pnpm 11 no longer reads the `pnpm` field from package.json, renamed
`onlyBuiltDependencies` to `allowBuilds`, and defaults `strictDepBuilds`
to true. It also reads non-auth/registry settings (like
`public-hoist-pattern`) from pnpm-workspace.yaml rather than .npmrc.
This does what renovate PR #3069 could not: alongside the version bump
it moves the build/override/hoist config for both pnpm projects
(frontend/ and desktop/) into a per-project pnpm-workspace.yaml, so the
settings are actually honored under pnpm 11 instead of being silently
ignored (which made #3069 hard-fail with ERR_PNPM_IGNORED_BUILDS).
- frontend/desktop package.json: drop `pnpm` field, bump packageManager
to pnpm@11.9.0
- frontend/pnpm-workspace.yaml: allowBuilds + overrides + publicHoistPattern
- desktop/pnpm-workspace.yaml: allowBuilds + overrides
- frontend/.npmrc removed (its only setting moved to publicHoistPattern)
- mise.toml: pnpm 10.34.4 -> 11.9.0
electron-winstaller is a transitive build script that was never in the
old onlyBuiltDependencies, so it was ignored under pnpm 10; it is
explicitly denied (allowBuilds: false) to keep behavior identical while
satisfying strictDepBuilds.
Claude-Session: https://claude.ai/code/session_01AHD9BmNcUfgBZdPveZRa8z
Bumps vite 7.3.6 -> 8.1.0 (Rolldown-based), split out of the bundled
renovate PR #3046.
Rolldown does not elide a type-only import that is referenced purely as
a type, so `RouteLocationRaw` in Notifications.vue must be imported with
`type` to keep it out of the runtime bundle.
vite 8 is not coupled to the other major bumps: vitest 4 and all vite
plugins already accept vite ^8, and @sentry/vite-plugin declares no vite
peer dependency.
Claude-Session: https://claude.ai/code/session_01AHD9BmNcUfgBZdPveZRa8z
Bump typescript from 5.9.3 to 6.0.3.
TS 6 changes that required source fixes:
- baseUrl is deprecated and now a hard error (TS5101). Dropped the unused
baseUrl from tsconfig.app.json; the @/* paths are relative and resolve
without it (tsconfig.vitest.json inherits this).
- vite.config.ts referenced ImportMetaEnv for getSentryConfig's parameter,
but it is only ever called with loadEnv()'s Record<string, string>. Typed
the parameter accordingly, matching its caller and the other config helpers.
Claude-Session: https://claude.ai/code/session_01AHD9BmNcUfgBZdPveZRa8z
Bumps independent dev-dependency majors split out of the bundled
renovate PR #3046:
- otplib 12.0.1 -> 13.4.1 (v13 is a rewrite: the `authenticator`
singleton was removed in favour of the functional API; the only
consumer is the TOTP e2e test, migrated to `await generate({secret})`)
- rollup-plugin-visualizer 6.0.11 -> 7.0.1
- stylelint-config-property-sort-order-smacss 10.0.0 -> 11.2.0
- @sentry/vite-plugin 3.6.1 -> 5.3.0 (no peer-dep coupling to vite)
Claude-Session: https://claude.ai/code/session_01AHD9BmNcUfgBZdPveZRa8z
Bumps eslint 9.39.4 -> 10.6.0, split out of the bundled renovate
PR #3046. eslint 10 no longer ships `@eslint/js` transitively, so it is
added as a direct devDependency (the flat config imports it for
`js.configs.recommended`).
eslint 10's expanded recommended set flags ten new errors, fixed here:
no-useless-assignment (dead initializer overwritten before any read):
- FilterAutocomplete.ts, UserTeam.vue, helpers/filters.ts,
parseSubtasksViaIndention.ts, models/notification.ts,
quickAddMagic/dateParser.ts (x2), quickAddMagic/repeatParser.ts
preserve-caught-error:
- stores/auth.ts verifyEmail() now attaches the caught error as `cause`
- stores/auth.ts refreshUserInfo() keeps its existing `{e, message}`
cause shape (read by message/index.ts as `cause.message`); the rule
is disabled inline there since changing the shape is a behaviour change
Claude-Session: https://claude.ai/code/session_01AHD9BmNcUfgBZdPveZRa8z
