Bump pnpm to v11 and ignore unfixable quick-xml advisories

[ScriptSmith]

pnpm 9 → 11

• All pnpm/action-setup steps in CI now use version: 11, and ui/, docs/, and deploy/tests pin "packageManager": "pnpm@11.9.0" so local pnpm (10+) self-switches to the same version.
• pnpm 11 no longer reads the "pnpm" field in package.json, so the ui security overrides and auditConfig.ignoreCves moved to ui/pnpm-workspace.yaml. Without this migration the overrides would silently stop applying and the CI pnpm audit job would fail on the two ignored CVEs.
• pnpm 11 blocks dependency build scripts by default. Each package root gets an allowBuilds list preserving pnpm 9 behavior: @modelcontextprotocol/ext-apps/esbuild/msw (ui), esbuild/sharp/unrs-resolver (docs), cpu-features/esbuild/protobufjs/ssh2 (e2e tests).
• Lockfiles are unchanged: pnpm 11.9.0 accepts the existing lockfileVersion: 9.0 files in frozen mode.

Verified locally with pnpm 11.9.0: CI=true pnpm install (frozen) in all three roots, pnpm audit --audit-level=high exits 0 in ui (migrated ignoreCves honored), and pnpm build in ui succeeds.

cargo audit blockers

cargo audit (and cargo deny check advisories) fail on RUSTSEC-2026-0194 and RUSTSEC-2026-0195: quick-xml < 0.41 DoS advisories (quadratic duplicate-attribute check, unbounded namespace-declaration allocation), published 2026-06-29 and fixed only in quick-xml 0.41.0.

There is no upgrade path yet — every dependent pins an older series and is already at its latest release:

• quick-xml 0.37.5 via samael ^0.37.2 (SAML SSO; latest is 0.0.21 and git master still pins 0.37)
• quick-xml 0.39.2 via calamine ^0.39 (latest is 0.35.0)
• quick-xml 0.40.1 via xberg 1.0.0-rc.1 / pdf_oxide / office_oxide ^0.40 (all latest)

Both advisories are ignored in .cargo/audit.toml and deny.toml with comments noting they are DoS-only (no memory unsafety) and should be dropped as soon as upstream releases pick up quick-xml 0.41. Verified cargo audit and cargo deny check advisories both pass.

Drive-by fix

scripts/vendor-wasm.mjs claims its outputs are "gitignored via ui/public/wasm/.gitignore", but that file didn't exist, so running a ui build left ~30 vendored pyodide/duckdb artifacts ready to be swept into a commit. Added the missing .gitignore.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR migrates the JavaScript toolchain from pnpm 9 to pnpm 11 across all three package roots (ui/, docs/, deploy/tests/) and bumps every GitHub Actions step to current major versions. It also suppresses two newly-published quick-xml DoS advisories (RUSTSEC-2026-0194/0195) in both cargo audit and cargo deny with documented rationale, and adds a drive-by fix for a missing ui/public/wasm/.gitignore.

• pnpm 11 config migration: overrides, auditConfig.ignoreGhsas (correctly using GHSA IDs), and allowBuilds (new pnpm 11 requirement for native dep build scripts) are moved from package.json's "pnpm" field into per-root pnpm-workspace.yaml files; the Dockerfile is updated to copy these new files for layer-caching correctness.
• Cargo advisory ignores: RUSTSEC-2026-0194 and -0195 are acknowledged as DoS-only with thorough provenance comments (three dependency chains, no upgrade path yet) and mirrored in both audit.toml and deny.toml.
• Drive-by fixes: A Dropdown focus-stealing bug on mount (itemIndex >= 0 guard) and the missing wasm .gitignore are resolved.

Confidence Score: 5/5

Safe to merge — the pnpm 11 migration is complete and consistent across all three package roots, CI, and the Dockerfile, with no configuration left in the deprecated package.json pnpm field.

Every changed file is mechanical tooling configuration (action version bumps, pnpm workspace settings, advisory ignores with documented rationale). The overrides and auditConfig settings are faithfully preserved in their new locations, allowBuilds covers the same native deps pnpm 9 built by default, and the quick-xml advisory ignores are temporary and well-commented. The drive-by Dropdown and gitignore fixes are small and correct.

