implements pnpm minimumReleaseAge and upgrades pnpm to 10.33.0 by robert-inkeep · Pull Request #2958 · inkeep/agents

robert-inkeep · 2026-04-01T18:42:08Z

No description provided.

vercel · 2026-04-01T18:42:14Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agents-api	Ready	Preview, Comment	Apr 1, 2026 7:04pm
agents-docs	Ready	Preview, Comment	Apr 1, 2026 7:04pm
agents-manage-ui	Ready	Preview, Comment	Apr 1, 2026 7:04pm

changeset-bot · 2026-04-01T18:42:25Z

⚠️ No Changeset found

Latest commit: 31709bd

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pullfrog · 2026-04-01T18:43:12Z

TL;DR — Upgrades pnpm from 10.10.0 to 10.33.0 across the entire monorepo (Dockerfiles, CI workflows, packageManager fields, and docs) and adds the minimumReleaseAge: 1440 supply-chain safety setting to pnpm-workspace.yaml, which prevents pnpm from resolving npm packages published less than 24 hours ago.

Key changes

Upgrade pnpm to 10.33.0 — Bumps packageManager in every package.json, all CI workflow files, Dockerfiles, and composite actions from 10.10.0 to 10.33.0.
Add minimumReleaseAge: 1440 to workspace config — Tells pnpm to skip any package version younger than 24 hours during resolution, reducing exposure to supply-chain attacks.
Bump create-agents-template dependencies — Updates Inkeep packages to ^0.59.4 and regenerates the template lockfile under pnpm 10.33.0.
Update contributing docs — Raises the documented minimum pnpm version from 10.10.0 to 10.30.0.

_{Summary ｜ 20 files ｜ 3 commits ｜ base: main ← pnpm-min-release}

pnpm 10.10.0 → 10.33.0

Before: pnpm 10.10.0 pinned across the repo — Dockerfiles, CI workflows, and packageManager fields.
After: pnpm 10.33.0 everywhere, updated in 18 files spanning CI, Docker, package manifests, and docs.

Every location that referenced pnpm's version has been updated in lockstep:

Location type	Files touched
Root + package `packageManager` fields	`package.json`, `agents-api/package.json`, `packages/agents-sdk/package.json`, `packages/ai-sdk-provider/package.json`, `create-agents-template/package.json`
CI workflows	`ci.yml` (×2), `auto-format.yml`, `ci-maintenance.yml`, `coverage.yml.disabled`, `cypress.yml`, `publish-skills.yml`
Dockerfiles	`.ai-dev/Dockerfile`, `Dockerfile.agents-api`, `Dockerfile.agents-manage-ui`, `Dockerfile.agents-migrate`
Docs / other	`.ai-dev/README.md`, `contributing/overview.mdx`, `cypress-e2e/action.yml`

package.json · .github/workflows/ci.yml · .ai-dev/Dockerfile

`minimumReleaseAge` supply-chain gate

Before: No minimum release age — pnpm could resolve packages the instant they were published to npm.
After: pnpm skips any package version published less than 1440 minutes (24 hours) ago during dependency resolution.

This leverages pnpm's built-in minimumReleaseAge setting. Existing lockfile entries are unaffected — the constraint only fires when pnpm picks a new version during pnpm install or pnpm update.

What does this protect against?

Freshly published packages carry higher risk: malicious actors sometimes publish compromised versions that get pulled within hours, and legitimate releases occasionally ship with regressions discovered shortly after publish. The 24-hour window lets the ecosystem's automated scanners and human reviewers flag problems before the monorepo can adopt them.

pnpm-workspace.yaml

Template dependency bumps

Before: create-agents-template pinned older Inkeep package versions under pnpm 10.10.0.
After: Inkeep packages bumped to ^0.59.4, pnpm.overrides synced with root, and lockfile regenerated under pnpm 10.33.0.

