chore: upgrade pnpm 9 → 11 with supply-chain protection

.github/workflows/ci.yml

@@ -20,13 +20,11 @@ jobs:
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
-        with:
-          version: 9.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 22
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -44,13 +42,11 @@ jobs:
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
-        with:
-          version: 9.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 22
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -70,13 +66,11 @@ jobs:
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
-        with:
-          version: 9.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 22
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -136,13 +130,11 @@ jobs:
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
-        with:
-          version: 9.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 22
           cache: 'pnpm'
 
       - name: Install dependencies

.github/workflows/release.yml

@@ -26,8 +26,6 @@ jobs:
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
-        with:
-          version: 9.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6

.github/workflows/storybook.yml

@@ -20,12 +20,10 @@ jobs:
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
-        with:
-          version: 9.0.0
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 22
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.npmrc

@@ -1,4 +1,3 @@
-# Better configuration than shamefully-hoist
 auto-install-peers=true
 strict-peer-dependencies=false
 public-hoist-pattern[]=*eslint*

AGENTS.md

@@ -8,8 +8,8 @@
   - `@youversion/platform-react-ui` (UI components)
 - Language: TypeScript
 - Test runner: Vitest
-- Node: >= 20.0.0
-- Package manager: pnpm >= 9.0.0 (no npm/yarn)
+- Node: >= 22.0.0
+- Package manager: pnpm >= 11.0.0 (no npm/yarn)
 
 ## WHERE TO MAKE CHANGES
 
@@ -49,7 +49,7 @@ tools/         Shared configs (TS, ESLint)
 
 ```bash
 # Setup
-pnpm install              # Requires pnpm >= 9.0.0, Node >= 20.0.0
+pnpm install              # Requires pnpm >= 11.0.0, Node >= 22.0.0
 
 # Build
 pnpm build               # Turbo builds all in dependency order
@@ -119,9 +119,11 @@ pnpm --filter @youversion/platform-react-ui build
 - Pre-commit hooks fail if typecheck or lint fails
 
 ### Environment
-- **Node.js requirement**: Minimum version 20.0.0 required
-- **React version**: Do not change React dependencies; pnpm overrides enforce 19.1.2
+- **Node.js requirement**: Minimum version 22.0.0 required (pnpm 11 requires Node >= 22.13)
+- **React version**: Do not change React dependencies; pnpm overrides (in `pnpm-workspace.yaml`) enforce 19.1.2
 - **Package manager**: Do not use npm/yarn; only pnpm supported
+- **Supply-chain protection**: `minimumReleaseAge: 4320` (3-day cooldown) in `pnpm-workspace.yaml` — `pnpm install` will reject packages published < 3 days ago. Override with `--force` if needed urgently. Workspace packages (`workspace:*`) are inherently excluded as they aren't fetched from the registry.
+- **pnpm 11 breaking changes**: Overrides moved from `package.json` → `pnpm-workspace.yaml`; build scripts require `allowBuilds` approval; `@internal/eslint-config` and `eslint-plugin-storybook` must be root devDependencies for resolution
 
 ### Package Boundaries (FOR AGENTS)
 - **Core must remain React-free** – do not import React or DOM APIs in `packages/core`
@@ -139,8 +141,8 @@ pnpm --filter @youversion/platform-react-ui build
 ❌ Don't assume shared source directory (each package self-contained)
 ❌ Don't use API Extractor (listed but not actually used)
 ❌ Don't expect consistent build tools (core: tsup, hooks: tsc only, ui: tsup + tsc)
-❌ Don't modify React version (exact 19.1.2 enforced via pnpm overrides)
-❌ Don't use npm/yarn (only pnpm >= 9.0.0 supported)
+❌ Don't modify React version (exact 19.1.2 enforced via pnpm overrides in `pnpm-workspace.yaml`)
+❌ Don't use npm/yarn (only pnpm >= 11.0.0 supported)
 ❌ Don't break unified versioning (all packages versioned together)
 
 ## MORE DETAIL PER PACKAGE

package.json

@@ -2,10 +2,10 @@
   "name": "youversion-sdk-monorepo",
   "private": true,
   "type": "module",
-  "packageManager": "pnpm@9.0.0",
+  "packageManager": "pnpm@11.1.1+sha512.d1fdf5f73c617b64fa1a56a81c3c8dfe0e966e33a6010aa256b517ae77be21d93e05affc0de1a83b0e4f29d569f68b446ae8f068cd7247c0bb3df0fb4d7bdf9a",
   "engines": {
-    "node": ">=20.0.0",
-    "pnpm": ">=9.0.0"
+    "node": ">=22.0.0",
+    "pnpm": ">=11.0.0"
   },
   "workspaces": [
     "packages/*"
@@ -36,10 +36,12 @@
   },
   "devDependencies": {
     "@changesets/cli": "2.29.7",
+    "@internal/eslint-config": "workspace:*",
     "@eslint/eslintrc": "3.3.1",
     "@microsoft/api-extractor": "7.53.1",
     "@types/node": "24.9.1",
     "eslint": "9.38.0",
+    "eslint-plugin-storybook": "10.3.5",
     "husky": "9.1.7",
     "knip": "5.66.3",
     "lint-staged": "16.2.5",
@@ -49,14 +51,5 @@
     "tsup": "8.5.0",
     "turbo": "2.5.8",
     "typescript": "5.9.3"
-  },
-  "pnpm": {
-    "overrides": {
-      "react": "19.1.2",
-      "react-dom": "19.1.2",
-      "@types/react": "19.1.2",
-      "@types/react-dom": "19.1.2",
-      "vite": ">=5.4.21"
-    }
   }
 }