chore: upgrade pnpm to 10.33.2 with security hardening

.github/workflows/changesets-pr.yml

@@ -88,7 +88,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: Setup node
         uses: buildjet/setup-node@v4

.github/workflows/claude.yml

@@ -33,7 +33,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4

.github/workflows/e2e-webapp.yml

@@ -48,7 +48,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4

.github/workflows/e2e.yml

@@ -31,7 +31,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
@@ -48,7 +48,7 @@ jobs:
         run: pnpm run build --filter trigger.dev^...
 
       - name: 🔧 Build worker template files
-        run: pnpm --filter trigger.dev run build:workers
+        run: pnpm --filter trigger.dev run --if-present build:workers
 
       - name: Enable corepack
         run: corepack enable

.github/workflows/release.yml

@@ -81,7 +81,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: Setup node
         uses: buildjet/setup-node@v4
@@ -250,7 +250,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: Setup node
         uses: buildjet/setup-node@v4

.github/workflows/sdk-compat.yml

@@ -25,7 +25,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
@@ -63,7 +63,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
@@ -104,7 +104,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
@@ -149,7 +149,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4

.github/workflows/typecheck.yml

@@ -19,7 +19,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4

.github/workflows/unit-tests-internal.yml

@@ -53,7 +53,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
@@ -122,7 +122,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4

.github/workflows/unit-tests-packages.yml

@@ -53,7 +53,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
@@ -122,7 +122,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4

.github/workflows/unit-tests-webapp.yml

@@ -53,7 +53,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
@@ -130,7 +130,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 10.23.0
+          version: 10.33.2
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4

AGENTS.md

@@ -13,7 +13,7 @@ This repository is a pnpm monorepo managed with Turbo. It contains multiple apps
 See `ai/references/repo.md` for a more complete explanation of the workspaces.
 
 ## Development setup
-1. Install dependencies with `pnpm i` (pnpm `10.23.0` and Node.js `20.20.0` are required).
+1. Install dependencies with `pnpm i` (pnpm `10.33.2` and Node.js `20.20.0` are required).
 2. Copy `.env.example` to `.env` and generate a random 16 byte hex string for `ENCRYPTION_KEY` (`openssl rand -hex 16`). Update other secrets if needed.
 3. Start the local services with Docker:
    ```bash

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code when working with this repository. Su
 
 ## Build and Development Commands
 
-This is a pnpm 10.23.0 monorepo using Turborepo. Run commands from root with `pnpm run`.
+This is a pnpm 10.33.2 monorepo using Turborepo. Run commands from root with `pnpm run`.
 
 ```bash
 pnpm run docker              # Start Docker services (PostgreSQL, Redis, Electric)

CONTRIBUTING.md

@@ -30,7 +30,7 @@ branch are tagged into a release periodically.
 ### Prerequisites
 
 - [Node.js](https://nodejs.org/en) version 20.20.0
-- [pnpm package manager](https://pnpm.io/installation) version 10.23.0
+- [pnpm package manager](https://pnpm.io/installation) version 10.33.2
 - [Docker](https://www.docker.com/get-started/)
 - [protobuf](https://github.com/protocolbuffers/protobuf)
 
@@ -51,7 +51,7 @@ branch are tagged into a release periodically.
    ```
 3. Ensure you are on the correct version of Node.js (20.20.0). If you are using `nvm`, there is an `.nvmrc` file that will automatically select the correct version of Node.js when you navigate to the repository.
 
-4. Run `corepack enable` to use the correct version of pnpm (`10.23.0`) as specified in the root `package.json` file.
+4. Run `corepack enable` to use the correct version of pnpm (`10.33.2`) as specified in the root `package.json` file.
 
 5. Install the required packages using pnpm.
    ```

ai/references/repo.md

@@ -1,6 +1,6 @@
 ## Repo Overview
 
-This is a pnpm 10.23.0 monorepo that uses turborepo @turbo.json. The following workspaces are relevant
+This is a pnpm 10.33.2 monorepo that uses turborepo @turbo.json. The following workspaces are relevant
 
 ## Apps
 

apps/supervisor/Containerfile

@@ -16,7 +16,7 @@ COPY --from=pruner --chown=node:node /app/out/json/ .
 COPY --from=pruner --chown=node:node /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
 COPY --from=pruner --chown=node:node /app/out/pnpm-workspace.yaml ./pnpm-workspace.yaml
 
-RUN corepack enable && corepack prepare pnpm@10.23.0 --activate
+RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
 
 FROM base AS deps-fetcher
 RUN apk add --no-cache python3-dev py3-setuptools make g++ gcc linux-headers

docker/Dockerfile

@@ -25,7 +25,7 @@ COPY --chown=node:node patches ./patches
 FROM base AS dev-deps
 WORKDIR /triggerdotdev
 # Corepack is used to install pnpm with the exact version from packageManager
-RUN corepack enable && corepack prepare pnpm@10.23.0 --activate
+RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
 ENV NODE_ENV=development
 RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --no-frozen-lockfile
 # Generate Prisma client here where all deps are installed
@@ -36,7 +36,7 @@ RUN pnpx prisma@6.14.0 generate --schema /triggerdotdev/internal-packages/databa
 FROM base AS production-deps
 WORKDIR /triggerdotdev
 # Corepack is used to install pnpm with the exact version from packageManager
-RUN corepack enable && corepack prepare pnpm@10.23.0 --activate
+RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
 ENV NODE_ENV=production
 RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --prod --no-frozen-lockfile
 
@@ -46,7 +46,7 @@ FROM base AS builder
 RUN apt-get update && apt-get install -y openssl dumb-init ca-certificates
 WORKDIR /triggerdotdev
 # Corepack is used to install pnpm with the exact version from packageManager
-RUN corepack enable && corepack prepare pnpm@10.23.0 --activate
+RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
 
 ARG SENTRY_RELEASE
 ARG SENTRY_ORG
@@ -106,11 +106,11 @@ ENV BUILD_APP_VERSION=${BUILD_APP_VERSION} \
 EXPOSE 3000
 
 # Add global pnpm shims and install pnpm during build (root user)
-RUN corepack enable && corepack prepare pnpm@10.23.0 --activate
+RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
 
 USER node
 
 # Ensure pnpm is installed during build and not silently downloaded at runtime (node user)
-RUN corepack prepare pnpm@10.23.0 --activate
+RUN corepack prepare pnpm@10.33.2 --activate
 
 CMD ["./scripts/entrypoint.sh"]

package.json

@@ -65,7 +65,7 @@
     "vite-tsconfig-paths": "^4.0.5",
     "vitest": "3.1.4"
   },
-  "packageManager": "pnpm@10.23.0",
+  "packageManager": "pnpm@10.33.2",
   "dependencies": {
     "@changesets/cli": "2.26.2",
     "@remix-run/changelog-github": "^0.0.5",

pnpm-workspace.yaml

@@ -19,3 +19,4 @@ publicHoistPattern:
   - "*prisma*"
 preferWorkspacePackages: true
 sideEffectsCache: false
+blockExoticSubdeps: true