The template's package.json also picks up updated versions of tailwindcss, @tailwindcss/vite, zod, and dotenv, with the lockfile regenerated accordingly (~1000 lines of diff).

create-agents-template/package.json · create-agents-template/pnpm-lock.yaml

^{｜ View workflow run ｜ Triggered by Pullfrog ｜ Using Claude Opus ｜ 𝕏}

pullfrog

Low urgency — good supply chain hardening, but the current pnpm version doesn't support this setting yet.

^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

pullfrog · 2026-04-01T18:43:23Z

  - "@types/react-dom"

 ignorePatchFailures: false
+minimumReleaseAge: 1440


minimumReleaseAge was added in pnpm v10.16.0. The repo currently pins [email protected] in package.json (packageManager field), so this setting will be silently ignored until pnpm is upgraded. Either bump packageManager to >=10.16.0 in this PR or in a companion PR, or note that this is intentionally staged ahead of the upgrade.

claude

PR Review Summary

(0) Total Issues | Risk: Low

This PR adds the minimumReleaseAge: 1440 setting to pnpm-workspace.yaml, which is a security hardening measure for the package manager.

What This Does

The minimumReleaseAge option tells pnpm to refuse installing any npm package that was published less than 1440 minutes (24 hours) ago. This is a supply chain security feature that protects against:

Malicious package injection — Attackers sometimes publish malicious versions of packages and quickly remove them, hoping to catch installations in that window
Compromised maintainer accounts — If an npm account is compromised, there's a 24-hour window for detection/revocation before packages reach your lockfile
Typosquatting attacks — Newly published typosquatted packages won't be installable until they've been public for 24 hours

Considerations

Trade-off: This setting can delay installing genuinely new packages or urgent security patches by up to 24 hours. In practice:

Most dependency updates are done via lockfile updates, which install exact versions regardless of age
Urgently-needed packages can still be installed by temporarily removing the setting
24 hours is a reasonable balance between security and velocity

Documentation: Consider adding a code comment explaining the 1440 value represents 24 hours (in minutes) for future maintainers.

✅ APPROVE

Summary: Clean security hardening change. The minimumReleaseAge setting adds supply chain protection with minimal workflow impact. Ship it! 🚀

Reviewers (1)

Reviewer	Returned	Main Findings	Consider	While You're Here	Inline Comments	Pending Recs	Discarded
`orchestrator`	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0

Note: Single-line DevOps config change — no sub-reviewers dispatched.

socket-security · 2026-04-01T18:49:12Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@opentelemetry/sdk-trace-node@2.1.0
	@opentelemetry/context-async-hooks@2.1.0
	@langfuse/tracing@4.0.1
	@types/node@22.18.4
	tsx@4.20.5
	langfuse@3.38.5
	typescript@5.9.2
	dotenv@16.6.1
	@opentelemetry/core@2.1.0

View full report

socket-security · 2026-04-01T18:49:15Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

claude

PR Review Summary

(0) Total Issues | Risk: Low

Delta Review Scope

This is a re-review scoped to changes since commit 93c1373d172d. The only change is:

-  "packageManager": "[email protected]"
+  "packageManager": "[email protected]"

Assessment

This commit directly addresses the prior pullfrog feedback that minimumReleaseAge requires pnpm ≥10.16.0. The version upgrade is appropriate:

v10.16.0 is the minimum version that supports minimumReleaseAge (pnpm changelog)
The upgrade is a minor version bump (10.10.0 → 10.16.0), which should be backward compatible
No other changes are required — the minimumReleaseAge: 1440 setting in pnpm-workspace.yaml will now be respected

Considerations

Lockfile regeneration: After merging, the first pnpm install will use the new pnpm version. If the lockfile format changed between versions, it may be rewritten. This is expected behavior and not a concern.

CI caching: If CI caches the pnpm store by version, the first run after merge may have a cache miss. This is a one-time cost.

