact private data in future proof.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body provides after-change terminal output for pnpm 11.21.0, frozen installation, checks, tests, build, package smoke, and CLI version; contributors should redact private data in future proof.

Label justifications:

• P3: This is routine, low-risk toolchain maintenance with no indicated user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body provides after-change terminal output for pnpm 11.21.0, frozen installation, checks, tests, build, package smoke, and CLI version; contributors should redact private data in future proof.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides after-change terminal output for pnpm 11.21.0, frozen installation, checks, tests, build, package smoke, and CLI version; contributors should redact private data in future proof.

Evidence

What I checked:

• Current main remains on the prior pnpm pin: Current main declares pnpm 11.20.0 with an integrity hash, so the requested 11.21.0 update is not already implemented. (package.json:48, 1571f3143be5)
• PR scope is a single integrity-pinned declaration: The PR head changes only the packageManager value to pnpm 11.21.0 and its SHA-512 integrity pin. (package.json:48, 967b4449bcf9)
• Release-age policy remains unchanged: The workspace retains its 2,880-minute minimum dependency release age, consistent with the PR description. (pnpm-workspace.yaml:1, 1571f3143be5)
• CI exercises the affected toolchain path: CI installs with frozen lockfile and runs typecheck, lint, formatting, tests, build, and package smoke validation through pnpm. (.github/workflows/ci.yml:22, 1571f3143be5)
• Toolchain history owner: Package metadata history shows Peter Steinberger authored the recent toolchain refresh commit 439d9e4, establishing current-main ownership of this maintenance surface. (package.json:48, 439d9e42b891)
• Not yet released or on main: The PR head is not contained by a local release tag; latest supplied release v0.7.2 points to an earlier main commit. (967b4449bcf9)

Likely related people:

• steipete: Peter Steinberger authored the recent current-main package/toolchain refresh and the proposed pin update. (role: recent package-toolchain contributor; confidence: high; commits: 439d9e42b891, 1571f3143be5; files: package.json, pnpm-workspace.yaml)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.