No files require special attention.

Important Files Changed

Filename	Overview
ui/pnpm-workspace.yaml	New file containing settings migrated from package.json pnpm field; correctly uses ignoreGhsas with GHSA identifiers, proper overrides, and allowBuilds for native deps.
.github/workflows/ci.yml	Bumps all GitHub Actions versions and pnpm from 9 to 11, Node from 20 to 24 consistently across all jobs.
ui/package.json	Removes the pnpm field (overrides/auditConfig now in pnpm-workspace.yaml), adds packageManager: pnpm@11.9.0; migration is complete and correct.
Dockerfile	Bumps corepack pnpm to 11.9.0 and copies pnpm-workspace.yaml alongside package.json for both ui/ and docs/ so overrides and allowBuilds apply during Docker layer-cached installs.
.cargo/audit.toml	Adds ignores for RUSTSEC-2026-0194/0195 (quick-xml DoS) with detailed provenance comments; well-reasoned given no upstream fix path yet.
deny.toml	Mirrors the cargo/audit.toml quick-xml ignores with matching rationale comments.
ui/src/components/Dropdown/Dropdown.tsx	Adds itemIndex >= 0 guard to prevent every unregistered DropdownItem from stealing focus on mount when both itemIndex and highlightedIndex default to -1.
ui/public/wasm/.gitignore	Adds missing .gitignore (* / !.gitignore) to prevent pyodide/duckdb wasm artifacts from being accidentally committed after a local pnpm build.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[pnpm 11 reads\npnpm-workspace.yaml] --> B{Per-root\npnpm-workspace.yaml}
    B --> C[ui/pnpm-workspace.yaml\noverrides + auditConfig.ignoreGhsas\n+ allowBuilds: ext-apps, esbuild, msw]
    B --> D[docs/pnpm-workspace.yaml\nallowBuilds: esbuild, sharp, unrs-resolver]
    B --> E[deploy/tests/pnpm-workspace.yaml\nallowBuilds: cpu-features, esbuild,\nprotobufjs, ssh2]

    F[pnpm 11 ignores\npackage.json pnpm field] --> G[ui/package.json\nremoved: overrides + auditConfig.ignoreCves]
    G --> C

    H[Dockerfile] --> I[COPY pnpm-workspace.yaml\nalongside package.json\nfor ui/ and docs/]

    J[cargo audit / cargo deny] --> K[.cargo/audit.toml + deny.toml\nignore RUSTSEC-2026-0194\nignore RUSTSEC-2026-0195]
    K --> L[quick-xml DoS\nDoS-only, no fix path yet\nsamael + calamine + xberg]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[pnpm 11 reads\npnpm-workspace.yaml] --> B{Per-root\npnpm-workspace.yaml}
    B --> C[ui/pnpm-workspace.yaml\noverrides + auditConfig.ignoreGhsas\n+ allowBuilds: ext-apps, esbuild, msw]
    B --> D[docs/pnpm-workspace.yaml\nallowBuilds: esbuild, sharp, unrs-resolver]
    B --> E[deploy/tests/pnpm-workspace.yaml\nallowBuilds: cpu-features, esbuild,\nprotobufjs, ssh2]

    F[pnpm 11 ignores\npackage.json pnpm field] --> G[ui/package.json\nremoved: overrides + auditConfig.ignoreCves]
    G --> C

    H[Dockerfile] --> I[COPY pnpm-workspace.yaml\nalongside package.json\nfor ui/ and docs/]

    J[cargo audit / cargo deny] --> K[.cargo/audit.toml + deny.toml\nignore RUSTSEC-2026-0194\nignore RUSTSEC-2026-0195]
    K --> L[quick-xml DoS\nDoS-only, no fix path yet\nsamael + calamine + xberg]

Loading

_{Reviews (5): Last reviewed commit: "Fix dropdown" | Re-trigger Greptile}

[ScriptSmith]

@greptile-apps

[ScriptSmith]

@greptile-apps