✅ APPROVE

Summary: Clean follow-up that addresses the version compatibility issue raised in prior review. The pnpm upgrade enables the minimumReleaseAge supply chain protection. Ship it! 🚀

Reviewers (1)

Reviewer	Returned	Main Findings	Consider	While You're Here	Inline Comments	Pending Recs	Discarded
`orchestrator`	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0

Note: Delta review — single-line version bump addressing prior feedback. No sub-reviewers dispatched.

claude

PR Review Summary

(0) Total Issues | Risk: Low

Delta Review Scope

This is a re-review scoped to changes since commit 038c9630e69a. The delta contains one commit:

31709bd77 upgrades pnpm to 10.33.0

This further bumps pnpm from 10.16.0 → 10.33.0 across 19 files:

Root package.json (packageManager field)
Multiple package.json files (agents-api, agents-sdk, ai-sdk-provider, create-agents-template)
CI workflows (.github/workflows/*.yml)
Dockerfiles (.ai-dev/Dockerfile, create-agents-template/Dockerfile.*)
Documentation (.ai-dev/README.md, agents-docs/content/.../overview.mdx)
Lockfile changes in create-agents-template/pnpm-lock.yaml (+387 lines)

Assessment

The version upgrade is appropriate and comprehensive:

10.33.0 is a recent stable pnpm release that includes minimumReleaseAge support (added in 10.16.0)
All pnpm version references across the monorepo are now consistently updated to 10.33.0
The lockfile changes are expected from the pnpm version upgrade
CI caching may see a one-time cache miss after merge — expected and acceptable

💭 Consider (1)

💭 1) agents-docs/content/community/contributing/overview.mdx:18 Documentation version alignment

Issue: The docs say "pnpm version 10.30.0 or higher (matches packageManager)" but packageManager is now 10.33.0.

Why: While technically correct ("10.30.0 or higher" includes 10.33.0), stating a minimum that's slightly below the actual version creates minor confusion.

Fix: Consider changing to "version 10.33.0 or higher" for precision, or "version 10.33 or higher" for future-proofing within the 10.33.x range.

Refs: overview.mdx:18

✅ APPROVE

Summary: Clean follow-up that upgrades pnpm from 10.16.0 to 10.33.0 across all version references. This maintains consistency and ensures the minimumReleaseAge supply chain protection is enabled with a recent stable release. The documentation version suggestion is a minor consideration but doesn't block approval. Ship it! 🚀

Reviewers (1)

Reviewer	Returned	Main Findings	Consider	While You're Here	Inline Comments	Pending Recs	Discarded
`orchestrator`	1	0	1	0	0	0	0
Total	1	0	1	0	0	0	0

Note: Delta review — DevOps version bump across multiple files. No sub-reviewers dispatched; orchestrator-level review sufficient for infrastructure changes.

github-actions · 2026-04-01T19:25:45Z

🔎💬 Inkeep AI search and chat service is syncing content for source 'Inkeep Agent Framework Docs'

* implements pnpm minimumReleaseAge * upgrades pnpm to 10.16.0 * upgrades pnpm to 10.33.0

