chore: upgrade pnpm from 9 to 11

[skwowet]

Summary

Upgrade the workspace from pnpm 9 to pnpm 11, following pnpm's recommended setup: one version pin, workspace settings in pnpm-workspace.yaml, packages declaring the tools they run, and pnpm/setup for GitHub Actions.

pnpm 11 also tightens install security. Dependency postinstall scripts are blocked unless we list them in allowBuilds. Transitive git/tarball dependencies are blocked by default.

What changed

• Pin pnpm 11.22.0 via root packageManager only. Nested pins on backend/ and services/ (which had drifted) are gone.
• Pin Node 24 for pnpm itself with devEngines.runtime so Corepack, CI (pnpm/setup@v2), and Docker all read the same files.
• Move pnpm 11 settings into pnpm-workspace.yaml:
  • catalog — one version list for shared deps (typescript, @types/node, tsx, eslint, prettier, Temporal SDK, axios, config, pg-promise). Packages use "catalog:" instead of copy-pasted ranges.
  • allowBuilds — explicit yes/no for packages that run install scripts (replaces the old onlyBuilt/neverBuilt lists).
• Packages that run eslint / prettier / tsx now declare those deps and call the local binary. npx is gone so we do not pick up a random version from the registry.
• CI uses pnpm/setup@v2 as pnpm documents for GitHub Actions (installs pnpm + Node and runs install). Docker copies root package.json so Corepack gets the same pnpm version, uses pnpm fetch then pnpm i --frozen-lockfile, and sets verifyDepsBeforeRun=false only on the runner image (pnpm 11 would otherwise try to reinstall before pnpm run start).

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[Copilot]

Pull request overview

Upgrades the server workspace to pnpm 11, centralizes dependency versions, and aligns CI and Docker installations.

Changes:

• Pins pnpm 11.22.0 and Node 24.
• Introduces dependency catalogs and explicit build permissions.
• Uses package-local tooling and unified CI/Docker setup.

Blocking findings:

• Docker runner images use an ignored camelCase pnpm environment variable; it must be pnpm_config_verify_deps_before_run.
• The PR title lacks the required trailing JIRA key.

Reviewed changes

Copilot reviewed 85 out of 86 changed files in this pull request and generated 26 comments.

Show a summary per file

File	Description
package.json	Pins pnpm and Node runtime.
pnpm-workspace.yaml	Adds catalogs and build permissions.
pnpm-lock.yaml	Regenerates pnpm 11 resolutions.
backend/package.json	Adopts catalogs and local binaries.
backend/.prettierrc.cjs	Resolves the Prettier plugin explicitly.
services/package.json	Removes nested pnpm pin; catalogs tools.
services/.prettierrc.cjs	Resolves the Prettier plugin explicitly.
services/libs/types/package.json	Uses local cataloged tooling.
services/libs/test-kit/package.json	Catalogs tooling and pg-promise.
services/libs/temporal/package.json	Catalogs Temporal and tooling dependencies.
services/libs/telemetry/package.json	Uses local cataloged tooling.
services/libs/snowflake/package.json	Catalogs TypeScript tooling.
services/libs/slack/package.json	Uses local cataloged tooling.
services/libs/redis/package.json	Uses local cataloged tooling.
services/libs/queue/package.json	Uses local cataloged tooling.
services/libs/opensearch/package.json	Catalogs tooling and Axios.
services/libs/nango/package.json	Catalogs tooling and Axios.
services/libs/logging/package.json	Uses local cataloged tooling.
services/libs/integrations/package.json	Catalogs tooling and Axios.
services/libs/database/package.json	Catalogs shared database dependencies.
services/libs/data-access-layer/package.json	Catalogs tooling and pg-promise.
services/libs/common/package.json	Catalogs tooling and config.
services/libs/common_services/package.json	Catalogs tooling and Axios.
services/libs/audit-logs/package.json	Uses local cataloged tooling.
services/libs/anthropic-aws/package.json	Uses local cataloged tooling.
services/archetypes/worker/package.json	Catalogs Temporal and tooling dependencies.
services/archetypes/standard/package.json	Catalogs tooling and pg-promise.
services/archetypes/consumer/package.json	Uses local cataloged tooling.
services/apps/webhook_api/package.json	Catalogs runtime and development tooling.
services/apps/temporal_codec_server/package.json	Catalogs Temporal and tooling dependencies.
services/apps/template_worker/package.json	Catalogs Temporal and tooling dependencies.
services/apps/template_consumer/package.json	Catalogs runtime and development tooling.
services/apps/snowflake_connectors/package.json	Catalogs Temporal and tooling dependencies.
services/apps/security_best_practices_worker/package.json	Catalogs shared runtime dependencies.
services/apps/search_sync_worker/package.json	Catalogs runtime and development tooling.
services/apps/search_sync_api/package.json	Catalogs runtime and development tooling.
services/apps/script_executor_worker/package.json	Removes npx and catalogs dependencies.
services/apps/projects_evaluation_worker/package.json	Catalogs Temporal and tooling dependencies.
services/apps/profiles_worker/package.json	Catalogs shared runtime dependencies.
services/apps/pcc_sync_worker/package.json	Catalogs Temporal and tooling dependencies.
services/apps/packages_worker/package.json	Catalogs shared worker dependencies.
services/apps/organizations_enrichment_worker/package.json	Catalogs shared runtime dependencies.
services/apps/nango_worker/package.json	Catalogs Temporal and tooling dependencies.
services/apps/nango_webhook_api/package.json	Catalogs runtime and development tooling.
services/apps/merge_suggestions_worker/package.json	Catalogs shared runtime dependencies.
services/apps/members_enrichment_worker/package.json	Catalogs shared runtime dependencies.
services/apps/kafka_connect_monitor/package.json	Catalogs runtime and development tooling.
services/apps/integration_stream_worker/package.json	Catalogs runtime and development tooling.
services/apps/integration_run_worker/package.json	Catalogs shared runtime dependencies.
services/apps/exports_worker/package.json	Catalogs Temporal and tooling dependencies.
services/apps/entity_merging_worker/package.json	Catalogs Temporal and tooling dependencies.
services/apps/data_sink_worker/package.json	Catalogs runtime and development tooling.
services/apps/cron_service/package.json	Catalogs runtime and development tooling.
services/apps/categorization_worker/package.json	Catalogs Temporal and tooling dependencies.
services/apps/cache_worker/package.json	Catalogs Temporal and tooling dependencies.
services/apps/automatic_projects_discovery_worker/package.json	Catalogs Temporal and tooling dependencies.
.github/workflows/server-tests.yml	Uses combined pnpm/Node setup.
.github/workflows/backend-lint.yaml	Uses combined pnpm/Node setup.
.github/actions/node/package.json	Catalogs Node and TypeScript versions.
scripts/services/docker/Dockerfile.backend	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.packages	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.webhook_api	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.snowflake_connectors_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.security_best_practices_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.search_sync_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.search_sync_api	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.script_executor_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.script_executor	Uses root pnpm pin.
scripts/services/docker/Dockerfile.projects_evaluation_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.profiles_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.pcc_sync_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.organizations_enrichment_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.nango_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.nango_webhook_api	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.merge_suggestions_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.members_enrichment_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.kafka_connect_monitor	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.integration_stream_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.integration_run_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.exports_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.entity_merging_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.data_sink_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.cron_service	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.categorization_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.cache_worker	Uses root pnpm pin; override is malformed.
scripts/services/docker/Dockerfile.automatic_projects_discovery_worker	Uses root pnpm pin; override is malformed.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 85 out of 86 changed files in this pull request and generated no new comments.