@claude

* chore(dashboard): dockerize visual regression tests for cross-OS consistency Run Playwright browser inside a Docker container so visual screenshot tests produce identical results on macOS (local dev) and Linux (CI). - Add docker-compose.visual.yml with Playwright server container - Update vitest config to connect to Docker browser via websocket when PW_TEST_CONNECT_WS_ENDPOINT env var is set - Add test:visual and test:visual:update npm scripts - Update CI workflow to use Docker Playwright server instead of bare Playwright install - Regenerate screenshot baselines from Linux container Closes PRD-6191 Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR review feedback - Add explicit failure handling if Playwright server doesn't start - Bind Docker port to 127.0.0.1 only (don't expose to network) - Align npx playwright version with Docker image (both 1.58.0) Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: restore Playwright install step in CI The @vitest/browser-playwright package requires a local Playwright install to initialize, even when the actual browser runs in Docker via connectOptions. Keep the install step alongside the Docker server. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix(dashboard): pass PW_TEST_CONNECT_WS_ENDPOINT through turbo strict mode Turbo v2 strict mode filters env vars not listed in turbo.json from child processes. The Playwright WebSocket endpoint was being silently dropped, causing vitest to fall back to local Chromium instead of the Docker server — producing mismatched screenshots in CI. Also pins docker-compose.visual.yml to linux/amd64 so local baselines match CI regardless of host architecture (see microsoft/playwright#13873), and fixes the Playwright cache restore-keys prefix mismatch. Co-Authored-By: Claude Opus 4.6 <[email protected]> * docs: add visual regression test workflow to AGENTS.md * fix(dashboard): resolve Monaco strict locator violation in nested error state visual test * fix(dashboard): fix Monaco strict locator violation with data-testid and stable render wait * Refactor vitest.config.ts by removing unused code * Update vitest.config.ts * fix(dashboard): restore onUnhandledError handler for Monaco browser tests The previous refactor removed the onUnhandledError handler, causing CI to fail with exit code 1 due to 3 known, unfixable Monaco Editor errors in Vitest browser mode: 1. "Cannot use import statement outside a module" - Monaco web workers cannot load ESM in the Vitest browser sandbox 2. "InvalidCharacterError" / "is not a valid name" - Monaco attempts createElement with an SVG data URI as the tag name 3. "Closing rpc while" - Vitest worker RPC shutdown race condition These errors were originally suppressed by Nick in #2046 and #2078 after investigation confirmed they are unfixable Monaco/Vitest internals that do not affect test correctness. Refs: #2046, #2078 * fix(dashboard): remove unused pixelmatch devDependency The pixelmatch package is no longer imported after the vitest.config.ts refactor removed the custom tolerantPixelmatch comparator. Knip correctly flags it as unused. * fix * upd * upd * format * lock * rm * fix * Create fluffy-gorillas-joke.md * Apply suggestion from @claude[bot] Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> * fix(@inkeep/agents-work-apps): mark `@slack/socket-mode` as `dependency` (#2951) * upd * upd * Apply suggestion from @dimaMachina * Apply suggestion from @dimaMachina * Create breezy-lemons-dream.md * Document MCP header forwarding in Visual Builder docs (#2956) * docs: add MCP header forwarding and fix header key casing examples * updated warnings in headers docs * updated warnings in mcp servers docs * In product copilot tutorial (#2957) * docs build updated api reference * tutorial done * implements pnpm minimumReleaseAge and upgrades pnpm to 10.33.0 (#2958) * implements pnpm minimumReleaseAge * upgrades pnpm to 10.16.0 * upgrades pnpm to 10.33.0 * ci: surface stable preview URLs in PRs (#2799) * ci: surface stable preview urls in PRs * fix: add temp file cleanup trap and paginate comment search - Add EXIT trap to clean up mktemp file - Paginate through all PR comments when searching for the existing marker comment, fixing duplicate-comment risk on PRs with 100+ comments Co-authored-by: Andrew Mikofalvy <[email protected]> Co-Authored-By: Claude Opus 4.6 <[email protected]> * ci: fix preview URL comment updates --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Andrew Mikofalvy <[email protected]> Co-authored-by: Claude Opus 4.6 <[email protected]> * feat: S3 presigned URLs for private media delivery (#2887) * feat: add S3 presigned URL support for private media delivery - Add optional getPresignedUrl() to BlobStorageProvider interface - Implement in S3BlobStorageProvider using @aws-sdk/s3-request-presigner - Make resolveMessageBlobUris() async with presigned URL first, manage proxy fallback for non-S3 backends (Option D hybrid) - Update both call sites (run + manage conversation routes) with await - Add presigned URL tests to s3-provider and resolve-blob-uris test suites - Include full spec with evidence files Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * docs: add S3 blob storage deployment guide Covers S3 setup, IAM permissions, env vars, S3-compatible services, storage backend priority, and presigned URL delivery flow. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * chore: add changeset for S3 presigned URL support Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * fix: add error handling for presigned URL failures with proxy fallback - Wrap getPresignedUrl() in try-catch so failures fall through to manage proxy URL instead of crashing the entire conversation response - Add test for presigned URL failure → proxy fallback path - Add mixed-content test with presigned URLs active - Fix doc icon quoting convention Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * fix: correct callout type and remove inaccurate configurable claim in docs Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * feat: make presigned URL expiry configurable via `BLOB_STORAGE_PRESIGNED_URL_EXPIRY_SECONDS` - Add `BLOB_STORAGE_PRESIGNED_URL_EXPIRY_SECONDS` to env.ts Zod schema (default 7200s / 2 hours, range 60–604800) - Replace hardcoded `DEFAULT_PRESIGNED_EXPIRY_SECONDS` constant in s3-provider.ts with env var lookup - Update tests to use env var in mocks and verify new default - Add env var to .env.example files and deployment docs * fix: address PR review comments - Clarify Vercel Blob is also a valid production backend (serves via proxy) - Add per-service S3-compatible path-style guidance (R2 vs B2 vs Spaces) - Make first resolve-blob-uris test explicitly set its mock (test isolation) Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * chore: reset lockfile from main to minimize resolution drift Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * fix: pin s3-request-presigner to match client-s3 to prevent lockfile drift Pin @aws-sdk/s3-request-presigner to 3.995.0 (same as resolved client-s3) to minimize pnpm-lock.yaml changes and prevent react version mismatch that caused agents-email test failures in CI. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * Resolve blob storage provider once per message list instead of per message Addresses PR feedback: call getBlobStorageProvider() once in resolveMessagesListBlobUris and pass the provider through to resolveMessageBlobUris, avoiding N singleton lookups per conversation retrieval. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * chore: reset lockfile from main and reinstall to fix CI Reset pnpm-lock.yaml from main per repo guidelines to prevent resolution drift that was causing monaco-editor ESM import failures in agents-manage-ui tests. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * Address remaining review suggestions: list-level presigned URL test and AWS CLI prerequisite - Add test for resolveMessagesListBlobUris with presigned URLs active across multiple messages, covering Promise.all handling - Add AWS CLI prerequisite note to S3 setup docs Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * Remove AWS CLI prerequisite note from S3 docs Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]> Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com> * ci: add preview janitor and recreate control (#2930) * ci: add preview state janitor and recreate path * ci: simplify preview janitor and var resolution * ci: address preview janitor review feedback * ci: gate preview auth on SpiceDB deployment readiness * ci: tighten preview bootstrap retry budget * ci: retry preview recreate after Railway delete * ci: clarify skipped preview workflow jobs * Rename headers in schema and usage to hyphen format (#2962) * Version Packages (#2952) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew Mikofalvy <[email protected]> * Update actions/setup-node and pnpm/action-setup to Node.js 24 versions (#2963) Upgrade actions/setup-node from v4 to v6.3.0 and pnpm/action-setup from v4 to v5.0.0 across all workflows to resolve the Node.js 20 deprecation warning. Node.js 20 actions will be forced to Node.js 24 starting June 2, 2026. https://claude.ai/code/session_01D5Ah1eAYvZCS2SfZ5Lopi3 Co-authored-by: Claude <[email protected]> * credential id reference added (#2967) * Add minimumReleaseAgeExclude for @inkeep/* packages (#2968) Excludes @inkeep scoped packages from the 1440-minute minimum release age gate so our own published packages can be installed immediately after release. https://claude.ai/code/session_01LBEnpfsjj6r4cdwXs2VeHx Co-authored-by: Claude <[email protected]> * add TooltipProvider * add back timeout * should fix tests * polish * fix * pnpm i * upd --------- Co-authored-by: Varun Varahabhotla <[email protected]> Co-authored-by: Claude Opus 4.6 <[email protected]> Co-authored-by: Varun Varahabhotla <[email protected]> Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> Co-authored-by: bryan-inkeep <[email protected]> Co-authored-by: Gaurav Varma <[email protected]> Co-authored-by: robert-inkeep <[email protected]> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Andrew Mikofalvy <[email protected]> Co-authored-by: Andrew Mikofalvy <[email protected]> Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com> Co-authored-by: inkeep-internal-ci[bot] <259778081+inkeep-internal-ci[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