Suppressed comments (26)

scripts/services/docker/Dockerfile.merge_suggestions_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.cache_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.script_executor_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.backend:15

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.kafka_connect_monitor:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.search_sync_api:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.
  scripts/services/docker/Dockerfile.categorization_worker:16
• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.data_sink_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.search_sync_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.
  scripts/services/docker/Dockerfile.integration_run_worker:16
• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.nango_webhook_api:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.exports_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.profiles_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.projects_evaluation_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.nango_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.entity_merging_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.snowflake_connectors_worker:18

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.
  scripts/services/docker/Dockerfile.automatic_projects_discovery_worker:16
• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.integration_stream_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.security_best_practices_worker:46

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.
  scripts/services/docker/Dockerfile.webhook_api:16
• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.
  scripts/services/docker/Dockerfile.members_enrichment_worker:16
• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.pcc_sync_worker:18

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.packages:19

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.cron_service:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

scripts/services/docker/Dockerfile.organizations_enrichment_worker:16

• This camelCase environment key is ignored by pnpm 11.22, whose config reader checks pnpm_config_verify_deps_before_run. The default install behavior therefore remains active and can trigger a failing reinstall in this runner, which does not contain the workspace or lockfile.

ENV pnpm_config_verifyDepsBeforeRun=false

[Copilot]

Pull request overview

Copilot reviewed 85 out of 86 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 90 out of 92 changed files in this pull request and generated no new comments.

[ulemons]

@skwowet great job !

[Copilot]

Pull request overview

Copilot reviewed 90 out of 92 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 90 out of 92 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

package.json:20

• The PR description says Node 24 is centralized in devEngines.runtime, but this manifest only updates packageManager; engines.node still allows every Node release from 24 onward. Consequently pnpm/Corepack cannot enforce or download the intended Node 24 runtime from the shared manifest. Add the runtime declaration (and then let pnpm/setup consume it), or revise the stated setup.

  "packageManager": "pnpm@11.22.0+sha512.1ff870c4c6133dfd88fb2afc46dd13d47f09c9794b438c6fdb47ca98caf3bc16381ee0be93a091b8e3824cf01f889f46d7d9e20910fb0be1ab0fb5baa80dd621"

[Copilot]

Pull request overview

Copilot reviewed 90 out of 92 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

package.json:20

• The described Node 24 runtime pin is missing. engines.node only rejects older versions and still permits Node 25+, while CI and Docker hard-code Node 24 independently; local pnpm therefore has no devEngines.runtime source to enforce/download the intended runtime. Add the stated runtime declaration (then CI can omit its duplicate runtime input), or correct the PR description.

  "packageManager": "pnpm@11.22.0+sha512.1ff870c4c6133dfd88fb2afc46dd13d47f09c9794b438c6fdb47ca98caf3bc16381ee0be93a091b8e3824cf01f889f46d7d9e20910fb0be1ab0fb5baa80dd621"

[Copilot]

Pull request overview

Copilot reviewed 90 out of 92 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

package.json:20

• The PR says Node 24 is pinned through devEngines.runtime, but this manifest still only has engines.node: ">=24.0.0". That range permits later majors and does not make pnpm resolve/download a Node 24 runtime, so local pnpm and pnpm/setup cannot derive the promised runtime pin from the repository. Add a Node 24 devEngines.runtime entry and regenerate the lockfile.

  "packageManager": "pnpm@11.22.0+sha512.1ff870c4c6133dfd88fb2afc46dd13d47f09c9794b438c6fdb47ca98caf3bc16381ee0be93a091b8e3824cf01f889f46d7d9e20910fb0be1ab0fb5baa80dd621"

[Copilot]

Pull request overview

Copilot reviewed 90 out of 92 changed files in this pull request and generated 2 comments.