implements pnpm minimumReleaseAge

93c1373

pullfrog Bot reviewed Apr 1, 2026

View reviewed changes

vercel Bot deployed to Preview – agents-docs April 1, 2026 18:43 View deployment

vercel Bot deployed to Preview – agents-api April 1, 2026 18:44 View deployment

vercel Bot deployed to Preview – agents-manage-ui April 1, 2026 18:44 View deployment

claude Bot reviewed Apr 1, 2026

View reviewed changes

github-actions Bot deleted a comment from claude Bot Apr 1, 2026

upgrades pnpm to 10.16.0

038c963

vercel Bot deployed to Preview – agents-manage-ui April 1, 2026 18:49 View deployment

claude Bot reviewed Apr 1, 2026

View reviewed changes

vercel Bot deployed to Preview – agents-docs April 1, 2026 18:50 View deployment

github-actions Bot deleted a comment from claude Bot Apr 1, 2026

vercel Bot deployed to Preview – agents-api April 1, 2026 18:52 View deployment

upgrades pnpm to 10.33.0

31709bd

vercel Bot deployed to Preview – agents-manage-ui April 1, 2026 19:02 View deployment

vercel Bot deployed to Preview – agents-api April 1, 2026 19:04 View deployment

claude Bot reviewed Apr 1, 2026

View reviewed changes

vercel Bot deployed to Preview – agents-docs April 1, 2026 19:04 View deployment

github-actions Bot deleted a comment from claude Bot Apr 1, 2026

robert-inkeep changed the title ~~implements pnpm minimumReleaseAge~~ implements pnpm minimumReleaseAge and upgrades pnpm to 10.33.0 Apr 1, 2026

robert-inkeep added this pull request to the merge queue Apr 1, 2026

Merged via the queue into main with commit 12306f0 Apr 1, 2026
26 checks passed

robert-inkeep deleted the pnpm-min-release branch April 1, 2026 19:25

dimaMachina pushed a commit that referenced this pull request Apr 2, 2026

implements pnpm minimumReleaseAge and upgrades pnpm to 10.33.0 (#2958)

e27dbc9

* implements pnpm minimumReleaseAge * upgrades pnpm to 10.16.0 * upgrades pnpm to 10.33.0

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

implements pnpm minimumReleaseAge and upgrades pnpm to 10.33.0#2958

implements pnpm minimumReleaseAge and upgrades pnpm to 10.33.0#2958
robert-inkeep merged 3 commits intomainfrom
pnpm-min-release

robert-inkeep commented Apr 1, 2026

Uh oh!

vercel Bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

pullfrog Bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

pullfrog Bot left a comment

Uh oh!

pullfrog Bot Apr 1, 2026

Uh oh!

claude Bot left a comment

Uh oh!

socket-security Bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

claude Bot left a comment

Uh oh!

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

robert-inkeep commented Apr 1, 2026

Uh oh!

vercel Bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

pullfrog Bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Key changes

pnpm 10.10.0 → 10.33.0

minimumReleaseAge supply-chain gate

Template dependency bumps

Uh oh!

pullfrog Bot left a comment

Choose a reason for hiding this comment

Uh oh!

pullfrog Bot Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

PR Review Summary

What This Does

Considerations

✅ APPROVE

Uh oh!

socket-security Bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

PR Review Summary

Delta Review Scope

Assessment

Considerations

✅ APPROVE

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

PR Review Summary

Delta Review Scope

Assessment

💭 Consider (1)

✅ APPROVE

Uh oh!

Uh oh!

github-actions Bot commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Apr 1, 2026 •

edited

Loading

changeset-bot Bot commented Apr 1, 2026 •

edited

Loading

pullfrog Bot commented Apr 1, 2026 •

edited

Loading

`minimumReleaseAge` supply-chain gate

socket-security Bot commented Apr 1, 2026 •

edited

Loading

socket-security Bot commented Apr 1, 2026 •

edited

Loading